TLDR: A new study reveals that federated learning (FL) for Automatic Speech Recognition (ASR) models, despite its privacy-preserving design, is vulnerable to attribute inference attacks. Researchers found that personal attributes like age, accent, emotion, and speech disorders can be inferred from model updates, even without access to raw speech. Attributes underrepresented in the initial training data, such as accents and age, are particularly susceptible to leakage. The study suggests that diversifying pre-training data can significantly mitigate these privacy risks, offering a path to more secure federated ASR systems.
Federated learning (FL) has emerged as a promising approach to training machine learning models while safeguarding user privacy. By keeping raw data on individual devices and only sharing model updates, FL aims to prevent sensitive information from leaving the user’s control. This method is particularly valuable for speech technologies, which process highly personal audio data for applications ranging from virtual assistants to healthcare. However, new research reveals that even this privacy-preserving framework is not immune to vulnerabilities, specifically concerning the leakage of personal attributes from speech models.
A recent study titled PERSONAL ATTRIBUTE LEAKAGE IN FEDERATED SPEECH MODELS by Hamdan Al-Ali and colleagues investigates how Automatic Speech Recognition (ASR) models, when trained using federated learning, can inadvertently expose sensitive personal details. The researchers focused on a specific type of privacy breach known as an attribute inference attack. This attack operates by analyzing the subtle changes, or “weight differentials,” in a model’s parameters as it learns from local user data, without ever accessing the raw speech itself.
The study tested this non-parametric white-box attack method on three widely used ASR models: Wav2Vec2, HuBERT, and Whisper. The goal was to determine if personal attributes like gender, age, accent, emotional state, and the presence of speech disorders (dysarthria) could be inferred from the model updates. The findings indicate a significant and previously undocumented vulnerability.
Key Findings: What Leaks and How
The research revealed varying degrees of leakage across different attributes and models. Accent and age proved to be the most vulnerable attributes, with attack success rates (accuracy) reaching between 80% and 100% across the tested models. Wav2Vec2, in particular, achieved a perfect 100% accuracy in inferring both accent and age. The Whisper model also consistently leaked attributes at over 70% accuracy, with the notable exception of gender.
Gender, surprisingly, was the most difficult attribute to predict, with accuracies ranging from 46% to 64%. This suggests that some attributes are inherently more resistant to these types of attacks, possibly due to their better representation and diversity in the initial pre-training data of the ASR models.
The study also explored the impact of pre-training data diversity on leakage. When the global model was fine-tuned on a small but diverse sample of accented speech before client updates, the effectiveness of the attribute inference attack for those accents significantly declined. This crucial insight suggests that a lack of diverse representation for certain attributes in the initial training data amplifies their vulnerability to leakage. Conversely, attributes that are well-represented, like gender, appear to be more robust against such attacks.
Also Read:
- Adaptive Privacy Budgets and Clipping Improve Federated Learning Performance
- Enhancing Speech Recognition for Language Learners: A Focus on Proficiency
Implications for Privacy and Security
The ability to infer personal attributes like age, accent, or a speech disorder from model updates, especially when combined with other data like IP addresses, poses serious privacy risks. Such information could enable profiling, discrimination, or surveillance, potentially violating legal protections such as GDPR and HIPAA.
This research highlights that while federated learning enhances privacy by keeping raw audio on-device, this protection is not uniform. Certain traits remain highly susceptible to inference attacks, particularly if they are underrepresented in the underlying model’s training data. The study concludes that pre-training ASR models on more diverse demographics and conditions could significantly improve their robustness against these privacy attacks in federated learning settings.
In essence, the paper uncovers a critical blind spot in federated ASR privacy and offers a clear direction for enhancing the security of these increasingly prevalent speech technologies.
