Turns out the go-to way of measuring whether a disguised voice is truly anonymous has a blind spot big enough to drive a biometric database through.
Researchers evaluated five speaker de-identification systems built under the IARPA ARTS program - tools meant to strip identifying traits from speech while keeping it understandable. The field has mostly graded these systems on one number: Equal Error Rate, which checks whether a biometric matching system can still verify who's talking. The researchers argue that's not enough. They built a five-metric framework that also checks for soft biometric leakage (things like inferred age or accent), re-identification through embedding similarity, structural similarity between voice templates, and whether the disguised speech is still intelligible. Running all five metrics on the same five systems showed each one catches a different kind of leak - a system can pass EER cleanly and still leak identity through other channels.
This matters because voice anonymization is quietly becoming infrastructure: call centers, voice assistants, and health and legal transcription tools all lean on the assumption that stripping a voiceprint makes speech safe to store or share. If EER is the only test a vendor runs, a system can look privacy-safe on paper while still letting someone reconstruct enough of a speaker's identity through side channels. The pattern echoes a familiar security lesson - a single metric optimized in isolation tends to hide the failure modes nobody checked for.
Expect biometric privacy claims to get harder to make with a straight face once evaluators start asking which of five tests a system actually passed, not just one.