Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Personal Attribute Leakage in Federated Speech Models

Hamdan Al-Ali, Ali Reza Ghavamipour, Tommaso Caselli, Fatih Turkmen, Zeerak Talat, Hanan Aldarmaki

TL;DR

The paper analyzes attribute leakage from weight updates in federated self-supervised ASR across Wav2Vec2, HuBERT, and Whisper. It uses a passive white-box threat model and shadow-model inspired training to map weight differentials to private attributes, operationalizing a feature vector $z_i$ from per-parameter statistics and comparing against centroids. Results show strong leakage for accent and age, with gender leakage generally weaker; leakage scales with model pretraining coverage and per-attribute representation. They further demonstrate that targeted fine-tuning on diverse accents can mitigate leakage for known accents, while unseen accents remain vulnerable, highlighting the importance of diverse pretraining data for privacy robustness in FL-based ASR.

Abstract

Federated learning is a common method for privacy-preserving training of machine learning models. In this paper, we analyze the vulnerability of ASR models to attribute inference attacks in the federated setting. We test a non-parametric white-box attack method under a passive threat model on three ASR models: Wav2Vec2, HuBERT, and Whisper. The attack operates solely on weight differentials without access to raw speech from target speakers. We demonstrate attack feasibility on sensitive demographic and clinical attributes: gender, age, accent, emotion, and dysarthria. Our findings indicate that attributes that are underrepresented or absent in the pre-training data are more vulnerable to such inference attacks. In particular, information about accents can be reliably inferred from all models. Our findings expose previously undocumented vulnerabilities in federated ASR models and offer insights towards improved security.

Personal Attribute Leakage in Federated Speech Models

TL;DR

The paper analyzes attribute leakage from weight updates in federated self-supervised ASR across Wav2Vec2, HuBERT, and Whisper. It uses a passive white-box threat model and shadow-model inspired training to map weight differentials to private attributes, operationalizing a feature vector from per-parameter statistics and comparing against centroids. Results show strong leakage for accent and age, with gender leakage generally weaker; leakage scales with model pretraining coverage and per-attribute representation. They further demonstrate that targeted fine-tuning on diverse accents can mitigate leakage for known accents, while unseen accents remain vulnerable, highlighting the importance of diverse pretraining data for privacy robustness in FL-based ASR.

Abstract

Federated learning is a common method for privacy-preserving training of machine learning models. In this paper, we analyze the vulnerability of ASR models to attribute inference attacks in the federated setting. We test a non-parametric white-box attack method under a passive threat model on three ASR models: Wav2Vec2, HuBERT, and Whisper. The attack operates solely on weight differentials without access to raw speech from target speakers. We demonstrate attack feasibility on sensitive demographic and clinical attributes: gender, age, accent, emotion, and dysarthria. Our findings indicate that attributes that are underrepresented or absent in the pre-training data are more vulnerable to such inference attacks. In particular, information about accents can be reliably inferred from all models. Our findings expose previously undocumented vulnerabilities in federated ASR models and offer insights towards improved security.
Paper Structure (14 sections, 3 equations, 3 figures, 2 tables)

This paper contains 14 sections, 3 equations, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Methodology
  3. Threat Model
  4. Attribute Inference Attack Model
  5. Experiments
  6. Datasets
  7. Experimental Conditions
  8. ASR Models
  9. Results
  10. Per-Layer Analysis
  11. Fine-Grained Accent Classification
  12. Effect of Targeted Fine-Tuning
  13. Generalization to Unseen Accents
  14. Conclusion

Figures (3)

  • Figure 1: Mean accuracy for binary classification of Emotion & Dysarthia with 95% confidence intervals.
  • Figure 2: Layer-wise classification accuracy using Wav2Vec2 encoder layers for three tasks. The dashed lines show the result obtained using the full set of parameters.
  • Figure 3: Wav2Vec2 accent classification results before and after fine-tuning. Results are shown as proportions of the total for each class, so the diagonal corresponds to precision. Note: Amharic is only used in training the attribute classifier, with no test samples.