The vector that is supposed to be you

A vector that is supposed to be you

Voice cloning works by separating what is being said from who is saying it.

A speaker encoder is trained on many thousands of voices with an objective that pushes recordings of the same person close together in a vector space and different people apart. Given a few seconds of speech, it produces an embedding (commonly a few hundred numbers) that is meant to capture speaker identity and nothing else.

A synthesiser is then trained to produce speech conditioned on both the text and that embedding. At inference, you supply a short sample of a target voice, the encoder turns it into a vector, and the synthesiser speaks your text in something resembling that voice.

This is zero-shot cloning: no training on the target, seconds of reference audio, a result in seconds. Fine-tuning (actually training on ten minutes to an hour of the target) produces a closer match and takes compute and time.

What the embedding captures, and what it does not

It captures timbre: the resonances of a particular vocal tract, the average pitch, the general quality of the voice. That is most of what makes a voice recognisable in a single word.

It does not capture idiolect: the way a specific person actually speaks. Their characteristic pauses. Whether they run sentences together or break them. Which syllable they lean on. Their filler words. The rhythm of their thinking.

This is precisely why a good clone sounds like the person and not like them. Play three seconds to somebody who knows them and they will say yes, that is them. Play thirty seconds and they will say something is off, and struggle to name it. The timbre is right and the behaviour is somebody else’s: the generic behaviour the synthesiser learned from its training distribution.

Fine-tuning on longer material narrows the gap because the model picks up some timing and stress habits along with the timbre. It does not close it.

Where clones degrade predictably

• Under-represented languages and accents. The encoder was trained on a distribution; voices far from it get embeddings that are less distinctive, and the output drifts toward the training average. In practice this means a clone of a speaker with a strong regional accent in a well-represented language often comes out noticeably softened, and clones in low-resource languages are much weaker.
• Emotional range. Reference audio of somebody speaking calmly gives you a calm clone. Asking it to shout produces a shout in something that no longer sounds like the person, because the mapping between calm and loud in a real voice is specific to that person’s anatomy.
• Poor reference audio. The encoder cannot separate the speaker from the room. A reference recorded in a bathroom produces a clone with a hint of bathroom in it, because the embedding absorbed some of it.
• Long output. Consistency drifts across a long read, which is why production use chunks and re-conditions.

Detection, and why it is not a solution

Two families of defence are discussed, and both have real limits.

Anti-spoofing classifiers are trained to distinguish synthetic from genuine speech. They perform well on the generation methods they were trained against and degrade on new ones, which is the ordinary arms-race problem: the classifier is always fitted to yesterday’s generators.

Watermarking embeds an imperceptible signal in generated audio. It works when the audio reaches the detector broadly intact. It is weakened or removed by the ordinary things audio undergoes (heavy lossy compression, re-recording through a speaker and microphone, pitch shifting, deliberate noise addition) and a determined adversary can strip it. Vendors publish robustness figures under specific transformations; those figures are not a claim about an adversary who is trying.

The honest summary: watermarking helps with accidental and casual misuse and with platform-side filtering. It is not evidence of authenticity, and the absence of a watermark proves nothing at all.

The technical does not settle the ethical

The next lesson covers consent in detail, and it is worth stating here why it cannot be an afterthought. Everything above describes how easy this is: a few seconds of audio, freely available for anybody who has ever spoken publicly, and a free model.

The capability is available to everyone. The restraint has to come from the practice, because it is not coming from the difficulty.

The free path

• Coqui XTTS: multilingual zero-shot cloning; the models remain available with the maintenance caveat from the previous lesson, and note that the XTTS weights carry a licence that restricts commercial use, so read it rather than assuming.
• OpenVoice: open-source tone-colour cloning with separate control of style.
• Piper: can be fine-tuned on a target speaker for a self-hosted voice.
• RVC and similar voice-conversion tools convert an existing performance into a target timbre, which preserves the original speaker’s timing and often sounds better than text-to-speech cloning for exactly the idiolect reason above.

Licences differ sharply across these projects and several restrict commercial use. Read the licence for each model, not just the repository.

The limitation

The most important one is not technical. A cloned voice is convincing enough for fraud, and the documented cases (relatives called by a synthesised voice asking for money, an employee instructed by a synthesised executive) turn on the fact that three seconds is enough to convince somebody who is not expecting it.

There is no technical countermeasure that an ordinary person can deploy. The practical defence that security guidance consistently recommends is procedural rather than technical: an agreed phrase within a family, a call back on a known number, a second channel for any instruction involving money. That is an unsatisfying answer and it is the one that works.