# Investigating the Robustness of Vision Transformers against Label Noise in
Medical Image Classification

Bidur Khanal1, Prashant Shrestha3∗, Sanskar Amgain3∗, Bishesh Khanal3, Binod
Bhattarai4 and Cristian A. Linte2 1Bidur Khanal is with Center for Imaging
Science, Rochester Institute of Technology, Rochester, NY, USA. (E-mail:
bk9618@rit.edu)3Prashant Shrestha, Sanskar Amgain, and Bishesh Khanal are with
NepAl Applied Mathematics and Informatics Institute for Research (NAAMII),
Lalitpur, Nepal.4Binod Bhattarai is with University of Aberdeen, Aberdeen,
UK.2Cristian A. Linte is with Biomedical Engineering, Rochester Institute of
Technology, Rochester, NY, USA.* Equal contributions.

###### Abstract

Label noise in medical image classification datasets significantly hampers the
training of supervised deep learning methods, undermining their
generalizability. The test performance of a model tends to decrease as the
label noise rate increases. Over recent years, several methods have been
proposed to mitigate the impact of label noise in medical image classification
and enhance the robustness of the model. Predominantly, these works have
employed CNN-based architectures as the backbone of their classifiers for
feature extraction. However, in recent years, Vision Transformer (ViT)-based
backbones have replaced CNNs, demonstrating improved performance and a greater
ability to learn more generalizable features, especially when the dataset is
large. Nevertheless, no prior work has rigorously investigated how
transformer-based backbones handle the impact of label noise in medical image
classification. In this paper, we investigate the architectural robustness of
ViT against label noise and compare it to that of CNNs. We use two medical
image classification datasets—COVID-DU-Ex, and NCT-CRC-HE-100K—both corrupted
by injecting label noise at various rates. Additionally, we show that
pretraining is crucial for ensuring ViT’s improved robustness against label
noise in supervised training.

##  I INTRODUCTION

Label noise in medical classification datasets can arise from several factors,
including inter-observer variability during annotation [20], the use of non-
expert annotators to reduce costs [17], and the growing reliance on automated
labeling algorithms [7]. It is well established that deep learning-based
supervised medical image classification requires accurately annotated labels
to effectively train classification models. Supervised training with
inaccurately annotated or noisy labels can impair a model’s generalizability,
resulting in subpar test performance [13, 27, 11, 10].

In response, recent studies have focused on training models to be robust
against label noise in medical image classification, encompassing a wide range
of datasets, including skin cancers, breast tumors, thoracic diseases, chest
infections, retinal diseases, and prostate cancers. These approaches
incorporate various techniques, such as label smoothing [19], estimating a
label noise transition matrix to modify end layers [2], sample re-weighting
[12, 25], consistency regularization [28], employing student-teacher networks
[26], or relying on self-supervised pretraining [9]. Each technique offers
unique advantages, depending on the nature of the noise and the
characteristics of the dataset. A common element in all these methods is the
use of CNN-based backbone networks, a trend also evident in state-of-the-art
general Learning with Noisy Label (LNL) methods [4, 14, 15].

Vision Transformers (ViTs) [3] have recently gained popularity, outperforming
CNNs in numerous benchmarks across both computer vision and medical datasets
[5, 22]. A key feature of transformers is their inherent attention mechanism,
which adeptly captures long-range dependencies across different spatial
regions of an image, thereby providing a comprehensive global context [3].
Transformers provide greater flexibility in learning, in contrast to CNNs,
which primarily focus on local context. Despite these advantages, to our
knowledge, there has been no recent work on LNL using ViT as the backbone for
medical classification tasks containing noisy training labels. This raises an
important question: How effective are ViTs in handling label noise in medical
image classification, and what is their robustness in such scenarios?

In this study, we examine the resilience of ViT against label noise in medical
image classification. We use two publicly available datasets for our
investigation: i) COVID-DU-Ex [23], a chest X-ray infection classification
dataset, and ii) NCT-CRC-HE-100K [8], a histopathology tissue classification
dataset. We also explore the application of two self-supervised pretraining
techniques on ViTs for these datasets to enhance robustness against label
noise. Furthermore, to assess the benefit of a ViT vs. a CNN backbone, we
compare the performance of a well-known LNL method—Co-teaching [4], which
typically trains robustly even with label noise, by replacing its CNN backbone
with a ViT. This allows us to evaluate how the performance differs from the
conventional CNN-based system. Our study does not introduce new methods;
rather, it aims to shed light on the architectural robustness of ViTs relative
to CNNs, against label noise in medical image classification, a topic that
needs more in-depth investigation.

##  II METHODOLOGY

###  II-A Label Noise

Let us consider a dataset $D=\\{(\mathbf{x}_{i},y_{i})\\}_{i}^{n}$ comprising
$n$ samples, where $x_{i}\in\mathbb{R}^{d}$ is an input and
$y_{i}\in\\{1,2,3,...,c\\}$ is its corresponding true label. To mimic a noisy
real-world dataset, we synthetically inject label noise into this clean
dataset by randomly flipping the true label $y_{i}$, to an incorrect label
$\hat{y_{i}}$ with a certain probability $p$, also referred to as label noise
rate. Here, $\hat{y_{i}}$ can be any class label from the dataset, except for
the true label, i.e.,
$\hat{y_{i}}\overset{p}{\sim}\\{1,2,3,...,c\\}\setminus\\{y_{i}\\}$.

###  II-B Dataset

We experimented with two datasets. The COVID-DU-Ex dataset [23] consists of
$33,920$ chest X-ray images, classified into COVID, non-COVID, and normal
categories. Out of these, $27,132$ images were used for training, and the
remaining $6,788$ images comprised the test set. The NCT-CRC-HE-100K dataset
[8] includes histopathology image patches of nine different tissue types, with
a total of $100,000$ images for training. It also has a separate test set
comprising $7,180$ samples from the same nine categories. We maintained the
size of inputs to $224\times 224$ for both datasets across all the
experiments.

###  II-C Training with Noisy Labels

As described in Section II-A, we injected label noise at various rates
$p=\\{0,0.1,0.2,0.3,...,0.9\\}$ into both datasets. Subsequently, we trained
ViT for image classification task using the noisy datasets (see Fig. 1).
Unlike CNNs, ViTs divides the input image into fixed-sized patches, which are
then flattened into vectors. The flattened vectors are concatenated with
positional embeddings and fed into a transformer encoder, followed by an MLP
for class predictions.

We initially trained ViTs and a CNN-based model (ResNet18) using standard
cross-entropy loss, which lacks inherent robustness against label noise. Then,
we employed Co-teaching, a LNL method, designed to mitigate the impact of
label noise. This method selects clean samples based on training loss, thereby
avoiding training on inaccurately labeled samples. While Co-teaching
traditionally uses CNNs as the backbone, we also experimented by replacing the
backbone with ViT. To keep our investigation unbiased and focus solely on
understanding the inherent robustness of transformers against label noise, we
first trained all methods from scratch, avoiding the influence of models
pretrained on large external natural-image datasets.

However, in the next phase, we pretrained the models using self-supervised
techniques on the respective datasets to investigate whether pretraining
improves the robustness of ViT against label noise. It is well known that
self-supervised pretraining enhances robustness against label noise in CNN-
based models [9]. Since self-supervised learning does not rely on given labels
for training, it is not impacted by label noise, thereby learning more robust
feature representations. To test this hypothesis with a ViT, we utilized two
self-supervised techniques, MAE [6] and SimMIM [24], to pretrain on their
respective datasets.

Figure 1: A pipeline for training medical image classification task with label
noise, where the feature extractor backbone is a transformer.

Both MAE and SimMIM rely on the reconstruction of masked image patches to
learn the representations in an unsupervised manner. While MAE utilizes an
encoder-decoder framework with Mean Squared Error (MSE) to regress the pixel
predictions, SimMIM is an encoder only framework with a simple prediction head
and utilizes $L_{1}$ distance to supervise the reconstruction. Consequently,
we repeated all cross-entropy and Co-teaching experiments using ViTs
pretrained with MAE and SimMIM.

###  II-D Evaluation

We evaluate classification performance using balanced accuracy, measuring both
the best test accuracy across all epochs (BEST) and the average test accuracy
of the last five epochs (LAST). The best test accuracy indicates the maximum
performance achieved by the model, while the average of the last five epochs
reflects whether the model overfits the noisy labels in the training data [9].

##  III Implementaion Details

We experimented with two ViT configurations: ViT Base and ViT Small. ViT Base
is larger with more parameters, while ViT Small is more compact. Both models
use $12$ layers, have an MLP ratio of $4$, and employ $16\times 16$ patches.
The ViT Small model has $6$ heads and an encoder dimension of $384$, while the
larger ViT Base model has $12$ heads with an encoder dimension of $768$. For
CNN, we selected the ResNet18 architecture. In the following subsections, we
discuss details for supervised training with noisy datasets, followed by self-
supervised pretraining for the ViTs.

###  III-A Supervised Training with Noisy labels

We use two approaches for supervised training with noisy labels: the first
uses standard cross-entropy loss without any modifications, while the second
uses Co-teaching, an LNL method, for robust training with label noise.

####  III-A1 Standard cross-entropy

We adopted the same training settings for both the ViT Small and ViT Base
models across both datasets. The data augmentation was limited to basic
techniques, including random horizontal flips and rotations up to
$10^{\circ}$. We utilized the AdamW optimizer
($\beta_{1}=0.9,\beta_{2}=0.95$), with weight decay of $1e^{-4}$, an initial
learning rate of $3e^{-5}$, and a Cosine Annealing learning rate scheduler.
The models were trained for 50 epochs using a batch size of 128, a duration
sufficient for the learning curve to saturate. For the ResNet18 model, we
followed a similar 50-epoch training regimen but with a batch size of 256. We
employed an SGD optimizer with a momentum of 0.9 and a weight decay of
$1e^{-4}$. The initial learning rate was set to 0.01, while using Cosine
Annealing scheduler.

####  III-A2 Co-teaching

We applied the same general training settings as used in standard cross-
entropy for both the ViT models and ResNet18 across both datasets. For Co-
teaching, the warm-up epochs were set to $5$ for ViT and $10$ for ResNet. The
method-specific hyperparameters were set as $\tau=p$ and $c=1$, where $p$
represents the label noise rate. In our experiments, we tested label noise
rates of $p=\\{0.4,0.5,0.6,0.7\\}$ for the COVID-DU-Ex dataset and
$p=\\{0.4,0.5,0.6,0.7,0.8\\}$ for the NCT-CRC-HE-100K dataset, representing
the typical range of high label noise. Co-teaching cannot enhance performance
beyond this range, as the noise rate surpasses a critical tipping threshold
($c-1/c$, where $c$ is the number of classes) [18].

All the experiments were trained using PyTorch 12.1 in Python 3.8, using A100
GPUs. Each experiment involving training with noisy labels was repeated three
times with random seeds, and the results were averaged for evaluation.

###  III-B Pretraining

For MAE, we set the mask ratio to $75\%$ of the image patches. The image
decoder utilizes a 6-layer transformer with an embedding dimension set to
$512$. For data augmentation, we employed randomly resized crops with a scale
ranging from $0.2$ to $1.0$. We utilized the AdamW optimizer [16]
($\beta_{1}=0.9,\beta_{2}=0.95$) along with a Cosine learning rate scheduler,
setting the learning rate to $1.5e-4$ and weight decay to $0.05$. The models
were trained until convergence using a batch size of $128$. For COVID-DU-Ex,
we trained for up to $800$ epochs for both ViT Base and ViT Small, while for
NCT-CRC-HE-100K, the training was done for up to $600$ epochs. The same
training configurations were used for both datasets, except for the number of
training epochs.

For SimMIM, $60\%$ of the image patches were masked. We used the AdamW
optimizer ($\beta_{1}=0.9,\beta_{2}=0.95$) along with a Cosine learning rate
scheduler, a base learning rate of $1e-4$, a weight decay of $0.05$, and warm-
up epochs of $10$. The models were trained using batch sizes of $512$ for ViT
Small and $256$ for ViT Base, respectively, until the loss converged. For
COVID-DU-Ex, training was done for up to $800$ epochs for both ViT Base and
ViT Small. For NCT-CRC-HE-100K, ViT Small was trained for up to $800$ epochs,
and ViT Base for up to $400$ epochs. We used the same training configurations
for both datasets, except for the number of training epochs.

##  IV RESULTS

###  IV-A Quantitative Results

In this section, we quantitatively evaluate supervised training in both
datasets at various noise rates. We first compare ViTs to ResNet18 without
pretraining, then assess the impact of self-supervised pretraining, and
finally compare Co-teaching with ViTs as the backbone to ResNet18.

####  IV-A1  Architecture’s Role in Noisy Label Training

To assess the tolerance of the architecture against label noise, we compared
ViTs and ResNet18 trained from scratch with standard cross-entropy loss in
Fig. 2. Both ViTs and ResNet18 exhibit declining test accuracy as label noise
rates increase in both the COVID-DU-Ex and NCT-CRC-HE-100K datasets, with a
similar trend observed in both. While ViTs and ResNet18 perform similarly in
the COVID-DU-Ex dataset, ResNet18 outperforms ViTs in the NCT-CRC-HE-100K
dataset. We also conducted a t-test using the BEST score to determine whether
ViT Small and ResNet18 performances are statistically different. In the NCT-
CRC-HE-100K, the difference between ViT Small and ResNet18 is statistically
significant with a $p$-value < $0.05$ for $p=\\{0.5,0.6,0.7,0.8\\}$.111The
$p$-value denotes statistical significance, whereas $p$ represents label noise
rates. In contrast, for COVID-DU-Ex, the difference is statistically
insignificant with a $p$-value > $0.05$, further validating the results seen
in the graph. Notably, ViT Base LAST’s performance for NCT-CRC-HE-100K is
worse than the corresponding BEST performance, potentially due to ViT Base’s
large parameter size and greater flexibility, making it more prone to
overfitting noisy labels.

Figure 2: Performance comparison of ViT Small, Vit Base and ResNet18 trained
with label noise rates (p) across COVID-DU-Ex and NCT-CRC-HE-100K dataset.
BEST represents the peak test performance across all epochs and LAST
represents the average of test performance in the last five epochs. Figure 3:
Performance comparison of ViT Small, Vit Base at various noise rates in COVID-
DU-Ex and NCT-CRC-HE-100K dataset, without/with pretraining using MAE and
SimMIM.BEST represents the peak test performance across all epochs and LAST
represents the average of test performance in the last five epochs.

####  IV-A2 Influence of Self-supervised Pretraining in ViTs

Supervised training with ViTs benefits from self-supervised pretraining –
which improves the learned representation. In Fig. 3, we compare the impact of
two self-supervised pretraining methods, MAE and SimMIM, on label-noise
tolerance during supervised training with standard cross-entropy. The results
indicate that pretraining improves performance for both datasets, especially
in the BEST performance metric, and this improvement is consistent for both
MAE and SimMIM. The performance boost is more pronounced at high label noise
levels in NCT-CRC-HE-100K compared to COVID-DU-Ex. However, we observe that
even after pretraining, ViT Base begins to overfit to noisy labels during
training, as indicated by the lower LAST performance, potentially due to it
being a large model and more susceptible to overfitting on label noise.

Figure 4: Comparison of Co-teaching performance across various architectures
at different noise rates in COVID-DU-Ex and NCT-CRC-HE-100K dataset,
without/with pretraining using MAE and SimMIM. BEST represents the peak test
performance across all epochs and LAST represents the average of test
performance in the last five epochs.

####  IV-A3 Co-teaching with ViT

We also compared how ViTs perform when used with the LNL method, such as Co-
teaching (see Fig. 4). Co-teaching does not perform well with ViTs when
trained from scratch. In comparison, the performance of Co-teaching with
ResNet-18 is not relatively worse than that with ViT Base and ViT Small
trained from scratch. However, when transformers are pretrained, both ViT Base
and ViT Small show significant performance improvements, as confirmed by the
t-test results. Specifically, MAE+ViT Small significantly surpasses ViT Small
in performance, with a $p$-value < 0.05 across all noise levels ($p$) for NCT-
CRC-HE-100K, and at $p=\\{0.4,0.5,0.6\\}$ for COVID-DU-Ex. These results
suggest that when using ViT as a backbone instead of CNN, pretraining is
crucial for achieving label-noise tolerance during training.

###  IV-B Qualitative Results

In this section, we present qualitative results by examining attention maps
and prediction outcomes for selected test samples from both COVID-DU-Ex and
NCT-CRC-HE-100K.

Figure 5: Attention maps of ViT Small for COVID class in COVID-DU-Ex dataset,
featuring two randomly selected test samples. Rows represent models trained
with different label noise rates $p=(0.1,0.3,0.6)$. Columns 1-2: No
pretraining, Columns 3-4: MAE pretraining, Columns 5-6: SimMIM pretraining
before supervised training with standard cross-entropy loss on noisy labels.
Figure 6: Attention maps of ViT Small for Background (left) and Adipose
(right) classes in NCT-CRC-HE-100K dataset, featuring two randomly selected
test samples. Rows represent models trained with different label noise rates
$p=(0.1,0.3,0.6)$. Columns 1-2: No pretraining, Columns 3-4: MAE pretraining,
Columns 5-6: SimMIM pretraining before supervised training with standard
cross-entropy loss on noisy labels.  Figure 7: Qualitative Results:
Predictions on representative test samples from COVID-DU-Ex and NCT-CRC-
HE-100K datasets using ResNet18 trained with Co-teaching, ViT Small trained
with Co-teaching (not pretrained and pretrained with MAE) with noisy labels at
three noise rates ($p$). Red boxes indicate incorrect predictions, and green
boxes indicate correct predictions.

First, we analyze the attention maps generated by the trained ViT Small to
investigate the potential impact of training with label noise. These attention
maps are computed using Attention Rollout [1], with attention weights averaged
across all heads and attention matrices multiplied between layers to produce a
single map per image.

Fig. 5 and Fig. 6 depict the attention map visualizations for selected test
samples from the COVID-DU-Ex and NCT-CRC-HE-100K datasets, respectively.
Notably, ViT Small, when trained on noisy labels without pretraining, tends to
produce attention maps with greater noise and dispersion, particularly evident
in the COVID-DU-Ex samples. In contrast, ViT Small pretrained with MAE tends
to generate cleaner maps focused on the lung regions (Fig. 5). In the context
of the NCT-CRC-HE-100K dataset, employing both MAE and SimMIM for pretraining
enhances the quality of the attention maps in ViT Small trained with noisy
labels, as shown in Fig. 6. For example, the attention map for the Adipose
class reveals that the model is correctly focusing on the cytoplasmic membrane
to distinguish the class. Interestingly, in the NCT-CRC-HE-100K samples,
attention maps from the ViT Small without pretraining become increasingly
noisier as training label noise increases, while those from the pretrained ViT
remain relatively unchanged. However, we do not observe a similar
deterioration in the attention maps from the ViT without pretraining in COVID-
DU-Ex, as the training noise increases.

In Fig. 7, we analyze the prediction outcome by the models trained with Co-
teaching on randomly selected representative samples from both the COVID-DU-Ex
and NCT-CRC-HE-100K datasets. We compare the test performance of three models:
ResNet18, ViT Small (without pretraining), and ViT Small (pretrained with
MAE), trained at various label noise rates. The pretrained ViT Small predicts
samples correctly even in the presence of high label noise, outperforming
ResNet18 and ViT Small without pretraining. However, at a low noise rate of
$0.4$ for the NCT-CRC-HE-100K dataset, all the backbones appear to
consistently yield accurate predictions, whether pretrained or not.

##  V CONCLUSION

In this study, we explored the relative robustness of ViTs against label noise
in medical image classification compared to CNN-based architectures like
ResNet18. Our results suggest that ViTs are more susceptible to overfitting,
particularly with larger model sizes. Without pretraining, ViTs are less
effective than basic CNN-based architectures for LNL methods. However, if ViTs
undergo proper pretraining using self-supervised methods before being applied
with LNL methods, their robustness against label noise significantly improves.
Therefore, proper pretraining is crucial for employing ViT as the backbone in
LNL methods to enhance robustness against label noise.

## ACKNOWLEDGMENT

This research was supported by the NIGMS Award No. R35GM128877 of the National
Institutes of Health, and OAC Award No. 1808530 and CBET Award No. 2245152,
both of the National Science Foundation. We also acknowledge Research
Computing at the Rochester Institute of Technology [21] for providing
computing resources.

## References

  * [1] Samira Abnar and Willem Zuidema.  Quantifying attention flow in transformers.  arXiv preprint arXiv:2005.00928, 2020.
  * [2] Yair Dgani, Hayit Greenspan, and Jacob Goldberger.  Training a neural network based on unreliable human annotation of medical images.  In 2018 IEEE 15th International symposium on biomedical imaging (ISBI 2018), pages 39–42. IEEE, 2018.
  * [3] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al.  An image is worth 16x16 words: Transformers for image recognition at scale.  arXiv preprint arXiv:2010.11929, 2020.
  * [4] Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama.  Co-teaching: Robust training of deep neural networks with extremely noisy labels.  Advances in neural information processing systems, 31, 2018.
  * [5] Kai Han, Yunhe Wang, Hanting Chen, Xinghao Chen, Jianyuan Guo, Zhenhua Liu, Yehui Tang, An Xiao, Chunjing Xu, Yixing Xu, et al.  A survey on vision transformer.  IEEE transactions on pattern analysis and machine intelligence, 45(1):87–110, 2022.
  * [6] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick.  Masked autoencoders are scalable vision learners.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16000–16009, 2022.
  * [7] Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ilcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al.  Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison.  In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 590–597, 2019.
  * [8] Jakob Nikolas Kather, Johannes Krisam, Pornpimol Charoentong, Tom Luedde, Esther Herpel, Cleo-Aron Weis, Timo Gaiser, Alexander Marx, Nektarios A Valous, Dyke Ferber, et al.  Predicting survival from colorectal cancer histology slides using deep learning: A retrospective multicenter study.  PLoS medicine, 16(1):e1002730, 2019.
  * [9] Bidur Khanal, Binod Bhattarai, Bishesh Khanal, and Cristian A Linte.  Improving medical image classification in noisy labels using only self-supervised pretraining.  In MICCAI Workshop on Data Engineering in Medical Imaging, pages 78–90. Springer, 2023.
  * [10] Bidur Khanal, SM Kamrul Hasan, Bishesh Khanal, and Cristian A Linte.  Investigating the impact of class-dependent label noise in medical image classification.  In Medical Imaging 2023: Image Processing, volume 12464, pages 728–733. SPIE, 2023.
  * [11] Bidur Khanal and Christopher Kanan.  How does heterogeneous label noise impact generalization in neural nets?  In Advances in Visual Computing: 16th International Symposium, ISVC 2021, Virtual Event, October 4-6, 2021, Proceedings, Part II, pages 229–241. Springer, 2021.
  * [12] Han Le, Dimitris Samaras, Tahsin Kurc, Rajarsi Gupta, Kenneth Shroyer, and Joel Saltz.  Pancreatic cancer detection in whole slide images using noisy label annotations.  In Medical Image Computing and Computer Assisted Intervention–MICCAI 2019: 22nd International Conference, Shenzhen, China, October 13–17, 2019, Proceedings, Part I 22, pages 541–549. Springer, 2019.
  * [13] Kimin Lee, Sukmin Yun, Kibok Lee, Honglak Lee, Bo Li, and Jinwoo Shin.  Robust inference via generative classifiers for handling noisy labels.  In International conference on machine learning, pages 3763–3772. PMLR, 2019.
  * [14] Junnan Li, Richard Socher, and Steven C.H. Hoi.  Dividemix: Learning with noisy labels as semi-supervised learning.  In International Conference on Learning Representations, 2020.
  * [15] Shikun Li, Xiaobo Xia, Shiming Ge, and Tongliang Liu.  Selective-supervised contrastive learning with noisy labels.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 316–325, 2022.
  * [16] Ilya Loshchilov and Frank Hutter.  Decoupled weight decay regularization.  arXiv preprint arXiv:1711.05101, 2017.
  * [17] Silas Nyboe Ørting, Andrew Doyle, Arno van Hilten, Matthias Hirth, Oana Inel, Christopher R Madan, Panagiotis Mavridis, Helen Spiers, and Veronika Cheplygina.  A survey of crowdsourcing in medical image analysis.  Human Computation, 7:1–26, 2020.
  * [18] Diane Oyen, Michal Kucer, Nicolas Hengartner, and Har Simrat Singh.  Robustness to label noise depends on the shape of the noise distribution.  Advances in Neural Information Processing Systems, 35:35645–35656, 2022.
  * [19] Hieu H Pham, Tung T Le, Dat Q Tran, Dat T Ngo, and Ha Q Nguyen.  Interpreting chest x-rays via cnns that exploit hierarchical disease dependencies and uncertainty labels.  Neurocomputing, 437:186–194, 2021.
  * [20] Tim Rädsch, Annika Reinke, Vivienn Weru, Minu D Tizabi, Nicholas Schreck, A Emre Kavur, Bünyamin Pekdemir, Tobias Roß, Annette Kopp-Schneider, and Lena Maier-Hein.  Labelling instructions matter in biomedical image analysis.  Nature Machine Intelligence, 5(3):273–283, 2023.
  * [21] Rochester Institute of Technology.  Research computing services, 2022.
  * [22] Fahad Shamshad, Salman Khan, Syed Waqas Zamir, Muhammad Haris Khan, Munawar Hayat, Fahad Shahbaz Khan, and Huazhu Fu.  Transformers in medical imaging: A survey.  Medical Image Analysis, page 102802, 2023.
  * [23] Anas M Tahir, Muhammad EH Chowdhury, Amith Khandakar, Tawsifur Rahman, Yazan Qiblawey, Uzair Khurshid, Serkan Kiranyaz, Nabil Ibtehaz, M Sohel Rahman, Somaya Al-Maadeed, et al.  Covid-19 infection localization and severity grading from chest x-ray images.  Computers in biology and medicine, 139:105002, 2021.
  * [24] Zhenda Xie, Zheng Zhang, Yue Cao, Yutong Lin, Jianmin Bao, Zhuliang Yao, Qi Dai, and Han Hu.  Simmim: A simple framework for masked image modeling.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9653–9663, 2022.
  * [25] Cheng Xue, Qi Dou, Xueying Shi, Hao Chen, and Pheng-Ann Heng.  Robust learning at noisy labeled medical images: Applied to skin lesion classification.  In 2019 IEEE 16th International symposium on biomedical imaging (ISBI 2019), pages 1280–1283. IEEE, 2019.
  * [26] Cheng Xue, Lequan Yu, Pengfei Chen, Qi Dou, and Pheng-Ann Heng.  Robust medical image classification from noisy labeled data with global and local representation guided co-training.  IEEE Transactions on Medical Imaging, 41(6):1371–1382, 2022.
  * [27] Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals.  Understanding deep learning (still) requires rethinking generalization.  Communications of the ACM, 64(3):107–115, 2021.
  * [28] Yi Zhou, Lei Huang, Tao Zhou, and Hanshi Sun.  Combating medical noisy labels by disentangled distribution learning and consistency regularization.  Future Generation Computer Systems, 141:567–576, 2023.


rowsep=0pt Michele Panariello, Massimiliano Todisco, Nicholas Evans

# Vocoder drift compensation by x-vector alignment in speaker anonymisation

###### Abstract

For the most popular x-vector–based approaches to speaker anonymisation, the
bulk of the anonymisation can stem from vocoding rather than from the core
anonymisation function which is used to substitute an original speaker
x-vector with that of a fictitious pseudo-speaker. This phenomenon can impede
the design of better anonymisation systems since there is a lack of fine-
grained control over the x-vector space. The work reported in this paper
explores the origin of so-called vocoder drift and shows that it is due to the
mismatch between the substituted x-vector and the original representations of
the linguistic content, intonation and prosody. Also reported is an original
approach to vocoder drift compensation. While anonymisation performance
degrades as expected, compensation reduces vocoder drift substantially, offers
improved control over the x-vector space and lays a foundation for the design
of better anonymisation functions in the future.

Index Terms: anonymisation, pseudonymisation, privacy, vocoder drift,
automatic speaker verification

##  1 Introduction

_Speaker anonymisation_ broadly refers to the task of processing speech
recordings to conceal the identity of the speaker while preserving linguistic
and paralinguistic content. Recently, the topic has attracted notable research
interest, particularly through the VoicePrivacy Challenge [1, 2, 3], first
launched in 2020 to define the task and to encourage the development of more
effective speaker anonymisation techniques. According to the VoicePrivacy
Challenge Evaluation Plan [3], the evaluation of a speaker anonymisation
solution is based upon estimates of the trade off between _privacy_
(protection of the speaker identity) and _utility_ (how well the remaining
signal content is preserved). The former is estimated by the ability of an
attacker to use automatic speaker verification (ASV) to infer the original
speaker identity and is measured in terms of equal error rate (EER). The
latter is estimated using the word error rate (WER) of an automatic speech
recognition (ASR) system as a proxy for utility.

Currently, the better-performing anonymisation solutions reflect the
processing pipeline described in [4] and rely upon an initial decomposition of
the input signal into the following three components:

  * •

a set of features representing the linguistic content of the signal, typically
in the form of ASR;

  * •

a component representing intonation and prosody, normally a fundamental
frequency (F0) curve;

  * •

a neural embedding representing the identity of the speaker, usually an _x-
vector_.

To obfuscate the speaker identity, an _anonymisation function_ is applied to
the x-vector embedding, thereby obtaining a new embedding which represents the
voice of a fictitious _pseudo-speaker_. The three components are subsequently
fed to a _vocoder_ model which synthesises a waveform with the same spoken
content and prosody as the original input audio, but in the voice of the
substitute pseudo-speaker.

For effective anonymisation, the pseudo-speaker's voice should sound
_different_ to that of the original speaker. For the majority of anonymisation
systems proposed to date, this requirement is fulfilled by maximising some
measure of the distance between the chosen pseudo-speaker embedding and the
original speaker embedding. The most popular anonymisation function to date
uses a _pool_ of external x-vectors [2, 3, 4, 5, 6, 7]. The pseudo-speaker
embedding is obtained by averaging a random subset of the furthest x-vectors
in the pool from the x-vector of the original speaker. More refined methods of
pseudo-speaker selection, e.g. based upon the use of singular-value
decomposition [8] and generative adversarial networks [9], have also been
explored. However, in our previous work [10], we showed that anonymisation
performance is influenced by more than just the role of the anonymisation
function. The vocoder also plays a role and its impact is comparable to, or
even dominates that of the anonymisation function. We termed this phenomenon
_vocoder drift_.

While one interpretation of these observations is that vocoder drift
contributes positively to anonymisation, and is hence a benefit, another is
that it implies a lack of fine-grained control over the x-vector space and
that this lack of control in turn impedes the design of effective x-vector
anonymisation functions. Moreover, vocoder drift can be learned and reversed
to undermine anonymisation safeguards [10].

With the work reported in this paper, we have sought to understand the cause
of vocoder drift and how it can be reduced in order to improve control over
the x-vector trajectory and full anonymisation process. We show that the cause
of drift is related to the mismatch between the distribution of x-vectors used
for vocoder training and the distribution after anonymisation. Such a mismatch
can be compensated for during anonymisation by aligning the input and output
x-vectors of the vocoder via gradient descent.

##  2 Relation to prior work

In this section, we describe the typical structure of an x-vector–based
anonymisation solution, the concept of drift, and other relevant, prior work.
We also describe the system we used for the experiments reported in Sections 3
and 4.

###  2.1 X-vector–based anonymisation

A graphical overview of a typical x-vector–based approach to anonymisation is
shown in Figure 1. Let $\mathbf{s}$ be a speech signal which we seek to
anonymise and from which we extract the following components: an F0 curve
$\mathbf{f}\in\mathbb{R}^{N}$, where $N$ is the number of frames into which
$\mathbf{s}$ is split; a set of linguistic features
$\mathbf{G}\in\mathbb{R}^{c\times N}$, where $c$ is the feature dimension; an
x-vector $f(\mathbf{s})=\mathbf{x}_{o}\in\mathbb{R}^{m}$, where $m$ is the
embedding dimension and $f(\cdot)$ is the embedding extraction function. The
x-vector is duplicated once for each frame, resulting in a matrix
$\mathbf{X}_{o}\in\mathbb{R}^{m\times N}$. The set of features are then
concatenated into a final matrix of dimension $(1+c+m)\times N$ and fed to a
vocoder model to produce an utterance
$\tilde{\mathbf{s}}=\operatorname{V}\left(\mathbf{f},\mathbf{G},\mathbf{X}_{o}\right)$.111Henceforth,
a bold lowercase $\mathbf{x}$ refers to a single x-vector, while an uppercase
$\mathbf{X}$ of the same subscript represents the matrix constructed from the
same x-vector duplicated $N$ times.

The vocoder is trained in a self-supervised fashion to reconstruct the
original signal. At test time, an input utterance is anonymised by
substituting the original speaker embedding $\mathbf{x}_{o}$ with a pseudo-
speaker embedding $\mathbf{x}_{p}$, which is obtained by means of an
anonymisation function $a\left(\mathbf{x}_{o}\right)=\mathbf{x}_{p}$. The
anonymised utterance $\tilde{\mathbf{s}}_{a}$ is synthesised as
$\tilde{\mathbf{s}}_{a}=\operatorname{V}\left(\mathbf{f},\mathbf{G},\mathbf{X}_{p}\right)$,
and a further x-vector $\mathbf{x}_{a}=f(\tilde{\mathbf{s}}_{a})$ can then be
extracted from it. Thus, as a result of anonymisation, the speaker identity
follows an x-vector trajectory, from $\mathbf{x}_{o}$ to $\mathbf{x}_{p}$ and
then $\mathbf{x}_{a}$.

Figure 1: Diagram of the speaker anonymisation system used in this work. The
dashed arrows indicate which x-vectors are used to compute _target distance_
and _vocoder drift_. Table 1: Average target distance and drift (without and
with compensation) for the four different VoicePrivacy Challenge 2022 data
subsets and for four different values of $\lambda$.

[1pt] |  $\lambda=0$ (copy-synthesis) |  |  | $\lambda=1/3$ |  |  | $\lambda=1/2$ |  |  |  $\lambda=1$ (normal anon.) |  |
---|---|---|---|---|---|---|---|---|---|---|---|---
| target | drift |  drift (compens.) | target | drift |  drift (compens.) | target | drift |  drift (compens.) | target | drift |  drift (compens.)
LibriSpeech (F) | 0 | 0.29 | 0.047 | 0.13 | 0.38 | 0.049 | 0.35 | 0.50 | 0.054 | 1.0 | 0.63 | 0.052
LibriSpeech (M) | 0 | 0.27 | 0.047 | 0.11 | 0.35 | 0.048 | 0.31 | 0.48 | 0.051 | 1.0 | 0.65 | 0.052
VCTK (F) | 0 | 0.29 | 0.049 | 0.11 | 0.36 | 0.051 | 0.30 | 0.49 | 0.084 | 1.0 | 0.69 | 0.082
VCTK (M) | 0 | 0.29 | 0.049 | 0.08 | 0.35 | 0.049 | 0.26 | 0.46 | 0.062 | 1.1 | 0.79 | 0.078
[1pt] |  |  |  |  |  |  |  |  |  |  |  |

###  2.2 Vocoder drift

In [10], we sought to understand the degree to which the anonymisation
function and the speech synthesis procedure impact upon the x-vector
trajectory from $\mathbf{x}_{o}$ to $\mathbf{x}_{a}$. We did so by measuring
how much the x-vector is perturbed during these two steps of the anonymisation
pipeline.

The anonymisation function controls the shift from $\mathbf{x}_{o}$ to
$\mathbf{x}_{p}$. Given a distance metric $d$, we define
$d(\mathbf{x}_{o},\mathbf{x}_{p})$ as the _target distance_ : this quantity is
set by the system designer and indicates the desired perturbation which is
applied to the original speaker embedding to give the pseudo-speaker
embedding. As a result of synthesis, $\mathbf{x}_{p}$ is further perturbed by
the vocoder, giving $\mathbf{x}_{a}$. We term
$d(\mathbf{x}_{p},\mathbf{x}_{a})$ the _vocoder drift_. To provide fine-
grained control over the x-vector space, the impact of drift should be as
small as possible in the total trajectory of an individual x-vector. In other
words, ideally, $d(\mathbf{x}_{o},\mathbf{x}_{p})\gg
d(\mathbf{x}_{p},\mathbf{x}_{a})$.

Our work reported in [10] shows that the impact of the anonymisation function
and vocoder are comparable and that, in some cases, the bulk of the
anonymisation is delivered by the vocoder, not the anonymisation function. In
this work, we propose a technique to compensate for vocoder drift.

###  2.3 System setup

For all experiments reported in this paper, we use a system which, except for
the use of different vocoders, is the same as that described in [10], which is
itself inspired by original work in [7]. The F0 contour $\mathbf{f}$ and the
linguistic features $\mathbf{G}$ are produced with YAAPT [11] and a HuBERT-
based soft content encoder [12], respectively. All x-vectors are extracted
with ECAPA-TDNN [13], and the vocoder model is a HiFi-GAN [14]. The
anonymisation function $a\left(\cdot\right)$ is the same x-vector pool-based
averaging function described in Section 1. Given an input $\mathbf{x}_{o}$,
the $K$ x-vectors furthest from it are selected from the pool. $K^{*}$ of them
are then randomly chosen and averaged to obtain $\mathbf{x}_{p}$. We set
$K=200$, $K^{*}=100$, and use the cosine distance metric as in [10]. Following
the VoicePrivacy Challenge 2022 [3] protocol, the external x-vector pool is
derived from LibriTTS-train-other-500 [15], and the evaluation sets are
derived from the LibriSpeech-test-clean [16] and VCTK [17] (split into female
and male sub-partitions) datasets. For consistency with $a\left(\cdot\right)$,
the target distance and vocoder drift are also measured in terms of the cosine
distance.

Figure 2: Vocoder drift plotted against target distance for the LibriSpeech
dataset and for female speakers. Dots and bars represent mean and standard
deviation of each of the following experimental setups: (A) $\lambda=0$; (B)
$\lambda=1/3$; (C) $\lambda=1/2$; (D) $\lambda=1$.

##  3 The cause of vocoder drift

In this section, we describe what we believe to be the source of vocoder drift
and present a set of experiments which validate our hypothesis.

###  3.1 Feature mismatch

As illustrated in Section 2.1, the vocoder model is trained in self-supervised
fashion to reconstruct input signals $\mathbf{s}$ at the output. While,
ideally, input components $\mathbf{f}$, $\mathbf{G}$ and $\mathbf{x}_{o}$
should be disentangled from one another – so that none contains any
information that is also contained in any other – there is no explicit
incentive in the training criterion of any of the three extraction models
which would encourage the learning of disentangled representations. Previous
work has confirmed that the representations are indeed _entangled_ to some
extent. For example, results in [18, 19] show that speaker-related
information, normally captured in $\mathbf{x}_{o}$, can leak into linguistic
representations $\mathbf{G}$. The vocoder can hence learn to rely on such
mutual dependencies between input features in learning how it should
reconstruct $\tilde{\mathbf{s}}$.

Through anonymisation, original speaker embeddings $\mathbf{x}_{o}$ are
substituted by pseudo-speaker embeddings $\mathbf{x}_{p}$, and used by the
vocoder to reconstruct a speech signal using the F0 curve $\mathbf{f}$ and
linguistic features $\mathbf{G}$ extracted from the input speech signal
corresponding to x-vector $\mathbf{x}_{o}$. The new pseudo-speaker embedding
will hence not _match_ any speaker-related information contained in
$\mathbf{f}$ and $\mathbf{G}$. This results in a _mismatch_ with the data
distribution learned by the vocoder at training time. It is our hypothesis
that this mismatch is the source of vocoder drift.

We verified our hypothesis with an experiment in which we anonymised a set of
utterances $\mathbf{s}$ and computed original x-vectors $\mathbf{x}_{o}$ and
corresponding pseudo-speaker embeddings
$a\left(\mathbf{x}_{o}\right)=\mathbf{x}_{p}$. Then, rather than synthesising
new waveforms according to the usual approach
$\operatorname{V}\left(\mathbf{f},\mathbf{G},\mathbf{X}_{p}\right)$, we
compute instead
$\operatorname{V}\left(\mathbf{f},\mathbf{G},\mathbf{X}_{i}\right)$, where
$\mathbf{x}_{i}$ is an interpolation between $\mathbf{x}_{o}$ and
$\mathbf{x}_{p}$:

$\mathbf{x}_{i}=\mathbf{x}_{o}+\lambda(\mathbf{x}_{p}-\mathbf{x}_{o})$ (1)

The parameter $\lambda\in[0,1]$ acts to control the distance between
$\mathbf{x}_{i}$ and either $\mathbf{x}_{o}$ or $\mathbf{x}_{p}$. In line with
definitions presented in Section 2.2, we term
$d(\mathbf{x}_{o},\mathbf{x}_{i})$ the _target distance_. The target distance
can be interpreted to reflect the mismatch between the speaker embedding that
would naturally complement $\mathbf{f}$ and $\mathbf{G}$ and the embedding
received by the vocoder. By adjusting $\lambda$, we conducted a set of
anonymisation experiments with increasing target distances, i.e. higher values
of $\lambda$, equivalent to increasing feature mismatch. For each experiment,
we also measure the resulting vocoder drift. A positive correlation between
drift and target distance would then suggest that vocoder drift does indeed
have some dependency on the mismatch between vocoder input features.

###  3.2 Experiments and results

We conducted experiments with values of ${\lambda=\\{0,1/3,1/2,1\\}}$. In the
case of $\lambda=0$, (1) reduces to $\mathbf{x}_{i}=\mathbf{x}_{o}$, which
corresponds to the absence of anonymisation (i.e. $a\left(\cdot\right)$ is not
applied): the system performs copy-synthesis. Conversely, in the case of
$\lambda=1$, (1) reduces to $\mathbf{x}_{i}=\mathbf{x}_{p}$: the pseudo-
speaker embedding is employed during synthesis as with usual anonymisation.
Values of $\lambda=1/3$ and $1/2$ correspond to different interpolations
between $\mathbf{x}_{o}$ and $\mathbf{x}_{p}$. We measured the target distance
and vocoder drift for all four configurations.

Results are reported in Table 1, which shows the target distance and drift in
the first two columns of each set of results for each value of $\lambda$.
Results are shown separately for LibriSpeech and VCTK datasets and for male
and female subsets in both cases. A degree of positive correlation between
$\lambda$ and both the target distance and drift is apparent. For $\lambda=0$,
the target distance is always $0$ (since $\mathbf{x}_{i}=\mathbf{x}_{o}$) and
the drift is consistently in the order of $0.28$. For $\lambda=1/3$, the
target distance increases to an average of $0.1$ and the drift to an average
of $0.36$. Both the target distance and drift increase further for higher
values of $\lambda$: such a correlation is evident when plotting the two
metrics against one another for a whole data partition and different values of
$\lambda$, as in Figure 2. These results show that, the greater the degree of
mismatch between input features, the greater is the vocoder drift. This in
turn implies that greater target distances incur less control over the
x-vector space. However, but not surprisingly, for copy-synthesis when
$\lambda=0$, the drift is still substantial. For this configuration, there is
no mismatch in the input features; those used for reconstruction are exactly
those extracted from the input signal. This suggests that a component of the
drift stems from the intrinsic nature of the waveform reconstruction process.
In the following, we report an approach to compensate for the vocoder drift.

Figure 3: t-SNE visualisations of four different x-vector spaces and
embeddings for the enrolment and trial utterances of the LibriSpeech dataset
and female speakers. Different colours correspond to different speakers. From
left to right: original x-vectors $\mathbf{x}_{o}$, pseudo-speaker embeddings
$\mathbf{x}_{p}$, anonimised embeddings $\mathbf{x}_{a}$, anonymised and
drift-compensated embeddings $\mathbf{x}_{a}^{*}$.

##  4 Drift compensation

Vocoder drift, while advantageous in terms of anonymisation [10], can be
undesirable in that it prevents fine-grained control over the x-vector space.
Because the impact of the vocoder upon the x-vector space can dominate that of
the anonymisation function, this lack of control impedes the design of better
anonymisation functions. Hence, even if lower vocoder drift might initially
degrade anonymisation performance, it may deliver better control over the
x-vector space and then be beneficial to the future development of better
anonymisation functions. In this section, we introduce a new technique for
vocoder drift compensation. It is based upon the iterative _alignment_ of
$\mathbf{x}_{a}$ to $\mathbf{x}_{p}$ at inference time.

###  4.1 X-vector alignment

Our goal is to adjust the matrix $\mathbf{X}_{i}$ so as to reduce the mismatch
to $\mathbf{G}$ and $\mathbf{f}$ in order then to reduce vocoder drift. This
adjustment can be formulated as an optimisation problem:

$\mathbf{X}_{i}^{*}=\operatorname*{argmin}_{\mathbf{X}_{i}}\text{
}d\Bigl{(}\,\,\underbrace{f\bigl{(}\operatorname{V}\left(\mathbf{f},\mathbf{G},\mathbf{X}_{i}\right)\bigr{)}}_{\mathbf{x}_{a}}\,\,,\,\,\mathbf{x}_{p}\Bigr{)}$
(2)

where $d$ is again the cosine distance. In essence, we seek to adjust
$\mathbf{X}_{i}$ so as to minimise the cosine distance between
$\mathbf{x}_{p}$ (the x-vector vocoder input) and $\mathbf{x}_{a}$ (the
x-vector extracted from its output). The resulting, optimised matrix
$\mathbf{X}_{i}^{*}$ is then used to synthesise an anonymised utterance
$\tilde{\mathbf{s}}_{a}^{*}$, whose drift-compensated x-vector we denote as
$\mathbf{x}_{a}^{*}$. We optimise the objective function directly at inference
time via gradient descent. With this approach, the drift can be arbitrarily
reduced by any desired amount, at the cost of proportionately increasing the
computation time required to synthesise the anonymised waveform.

###  4.2 Experiments and results

We optimise (2) at the utterance level using Adam [20] with a learning rate of
$5\mathrm{e}{-3}$. Optimisation runs for a maximum of 150 steps, but stops
earlier if the drift falls below 0.05 (set arbitrarily to reduce processing
time). The impact of drift compensation is then observed by repeating the
experiments described in Section 3 but with $\mathbf{X}_{i}$ replaced by drift
compensated versions $\mathbf{X}_{i}^{*}$ and by observing the reduction in
vocoder drift.

Results are shown in the third columns of each block in Table 1. Drift
compensation reduces the vocoder drift for all values of $\lambda$. For
$\lambda=\\{0,1/3\\}$, 150 optimisation steps are generally sufficient for the
drift to reach the lower bound of 0.05, for all datasets. This is also the
case for the LibriSpeech dataset for $\lambda=\\{1/2,1\\}$. For the VCTK
dataset, we obtain drift values of approximately 0.07 — slightly higher than
LibriSpeech, yet still considerably lower than the initial vocoder drift.
Informal listening tests show that drift compensation introduces no
discernible degradation to speech quality — any differences are negligible to
the point that signals generated with and without drift compensation are
difficult to tell apart.

###  4.3 Impact upon privacy protection

If the vocoder drift is responsible for the bulk of anonymisation performance,
and if drift compensation performs as intended, then the application of drift
compensation is expected to result in degraded anonymisation performance. We
performed a set of ASV experiments to observe the impact. Experiments were
conducted according to the protocol described in the VoicePrivacy Challenge
2022 evaluation plan [3]. For each dataset, the experiment is run four times,
each time using one of the set of x-vectors ($\mathbf{x}_{o}$,
$\mathbf{x}_{p}$, $\mathbf{x}_{a}$, $\mathbf{x}_{a}^{*}$) for each utterance.
The results are reported in Table 2.

As expected, low EERs for x-vectors $\mathbf{x}_{o}$ increase for
$\mathbf{x}_{p}$ and even more noticeably for $\mathbf{x}_{a}$, indicating the
dominant impact of the vocoder upon anonymisation. This is especially evident
in VCTK partitions, likely because of a domain mismatch with the HiFi-GAN
vocoder which, in accordance with the VoicePrivacy 2022 protocol, is trained
on LibriTTS-train-clean-100. EERs for x-vectors $\mathbf{x}_{a}^{*}$ are close
to those of $\mathbf{x}_{p}$, indicating successful vocoder drift
compensation. This result can also be observed visually in Figure 3, which
shows t-SNE visualisations [21] of all four x-vector embeddings for the
LibriSpeech dataset and female speakers (both trial and enrolment utterances).
The effect of drift is clearly visible upon the comparison of the
visualisations for $\mathbf{x}_{p}$ and $\mathbf{x}_{a}$: in the latter,
embeddings are notably more dispersed. The visualisation for
$\mathbf{x}_{a}^{*}$ shows that drift compensation reduces the dispersion,
giving compact clusters once more.

Table 2: ASV results (EER, %) for VoicePrivacy 2022 test sets, using the same
set of different x-vector speaker embeddings as in Figure 3.

[1pt] | $\mathbf{x}_{o}$ | $\mathbf{x}_{p}$ | $\mathbf{x}_{a}$ |  $\mathbf{x}_{a}^{*}$ (comp.)
---|---|---|---|---
LibriSpeech (F) | $0.54$ | $2.51$ | $15.0$ | $2.75$
LibriSpeech (M) | $0.88$ | $2.99$ | $14.5$ | $3.34$
VCTK (F) | $1.13$ | $5.59$ | $25.3$ | $9.20$
VCTK(M) | $0.17$ | $3.04$ | $18.5$ | $5.23$
[1pt] |  |  |  |

##  5 Conclusions

This paper shows that the mismatch between the representations of linguistic
information, intonation and prosody and a substitute pseudo-speaker embedding
is a source of vocoder drift – the difference between a target x-vector and
that which can be extracted from the synthesised output of popular approaches
to speaker anonymisation.

While beneficial to anonymisation, vocoder drift can nonetheless be
undesirable: it reduces fine-grained control over the x-vector space and hence
impedes optimisation of the core anonymisation function. Experiments show that
a novel approach to compensate for vocoder drift through the iterative
adjustment of pseudo-speaker embeddings to linguistic, intonation and prosodic
components is effective in reducing the drift. As expected, however, the loss
of vocoder drift degrades anonymisation performance. This result adds further
weight to our previous findings that vocoder drift plays a substantial, but
only superficial role in anonymisation; the vocoder drift can be learned and
undone, or reversed by an adversary.

The anonymisation function remains to be of paramount importance since its
impact cannot be, or is at least much more difficult to reverse. The design of
better anonymisation functions should hence remain a focus in future work. The
alleviation of extraneous influences coming from vocoder drift delivers better
control over the x-vector space and hence better potential to design more
effective anonymisation functions in the future. This does not preclude the
study of disentangled representations or other vocoder schemes which might
also offer complementary opportunities to reduce drift and improve control
over the x-vector space.

## References

  * [1] N. Tomashenko, B. M. L. Srivastava, X. Wang, E. Vincent, A. Nautsch, J. Yamagishi, N. Evans, J. Patino, J.-F. Bonastre, P.-G. Noé, and M. Todisco, ``Introducing the VoicePrivacy Initiative,'' in _Proc. Interspeech 2020_ , 2020, pp. 1693–1697.
  * [2] N. Tomashenko, X. Wang, E. Vincent, J. Patino, B. M. L. Srivastava, P.-G. Noé, A. Nautsch, N. Evans, J. Yamagishi, B. O’Brien, A. Chanclu, J.-F. Bonastre, M. Todisco, and M. Maouche, ``The VoicePrivacy 2020 challenge: Results and findings,'' _Computer Speech & Language_, vol. 74, p. 101362, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0885230822000080
  * [3] N. Tomashenko, X. Wang, X. Miao, H. Nourtel, P. Champion, M. Todisco, E. Vincent, N. Evans, J. Yamagishi, and J.-F. Bonastre, ``The VoicePrivacy 2022 challenge evaluation plan,'' 2022.
  * [4] F. Fang, X. Wang, J. Yamagishi, I. Echizen, M. Todisco, N. Evans, and J.-F. Bonastre, ``Speaker Anonymization Using X-vector and Neural Waveform Models,'' in _Proc. 10th ISCA Speech Synthesis Workshop_ , 2019, pp. 155–160.
  * [5] P. Champion, D. Jouvet, and A. Larcher, ``A study of F0 modification for x-vector based speech pseudo-anonymization across gender,'' in _The Second AAAI Workshop on Privacy-Preserving Artificial Intelligence (PPAI)._ , 2020\.
  * [6] U. E. Gaznepoglu, A. Leschanowsky, and N. Peters, ``VoicePrivacy 2022 system description: speaker anonymization with feature-matched f0 trajectories,'' in _Proc. 2nd Symposium on Security and Privacy in Speech Communication_ , 2022.
  * [7] X. Miao, X. Wang, E. Cooper, J. Yamagishi, and N. Tomashenko, ``Language-independent speaker anonymization approach using self-supervised pre-trained models,'' in _Proc. The Speaker and Language Recognition Workshop (Odyssey 2022)_ , 2022, pp. 279–286.
  * [8] C. O. Mawalim, K. Galajit, J. Karnjana, S. Kidani, and M. Unoki, ``Speaker anonymization by modifying fundamental frequency and x-vector singular value,'' _Computer Speech & Language_, vol. 73, p. 101326, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0885230821001194
  * [9] S. Meyer, P. Tilli, P. Denisov, F. Lux, J. Koch, and N. T. Vu, ``Anonymizing speech with generative adversarial networks to preserve speaker privacy,'' in _2022 IEEE Spoken Language Technology Workshop (SLT)_ , 2023, pp. 912–919.
  * [10] M. Panariello, M. Todisco, and N. Evans, ``Vocoder drift in x-vector-based speaker anonymization,'' in _Proc. Interspeech 2023_ , 2023.
  * [11] K. Kasi and S. A. Zahorian, ``Yet another algorithm for pitch tracking,'' in _2002 IEEE International Conference on Acoustics, Speech, and Signal Processing_ , vol. 1, 2002, pp. I–361–I–364.
  * [12] B. van Niekerk, M.-A. Carbonneau, J. Zaïdi, M. Baas, H. Seuté, and H. Kamper, ``A comparison of discrete and soft speech units for improved voice conversion,'' in _ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2022, pp. 6562–6566.
  * [13] B. Desplanques, J. Thienpondt, and K. Demuynck, ``ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification,'' in _Proc. Interspeech 2020_ , 2020, pp. 3830–3834.
  * [14] J. Kong, J. Kim, and J. Bae, ``HiFi-GAN: Generative adversarial networks for efficient and high fidelity speech synthesis,'' in _Advances in Neural Information Processing Systems_ , H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 17 022–17 033.
  * [15] H. Zen, V. Dang, R. Clark, Y. Zhang, R. J. Weiss, Y. Jia, Z. Chen, and Y. Wu, ``LibriTTS: A Corpus Derived from LibriSpeech for Text-to-Speech,'' in _Proc. Interspeech 2019_ , 2019, pp. 1526–1530.
  * [16] V. Panayotov, G. Chen, D. Povey, and S. Khudanpur, ``Librispeech: An asr corpus based on public domain audio books,'' in _2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2015, pp. 5206–5210.
  * [17] J. Yamagishi, C. Veaux, and K. MacDonald, ``CSTR VCTK Corpus: English multi-speaker corpus for CSTR Voice Cloning Toolkit (version 0.92),'' 2019. [Online]. Available: https://datashare.ed.ac.uk/handle/10283/3443
  * [18] C. Pierre, A. Larcher, and D. Jouvet, ``Are disentangled representations all you need to build speaker anonymization systems?'' in _Proc. Interspeech 2022_ , 2022, pp. 2793–2797.
  * [19] A. S. Shamsabadi, B. M. L. Srivastava, A. Bellet, N. Vauquier, E. Vincent, M. Maouche, M. Tommasi, and N. Papernot, ``Differentially private speaker anonymization,'' _Proceedings on Privacy Enhancing Technologies_ , vol. 1, pp. 98–114, 2023.
  * [20] D. P. Kingma and J. Ba, ``Adam: A method for stochastic optimization,'' in _3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings_ , Y. Bengio and Y. LeCun, Eds., 2015.
  * [21] L. van der Maaten and G. Hinton, ``Visualizing Data using t-SNE,'' _Journal of Machine Learning Research_ , vol. 9, no. 86, pp. 2579–2605, 2008\.


* TensorFlow Authors [2020] TensorFlow Authors: TensorFlow Fairness Indicators. https://www.tensorflow.org/responsible_ai/fairness_indicators/guide. Open-source library for computing fairness metrics in machine learning (2020)
  * Wexler et al. [2019] Wexler, J., Pushkarna, M., Bolukbasi, T., Wattenberg, M., Viégas, F., Wilson, J.: The what-if tool: Interactive probing of machine learning models. IEEE Transactions on Visualization and Computer Graphics 26(1), 56–65 (2019)
  * Tramèr et al. [2017] Tramèr, F., Atlidakis, V., Geambasu, R., Hsu, D., Hubaux, J.-P., Humbert, M., Juels, A., Lin, H.: Fairtest: Discovering unwarranted associations in data-driven applications. In: 2017 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 401–416 (2017). IEEE
  * Adebayo [2016] Adebayo, J.: Fairml : Toolbox for diagnosing bias in predictive modeling. (2016). https://api.semanticscholar.org/CorpusID:11915312
  * Mullis et al. [2016] Mullis, I.V.S., Martin, M.O., Foy, P., Hooper, M.: TIMSS 2015 International Results in Mathematics and Science. TIMSS & PIRLS International Study Center, Boston College, Chestnut Hill, MA (2016)
  * OECD [2019] OECD: PISA 2018 Results. OECD Publishing, Paris, France (2019)
  * Ingels et al. [2005] Ingels, S.J., Pratt, D.J., Rogers, J.E., Siegel, P.H., Stutts, E.S.: Education longitudinal study of 2002 (els:2002): A first look at the initial postsecondary experiences of the sophomore class of 2002. Technical report, National Center for Education Statistics (2005)
  * Choi et al. [2020] Choi, Y., Lee, Y., Shin, D., Cho, J., Park, S., Lee, S., Baek, J., Kim, B., Jang, Y., Kim, Y., Heo, J.: Ednet: A large-scale hierarchical dataset in education. Proceedings of the 13th International Conference on Educational Data Mining (EDM 2020) (2020)
  * Bozick et al. [2007] Bozick, R., Lauff, E., Wirt, J.: Education longitudinal study of 2002 (els: 2002): A first look at the initial postsecondary experiences of the high school sophomore class of 2002. National Center for Education Statistics (2007)
  * Broyles [1994] Broyles, S.: Integrated postsecondary education data system (ipeds). (1994)
  * Glander [2017] Glander, M.: Documentation to the 2015-16 common core of data (ccd) universe files. nces 2017-074. National Center for Education Statistics (2017)
  * Feng et al. [2019] Feng, W., Tang, J., Liu, T.X.: Understanding dropouts in moocs. In: Proceedings of the AAAI Conference on Artificial Intelligence, pp. 517–524 (2019)
  * Kuzilek et al. [2017] Kuzilek, J., Hlosta, M., Zdrahal, Z.: The open university learning analytics dataset. Scientific Data 4, 170171 (2017) https://doi.org/10.1038/sdata.2017.171
  * Stamper et al. [2006] Stamper, J., Barnes, T., Croy, M.: A comparative study on human and automated tutoring of children. In: Intelligent Tutoring Systems, pp. 383–392 (2006). Springer
  * Veeramachaneni et al. [2014] Veeramachaneni, K., O’Reilly, U.-M., Taylor, C.: Moocdb: Developing data standards for mooc data science. In: AIED Workshops (2014)
  * Koedinger et al. [2012] Koedinger, K.R., McLaughlin, E.A., Stamper, J.C.: Knowledge components: The anatomy of adaptive learning technologies. In: The 4th International Conference on Educational Data Mining (2012)
  * Siemens and Baker [2012] Siemens, G., Baker, R.S.: Learning analytics and educational data mining: Towards communication and collaboration. Proceedings of the 2nd International Conference on Learning Analytics and Knowledge, 252–254 (2012)
  * Hill et al. [2016] Hill, P.W., Sutherland, S., Stack, J.: Computer-based tutoring in algebra. Emerging trends in the social and behavioral sciences: an interdisciplinary, searchable, and linkable resource (2016)
  * Feng et al. [2009] Feng, M., Heffernan, N.T., Koedinger, K.R.: Addressing the assessment challenge with an online system that tutors as it assesses. User Modeling and User-Adapted Interaction 19(3), 243–266 (2009)
  * Chen et al. [2021] Chen, X., Zou, D., Xie, H., Cheng, G.: Twenty years of personalized language learning. Educational Technology & Society 24(1), 205–222 (2021)
  * Chan and Zary [2019] Chan, K.S., Zary, N.: Applications and challenges of implementing artificial intelligence in medical education: integrative review. JMIR medical education 5(1), 13930 (2019)
  * Barocas and Selbst [2016] Barocas, S., Selbst, A.D.: Big data’s disparate impact. California Law Review 104, 671 (2016)
  * Rajkomar et al. [2018] Rajkomar, A., Hardt, M., Howell, M.D., Corrado, G., Chin, M.H.: Ensuring fairness in machine learning to advance health equity. Annals of Internal Medicine 169(12), 866–872 (2018)
  * Binns [2018] Binns, R.: Fairness in machine learning: Lessons from political philosophy. In: Conference on Fairness, Accountability, and Transparency, pp. 149–159 (2018)
  * Asher [2021] Asher, S.: Covid-19, distance learning and the digital divide: A case of higher education in the united states and pakistan. International Journal of Multicultural Education (2021)
  * Veras et al. [2024] Veras, M., Dyer, J.-O., Kairy, D.: Artificial intelligence and digital divide in physiotherapy education. Cureus 16(1) (2024)
  * Iftikhar et al. [2023] Iftikhar, A., Ahmed, N., Shah, D.S.U.M.: Analyzing digital divide among university students of pakistan. Turkish Online Journal of Distance Education (2023)
  * Suleiman [2023] Suleiman, M.S.: Bridging the digital gender divide for peace and development in nigeria: Challenges, policies, and collaborative solutions for sustainable peace. International Journal of Peace, Education and Development (2023)
  * Ragab and Bajnaid [2010] Ragab, A.H.M., Bajnaid, A.: Aacwels: Automated “adaptive content” web based e-learning system for teaching AI. (2010). https://api.semanticscholar.org/CorpusID:65178327
  * Alam [2021] Alam, A.: Should robots replace teachers? mobilisation of ai and learning analytics in education. 2021 International Conference on Advances in Computing, Communication, and Control (ICAC3), 1–12 (2021)
  * Abdelhalim [2024] Abdelhalim, S.M.: Using chatgpt to promote research competency: English as a foreign language undergraduates’ perceptions and practices across varied metacognitive awareness levels. Journal of Computer Assisted Learning (2024)
  * Khalil et al. [2023] Khalil, G.I., Sajjad, H.M., Sohail, M., Ishfaq, Z.: Role of ai in the education sector in the kingdom of bahrain. 2023 International Conference on Computer Science, Information Technology and Engineering (ICCoSITE), 992–997 (2023)
  * Sirkeci and Lo [2023] Sirkeci, I., Lo, L.: Editorial: Transformative impact of artificial intelligence on higher education. Transnational Education Review (2023)