VoxPrivacy: A Benchmark for Evaluating Interactional Privacy of Speech Language Models

TL;DR

VoxPrivacy tackles interactional privacy in multi-user Speech Language Models by introducing a three-tier benchmark and validating it with synthetic and real speech. It employs a large-scale bilingual corpus ($32.86$ hours, $7{,}107$ utterances) and a Real-VoxPrivacy validation set to measure tiered privacy behavior, and demonstrates that open-source models struggle to enforce speaker-conditioned rules, with a viable path emerging from fine-tuning on a new $4{,}000$-hour training set. The authors provide the benchmark, the training data, and a fine-tuned model to spur safer context-aware SLMs, and show that privacy success hinges on integrating speaker verification with contextual reasoning. This work highlights the need for context-aware safety in shared environments and offers a practical route to improve robustness against adversarial and biometric challenges in multi-user dialogue.

Abstract

As Speech Language Models (SLMs) transition from personal devices to shared, multi-user environments such as smart homes, a new challenge emerges: the model is expected to distinguish between users to manage information flow appropriately. Without this capability, an SLM could reveal one user's confidential schedule to another, a privacy failure we term interactional privacy. Thus, the ability to generate speaker-aware responses becomes essential for SLM safe deployment. Current SLM benchmarks test dialogue ability but overlook speaker identity. Multi-speaker benchmarks check who said what without assessing whether SLMs adapt their responses. Privacy benchmarks focus on globally sensitive data (e.g., bank passwords) while neglecting contextual privacy-sensitive information (e.g., a user's private appointment). To address this gap, we introduce VoxPrivacy, the first benchmark designed to evaluate interactional privacy in SLMs. VoxPrivacy spans three tiers of increasing difficulty, from following direct secrecy commands to proactively protecting privacy. Our evaluation of nine SLMs on a 32-hour bilingual dataset reveals a widespread vulnerability: most open-source models perform close to random chance (around 50% accuracy) on conditional privacy decisions, while even strong closed-source systems fall short on proactive privacy inference. We further validate these findings on Real-VoxPrivacy, a human-recorded subset, confirming that failures observed on synthetic data persist in real speech. Finally, we demonstrate a viable path forward: by fine-tuning on a new 4,000-hour training set, we improve privacy-preserving abilities while maintaining robustness. To support future work, we release the VoxPrivacy benchmark, the large-scale training set, and the fine-tuned model to foster the development of safer and more context-aware SLMs.

Figures (10)

• Figure 1: An overview of the VoxPrivacy benchmark, designed to evaluate interactional privacy across three tiers of increasing cognitive difficulty. Tier 1 tests a model's ability to obey a direct non-disclosure command. Tier 2 requires the model to use a speaker's voice as a key for conditional access. Tier 3 challenges the model to proactively protect privacy, requiring it to use common sense to infer what is sensitive without being told.
• Figure 2: Overview of the benchmark construction and evaluation. The pipeline proceeds from text to audio: Stages 1–2 generate and refine secret statements; Stage 3 structures them into three difficulty tiers; and Stage 4 assigns speakers and synthesizes the final audio.
• Figure 3: Prompt template used for generating statements related to privacy and confidentiality. Here, only the prompt template for the privacy scenario of "Personally Informed" is displayed.
• Figure 4: Prompt template used for sentence polishing.
• Figure 5: Prompt template used for generating statements related to non secret.