Evaluating voice conversion-based privacy protection against informed attackers
Table 3: WER (%) achieved using end-to-end ASR.
['[BOLD] Subset\xa0↓ / Strategies\xa0→', '[BOLD] VoiceMask  [ITALIC] random', '[BOLD] VTLN-based VC  [ITALIC] const', '[BOLD] VTLN-based VC  [ITALIC] perm', '[BOLD] VTLN-based VC  [ITALIC] random', '[BOLD] Disentangl.-based VC  [ITALIC] const', '[BOLD] Disentangl.-based VC  [ITALIC] perm', '[BOLD] Disentangl.-based VC  [ITALIC] random']
Note that there is no difference between converted data in different attack scenarios, hence the WER does not depend on the attacker. VoiceMask and VTLN-based VC achieve reasonable WER compared to the untransformed data, while the disentangled representation based VC produces unreasonably high WER. Note that these WERs are achieved when ASR is trained solely using converted data. In practice, many techniques can be used optimize the WER, such as using converted data to augment clean data.