Detecting Voice Cloning Attacks via Timbre Watermarking

Detecting Voice Cloning Attacks via Timbre Watermarking

Speakers: Chang Liu

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=PUV2xvb6p7U

Overview

In an increasingly "Ear Economy" era, where audio content is shared ubiquitously for both social and commercial purposes, the security landscape faces a critical challenge: the proliferation of advanced voice cloning technology. This talk, presented by Chang Liu at the NDSS Symposium, introduces a groundbreaking solution: Timbre Watermarking for detecting and tracing unauthorized voice clones. Attackers can now effortlessly impersonate individuals by leveraging publicly available audio, leading to severe consequences such as financial fraud, reputational damage, and copyright infringement. A stark illustration of this threat was the deepfake audio of President Biden, which caused public alarm by announcing a fabricated attack plan against Russia. The fundamental problem addressed by this research is the unauthorized synthesis of an individual's unique vocal timbre.

Previous attempts to counter voice cloning have largely fallen short. Passive detection methods, while capable of identifying synthetic voices, are locked in an endless "arms race" against evolving cloning techniques, quickly becoming obsolete and failing to trace the source of the original timbre. Proactive prevention methods, such as adding adversarial noise, significantly degrade audio quality and demand specific domain knowledge of the attack, severely limiting their generalizability. To overcome these inherent limitations, Timbre Watermarking proposes a novel, proactive approach: imperceptibly embedding watermark information, such as ownership details, into an individual's speech before it is released. If this watermarked audio is subsequently used by an attacker to clone a voice, the embedded watermark can be extracted from the synthetic speech, thereby enabling the detection of the attack and the reliable tracing of the original timbre.

The research tackles two primary challenges: robustness against common speech preprocessing (e.g., compression, filtering) that attackers might apply to remove watermarks, and generalization across the vast and varied landscape of voice cloning approaches. The proposed end-to-end framework addresses these by embedding watermarks in the frequency domain for inherent robustness, enhancing this through a repeated embedding strategy, and integrating a carefully designed distortion layer during training that simulates common voice cloning processes. This innovative approach allows the system to learn to resist diverse cloning attacks, offering a robust and generalized defense against the misuse of vocal identity.

Background

▶ Watch: Problem of voice cloning and motivation for research (0:00)

Voice cloning is fundamentally the process of creating a synthetic voice that meticulously mimics a target individual's unique vocal timbre. This is primarily achieved through two mainstream techniques: voice conversion (VC), which transforms one speaker's voice into another's while preserving linguistic content, and text-to-speech (TTS) generation, which synthesizes speech directly from text in a target speaker's voice. This paper primarily focuses on TTS-based attacks due to their greater flexibility in generating arbitrary speech from text without needing the original speech for transfer, though the proposed method is also applicable to VC.

A typical TTS system pipeline, as detailed in the talk, involves three key components:

1. Text Processing: This initial stage converts raw text into linguistic and acoustic features. It encompasses text normalization (e.g., removing punctuation, expanding abbreviations) and linguistic analysis (e.g., segmenting text into phonemes, predicting prosody for natural pitch and rhythm).
2. Acoustic Model: This component translates linguistic information into acoustic features, most commonly mel-spectrograms. Early models like Tacotron suffered from distortion issues, leading to advancements such as Tacotron 2 and FastSpeech 2, which significantly improved synthesis quality and efficiency. The researchers adopted Tacotron 2 and FastSpeech 2 as default acoustic models for their voice cloning attack simulations.
3. Vocoder: The final component synthesizes speech signals from the mel-spectrograms. Traditional vocoders like Griffin-Lim are computationally inexpensive but can introduce noise. Deep learning-based vocoders, such as WaveGAN and HiFiGAN, generate higher-fidelity audio. Griffin-Lim and HiFiGAN were used as default vocoders in the experiments, with VITS (an end-to-end text-to-speech model) also considered.

Existing countermeasures against voice cloning fall into two main categories:

1. Passive Detection-based: These methods aim to identify whether speech is human-generated or artificially synthesized by analyzing specific audio features. Examples include audio-based CAPTCHA systems, DeepSonar (which leverages neuron activation patterns), and Void (analyzing spectral power differences). Deep learning approaches like One-Class also exist to detect unseen synthetic voices. However, these methods suffer from significant limitations: they struggle with generalization to unseen data distributions, leading to a perpetual "arms race" against evolving cloning techniques, and critically, they cannot trace the original timbre back to its source, providing no information about authorship or origin.
2. Proactive Prevention-based: These strategies attempt to disrupt the voice cloning process itself. Huang et al. proposed adding adversarial perturbations to speech samples. While this can prevent unauthorized synthesis, it often degrades the quality of the target speech and requires specific knowledge of the voice conversion task, limiting its practical applicability.

Traditional audio watermarking methods aim for both fidelity (imperceptibility) and robustness (resistance to distortions). Fidelity is often achieved by embedding watermarks into frequency domain features, making subtle, imperceptible changes. Robustness focuses on resisting common signal processing distortions like re-recording or desynchronization. However, these methods are not designed to withstand the complex, structural alterations inherent in voice cloning attacks. As demonstrated by the research, existing methods relying on synchronization codes or time-scaling invariant features (e.g., FSVC and RFDLM) completely fail when faced with cropping or time scaling, let alone the fundamental structural changes introduced by voice cloning, with experimental validation confirming these limitations.

Threat Model

The proposed framework operates within a comprehensive threat model involving three key entities:

1. Users: Individuals who register their authorship information and share audio data on a platform. Their goal is to ensure their audio is not maliciously used and to request verification when suspicious cloned audio is identified.
2. Platform Provider: The entity that deploys the novel watermark embedding algorithm, EM(), to embed a watermark w (e.g., authorship information) into a user's speech s, producing s' = EM(s, w). The platform must guarantee high speech fidelity (s' should be nearly identical to s). It also possesses a watermark extraction algorithm, EX(), to recover w' from any suspicious audio s*, using w' as evidence of a voice cloning attack.
3. Attacker: An adversary who collects watermarked speech samples S from a target speaker T. The attacker pre-processes this data to construct a text-speech dataset Dw = (x_i, y_iw), where y_iw are watermarked speech samples. Using Dw, the attacker trains their TTS model M, typically comprising an Acoustic Model (MA) and a Vocoder (Mv). For an arbitrary text x, the attacker synthesizes speech ŷ = M(x) = Mv(MA(x)).

The talk defines three primary voice cloning attack scenarios based on the attacker's capabilities:

• Professional Voice Cloning Attack: The attacker is an expert in TTS, capable of fine-tuning a general vocoder Mv on Dw to create a superior, custom vocoder Mvw. This allows for highly realistic counterfeit speech resembling the target speaker's timbre: YwP = Mvw(MAw(x)).
• Regular Voice Cloning Attack: The attacker trains their acoustic model MAw on Dw but then uses an off-the-shelf, pre-trained vocoder Mv (e.g., HiFi-GAN trained on watermark-free data) for synthesis: YwR = Mv(MAw(x)).
• Low-quality Voice Cloning Attack: Lacking resources or fine-tuning capabilities, the attacker uses traditional, non-deep learning techniques, such as the Griffin-Lim algorithm (GL()), for waveform synthesis: YwL = GL(MAw(x)).

Beyond these common cloning attacks, the research also considers Adaptive Attacks, where the attacker has knowledge of the watermarking strategy and actively attempts to remove the watermark while preserving audio quality. These include:

• Without access to the watermarking model: Pre-processing (severe compression, low-pass filtering), VAE reconstruction to evade the watermark, or synthesizing audio with a mixed dataset (pristine and watermarked).
• With access to the watermarking model: Watermark overwriting (embedding another watermark), watermark erasing VAE, direct removal of the embedded region, or training a classifier to detect the watermark and using domain-adversarial training to synthesize watermark-free audio.
• Combining multiple attack strategies: Integrating various schemes like regular/harmful pre-processing, domain-adversarial training, VAE reconstruction, and watermark overwriting.

Key Findings

▶ Watch: Primary challenges: robustness and generalization (1:30)

The research on Detecting Voice Cloning Attacks via Timbre Watermarking presents several significant contributions to the field of audio security and deepfake detection:

1. Novel Defense Mechanism: The work formally highlights the critical risk to timbre rights from advanced voice cloning attacks and introduces Timbre Watermarking as an innovative and viable proactive defense mechanism. This shifts the paradigm from reactive detection to a preventative and traceable approach.
2. End-to-End Voice Cloning-Resistant Framework: A novel, comprehensive framework is proposed for audio watermarking that is specifically designed to resist voice cloning attacks. Key to this design is the repeated embedding of watermark information directly into the frequency domain, which inherently provides strong robustness against common audio processing operations that attackers might employ.
3. Generalization through Distortion Layer: A crucial architectural innovation is the integration of a distortion layer during the training phase. This layer effectively modulates and simulates the shared, fundamental processes involved in various voice cloning techniques (e.g., normalization, mel-spectrogram transformation, vocoder-based reconstruction). This strategic incorporation enables the framework to achieve remarkable generalization across a diverse range of voice cloning attacks, ensuring its effectiveness against both known and unseen cloning methodologies.
4. Extensive Experimental Validation: The method's effectiveness is rigorously demonstrated through extensive experiments, showcasing its high generalization and robustness against a wide array of voice cloning attacks. This includes professional, regular, and low-quality cloning methods, as well as sophisticated adaptive attacks where adversaries attempt to actively remove the watermark.
5. Practical Applicability: The framework's utility extends beyond theoretical effectiveness, with demonstrated practical applicability in real-world services. This includes successful integration with popular TTS platforms like PaddleSpeech and Voice-Cloning-App, as well as voice conversion services like so-vits-svc, confirming its readiness for deployment in complex, operational environments.

These findings collectively establish Timbre Watermarking as a robust, generalizable, and practical solution for protecting vocal identity in the face of increasingly sophisticated voice cloning threats.

Technical Deep Dive

▶ Watch: Background on voice cloning techniques and TTS pipeline (2:00)

The core of this research is an innovative, end-to-end framework, depicted in Figure 4, comprising a watermark embedding module, a watermark extraction module, and a crucial intervening distortion layer. These components are jointly trained to achieve robust and generalized protection against voice cloning.

A. Watermark Embedding (EM())

The embedding process begins with a single-channel raw speech audio a of flexible length N.

1. STFT Transformation: The Short-Time Fourier Transform (STFT) is applied to a, yielding a magnitude spectrogram s and phase information p. The magnitude spectrogram s acts as the carrier for embedding, while p is preserved for later signal reconstruction.
2. Carrier Encoding: The spectrogram s is fed into a Carrier Encoder (ENc) to obtain encoded carrier features fc.
3. Watermark Encoding: Simultaneously, the n-bit watermark information w is processed by a Watermark Encoder (ENw) to generate encoded watermark features fw.
4. Repeated Embedding: A key strategy for time-independence and robustness against time-domain distortions (like cropping or time scaling) is to repeat fw along the time axis, matching the shape of fc.
5. Feature Concatenation: The encoded carrier features fc, the original spectrogram s, and the repeated fw are concatenated to form f+. A skip concatenation, inspired by DenseNet, is also incorporated to enhance nonlinearity and preserve original carrier information.
6. Watermark Embedding: f+ is then fed into the Watermark Embedder (EM), which produces the final watermarked spectrogram sw.
7. Audio Reconstruction: The watermarked audio aw is reconstructed by applying the Inverse Short-Time Fourier Transform (ISTFT) using sw and the original phase p.

To ensure high audio quality and imperceptibility, two loss functions are employed during training:

• Watermark Embedding Loss (Le): Calculated as the Mean Squared Error (MSE) between the original audio a and the watermarked audio aw.
• Adversarial Loss (Ladv): Inspired by Generative Adversarial Networks (GANs), an additional discriminator D is trained to distinguish aw from pristine a. This loss component helps ensure the realism and naturalness of the generated watermarked audio.

B. Watermark Extraction (EX())

Given a potentially watermarked speech audio aw, the extraction module aims to recover the embedded watermark w'.

1. STFT Transformation: aw is transformed back into its phase pw and magnitude spectrogram sw using STFT.
2. Watermark Feature Extraction: The spectrogram sw is fed into the Watermark Extractor (EX) to obtain extracted watermark features fw'.
3. Averaging for Time-Independence: fw' is averaged along the horizontal (time) direction. This step directly corresponds to the repeated embedding strategy and ensures the extracted features are independent of specific time-domain distortions.
4. Watermark Decoding: The averaged features are then fed into the Watermark Decoder (DE) to decode the final watermark information w'.
5. Watermark Extraction Loss (Lw): This loss ensures the accuracy of w' compared to the original w during training.

C. Distortion Layer (DP)

This is a critical component for enhancing the framework's robustness and generalization against diverse voice cloning attacks. The distortion layer DP is inserted only during the training stage between the embedding and extraction modules and is discarded during actual deployment. It simulates common voice cloning processes:

1. ISTFT Distortion: Handled inherently by the embedding process, as modifying the amplitude spectrogram while preserving phase can lead to signal loss during ISTFT reconstruction.
2. Normalization Distortion: Voice cloning models frequently normalize audio amplitude. This is simulated by normalizing aw: aw_norm = aw / max(aw).
3. Transformation Distortion: Mel-spectrograms are supervisory signals in TTS. A mel-transform is applied: msw = Mel(aw_norm).
4. Wave Reconstruction Distortion: Vocoders often reconstruct waveforms from mel-spectrograms, frequently omitting phase information, which is a lossy process. This is simulated using the conventional Griffin-Lim algorithm (GL()): aw_dist = GL(msw). This step introduces severe distortions, significantly enhancing transferable robustness.

The full pipeline of the distortion layer is expressed as DP(aw) = GL(Mel(aw / max(aw))). During training, aw_dist (the output of the distortion layer) is fed into the watermark extraction stage, and an additional loss Lw_dist is calculated for watermark extraction accuracy from this distorted audio.

D. End-to-End Protection

All modules—the Carrier Encoder (ENc), Watermark Encoder (ENw), Watermark Embedder (EM), Watermark Extractor (EX), Watermark Decoder (DE), and Discriminator (D)—are jointly trained. The total loss function L combines the embedding fidelity loss (Le), adversarial loss (Ladv), and watermark extraction losses from both undistorted (Lw) and distorted (Lw_dist) watermarked audio. Hyper-parameters λe, λadv, and λw balance these terms. This joint training ensures both generalization and robustness. In deployment, only the trained ENc, ENw, and EM are used for embedding, and EX and DE for extraction. Detection is based on the bit recovery accuracy exceeding a predefined threshold.

Implementation Details

The framework was implemented using fully 2D convolutional networks for ENc, EM, and EX, featuring a skip gated block as their fundamental unit to integrate Gated Convolutional Neural Networks with skip connections. ENw employs a fully connected layer with a LeakyReLU activation, while DE is a pure linear layer. The Discriminator (D) includes STFT, ReluBlocks, average pooling, and a linear layer. Training utilized the Adam optimizer (β₁ = 0.9, β₂ = 0.98, ε = 10⁹, learning rate 2e-5). Hyper-parameters for the total loss were set to λe = 1, and λw = λadv = 0.01. STFT parameters included a filter length of 1024, a hop length of 256, and a window function applied with a length of 1024.

Datasets and Metrics

• Datasets: LJSpeech 61 (1-10s clips) was used for training voice cloning models. LibriSpeech 62 (train_clean100 for watermarking model training, standard test set of 2620 samples for evaluation, 10s clips). All audio was resampled to 22.05 kHz. Crucially, there was no overlap between the training data for the watermarking model and the voice cloning models.
• Fidelity Evaluation: Objective metrics included Signal-to-Noise Ratio (SNR), Perceptual Evaluation of Speech Quality (PESQ) 63, and Speaker Encoder Cosine Similarity (SECS) 64 (computed using Resemblyzer 66; values above 0.9 typically indicate bypass). A subjective Mean Opinion Score (MOS) was also used (10 participants, 5-point scale).
• Watermark Extraction Effectiveness: Measured by Bit Recovery Accuracy (ACC), calculated from all LibriSpeech test set audios. For voice cloning attacks, ACC was derived from 500 synthesized speech samples. The default watermark length was 10 bits.

Demo / Proof of Concept

▶ Watch: Why current detection and prevention methods are inadequate (3:07)

While the presentation did not feature a live, interactive demonstration, the "Evaluation and Results" section serves as a comprehensive proof of concept, rigorously validating the Timbre Watermarking framework's capabilities across various attack vectors and real-world scenarios.

Fidelity Evaluation:

The framework demonstrated superior fidelity compared to the adversarial perturbation-based method by Huang et al. (17). Objective metrics (SNR, PESQ, SECS) showed higher quality and better speaker similarity, with the method significantly outperforming the baseline. Subjective MOS evaluations, involving 10 participants, consistently rated the watermarked speech quality higher, confirming that Timbre Watermarking does not degrade the original timbre.

Generalization Across Voice Cloning Attacks:

The framework exhibited exceptional generalization (Table I) across diverse voice cloning attack types:

• Professional Voice Cloning Attack: Using Fastspeech2 or Tacotron2 with fine-tuned Hifi-GAN, or VITS, the method achieved 100% watermark extraction accuracy (ACC).
• Regular Voice Cloning Attack: With Fastspeech2 or Tacotron2 combined with an off-the-shelf, pre-trained Hifi-GAN, ACC remained high, over 99%.
• Low-quality Voice Cloning Attack: Utilizing Fastspeech2 or Tacotron2 with the Griffin-Lim vocoder, the method still achieved 100% ACC.

In stark contrast, training voice cloning models on watermark-free data resulted in an ACC of around 50% (Table II), akin to random guessing, underscoring the effectiveness of the watermarking.

Robustness Against Unseen Distortions:

The approach proved highly robust against various common audio processing operations (Table III, Figure 7):

• Cropping: Even when 90% of the audio was cropped from any position (front, middle, or behind), the method maintained 100% ACC, demonstrating intrinsic robustness to time-domain desynchronization.
• Other Preprocessing: Achieved high accuracy against resampling (16kHz: 100%, 8kHz: 99.4% ACC), amplitude scaling (20-80%: 100% ACC), MP3 compression (8-64kbps: 91.86% to 100% ACC), Recount (8bps: 99.95% ACC), Median Filtering (5-35 Samples: 94.02% to 100% ACC), Low Pass Filtering (2000Hz: 90.3% ACC), High Pass Filtering (500Hz: 100% ACC), and Gaussian Noise (20-40dB: 99.62% to 100% ACC). In all these cases, ACC remained above 90%.

Resistance Against Adaptive Attacks:

The framework also demonstrated strong resilience against sophisticated adaptive attacks (Table IV, Table V, Figure 8, Figure 9, Figure 10):

• Preprocessing Before Voice Cloning: Maintained 100% ACC for regular preprocessing (e.g., Resampling 16K, MP3 64kbps). For harmful preprocessing (e.g., MP3 8kbps, Low Pass 2000 Hz), it still achieved nearly 90% ACC (89.96-94.82%), even with significant audio degradation (SECS 0.65).
• Voice Cloning with Partial Unwatermarked Data: With 75% watermarked speech data, the system achieved over 95% ACC. Even with only 25% watermarked data, 66.36% ACC was retained, still effective for detection.
• Watermark Overwriting Attack: When attackers used existing watermarking schemes (FSVC, RFDLM) to overwrite, the original watermark was 100% extractable, while the attacker's watermark was not. An initial limitation where an attacker using our own method for overwriting reduced ACC to 93.46% was successfully addressed by incorporating a weighted embedding process and an overwriting distortion into training, resulting in 100% ACC for the original watermark (Table X).
• Audio Reconstruction-based Removal (MelVAE): Using MelVAE pre-trained on clean audio, the method achieved 99.98% ACC. When using a MelVAE pre-trained on watermarked-unwatermarked pairs, ACC was 74.90%.
• Identifying Watermark Location and Removing It: Masking medium-to-low frequency bands had the most impact on ACC. However, to significantly degrade ACC (e.g., to 70% by masking 90% of the spectrogram), the audio quality was severely destroyed (SECS from 1.0 to 0.1).
• Voice Cloning Attack with Public Extractor (Domain-adversarial training): The method maintained 100% ACC, even though this strategy degraded the TTS model's performance.
• Combining Multiple Attack Strategies: Even with severe combined attacks (e.g., resampling 16 kHz + MP3 16 kbps + domain-adversarial training + VAE reconstruction + watermark overwriting), ACC only slightly degraded (100% to 99.94%), but the audio quality was significantly compromised (SECS from 1.000 to 0.8575).

Practicality in Real-world Services:

The solution's practicality was validated on real-world services (Table VI):

• Real-world TTS Services: For PaddleSpeech 71, 100% ACC was achieved for both English (VCTK dataset speakers p225-p230) and Chinese (THCHS30 dataset speakers D4-D12) voice cloning scenarios. For Voice-Cloning-App 27, ACC was maintained at a satisfactory level of ≥ 90%.
• Real-world Voice Conversion Service: For singing voice synthesis using so-vits-svc 28, the method achieved 100% ACC for converted vocals.

These extensive results unequivocally demonstrate the Timbre Watermarking framework's robust performance and practical utility in detecting and tracing voice cloning attacks across a broad spectrum of real-world conditions and adversarial efforts.

Defensive Implications

▶ Watch: Detailed explanation of the threat model and involved parties (4:00)

The Timbre Watermarking framework offers significant defensive implications for individuals, platform providers, and the broader digital economy grappling with voice cloning threats.

Firstly, for platform providers and content distributors, this research provides a robust, proactive mechanism to safeguard user audio assets. By integrating the watermark embedding algorithm (EM()) into their upload or publishing pipeline, platforms can ensure that any speech content released is imbued with ownership or source information. This transforms a previously vulnerable asset into a traceable one, establishing a clear chain of custody.

Secondly, unlike traditional passive detection methods that merely identify synthetic voices, Timbre Watermarking offers traceability. When a suspicious voice clone is detected, the embedded watermark can be extracted, providing irrefutable evidence of the original source and potentially the author. This traceability is crucial for legal and copyright enforcement, allowing content creators and rights holders to identify and prosecute malicious actors who misuse their vocal timbre. This capability moves beyond simply identifying a deepfake to identifying who was deepfaked and from where the source material originated.

Thirdly, the framework's demonstrated robustness against common audio processing and adaptive attacks means that attackers cannot easily remove the watermark through standard techniques like compression, filtering, or even sophisticated machine learning methods like VAE reconstruction. Even when attackers combine multiple severe attack strategies, the watermark largely persists, often at the cost of significant audio quality degradation. This makes the effort of removing the watermark disproportionately high compared to its potential gain for the attacker, serving as a deterrent.

Fourthly, the generalization across diverse voice cloning techniques (professional, regular, low-quality, and even complex adaptive attacks) ensures that defenders are not caught in a perpetual "arms race." The distortion layer, trained to simulate common cloning processes, allows the system to remain effective even against novel or evolving cloning models, providing a more future-proof defense.

Finally, the validation on real-world TTS and voice conversion services (PaddleSpeech, Voice-Cloning-App, so-vits-svc) indicates that this technology is not merely theoretical but practical for immediate deployment. Organizations handling sensitive audio content, such as financial institutions using voice authentication, media companies, or social platforms, can leverage this framework to add a critical layer of security and accountability. While the current experiments primarily focus on digital environments, future work addressing physical-world distortions (e.g., re-recording) will further enhance its applicability, making it even more comprehensive for real-world scenarios.

In essence, Timbre Watermarking empowers defenders with a powerful, proactive tool that not only detects voice cloning but also provides the crucial evidence needed to attribute and mitigate the source of malicious activity, thereby bolstering trust and security in the "Ear Economy."

Key Takeaways

• Proactive Timbre Protection: Timbre Watermarking introduces a novel, proactive defense mechanism against voice cloning attacks, shifting from reactive detection to embedding ownership information directly into speech audio before release.
• Robustness Through Frequency Domain Embedding: The framework achieves high robustness against common audio processing distortions (e.g., cropping, compression, filtering) by embedding watermarks in the frequency domain and employing a repeated embedding strategy.
• Generalization via Distortion Layer: A unique distortion layer, integrated only during training, simulates diverse voice cloning processes, enabling the system to generalize effectively across professional, regular, low-quality, and even adaptive cloning attacks.
• High Fidelity and Traceability: The method ensures high audio fidelity, preserving the original timbre, while simultaneously providing critical traceability to identify the source of cloned voices – a key advantage over passive detection methods.
• Resilience Against Adaptive Adversaries: Extensive evaluations demonstrate strong resistance against sophisticated adaptive attacks, including watermark overwriting, VAE reconstruction-based removal, and combined attack strategies, often forcing attackers to severely degrade audio quality to remove the watermark.
• Proven Real-world Practicality: The framework's effectiveness has been validated on real-world TTS and voice conversion services like PaddleSpeech, Voice-Cloning-App, and so-vits-svc, confirming its readiness for practical deployment.

About the Speaker(s)

The talk "Detecting Voice Cloning Attacks via Timbre Watermarking" was presented by Chang Liu at the NDSS Symposium. Based on the provided metadata and transcript, no further biographical details such as their title or institutional affiliation were specified. However, their presentation at a prestigious security conference like NDSS indicates expertise and significant contributions to the field of cybersecurity research, particularly in audio security and deepfake detection.