Vocalbridge Eval

vocalbridge-eval

VocalBridge: Latent Diffusion-Bridge Purification for Defeating Perturbation-Based Voiceprint Defenses — Abbasihafshejani et al. (2026) (arXiv:2601.02444, 2026)

What this evaluates

Evaluates a latent diffusion purification model's ability to remove adversarial perturbations from voiceprint defenses while preserving speaker identity and perceptual quality. It measures how effectively the purifier restores speaker verification scores and maintains speech naturalness and intelligibility for downstream voice cloning tasks.

Datasets

• LibriSpeech — total ?; splits: train (-1), test (-1)
• VCTK — total ?; splits: train (-1), test (-1)

Metrics

• ARR (primary) — range: [0, 1]
  • Authentication Restoration Rate measures the proportion of protected utterances that were initially below the EER threshold but become verified after purification. Formula: ARR(τ_eer) = (∑_i 1{s_i^prot < τ_eer ∧ s_i^pur ≥ τ_eer}) / (∑_i 1{s_i^prot < τ_eer}).
• NISQA MOS — range: [1, 5]
  • Automated Mean Opinion Score predicted by the NISQA model to estimate speech quality and intelligibility on a scale from 1 (poor) to 5 (excellent).
• WER — range: percent
  • Word Error Rate computed using a pre-trained Whisper-small model to assess pronunciation clarity. Lower values indicate better transcription accuracy.

Input / output format

Input: Adversarially perturbed speech utterances (protected by defenses such as SafeSpeech, Attack-VC, POP, AntiFake, or GAN-ADV) intended for voice cloning or speaker verification.

Output: Purified speech waveforms, followed by speaker verification cosine similarity scores against enrolled centroids, and automated perceptual/transcription metrics.

Scoring recipe

def compute_metrics(purified_waveforms, protected_waveforms, enrollment_centroids, tau_eer, gold_transcripts):
    arr_num = 0
    arr_den = 0
    mos_scores = []
    wer_scores = []
    for p_wave, prot_wave in zip(purified_waveforms, protected_waveforms):
        e_pur = get_embedding(p_wave, enrollment_centroids)
        e_prot = get_embedding(prot_wave, enrollment_centroids)
        s_pur = cosine_similarity(e_pur, enrollment_centroids)
        s_prot = cosine_similarity(e_prot, enrollment_centroids)
        if s_prot < tau_eer:
            arr_den += 1
            if s_pur >= tau_eer:
                arr_num += 1
        mos_scores.append(nisqa_model.predict(p_wave))
        wer_scores.append(whisper_small.wer(p_wave, gold_transcript))
    arr = arr_num / arr_den if arr_den > 0 else 0.0
    return arr, mean(mos_scores), mean(wer_scores)

Common pitfalls

• ARR only counts utterances that were initially below the EER threshold; if a defense is weak and most utterances are already above threshold, ARR can be artificially high or undefined.
• NISQA MOS is an automated proxy for human listening tests and may not perfectly correlate with subjective perceptual judgments, especially for heavily perturbed or purified audio.
• WER is computed using Whisper-small, which introduces a model-specific transcription bias that may not reflect true human-level intelligibility.

Evidence (verbatim from paper)

To this end, we introduce the Authentication Restoration Rate (ARR) as the primary metric to quantify the efficacy of purification. ARR measures the proportion of previously unverified (below-threshold) protected utterances that become successfully verified after purification. For each identity, a clean enrollment centroid c is calculated from a subset of clean enrollment utterances. Let s(e,c) denote the cosine similarity between an embedding e and the enrolled centroid. We denote by s_i^prot=s(e_i^prot,c) and s_i^pur=s(e_i^pur,c) the similarity scores for the protected and purified versions of the same utterance, respectively. Given the equal-error threshold τ_eer in Section[V-A4], the ARR is defined as ARR(τ_eer)=(∑_i 1{s_i^prot<τ_eer ∧ s_i^pur≥τ_eer})/(∑_i 1{s_i^prot<τ_eer}). Higher ARR values indicate stronger authentication recovery and more effective removal of protective perturbation.

Citation

@misc{abbasihafshejani2026vocalbridge,
  title={VocalBridge: Latent Diffusion-Bridge Purification for Defeating Perturbation-Based Voiceprint Defenses},
  author={Abbasihafshejani et al. (2026)},
  year={2026},
  note={arXiv:2601.02444}
}

• arXiv: 2601.02444