Voice-privacy research usually assumes an attacker has nothing but the audio. Real-world collections, though, often bundle speech with metadata such as location. The authors of a new arXiv paper argue that this mismatch leaves a blind spot: no publicly available dataset had the detailed, directly linkable speech-and-side-information pairs needed to measure the combined risk.
To fill that gap, they propose a distribution-constrained method for building a semi-synthetic dataset, combining the English portion of Mozilla Common Voice with 2021 UK Census data. They then tested singling out risk under two attacker models—ignorant and semi-informed—and introduced a conditional reference to isolate what the audio itself adds beyond the candidate-set reduction caused by the side information.
In their controlled geographic case study, the semi-informed attacker achieved an observed isolation probability of 0.718 in the finest output-area-plus-household setting, compared with 0.380 for the signal-only setting. The excess over the conditional reference jumped from 0.012 to 0.340. The ignorant attacker showed the same trend at a lower level. The authors recommend that future voice-privacy evaluations include attacker settings with side information, since the biggest effect appears precisely where audio-only evaluation looks most reassuring.