Does anti voice cloning work?

Anti voice cloning tools genuinely raise the bar: they add an inaudible adversarial layer so a model trained on your posted audio produces a voice that sounds less like you. But a 2025 purification attack has already shown that this protection can be stripped back off and the clone restored. It is the same arms-race story as the art tools, on the voice side: a real deterrent, not a guarantee, and useless against a cloner who already holds clean recordings of you.

How anti voice cloning works

The idea mirrors the art cloaks. You add a perturbation to your audio that a person cannot hear but that disrupts a voice-cloning model trying to learn your voice. AntiFake (Yu, Zhai, Zhang, CCS 2023) is the best-known method: it adds an adversarial layer so that a text-to-speech or voice-conversion model trained on your samples produces speech that does not resemble you. According to Yu, Zhai and Zhang (CCS 2023), the authors evaluated AntiFake against five state-of-the-art synthesizers and it “achieved over 95% protection rate even to unknown black-box models,” with a usability study of 24 participants confirming the protected audio stayed listenable.

VoiceBlock (O’Reilly, Bugler, Bhandari, Morrison, Pardo, NeurIPS 2022) takes a real-time angle, applying the perturbation to an outgoing audio stream on a single CPU thread so a speaker-recognition system cannot identify you as you speak. A newer method, VoiceCloak (Hu, Wu, Lu, Luo, AAAI 2026), extends the same defensive idea to diffusion-based voice conversion, the newest generation of cloning models. Between them, these tools cover the main ways your voice gets copied.

The published break

Here is the limit, and it is the voice version of what happened to art protection. Fan, Chen, Liu, Zhang and Yu (ICML 2025), in a paper titled De-AntiFake, built a purification attack against protected speech and found that “determined attackers can mitigate these protective perturbations and successfully execute VC,” where VC is voice cloning. Their two-stage method purifies the perturbed audio and then refines it with phoneme guidance to realign it with clean speech, and they report it outperforms state-of-the-art purification methods at disrupting these defences. In plain terms: the protective layer that a tool like AntiFake adds can be substantially removed, and the clone it was meant to prevent can be restored.

This is not a voice-only surprise. It is the same result the LightShed attack (Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi, USENIX Security 2025) produced for images, and that Hönig, Rando, Carlini and Tramèr (ICLR 2025) produced for art, where cheap black-box removal reached best-of-four mimicry success of 56.6% for Glaze, 56.6% for Anti-DreamBooth, and 62.0% for Mist. Across media, a determined remover with the right tools can strip a first-generation perturbation. The protection is real, but it is removable.

Tool	What it tries to do	Limit
AntiFake	Protect posted speech from unauthorized synthesis	Can be targeted by purification
VoiceBlock	Real-time perturbation with intelligible speech	Research-grade, not clone-proof
VoiceCloak	Extend protection to diffusion voice conversion	Still part of the same arms race
De-AntiFake	Purify protected speech before cloning	The published break, not a consumer fix

What these tools do and do not protect

Two limits matter most. First, anti-cloning perturbations only protect the audio you apply them to before posting. They do nothing about recordings an attacker already holds: if someone already has a clean voicemail, interview clip or podcast episode of you, cloaking your next upload does not help. Second, these are research-grade methods rather than turnkey consumer apps with a large install base, and no independent body certifies any single tool as clone-proof. Voice cloning drew fresh regulatory attention in 2024, including from the US Federal Trade Commission, but raising an alarm about the problem is not the same as certifying a tool against it.

So should you use it?

Yes, as a deterrent, with the same clear eyes the art tools deserve. Adding an anti-cloning layer to audio you are about to publish raises the cost and lowers the quality of a clone built from that audio, which against a casual scraper may be enough. It is not a guarantee against a motivated attacker who can run a purifier, and it cannot retrieve audio that is already in the wild. If your goal is to keep your voice out of a dataset entirely, or to take down recordings that already exist, that is a concealment-and-removal job rather than an active-perturbation one, covered in voice anonymizer tools that work.

The 2026 verdict: anti voice cloning genuinely works in the sense that it degrades clones and raises an attacker’s cost, but a published 2025 purification attack shows the protection is removable. Treat it as a deterrent, not a guarantee, and never as a substitute for controlling who gets clean recordings of you in the first place.

For the named tools in detail, see DeFake, AntiFake and Voice Guard explained and the how-to on protecting your voice from AI cloning; for how voice protection scores against every other tool, see do AI poisoning tools actually work?.

Sources

• Yu, Zhai, Zhang (2023). AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech Synthesis. CCS 2023.
• O’Reilly, Bugler, Bhandari, Morrison, Pardo (2022). VoiceBlock: Privacy through Real-Time Adversarial Attacks with Audio-to-Audio Models. NeurIPS 2022.
• Hu, Wu, Lu, Luo (2026). VoiceCloak: A Multi-Dimensional Defense Framework against Unauthorized Diffusion-based Voice Cloning. AAAI 2026.
• Fan, Chen, Liu, Zhang, Yu (2025). De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attacks. ICML 2025.
• Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
• Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.