ai-research-survey

scan-v5.json (19071B)

---

 {
   "scan_version": 5,
   "paper_type": "benchmark-creation",
   "paper": {
     "title": "HearSay Benchmark: Do Audio LLMs Leak What They Hear?",
     "authors": [
       "Jin Wang",
       "Liang Lin",
       "Kaiwen Luo",
       "Weiliu Wang",
       "Yitian Chen"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.03783",
     "doi": "10.48550/arXiv.2601.03783"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Key abstract claims — 92.89% gender accuracy (Table 1), near-zero refusal rates for physiological traits (Table 1), and CoT amplifying risk in capable models (Figure 4) — are all supported; the CoT claim is appropriately qualified to 'capable models' matching the mixed evidence.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Claims that CoT 'boosts Accent inference by 22.1%' are based on direct controlled comparisons with and without CoT prompting; the paper frames these as observational effects rather than mechanism claims, which is adequate for the study design.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims ALLMs 'inherently' encode private attributes as an 'emergent property of pre-training,' but the entire dataset derives from public figures giving academic lectures — a highly unrepresentative population — and no caveat qualifies these sweeping generalizations.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "RQ3 explicitly investigates whether high IAR reflects genuine acoustic reasoning vs. statistical hallucination using the Blind Bias Rate (BBR) metric, and Figure 5 visualizes model-level separation between these two explanations.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "IAR directly measures accuracy against ground-truth attribute labels; the paper is clear it measures model inference accuracy on labeled clips, not real-world privacy harm, though the gap between these is not fully theorized.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Limitation' is present and substantive, identifying English-centrism, lack of audio-level defense testing, and unexplored adversarial attack vectors.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section omits the most critical validity threats: all speakers are public figures who are likely already in models' training data (inflating IAR via memorization), and the validity of inferring social constructs like income and social stratum from voice is never questioned.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper acknowledges English-centrism and unexplored attack vectors but never explicitly states that results cannot generalize to non-public-figure speakers or that acoustic social attribute inference may reflect corpus stereotypes rather than real-world acoustic correlates.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgments or funding disclosure section appears anywhere in the paper.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed on the title page: XDU, NTU, NCEPU, BUPT, SHU, UAEU, UCAS-IIE, and Squirrel AI.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed; NA since no funder to assess, though one author's affiliation with Squirrel AI (a commercial AI company) is undisclosed in terms of potential conflict.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure of any kind appears in the paper.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "ALLM architecture is formally defined in Section 2.1 with mathematical notation; IAR, ARR, and BBR are all precisely defined in Section 4.1 with equations and operational criteria.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly positions HearSay as 'the first comprehensive benchmark investigating the privacy inference capabilities of ALLMs solely from voiceprint' with clear evaluation goals across eight attributes.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.2 distinguishes HearSay from text-based privacy inference (Staab et al.), vision-based approaches (Li et al. 2025b), and prior task-specific audio classifiers, explaining the specific gap this benchmark fills.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "benchmark-creation": {
       "construct_design": {
         "construct_validity_argued": {
           "applies": true,
           "answer": false,
           "justification": "The paper motivates that pre-training may encode voice-attribute correlations but provides no systematic argument for why each of the 8 attributes is validly measurable from voiceprint alone, particularly abstract social constructs like income and social stratum.",
           "source": "haiku"
         },
         "difficulty_distribution_characterized": {
           "applies": true,
           "answer": false,
           "justification": "Figure 2 shows attribute class distributions but no difficulty tiers are defined or measured; varying IAR across attributes implicitly shows difficulty variation but this is not analyzed or designed as a benchmark property.",
           "source": "haiku"
         },
         "ceiling_floor_effects_checked": {
           "applies": true,
           "answer": false,
           "justification": "Gender achieves 92.89% average IAR — a near-ceiling result — but the paper treats this as a finding rather than a discriminability problem; no explicit ceiling/floor effect analysis is performed or flagged as a benchmark design concern.",
           "source": "haiku"
         },
         "human_baseline_included": {
           "applies": true,
           "answer": false,
           "justification": "No human baseline is reported for any attribute; models are only compared against random guessing, leaving open whether results represent superhuman, human-level, or sub-human inference capability.",
           "source": "haiku"
         },
         "scoring_rubric_justified": {
           "applies": true,
           "answer": false,
           "justification": "GPT-4o-mini is used as automated judge for IAR but no validation against human annotations is reported, no inter-annotator reliability is measured, and no edge-case handling for ambiguous responses is described.",
           "source": "haiku"
         }
       },
       "robustness": {
         "contamination_resistance_designed": {
           "applies": true,
           "answer": false,
           "justification": "The dataset is built from public figures' lecture audio that is very likely in evaluated models' training corpora; no temporal split, canary strings, held-out test partition, or contamination check is designed or discussed.",
           "source": "haiku"
         },
         "temporal_robustness_discussed": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of how the benchmark will remain useful as models improve; with gender already at 92.89%, physiological attributes may saturate rapidly, and no update plan is mentioned.",
           "source": "haiku"
         },
         "failure_modes_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The paper discusses model failure modes (BBR, CoT degradation) but not benchmark failure modes — there is no analysis of what HearSay itself cannot measure or how it could be systematically gamed.",
           "source": "haiku"
         },
         "baseline_implementations_provided": {
           "applies": true,
           "answer": true,
           "justification": "Code is available at https://github.com/JinWang79/HearSay_Benchmark and all evaluation prompts are provided verbatim in Appendix C.",
           "source": "haiku"
         }
       },
       "documentation": {
         "dataset_documentation_complete": {
           "applies": true,
           "answer": true,
           "justification": "Section 3.2 describes the four-stage data curation pipeline; Appendix A documents all three external sources (NISP, VocalSound, Age-Vox-Celeb) with their collection methodology and preprocessing steps.",
           "source": "haiku"
         },
         "licensing_and_access_clear": {
           "applies": true,
           "answer": true,
           "justification": "Appendix A.2 explicitly states the license for each external dataset (CC BY 4.0, CC BY-SA 4.0, NTT Software Evaluation License) and explains the controlled-access mechanism requiring a formal research application.",
           "source": "haiku"
         },
         "intended_use_specified": {
           "applies": true,
           "answer": true,
           "justification": "Section 7 (Ethical Statement) explicitly states the research-only intent, acknowledges dual-use risk from malicious profiling applications, and restricts dataset use to academic non-commercial purposes.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "ALLMs achieve average gender inference accuracy of 92.89% from voiceprint alone",
       "evidence": "Table 1 shows average IAR for Gender across 9 open-source models is 92.89%, with MERaLION reaching 96.44%",
       "supported": "strong"
     },
     {
       "claim": "Audio-based inference surpasses random guessing baseline by 46.4%",
       "evidence": "Figure 3 compares With-Audio, Transcribed-Text, and Random Guessing settings; the 46.4% gap is labeled on the figure",
       "supported": "strong"
     },
     {
       "claim": "Most open-source models have near-zero Answer Refusal Rates for physiological attributes",
       "evidence": "Table 1 shows ARR near 0% for Gender across nearly all open-source models despite high IAR; only GPT-4o-Audio achieves 100% ARR on Weight",
       "supported": "strong"
     },
     {
       "claim": "CoT prompting boosts Accent inference accuracy by 22.1% in capable models (Qwen3-Omni-Flash)",
       "evidence": "Figure 4 shows CoT vs. no-CoT comparison; 22.1% gain on Accent for Qwen3-Omni-Flash is reported, with mixed effects across other models",
       "supported": "moderate"
     },
     {
       "claim": "Privacy leakage stems from genuine acoustic inference, not statistical hallucination",
       "evidence": "Figure 5 BBR analysis shows capable models (Qwen3-Omni-Flash, MiniCPM-o-2.6) systematically deviate from prior distributions when given audio, placing them in the 'Correction Zone'",
       "supported": "moderate"
     },
     {
       "claim": "Lightweight prompt defense significantly increases refusal rates in responsive models",
       "evidence": "Table 2 shows Kimi-Audio ARR for Age jumps from 0.46% to 97.96% with a safety system prompt; MiniCPM-o-2.6 reaches 61.42% overall ARR under defense",
       "supported": "strong"
     },
     {
       "claim": "Social attribute inference (Income, Social Stratum) is effectively possible with capable ALLMs",
       "evidence": "Qwen3-Omni-Flash achieves 61.19% on Income (Table 1), but average IAR for social attributes across all models is only 25-43%, barely above random for many",
       "supported": "weak"
     }
   ],
   "methodology_tags": [
     "benchmark-creation",
     "benchmark-eval"
   ],
   "key_findings": "HearSay is a 22,064-clip benchmark demonstrating that Audio LLMs can infer private attributes from voiceprint with alarming accuracy — 92.89% average for gender, and up to 61.19% for abstract social attributes like income in capable models. Nearly all open-source models have near-zero answer refusal rates despite high inference accuracy, while GPT-4o-Audio shows strong defensive behavior. Chain-of-Thought reasoning amplifies privacy risk in capable models (+22.1% Accent accuracy for Qwen3-Omni-Flash) but degrades performance in weaker models. BBR analysis confirms capable models extract genuine acoustic signal rather than hallucinating from statistical priors.",
   "red_flags": [
     {
       "flag": "Public figure selection bias",
       "detail": "The dataset is entirely constructed from academic public lecturers — an extreme population skew for social attributes like income, education, and social stratum. All speakers self-selected into public roles, making results ungeneralizable to the general population while the paper makes sweeping claims about ALLM privacy risk for ordinary users."
     },
     {
       "flag": "Training data contamination unaddressed",
       "detail": "Public figures whose lectures constitute the benchmark are very likely in the training corpora of the evaluated models, creating a memorization confound that could inflate IAR substantially. No contamination check, temporal split, or speaker de-duplication against known training sets is performed."
     },
     {
       "flag": "No human baseline",
       "detail": "Without human performance on the same eight attributes, there is no way to calibrate whether model accuracy represents superhuman inference or simply replicates what any person could infer from voice — a standard requirement for 'emergent capability' claims."
     },
     {
       "flag": "LLM judge unvalidated",
       "detail": "GPT-4o-mini is used as automated judge for all IAR calculations with no validation against human annotations, no inter-rater reliability metrics, and no analysis of judge failure modes for ambiguous responses."
     },
     {
       "flag": "Construct validity of social attributes questionable",
       "detail": "The claim that income, social stratum, and education can be validly inferred from voiceprint is scientifically contested and potentially encodes harmful stereotypes; the paper provides no literature grounding for these specific voice-attribute correlations and no discussion of whether the associations in the dataset reflect real acoustic signals or sociolinguistic confounds."
     },
     {
       "flag": "Gender ceiling effect unaddressed as benchmark design flaw",
       "detail": "At 92.89% average accuracy, gender is immediately saturated and provides minimal discriminative power for ranking models, yet this is celebrated as a finding rather than identified as a benchmark design limitation that undermines longitudinal usefulness."
     }
   ],
   "cited_papers": [
     {
       "title": "Beyond memorization: Violating privacy via inference with large language models",
       "relevance": "Direct predecessor establishing that LLMs can infer private attributes from text; HearSay extends this to the audio modality"
     },
     {
       "title": "The man behind the sound: Demystifying audio private attribute profiling via multimodal large language model agents",
       "relevance": "Concurrent work on audio privacy inference using multimodal agents with synthetic/TV-series audio; HearSay claims improvement via real-world public lecture audio with ground-truth labels"
     },
     {
       "title": "Auditing M-LLMs for privacy risks: A synthetic benchmark and evaluation framework",
       "relevance": "Related benchmark for multimodal LLM privacy evaluation using synthetic data, contrasted with HearSay's real audio approach"
     },
     {
       "title": "AudioTrust: Benchmarking the multifaceted trustworthiness of audio large language models",
       "relevance": "Concurrent comprehensive ALLM safety benchmark; HearSay focuses specifically on voiceprint privacy inference as one trustworthiness dimension"
     },
     {
       "title": "Extracting training data from large language models",
       "relevance": "Foundational privacy work motivating the shift from memorization-based to inference-based privacy risk analysis in LLMs"
     },
     {
       "title": "Judging LLM-as-a-judge with MT-Bench and Chatbot Arena",
       "relevance": "Methodological basis for the LLM-as-judge evaluation paradigm used for IAR scoring throughout HearSay experiments"
     },
     {
       "title": "Do-not-answer: A dataset for evaluating safeguards in LLMs",
       "relevance": "Related work on safety refusal evaluation methodology, informing the ARR metric design and safety alignment assessment"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Practitioners deploying audio LLMs can use HearSay to audit privacy alignment before deployment, though controlled-access limits immediate usability."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The finding that CoT reasoning amplifies privacy risk in capable models — rather than improving safety — challenges the default assumption that better reasoning equals safer behavior."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly frames ALLM capabilities as concrete privacy threats with alarming accuracy numbers (92.89% gender, 61.19% income), linking to real-world risks of voice-based mass profiling."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "The stark contrast between GPT-4o-Audio's 100% ARR on Weight vs. open-source models' near-zero ARR creates a commercial-vs-open-source safety narrative."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code is on GitHub but the dataset requires a formal research application for controlled access, preventing easy public demonstration."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Evaluates GPT-4o-Audio, Gemini-2.5-Pro, and multiple Qwen models, leveraging high name recognition of major commercial AI systems."
     }
   },
   "hn_data": {
     "threads": [],
     "top_points": 0,
     "total_points": 0,
     "total_comments": 0
   }
 }