Cause of the transfer effect from B4 perturbations to the ASR system

Investigate why adversarial perturbations optimized to disrupt the B4 voice anonymization system transfer to the original VoicePrivacy Challenge automatic speech recognition system, despite B4 and that ASR system sharing no internal modules.

Background

The paper reports that perturbations optimized for the B4 voice anonymization system unexpectedly cause a substantial increase in the word error rate of the VoicePrivacy Challenge automatic speech recognition system used for evaluation. The effect is partly supported by experiments with a different ASR system, for which the word error rate is considerably lower, suggesting that the degradation may arise from unintended transfer between the perturbation and the evaluation ASR model.

The mechanism behind this transfer is unresolved because B4 and the original VoicePrivacy Challenge ASR system do not share internal modules. The authors contrast this finding with B5, whose wav2vec-based architecture is more similar to the ASR system but does not exhibit a comparable transfer effect.

References

The cause of this transfer remains unclear, since B4 and the original VPC ASR system do not share any internal modules.

— Preemptive defense against re-identification attacks on voice anonymization via adversarial perturbation  (2610.06074 - Panariello et al., 5 Oct 2026) in Section Results, subsection Quality preservation, footnote to the discussion of the B4 word error rate

We hypothesize that this is because tokens carrying reference information are also aggregated through softmax attention in all these models, so the reduced diversity of the reference representation induced by LETHE also generalizes beyond the surrogate. We leave a more thorough investigation to future work.

— LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse  (2610.13333 - Li et al., 9 Oct 2026) in Section 5.3, Transferability