Privacy attacks for automatic speech recognition acoustic models in a federated learning framework

Abstract

This paper investigates methods to effectively retrieve speaker information from the personalized speaker adapted neural network acoustic models (AMs) in automatic speech recognition (ASR). This problem is especially important in the context of federated learning of ASR acoustic models where a global model is learnt on the server based on the updates received from multiple clients. We propose an approach to analyze information in neural network AMs based on a neural network footprint on the so-called Indicator dataset. Using this method, we develop two attack models that aim to infer speaker identity from the updated personalized models without access to the actual users' speech data. Experiments on the TED-LIUM 3 corpus demonstrate that the proposed approaches are very effective and can provide equal error rate (EER) of 1-2%.

arXiv commentSubmitted to ICASSP 2022

References in corpus (12)

• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Federated Learning: Challenges, Methods, and Future Directions
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Differentially Private Generative Adversarial Network
• TED-LIUM 3: twice as much data and corpus repartition for experiments on speaker adaptation
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Practical Secure Aggregation for Federated Learning on User-Held Data
• The VoicePrivacy 2020 Challenge: Results and findings
• Introducing the VoicePrivacy Initiative
• Training Speech Recognition Models with Federated Learning: A Quality/Cost Framework
• Federated Transfer Learning with Dynamic Gradient Aggregation
• Federated Learning in ASR: Not as Easy as You Think

Cited by in corpus (1)

• The VoicePrivacy 2020 Challenge: Results and findings