Your Voice Assistant Is Leaking Your Identity: Privacy Attacks on Full-Duplex Speech Models

Paper: 2603.08179 Authors: Nikita Kuzmin, Tao Zhong, Jiajun Deng, Yingke Zhu, Tristan Tsoi, Tianxiang Cao, Simon Lui, Kong Aik Lee, Eng Siong Chng Categories: eess.AS, cs.AI, eess.SP

The Gap

Full-duplex speech models (SALM-Duplex, Moshi) are the new generation of voice assistants that can listen and speak simultaneously, processing your audio through an always-on LLM backbone. Everyone’s excited about the natural conversation flow. Nobody checked what these models remember about your voice.

Prior work on voice privacy focused on traditional ASR pipelines or offline systems. VoicePrivacy challenges tackled speaker anonymization for batch processing. But full-duplex models are fundamentally different: they stream audio continuously through transformer layers, maintaining hidden states across turns. The privacy implications of these persistent representations? Unexamined.

The gap is specific: we don’t know if an attacker with access to the model’s internal states can identify speakers, and if so, where in the architecture the leakage occurs. We also lack streaming anonymization methods that work with the real-time constraints of full-duplex dialogue.

Problem: Full-duplex models process continuous audio
         but privacy of hidden states unknown
            |
            v
Assumption: Hidden states may encode speaker identity
            across layers and conversation turns
            |
            v
Method: (1) Attack hidden states with speaker verification
        (2) Analyze layer-wise and turn-wise leakage
        (3) Insert streaming anonymization front-end
            |
            v
Evidence: EER 11.2% (strong leakage) -> 41.0% (near random)
          Leakage persists across all layers
          First few turns are most vulnerable
            |
            v
Conclusion: Full-duplex models leak identity severely
            Stream-Voice-Anon can protect privacy
            while maintaining dialogue quality

The Increment

One sentence: Before this paper, we assumed full-duplex speech models were privacy-neutral black boxes; after, we know they leak speaker identity through every layer and need explicit anonymization to be safe.

Core Mechanism

The paper introduces two streaming anonymization setups built on Stream-Voice-Anon. Both sit between the user’s microphone and the full-duplex model, processing audio in real-time chunks.

Anon-W2W (waveform-to-waveform) takes raw audio, runs it through a voice conversion pipeline that separates content from speaker identity, replaces the speaker embedding with a pseudo-speaker, and outputs anonymized waveform. This waveform then feeds into the full-duplex model’s normal audio encoder. The advantage: works with any model as a plug-and-play front-end. The cost: two encoding steps (anonymizer + model encoder) add latency.

Anon-W2F (waveform-to-feature) does the anonymization but outputs acoustic features directly, bypassing the full-duplex model’s audio encoder entirely. The anonymizer’s decoder is replaced with a feature projection layer that maps to the model’s expected input space. This cuts one encoding step, reducing latency. The tradeoff: requires model-specific integration and retraining the projection layer.

Anon-W2W:
User Audio -> [Stream-Voice-Anon] -> Anon Waveform -> [Model Encoder] -> Hidden States -> LLM
               (content + pseudo-ID)                   (standard path)

Anon-W2F:
User Audio -> [Stream-Voice-Anon] -> Anon Features -----------------> Hidden States -> LLM
               (content + pseudo-ID)   (bypass encoder)

Think of it like a witness protection program for voices. The full-duplex model is a courthouse where everyone can see and remember faces. Anon-W2W is like putting a mask on the witness before they enter—the courthouse processes them normally, but the face is already changed. Anon-W2F is like having a special entrance where the witness gets a full disguise applied by security, then walks directly into the courtroom without going through the public lobby. Both approaches hide the witness’s real identity, but the second route is faster because it skips the lobby (the model’s audio encoder). The courthouse (LLM) still hears the testimony (speech content) clearly, but can’t link it back to the original person.

Key Concepts

• Equal Error Rate (EER): Imagine you’re a bouncer checking IDs. You can be too strict (reject real customers) or too loose (let in fakes). EER is the sweet spot where your false rejection rate equals your false acceptance rate. In speaker verification, 0% EER means perfect identification, 50% EER means random guessing. This paper aims to push EER toward 50% to make speaker identification impossible. When they report moving from 11.2% to 41.0%, they’re saying the attacker went from “pretty confident” to “almost guessing blindly.”

• Linkability: Can an attacker tell if two audio clips come from the same person, even without knowing who that person is? It’s like asking “are these two anonymous tips from the same whistleblower?” without caring about the whistleblower’s name. The paper shows linkability spikes in the first few conversation turns—once the model has heard you for 3-4 exchanges, it’s built a strong enough representation to link your utterances together. This matters because even pseudonymous conversations can be de-anonymized if an attacker can cluster your turns.

• First Response Latency (FRL): The delay between when you stop speaking and when the model starts responding. Full-duplex models pride themselves on sub-second FRL for natural conversation. Adding anonymization risks breaking this. The paper’s Anon-W2W achieves 0.8s FRL—barely noticeable. Anon-W2F could go lower by skipping the model encoder, but they don’t report exact numbers. FRL under 1 second is the threshold for “feels real-time” in human perception.

Framework Shift

Before (mainstream approach):        After (this paper):

User Audio                           User Audio
    |                                    |
    v                                    v
[Audio Encoder]                      [Anonymizer]
    |                                    |
    v                                    v
[Transformer Layers]                 [Audio Encoder]
    |                                    |
    v                                    v
[LLM Backbone]                       [Transformer Layers]
    |                                    |
    v                                    v
Response                             [LLM Backbone]
                                         |
(Hidden states encode                    v
 speaker identity)                   Response
                                     
                                     (Hidden states encode
                                      pseudo-speaker only)

From “trust the model to handle privacy implicitly” to “explicitly sanitize inputs before they enter the model,” the core shift is treating speaker identity as a contaminant that must be filtered at the boundary.

Expert Assessment

Problem choice: This is a real gap, not manufactured. Full-duplex models are shipping (Moshi is open-source, GPT-4o has similar capabilities). The VoicePrivacy community has been sounding alarms about speaker identification for years, but nobody applied their threat model to these new architectures. The timing is perfect—catch the privacy issue before deployment scales.

Method maturity: Mostly assembly of existing pieces. Stream-Voice-Anon already existed; this paper applies it to a new context. The layer-wise and turn-wise analysis is straightforward probing—train a speaker verification model on hidden states and measure accuracy. No novel algorithms. But that’s fine; the contribution is demonstrating the problem and showing a practical solution works. The Anon-W2F variant is a clever optimization (skip the encoder), though not deeply explored.

Experimental integrity: Baselines are fair. They follow VoicePrivacy 2024 protocol, which is the community standard. The “lazy-informed attacker” assumption (attacker has model access but doesn’t know the anonymization method) is reasonable for most threat models. One concern: they only test on two models (SALM-Duplex and Moshi). Generalization to other architectures is unclear. The sBERT scores (semantic similarity) are a decent proxy for dialogue quality, but no human evaluation. I’d want to see user studies confirming the anonymized conversations feel natural.

Writing quality: The abstract is dense—packs too many numbers without context. The layer-wise analysis section is repetitive; they describe the same pattern (leakage across all layers) twice for two models. The paper would benefit from consolidating this into a single comparative analysis. The related work section is thin—barely mentions why existing anonymization methods don’t apply to streaming full-duplex. The experimental setup is clear, but the results section could use better visualization. Tables are fine, but a plot showing EER vs. conversation turn would make the linkability finding pop.

Verdict: weak accept — Addresses a real privacy risk in deployed systems with a working solution, but the method is incremental and evaluation could be more thorough.

Takeaways

If you’re building any system with persistent hidden states (not just speech—think chatbots, recommendation engines), assume those states leak sensitive attributes. Don’t rely on the model to “forget” information implicitly. Insert explicit sanitization at the input boundary.

The turn-wise analysis technique is portable: probe your model’s representations at different time steps to see when sensitive information crystallizes. If you find leakage spikes early (like this paper’s first-few-turns finding), you can focus your defenses there.

The Anon-W2F trick (bypass the encoder by projecting anonymized features directly) is a general latency optimization for any pipeline where you’re adding a preprocessing step. If your preprocessor outputs something close to the model’s expected input space, train a small projection layer and skip the encoder. Cuts one forward pass.

For practitioners deploying voice AI: if you’re using full-duplex models in privacy-sensitive contexts (healthcare, legal, therapy), you need anonymization. This paper shows it’s feasible without destroying dialogue quality. The 78-93% sBERT retention means users probably won’t notice the difference.