Is changing pitch enough for anonymizing a person's voice?

Question

In every TV program where there's a person that wants to remain anonymous, they change their voice in a way that to me sounds like a simple increase or decrease in pitch (frequencies). What I'm wondering is:

• is the usual anonymizing method actually based on a simple change in pitch, or is it a more complex transformation that most TVs / media / etc. are using?
• is a simple change in pitch enough to make it impossible, or very hard anyway, to recover the original voice? I would think that if a voice has been changed to have a higher pitch, by lowering the pitch I might try to get the original voice, but I'm not sure how hard or reliable it could be.

Note that I'm just talking about the voice quality, not about other features that of course could immediately deanonymize a person (like accent, dialect, personal vocabulary and slang, etc.)

Answer 1

A simple pitch change is insufficient to mask a voice, as an adversary could simply pitch the audio back to recover the original audio.

Most voice modulators use a vocoder, not a simple pitch change. The term "vocoder" is unfortunately rather heavily overloaded these days, so to clarify I mean the type that is most generally used in music, rather than a phase vocoder, pitch remapper, or voice codec.

The way this works is as follows:

1. The voice input audio (called the modulation signal) is split into time slices, and its spectral content is analysed. In DSP this is usually implemented using an FFT, which effectively translates a signal from the time domain - a sequence of amplitudes over time - into the frequency domain - a collection of signals of increasing frequency that, if combined, represent the signal. In practice implementations output a magnitude and phase value for each of a fixed number of "buckets", where each bucket represents a frequency. If you were to generate a sine wave for each bucket, at the amplitude and phase offset output by the FFT, then add all of those sine waves together, you'd get a very close approximation of the original signal.
2. A carrier signal is generated. This is whatever synthesised sound you want to have your voice modulator sound like, but a general rule of thumb is that it should be fairly wideband. A common approach is to use synth types with lots of harmonics (e.g. sawtooth or square waves) and add noise and distortion.
3. The carrier signal is passed through a bank of filters whose center frequencies match that of the FFT buckets. Each filter's parameters are driven by its associated bucket's value. For example, one might apply a notch filter with a high Q factor and modulate the filter's gain with the FFT output.
4. The resulting modulated signal is the output.

A rather crude diagram of an analog approach is as follows:

The audio input is split into a number of frequency bands using band pass filters, which each pass through only a narrow frequency range. The "process" blocks take the results and perform some sort of amplitude detection, which then becomes a control signal to the voltage controlled amplifiers (VCAs). The path at the top generates the carrier waveform, usually by performing envelope detection on the input and using it to drive a voltage controlled oscillator (VCO). The carrier is then filtered into individual frequency bands by the bandpass filters on the right, which are then driven through the VCAs and combined into the output signal. The whole approach is very similar to the DSP approach described above.

Additional effects may be applied as well, such as pre- and post-filtering, noise and distortion, LFO, etc., in order to get the desired effect.

The reason this is difficult to invert is that the original audio is never actually passed through to the output. Instead, information is extracted from the original audio, then used to generate a new signal. The process is inherently lossy enough to make it fairly prohibitive to reverse.

Answer 2

tl;dr– It's not generally reversible, but it might still be reversed in practice.

---

Analogy: Reversibility of reducing a name to its length.

Consider a reduction method that takes in a person's first name and gives the number of letters in it. For example, "Alice" is transformed into 5.

This is a lossful process, so it can't be generally reversed. This is, we can't generally say that 5 necessarily maps to "Alice", as it might also map to, e.g., "David".

That said, knowing that the transform is 5 still contains a lot of information in that we can exclude any name that doesn't transform into 5. For example, it's obviously not "Christina".

So now say that you're a police detective, trying to solve a case. You've narrowed down the suspects to Alice and Bob, and you know that the culprit's anonymized name was 5. Sure you can't generally reverse 5, but, does that theoretical point really help Alice in this case?

---

Point: Lossful voice transforms aren't generally reversible, but they still leak information.

In the good ol' days, before computers and such, it may've been enough to lossfully transform one's voice. Then if a third party wanted to recover the original speaker's voice, they couldn't – which, back then, would've probably been it.

Today, we can use computers by:

1. Establish the ensemble of possibilities with their prior probabilities tagged.

2. Run the voice-anonymization software symbolically to generate a probabilistic ensemble of voices.

3. Take the inner product of that ensemble with, say, a set of suspects to generate an informed set of probabilities.

This method is general to any transform that isn't completely lossful. However, the usefulness of the resulting information will vary with the degree to which the anonymization method was lossful; a mildly lossful transform may still be largely reversible in practice despite not being generally reversible, while a heavily lossful transform may yield so little helpful information that it'd be practically irreversible.

Answer 3

No it's certainly not secure.

If I were to do it, I would use speech to text then dictate using a common voice like Stephen Hawking's. That completely eliminates any actual voice information.

The only thing left would be to anonymise your style of dialect by formalising/normalising your vocab/sentences.

Honestly that latter stage is extremely difficult. To normalise a thought is extremely complex. You would be divulging personally identifiable information without it though.

Answer 4

As in all things InfoSec it depends on your threats and the resources of your adversaries.

If you're trying to play a practical joke on your older brother a fake accent is sufficient. If you're trying to fool your wife it's harder.

If you're trying to carry out a complex conversation against an adversary with sufficient technical resources, depending on the context, it's going to be almost impossible without significant assistance, unless you're ok with them knowing you're hiding your voice.

The problem isn't pitch, it's going to be all sorts of things that you do unconsciously. You have "catch phrases", things you say. You have a cadence to your speech, word usage, and more importantly specific words you consistently misuse. You will have a few words you pronounce differently than most people, or a regional accent etc. It's almost like a finger print.

You can train yourself out of some of this where you catch it, but then THAT becomes your finger print.

You could possibly (if you're a good actor) "Adopt the role" and deliberately change many of these things "just for the role" and then drop it when done. That will fool many types of analysis, but that's a LOT of work and you have to be on every time.

Answer 5

We are now in the age of Machine Learning.

Any obfuscation achieved through transformation of information should not be considered secure. Not now. Certainly not against future technology. ML is able to reverse-transform.

You can think of this in terms of Manifold Topology. Suppose a kitten pic is distorted, projected onto some manifold. Let's say a cylinder. Just as a human brain can perceive the manifold and unwrap the image, so can ML.

To achieve true obfuscation, the information CONTENT must be separated from the information STYLE. This can also be achieved via ML.

You can look at the images from https://towardsdatascience.com/a-neural-algorithm-of-artistic-style-a-modern-form-of-creation-d39a6ac7e715 to get a visual sense of this.

An old-school voice anonymizer might break the incoming audio into MFCC feature vectors and reconstruct the vectors into audio.

If it is a little more advanced, it might break these MFCCs into timed phonemes, and then reconstruct the audio from this.

The most secure approach would be to use existing STT->TTS technologies.

But simply pitch shifting is no better than wrapping a kitten-pic around a cylinder. You can still make out if it is your kitten or not.