AegisVox: Factorized Privacy and Clinical Preservation for Long-Form Speech

# AegisVox: Factorized Privacy and Clinical Preservation for Long-Form Speech
Source: [https://arxiv.org/html/2610.14643](https://arxiv.org/html/2610.14643)
\\jmlrpages

###### Abstract

Clinical speech reveals identity through both spoken identifiers and voice, yet its pauses, delivery, and speaker roles can also carry useful clinical evidence\. Protecting that speech therefore requires more than preserving its words\. We presentAegisVox, a factorized framework that assigns consistent surrogate voices and edits identifier\-bearing turns using document\-consistent replacements\. Across 390 public simulated or non\-patient conversations totaling 63\.6 hours, a matched comparison of two speech renderers separates replacement realization from retained identifiers, speaker linkage, and clinical preservation\. Text\-to\-speech rendering realizes 535/601 planned replacements versus 453/601 for the codec\-based speech editor\. However, similar aggregate clinical preservation conceals more model\-labeled contradictions, and conversation\-wide speaker scores conceal greater edited\-speech linkage under a score\-direction sensitivity analysis\. Fresh transcription of original audio provides a reference for interpreting the clinical measurement chain; an independent judge tests sensitivity to model\-based assessment\. Better replacement realization can therefore coexist with worse clinical or speaker\-linkage measurements\. AegisVox supports use\-specific evaluation of those tradeoffs, not a guarantee of identifier removal or clinical safety\.

††proceedings:: Preprint††year:2026###### keywords

clinical speech, audio privacy, de\-identification, voice conversion, speech editing

##### Data and Code Availability

We use public PriMock57, Fareez, and SIMSAMU\([Papadopoulos Korfiatis et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib21);[Fareez et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib12);[Nun et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib19)\), OpenSwara target voices\([Munshi, 2026](https://arxiv.org/html/2610.14643#bib.bib17)\), and synthetic ASQ\-PHI\([Weatherhead et al\., 2026](https://arxiv.org/html/2610.14643#bib.bib37)\)\. Appendix[B\.1](https://arxiv.org/html/2610.14643#A2.SS1)gives revisions and redistribution restrictions\. Code is available at[https://github\.com/spraphul/aegisvox](https://github.com/spraphul/aegisvox)\. The accompanying evidence artifact documents the evaluation; source audio remains subject to the listed access and redistribution terms\.

##### Institutional Review Board \(IRB\)

Audio experiments used public simulated or non\-patient recordings\. The limited five\-reviewer listener study was not submitted for formal IRB review\.

## 1Introduction

![Refer to caption](https://arxiv.org/html/2610.14643v1/fig01_system_new.png)Figure 1:AegisVox separates voice identity from identifying words\. SeedVC converts every turn using one consistent surrogate voice per source speaker\. The lexical renderer changes only converted turns with planned identifier replacements; the remaining converted turns pass directly to reconstruction\. F5\-TTS is the illustrated renderer, and VoiceCraft is the matched alternative\. PHI denotes protected health information\.A clinical conversation contains more than its transcript\. The words state symptoms and decisions, while the recording preserves who spoke, when a correction occurred, and how an answer was delivered\. Pauses, prosody, accent, and non\-speech events may matter when researchers study communication or build speech\-based clinical tools\. Yet that same recording exposes identity through both spoken identifiers and vocal characteristics\. Removing a name from text leaves both its spoken form and the original voice available in the audio\.

Releasing a de\-identified transcript can avoid the additional risks of sharing sound\. When research requires audio, however, transformation must preserve useful evidence without simply recreating the encounter\. Muting can interrupt an utterance\. Full resynthesis can reproduce its words but cannot preserve the observed delivery by construction\. The practical question is therefore not just whether transformed speech remains intelligible, but which identifying and clinically important properties change together\.

Prior work provides strong components for this task\. Clinical de\-identification detects sensitive text or edits its spoken realization\([Cohn et al\., 2019](https://arxiv.org/html/2610.14643#bib.bib10);[Singh et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib29);[Kim et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib13)\)\. Speaker anonymization transforms voice identity and measures source linkage with automatic speaker verification \(ASV\)\([Tomashenko et al\., 2020](https://arxiv.org/html/2610.14643#bib.bib32);[Panariello et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib20);[Tomashenko et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib33)\)\. Recent systems also combine speaker and lexical transformations\([Xiao et al\., 2026](https://arxiv.org/html/2610.14643#bib.bib39)\)\. What remains unclear is how these interventions interact in long\-form clinical conversations, where one speaker and one entity can recur across many turns\. A replacement may be spoken while an earlier mention of the original remains; a fluent transcript may lose a negation; an overall speaker score may hide linkability in the edited speech\.

We introduceAegisVox, a factorized framework that changes speaker identity and identifying words while retaining the surrounding converted conversation\. Each speaker receives a consistent surrogate voice, called a*pseudo\-speaker*\. A language model generates source\-language synthetic replacements for detected entities, with one mapping reused throughout the conversation\. A speech renderer then edits only the affected complete turns\. This separation supports controlled renderer comparisons and distinct tests of detection, replacement, linkage, and clinical preservation\.

Our evaluation covers 390 public simulated or non\-patient clinical conversations totaling 63\.6 hours\. The matched renderer comparison improves replacement realization, but the controls reveal a more consequential finding: similar aggregate clinical preservation does not imply similar error types, and conversation\-wide linkage does not describe every edited region\. A freshly transcribed original\-audio control helps interpret the measured clinical change without treating model judgments as clinical truth\.

Contributions\.We provide \(1\) a long\-form speech transformation with consistent speaker and lexical mappings; \(2\) a stage\-resolved evaluation that separates planned replacement, retained identifiers, final\-output linkage, and source\-grounded clinical evidence; and \(3\) a controlled study of two lexical renderers, with original\-audio, independent\-judge, frontend, and downstream\-note checks that expose where the measures agree and where they do not\.

## 2Related Work

##### Speaker and lexical privacy\.

VoicePrivacy pairs attacker\-oriented ASV with intelligibility and quality measurements\([Tomashenko et al\., 2020](https://arxiv.org/html/2610.14643#bib.bib32);[Panariello et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib20);[Tomashenko et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib33)\)\. Newer systems improve pseudo\-speaker generation and utility\([Chen et al\., 2026](https://arxiv.org/html/2610.14643#bib.bib8);[Kuzmin et al\., 2026](https://arxiv.org/html/2610.14643#bib.bib14)\)\. Clinical text systems address a different identity surface through detection, redaction, or consistent pseudonymization\([Vakili and Dalianis, 2022](https://arxiv.org/html/2610.14643#bib.bib34);[Simancek and Vydiswaran, 2024](https://arxiv.org/html/2610.14643#bib.bib28);[Singh et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib29)\)\. Audio de\-identification must also accommodate transcription errors and realize its text changes in speech\([Cohn et al\., 2019](https://arxiv.org/html/2610.14643#bib.bib10);[Abdjul et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib1)\)\. Neither a text\-detection score nor a speaker\-verification score establishes both forms of protection\.

##### Speech editing and joint transformation\.

Text\-guided editors replace selected speech while conditioning on observed context\([Tan et al\., 2021](https://arxiv.org/html/2610.14643#bib.bib31);[Wang et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib36);[Borsos et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib5);[Peng et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib23);[Chen et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib9)\)\. General speech generation offers another route, but requires rechecking the interaction it reconstructs\([Borsos et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib6);[Shen et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib27)\)\.[Aggazzotti et al\. \(2026\)](https://arxiv.org/html/2610.14643#bib.bib2)transform long\-form transcripts to reduce linkage through linguistic style\.[Xiao et al\. \(2026\)](https://arxiv.org/html/2610.14643#bib.bib39)combine generated speaker embeddings with localized identifier editing and evaluate the result as training data\. AegisVox builds on joint transformation through long\-form clinical factorization and controlled assessment of its distinct privacy and preservation outcomes\.

##### Clinical preservation\.

Clinical note generation depends on facts, roles, temporal relations, and supported decisions, not lexical similarity alone\([Nair et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib18);[Ben Abacha et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib4);[wai Yim et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib35)\)\. Word error rate \(WER\) does not distinguish a benign transcription variant from a changed dose or negation\. Model\-based evaluation can test these distinctions at scale, but introduces dependence on the judge\([Liu et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib16);[Zheng et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib40)\)\. We therefore retain separate clinical labels, test an independent judge, and report the limits of transcript\-based evidence\. Our renderer comparison uses published components within one framework; it is not a matched benchmark against another complete privacy pipeline\.

## 3AegisVox

### 3\.1Task and consistent mappings

The input is a conversation waveform\. Automatic speech recognition \(ASR\) transcribes speech, and diarization assigns it to speakers\. Together they produceX=\{\(ai,ti,si,τi\)\}i=1NX=\\\{\(a\_\{i\},t\_\{i\},s\_\{i\},\\tau\_\{i\}\)\\\}\_\{i=1\}^\{N\}, whereaia\_\{i\}is the waveform of turnii,tit\_\{i\}its transcript,sis\_\{i\}its speaker, andτi\\tau\_\{i\}its time interval\. Detection identifies sensitive mentionsEEwith literal transcript evidence and turn ownership\. AegisVox uses two mappings:π:s↦v\\pi:s\\mapsto v, from each source speaker to a public surrogate reference voice, andρ:e↦e′\\rho:e\\mapsto e^\{\\prime\}, from each detected entity to a synthetic replacement\. Both mappings remain fixed within a conversation\.

The output is a reconstructed waveform with transformed voices and planned lexical substitutions\. A turn is*affected*if it contains at least one planned substitution\. All turns undergo voice conversion; only affected turns undergo additional lexical rendering \(Figure[1](https://arxiv.org/html/2610.14643#S1.F1)\)\. These rules limit resynthesis, but do not by themselves guarantee correct detection, identifier removal, or preserved delivery\.

### 3\.2Speaker transformation

The ECAPA\-TDNN speaker\-embedding model represents each source speakerssand public reference voicevvas normalized vectorszsz\_\{s\}andzvz\_\{v\}\([Desplanques et al\., 2020](https://arxiv.org/html/2610.14643#bib.bib11)\)\. The voice pool contains 4,062 quality\-controlled OpenSwara units\([Munshi, 2026](https://arxiv.org/html/2610.14643#bib.bib17)\)with available language, accent, gender\-presentation, and vocal\-trait metadata\. The FAISS similarity\-search library retrieves 75 candidates per speaker\. Eligible references meet duration, audio\-quality, language, and source\-distance constraints\. Available metadata helps avoid an acoustically incompatible reference, but is not a privacy guarantee\.

Candidates are ranked by

Dcos​\(s,v\)\\displaystyle D\_\{\\cos\}\(s,v\)=1−cos⁡\(zs,zv\),\\displaystyle=1\-\\cos\(z\_\{s\},z\_\{v\}\),\(1\)q⁡\(s,v\)\\displaystyle q\(s,v\)=Dcos​\(s,v\)\+2​T​\(s,v\),\\displaystyle=D\_\{\\cos\}\(s,v\)\+2T\(s,v\),whereT⁡\(s,v\)∈\[0,1\]T\(s,v\)\\in\[0,1\]is a weighted match over available voice traits\. In deterministic speaker order, assignment selects the highest\-ranked unused reference satisfying source–target distance≥0\.70\\geq 0\.70and pairwise target–target distance≥0\.65\\geq 0\.65, with bounded backtracking for dead ends\. References cannot be reused within a conversation\. The thresholds are untuned heuristics: all 16 tested settings assigned all 809 conversation\-speaker profiles, and three rendered operating points changed only 14–23 assignments without a detectable downstream contrast \(Appendix[D](https://arxiv.org/html/2610.14643#A4)\)\. This is constrained ranking, not learned global assignment or an established privacy–utility frontier\.

SeedVC, a zero\-shot diffusion\-transformer voice converter\([Liu, 2024](https://arxiv.org/html/2610.14643#bib.bib15)\), converts every turn toward its assigned reference\. Reusing the reference maintains a consistent intended pseudo\-identity across a speaker’s turns\. Distinct references maintain the intended separation between speakers, while ASV tests whether source linkage persists after transformation\.

### 3\.3Lexical planning and complete\-turn rendering

GPT\-5\.4 receives the complete speaker\-attributed transcript and generates a structured identifier and replacement plan\. The detector follows a frozen contract based on Health Insurance Portability and Accountability Act \(HIPAA\) Safe Harbor categories\. Each entity receives a speakable synthetic substitute in the source language, reused across coreferent mentions\. The instructions exclude changes to clinical facts, medication, negation, chronology, and roles\. The instruction does not verify complete detection or regulatory compliance\.

Applyingρ\\rhoyields the complete replacement\-bearing transcriptti′t\_\{i\}^\{\\prime\}\. For an affected turn, the renderer receives the complete SeedVC\-converted audio, its transcripttit\_\{i\}, andti′t\_\{i\}^\{\\prime\}\. We compare two implementations:*AegisVox \(VoiceCraft\)*, using a pretrained neural\-codec speech editor\([Peng et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib23)\), and*AegisVox \(F5\-TTS\)*, using a flow\-matching text\-to\-speech model conditioned on the reference turn\([Chen et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib9)\)\. Each produces an edited complete turn, not an isolated replacement word\. The framework is renderer\-agnostic; these are two implementations of the same factorization\.

Table 1:Public evaluation population and comparison roles\. The original\-audio control changes no speech; all transformation conditions share the source recordings\. EN and FR denote English and French\.

### 3\.4Reconstruction and measurement boundaries

Rendered turns replace the corresponding converted turns\. The remaining SeedVC\-converted turns, gaps, and speaker ordering supply the reconstruction context\. Inserted durations may shift later timestamps; the validated lexical replay concatenates these segments rather than enforcing original turn length\. Appendix[C](https://arxiv.org/html/2610.14643#A3)gives model and interface details, and Appendix[R](https://arxiv.org/html/2610.14643#A18)describes execution and failure accounting\.

We distinguish the generated\-turn benchmark from evaluation of reconstructed conversations\. The former scores every matched edit intention, retaining failed or uncertain outcomes without selecting a successful fallback\. The latter measures saved conversation reconstructions, including 16 regions that retain converted speech after VoiceCraft generation failure\. The focused benchmark tests one substitution at a time; its intentions are not the composed regions counted in final reconstruction \(Appendix[I\.3](https://arxiv.org/html/2610.14643#A9.SS3)\)\. A score on a generated turn is not proof that every identifier was removed from the complete conversation\.

Replacement and retention can coexistSource:“your name\. Doris\. So Doris, …”
Intended text:“your name\. Nina\. So Doris, …”
Edited\-audio ASR:“your name\. Nina\. So Doris, …”
The substitute is realized, but the original remains\. This observed public\-data example explains why the two outcomes need separate labels\. The intended text is reconstructed from saved planning evidence, not a captured model request \(Appendix[I\.3](https://arxiv.org/html/2610.14643#A9.SS3)\)\.

## 4Evaluation Design

### 4\.1Population and controlled comparisons

The study uses PriMock57, Fareez, and SIMSAMU\([Papadopoulos Korfiatis et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib21);[Fareez et al\., 2022](https://arxiv.org/html/2610.14643#bib.bib12);[Nun et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib19)\)\(Table[1](https://arxiv.org/html/2610.14643#S3.T1)\)\. The recordings are public simulated or non\-patient conversations, not a sample of real patient encounters\. The primary frontend is faster\-whisper large\-v3 ASR\([Radford et al\., 2023](https://arxiv.org/html/2610.14643#bib.bib25)\)with pyannote 3\.1 diarization\([Bredin et al\., 2020](https://arxiv.org/html/2610.14643#bib.bib7)\)\. The two renderer conditions share recordings, frontend, pseudo\-speaker assignments, SeedVC outputs, planned edit intentions, and comparison rules\. Localized redaction supplies a separate deletion boundary\. Dataset access, population strata, and condition definitions appear in Appendices[B](https://arxiv.org/html/2610.14643#A2)–[E](https://arxiv.org/html/2610.14643#A5)\.

### 4\.2Separate privacy outcomes

##### Detection and realized replacements\.

We test text detection on all 1,051 synthetic ASQ\-PHI queries\([Weatherhead et al\., 2026](https://arxiv.org/html/2610.14643#bib.bib37)\)\. The primary exact typed endpoint covers 2,147 gold elements in the intersection of the benchmark ontology and our frozen identifier contract; the full ontology contains 2,973 elements\. This independent text test does not estimate identifier recall in the 390 source recordings\.

The renderer benchmark contains 601 matched*edit intentions*from 208 conversations\. For each intention, GPT\-5\.4 examines transcripts from two ASR models applied to the generated complete turn\. It separately judges whether the synthetic replacement is realized and whether the original identifier is retained, allowing spelling or phonetic variants\. Either judgment can be uncertain, and both can be positive\. The denominator includes failures; it is not the number of unique turns or an exhaustive inventory of source PHI\. Exact protocols appear in Appendices[H](https://arxiv.org/html/2610.14643#A8),[I](https://arxiv.org/html/2610.14643#A9), and[T](https://arxiv.org/html/2610.14643#A20)\.

##### Linkage to the source speaker\.

The final\-waveform test enrolls ECAPA\-TDNN on original speech from the same recording, then tests sampled speech from each saved reconstructed output\. A conversation\-speaker profile is one assigned speaker within one recording, not necessarily a unique person across the corpus\. The primary trials pair 809 profiles with their own transformed speech and with other speakers in the same conversation, yielding 809 positive and 916 negative trials\. This avoids assuming that different recordings contain different people\.

Each profile pools at most ten three\-second windows\. Equal error rate \(EER\) is measured where false matches and missed matches balance\. We report both cosine score directions and the lower EER as a score\-orientation sensitivity analysis: the direction is selected using evaluation labels, not held\-out calibration\. Lower EER means easier linkage under this test\. This is not an attacker trained on converted speech\. A second analysis restricts the samples to planned inserted\-turn intervals in the final output\. Historical shared\-stage ECAPA and x\-vector tests\([Snyder et al\., 2018](https://arxiv.org/html/2610.14643#bib.bib30)\)use different sampling and impostors; they are reported separately in Appendix[K](https://arxiv.org/html/2610.14643#A11), not assigned to each final renderer condition\.

### 4\.3Clinical evidence and controls

GPT\-5\.4 extracts 25,778 evidence\-linked*clinical atomic propositions*\(CAPs\) from the source ASR transcripts\. A CAP is one checkable fact with its relevant modifiers, such as “the patient denies a penicillin allergy\.” The inventory is frozen across conditions\. The judge seeks literal evidence in each condition’s transcript and assigns preserved, partial, missing, contradicted, or uncertain\. Strict preservation counts only preserved\. Contradiction is reported separately, since two systems can have similar preservation rates but different error profiles\.

The original\-audio control freshly transcribes all 390 original ingested WAVs and adjudicates them against the same frozen CAPs\. It uses the same declared ASR model and settings as the evaluator, rather than reusing saved source text\. Historical checkpoint/runtime identity and hosted\-judge temporal stability could not be fully verified\. This control measures the combined transcription and adjudication reference, not a human transcript or facts omitted from the initial extraction \(Appendix[I\.1](https://arxiv.org/html/2610.14643#A9.SS1)\)\.

Both GPT\-5\.4 and the independent Qwen3\-32B judge\([Qwen Team, 2025](https://arxiv.org/html/2610.14643#bib.bib24)\)passed a controlled qualification suite before study adjudication\. Qwen then assessed 600 shared CAPs in two presentation orders across three conditions, and all 601 editor intentions, without seeing GPT outcomes\. Qualification tests known perturbations, not agreement with clinicians\. Appendices[G](https://arxiv.org/html/2610.14643#A7)and[G\.1](https://arxiv.org/html/2610.14643#A7.SS1)report its coverage and judge dependence\.

A further control generates structured clinical notes from each condition’s transcript alone\. The generator receives no source CAP inventory; that inventory enters only the subsequent evaluator\. This separates note\-writing inputs from evaluation references\. We also retain clinical action, role, chronology, and final\-state endpoints, plus WER, timing, events, and acoustic similarity from CLAP and HeAR\([Wu et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib38);[Baur et al\., 2024](https://arxiv.org/html/2610.14643#bib.bib3)\)\. The latter compare learned audio representations, not clinical correctness or human naturalness \(Appendices[I](https://arxiv.org/html/2610.14643#A9)–[J](https://arxiv.org/html/2610.14643#A10)\)\.

Figure 2:Clinical controls and matched renderer effects on 25,778 source CAPs from 390 conversations\. \(a\) Fresh original\-audio ASR supplies the reference, not clinical ground truth\. \(b\) F5\-TTS minus VoiceCraft effects in percentage points \(pp\), with 95% conversation\-cluster intervals\. Similar strict preservation coexists with more model\-labeled contradictions\.
### 4\.4Statistical units and uncertainty

Main rates are item\-weighted: each edit intention or source CAP contributes once\. Paired renderer effects use 10,000 conversation\-cluster bootstrap resamples, preserving dependence among items from one recording\. We also report equal\-conversation weighting\. Post hoc contradiction and retained\-original tests use paired sign flips and Holm adjustment within their two\-test family\. The original\-control and robustness families are separate\. Final\-waveform EER uses 2,000 conversation\-cluster resamples; ASQ uses 2,000 query\-level resamples\.

Uncertain judgments do not count as verified success or verified absence\. Failed lexical cases remain in the 601\-intention denominator\. Invalid note outputs remain unobserved, not zero; note contrasts use the valid matched subset and report missingness bounds\. Confidence intervals describe sampling uncertainty, whereas bounds describe unresolved outcomes\. An interval crossing zero does not establish equivalence\. Appendix[F](https://arxiv.org/html/2610.14643#A6)defines all units, and Appendix[P](https://arxiv.org/html/2610.14643#A16)gives paired and weighting sensitivities\. Failure accounting and executable specifications appear in Appendices[Q](https://arxiv.org/html/2610.14643#A17)and[S](https://arxiv.org/html/2610.14643#A19)\.

## 5Results

### 5\.1The original\-audio control explains the reference scale

Fresh ASR of the original audio preserves 24,998/25,778 CAPs \(96\.97%; 95% CI 96\.66–97\.28\), compared with 20,089/25,778 \(77\.93%\) after SeedVC alone \(Figure[2](https://arxiv.org/html/2610.14643#S4.F2)\)\. The paired change is−19\.04\-19\.04percentage points \(CI−20\.29\-20\.29to−17\.83\-17\.83\)\. Both renderer rates are close to the SeedVC\-only rate: 77\.41% for VoiceCraft and 77\.31% for F5\-TTS\.

Most of the aggregate deficit is already present in the SeedVC\-only comparison\. Similar aggregate rates do not show that the same facts failed in each condition\. It does not show that voice conversion audibly destroys 19% of clinical facts: transformed speech can change ASR output, and the judge can label evidence differently\. The frozen inventory also omits facts missed by source ASR or extraction\. The control makes the absolute rates interpretable without resolving these causes\. Appendix[I\.1](https://arxiv.org/html/2610.14643#A9.SS1)separates it from the much easier identical\-saved\-text self\-consistency check\.

Table 2:Matched outcomes within AegisVox\. Counts and item\-weighted rates are shown for each renderer\. Effects are F5\-TTS minus VoiceCraft, with 95% conversation\-cluster intervals\. The lexical rows cover 601 edit intentions from 208 conversations; clinical rows cover 25,778 CAPs from 390 conversations\. Realization is conditional on a planned edit, not complete PHI removal\.
### 5\.2More replacements do not imply uniform gains

F5\-TTS realizes 535/601 planned replacements \(89\.02%\), compared with 453/601 \(75\.37%\) for VoiceCraft, a gain of 13\.64 points \(CI 9\.69–17\.59; Table[2](https://arxiv.org/html/2610.14643#S5.T2)\)\. Original PHI is nevertheless retained in 28/601 versus 21/601 edits\. That difference is not statistically resolved \(Holm\-adjustedp=0\.272p=0\.272\), but neither rate represents verified absence in all remaining cases: original\-term judgments are uncertain in 40 and 92 cases, respectively, with one additional VoiceCraft generation failure\.

Aggregate CAP preservation differs by just−0\.10\-0\.10points \(CI−0\.61\-0\.61to0\.420\.42\)\. Yet F5\-TTS has more model\-labeled contradictions: 479/25,778 versus 391/25,778, a paired increase of 0\.34 points \(CI 0\.15–0\.54; Holm\-adjustedp=0\.0017p=0\.0017\)\. This adverse secondary finding matters because strict preservation combines several distinct failure types\. Changing missing or uncertain to contradicted need not alter that rate\. The labels are not clinician\-confirmed harms; they warrant inspection rather than being hidden by the preservation average\. Appendix[I](https://arxiv.org/html/2610.14643#A9)reports the full outcome partition and source\-assigned importance strata\.

Detection remains a separate limit\. On ASQ\-PHI, exact typed F1 is 94\.4% \(CI 93\.5–95\.3\) under the frozen contract intersection, but 79\.9% \(CI 78\.9–80\.8\) under the full benchmark ontology\. The difference includes a geographic\-category mismatch\. Of 219 hard\-negative queries, 48 elicit at least one prediction\. These are text\-detection results, not recall for identifiers in the clinical recordings; multiplying them by replacement realization would not estimate end\-to\-end privacy \(Appendix[H](https://arxiv.org/html/2610.14643#A8)\)\.

### 5\.3Final\-output averages can hide edited\-speech linkage

Across all\-turn samples from final conversations, score\-orientation EER is 0\.369 for SeedVC alone, 0\.365 for VoiceCraft, and 0\.367 for F5\-TTS\. The paired F5\-TTS\-minus\-VoiceCraft contrast is 0\.22 points \(CI−1\.01\-1\.01to0\.990\.99\), with no detectable difference\. These tests use 809 matched conversation\-speaker profiles, not 809 independently identified people\.

Figure 3:Final\-waveform linkage under evaluation\-label\-selected score direction\. F5\-TTS minus VoiceCraft effects use all\-turn samples \(809 profiles, 390 conversations\) or planned\-edit regions \(291 profiles, 204 conversations\)\. Bars are 95% clustered CIs\. Lower EER means easier source linkage\.Restricting samples to planned inserted\-turn intervals changes the result\. On 291 matched eligible profiles from 204 conversations, F5\-TTS has 11\.34\-point lower EER \(CI−15\.91\-15\.91to−6\.69\-6\.69; Figure[3](https://arxiv.org/html/2610.14643#S5.F3)\)\. Thus, similar conversation\-wide estimates do not exclude greater source linkability in the speech being edited\. Six additional VoiceCraft profiles lack one second of eligible F5\-TTS speech and are excluded from this matched contrast, not scored as successful privacy\. These findings are sensitivity results under same\-recording enrollment and selected score direction, not a learned adaptive attack or a cross\-session identification claim \(Appendix[K](https://arxiv.org/html/2610.14643#A11)\)\.

### 5\.4Clinical conclusions depend on the measurement protocol

Qwen3\-32B corroborates the lexical ordering, judging 486/601 F5\-TTS and 421/601 VoiceCraft replacements realized\. Clinical labels nevertheless differ: Cohen’sκ\\kappais 0\.253–0\.340 where Qwen returns valid, agreeing labels under both presentation orders\. This unweighted comparison retains uncertainty as a separate category\. Qwen’s overall weighted clinical contrast also crosses zero, but its absolute rates and low\-importance fact contrast differ from GPT\-5\.4\. The independent judge tests sensitivity, not clinical truth \(Appendix[G\.1](https://arxiv.org/html/2610.14643#A7.SS1)\)\.

When notes are generated without the source\-fact inventory, the valid matched subset contains 314 conversations and 20,316 CAPs\. F5\-TTS versus VoiceCraft strict note preservation differs by−0\.37\-0\.37points \(CI−1\.30\-1\.30to0\.560\.56\), while model\-labeled contradictions increase by 0\.48 points \(CI 0\.24–0\.72\)\. Only 1,440/1,560 note generations and 999/1,170 judgments are valid\. These exploratory contrasts describe observed matched cases; unresolved cases can change the population direction \(Appendix[J\.1](https://arxiv.org/html/2610.14643#A10.SS1)\)\.

Five reviewers also rated 25 clinical and 25 perceptual items in a limited blinded panel, yielding 125 ratings per panel\. Its uneven coverage, including only seven clinical and four perceptual F5\-TTS items, supports descriptive listening observations, not renderer superiority or CAP\-level validation \(Appendix[O](https://arxiv.org/html/2610.14643#A15)\)\.

### 5\.5Frontend and recording conditions constrain use

Crossing Whisper small, turbo, and large\-v3 and Canary\-1B\-v2 with pyannote and NeMo Sortformer yields 3,120 recording\-cell evaluations\([Sekoyan et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib26);[Park et al\., 2025](https://arxiv.org/html/2610.14643#bib.bib22)\)\. Strict CAP preservation ranges from 0\.771 to 0\.807, without one backend leading all measures\. Canary has competitive matched WER, yet its interface lacks the speaker\-turn and timing links needed to localize planned edits\. Observed realization is only 2/481 intentions with NeMo and 3/596 with pyannote\. These are integration failures of the evaluated pipeline, not inherent limits of Canary or the renderer\. A transcript can be useful while its timing interface is unusable for local speech editing \(Appendix[M](https://arxiv.org/html/2610.14643#A13)\)\.

Applying 12\-dB room noise before the full pipeline reduces the conversation\-level chronology endpoint by 12\.1 points \(CI 6\.4–17\.5; Holm\-adjustedp=0\.0006p=0\.0006; Appendix[N](https://arxiv.org/html/2610.14643#A14)\)\. CLAP and HeAR similarities provide complementary acoustic evidence but do not establish accent or naturalness invariance \(Appendix[J](https://arxiv.org/html/2610.14643#A10)\)\. English and French differences remain confounded with dataset, duration, and interaction setting rather than identifying a causal language effect \(Appendix[L](https://arxiv.org/html/2610.14643#A12)\)\.

## 6Discussion

##### Different privacy tests answer different questions\.

A spoken substitute does not prove removal of its source, and voice conversion does not remove spoken identifiers\. F5\-TTS improves planned realization, but contradictions and edited\-region linkage argue against a universal renderer choice\. Neither WER nor one privacy–utility score can express this tradeoff\. The relevant balance depends on what a recipient needs to hear and what identifying evidence an attacker can access\.

##### Preserving sound requires more than preserving words\.

Complete\-turn rendering supplies context without rerendering every converted turn\. It limits lexical resynthesis, not all acoustic change\. The original\-audio control and frontend sensitivity show why facts, speaker attribution, timing, and delivery require checks across the full measurement chain, not only within the editor\.

##### Review before release\.

Consistent pseudo\-speakers can retain useful conversational roles, but matching language and voice traits can also narrow an attacker’s search\. Voice\-pool knowledge, auxiliary recordings, and repeated releases could strengthen that attacker\. Restricted access, inspection of uncertain edits, and purpose\-limited release are therefore possible safeguards, not deployments validated here \(Appendix[A](https://arxiv.org/html/2610.14643#A1)\)\. No measured EER or replacement rate establishes HIPAA compliance or a universal threshold for releasing clinical audio\.

##### What remains unvalidated\.

The study does not provide an exhaustive independently annotated identifier inventory for the source recordings, proposition\-level clinician truth, a learned conversion\-adapted attacker, or a matched external complete pipeline\. The renderer contrast does not establish superiority over complete systems\. GPT\-5\.4 is used for planning and primary clinical evaluation; Qwen reduces single\-family dependence but does not validate source extraction\. ASR and judging errors remain mixed with audio changes\. The non\-patient population, partial notes, and limited listening evidence leave transfer to real care untested\.

## 7Conclusion

AegisVox makes long\-form speech privacy a joint transformation and preservation problem, with consistent voice assignments and document\-level lexical replacements\. Its controlled evaluation shows why the outcomes must remain separate: more planned replacements can coexist with retained identifiers, more model\-labeled contradictions, and easier edited\-region linkage under the evaluated score direction\. Original\-audio and final\-waveform controls make these tradeoffs visible without equating model judgments with clinical truth\. Future work should pair independent clinical and identifier references with stronger attacks on released speech\.

###### acknowledgments\-disclosure\-of\-funding\.

We thank Raefer Gabriel, Kiran Rama, Vishal Vishnoi, Amitabh Saikia, Irfan Bulu, Jangwon Kim, Neil Hauge, and Gyan Shankar for their guidance and feedback\. We thank Oracle Health AI for supporting this research and providing the computational resources used in the experiments and analyses\.

## References

- Abdjul et al\. \(2025\)Rifqi Naufal Abdjul, Dessi Puji Lestari, Ayu Purwarianti, Candy Olivia Mawalim, Sakriani Sakti, and Masashi Unoki\.Indonesian speech content de\-identification in low resource transcripts\.In Derry Wijaya, Alham Fikri Aji, Clara Vania, Genta Indra Winata, and Ayu Purwarianti, editors,*Proceedings of the Second Workshop in South East Asian Language Processing*, pages 63–71, Online, January 2025\. Association for Computational Linguistics\.URL[https://aclanthology\.org/2025\.sealp\-1\.6/](https://aclanthology.org/2025.sealp-1.6/)\.
- Aggazzotti et al\. \(2026\)Cristina Aggazzotti, Ashi Garg, Zexin Cai, and Nicholas Andrews\.Content anonymization for privacy in long\-form audio, 2026\.URL[https://arxiv\.org/abs/2510\.12780](https://arxiv.org/abs/2510.12780)\.
- Baur et al\. \(2024\)Sebastien Baur, Zaid Nabulsi, Wei\-Hung Weng, Jake Garrison, Louis Blankemeier, Sam Fishman, Christina Chen, Sujay Kakarmath, Minyoi Maimbolwa, Nsala Sanjase, Brian Shuma, Yossi Matias, Greg S\. Corrado, Shwetak Patel, Shravya Shetty, Shruthi Prabhakara, Monde Muyoyeta, and Diego Ardila\.Hear – health acoustic representations, 2024\.URL[https://arxiv\.org/abs/2403\.02522](https://arxiv.org/abs/2403.02522)\.
- Ben Abacha et al\. \(2023\)Asma Ben Abacha, Wen\-wai Yim, Griffin Adams, Neal Snider, and Meliha Yetisgen\.Overview of the MEDIQA\-chat 2023 shared tasks on the summarization & generation of doctor\-patient conversations\.In Tristan Naumann, Asma Ben Abacha, Steven Bethard, Kirk Roberts, and Anna Rumshisky, editors,*Proceedings of the 5th Clinical Natural Language Processing Workshop*, pages 503–513, Toronto, Canada, July 2023\. Association for Computational Linguistics\.[10\.18653/v1/2023\.clinicalnlp\-1\.52](https://doi.org/10.18653/v1/2023.clinicalnlp-1.52)\.URL[https://aclanthology\.org/2023\.clinicalnlp\-1\.52/](https://aclanthology.org/2023.clinicalnlp-1.52/)\.
- Borsos et al\. \(2022\)Zalán Borsos, Matt Sharifi, and Marco Tagliasacchi\.Speechpainter: Text\-conditioned speech inpainting, 2022\.URL[https://arxiv\.org/abs/2202\.07273](https://arxiv.org/abs/2202.07273)\.
- Borsos et al\. \(2023\)Zalán Borsos, Raphaël Marinier, Damien Vincent, Eugene Kharitonov, Olivier Pietquin, Matt Sharifi, Dominik Roblek, Olivier Teboul, David Grangier, Marco Tagliasacchi, and Neil Zeghidour\.Audiolm: a language modeling approach to audio generation, 2023\.URL[https://arxiv\.org/abs/2209\.03143](https://arxiv.org/abs/2209.03143)\.
- Bredin et al\. \(2020\)Herve Bredin, Ruiqing Yin, Juan Manuel Coria, Gregory Gelly, Pavel Korshunov, Marvin Lavechin, Diego Fustes, Hadrien Titeux, Wassim Bouaziz, and Marie\-Philippe Gill\.Pyannote\.audio: Neural building blocks for speaker diarization\.In*ICASSP 2020 \- 2020 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\)*, page 7124–7128\. IEEE, May 2020\.[10\.1109/icassp40776\.2020\.9052974](https://doi.org/10.1109/icassp40776.2020.9052974)\.URL[http://dx\.doi\.org/10\.1109/ICASSP40776\.2020\.9052974](http://dx.doi.org/10.1109/ICASSP40776.2020.9052974)\.
- Chen et al\. \(2026\)Meiying Melissa Chen, Anastasia Kuznetsova, Zhenyu Wang, and Zhiyao Duan\.Nouveauvoice: Generating novel pseudo speakers for voice anonymization, 2026\.URL[https://arxiv\.org/abs/2607\.03985](https://arxiv.org/abs/2607.03985)\.
- Chen et al\. \(2025\)Yushen Chen, Zhikang Niu, Ziyang Ma, Keqi Deng, Chunhui Wang, Jian Zhao, Kai Yu, and Xie Chen\.F5\-tts: A fairytaler that fakes fluent and faithful speech with flow matching, 2025\.URL[https://arxiv\.org/abs/2410\.06885](https://arxiv.org/abs/2410.06885)\.
- Cohn et al\. \(2019\)Ido Cohn, Itay Laish, Genady Beryozkin, Gang Li, Izhak Shafran, Idan Szpektor, Tzvika Hartman, Avinatan Hassidim, and Yossi Matias\.Audio de\-identification \- a new entity recognition task\.In Anastassia Loukina, Michelle Morales, and Rohit Kumar, editors,*Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 \(Industry Papers\)*, pages 197–204, Minneapolis, Minnesota, June 2019\. Association for Computational Linguistics\.[10\.18653/v1/N19\-2025](https://doi.org/10.18653/v1/N19-2025)\.URL[https://aclanthology\.org/N19\-2025/](https://aclanthology.org/N19-2025/)\.
- Desplanques et al\. \(2020\)Brecht Desplanques, Jenthe Thienpondt, and Kris Demuynck\.ECAPA\-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification\.In*Interspeech 2020*, pages 3830–3834, 2020\.[10\.21437/Interspeech\.2020\-2650](https://doi.org/10.21437/Interspeech.2020-2650)\.
- Fareez et al\. \(2022\)Faiha Fareez, Tishya Parikh, Christopher Wavell, Saba Shahab, Meghan Chevalier, Scott Good, Isabella De Blasi, Rafik Rhouma, Christopher McMahon, Jean\-Paul Lam, Thomas Lo, and Christopher W\. Smith\.A dataset of simulated patient\-physician medical interviews with a focus on respiratory cases\.*Scientific Data*, 9\(1\), June 2022\.ISSN 2052\-4463\.[10\.1038/s41597\-022\-01423\-1](https://doi.org/10.1038/s41597-022-01423-1)\.URL[http://dx\.doi\.org/10\.1038/s41597\-022\-01423\-1](http://dx.doi.org/10.1038/s41597-022-01423-1)\.
- Kim et al\. \(2024\)Woojin Kim, Sungeun Hahm, and Jaejin Lee\.Generalizing clinical de\-identification models by privacy\-safe data augmentation using GPT\-4\.In Yaser Al\-Onaizan, Mohit Bansal, and Yun\-Nung Chen, editors,*Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*, pages 21204–21218, Miami, Florida, USA, November 2024\. Association for Computational Linguistics\.[10\.18653/v1/2024\.emnlp\-main\.1181](https://doi.org/10.18653/v1/2024.emnlp-main.1181)\.URL[https://aclanthology\.org/2024\.emnlp\-main\.1181/](https://aclanthology.org/2024.emnlp-main.1181/)\.
- Kuzmin et al\. \(2026\)Nikita Kuzmin, Songting Liu, Kong Aik Lee, and Eng Siong Chng\.Stream\-voice\-anon: Enhancing utility of real\-time speaker anonymization via neural audio codec and language models, 2026\.URL[https://arxiv\.org/abs/2601\.13948](https://arxiv.org/abs/2601.13948)\.
- Liu \(2024\)Songting Liu\.Zero\-shot voice conversion with diffusion transformers, 2024\.URL[https://arxiv\.org/abs/2411\.09943](https://arxiv.org/abs/2411.09943)\.
- Liu et al\. \(2023\)Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu\.G\-eval: NLG evaluation using gpt\-4 with better human alignment\.In Houda Bouamor, Juan Pino, and Kalika Bali, editors,*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 2511–2522, Singapore, December 2023\. Association for Computational Linguistics\.[10\.18653/v1/2023\.emnlp\-main\.153](https://doi.org/10.18653/v1/2023.emnlp-main.153)\.URL[https://aclanthology\.org/2023\.emnlp\-main\.153/](https://aclanthology.org/2023.emnlp-main.153/)\.
- Munshi \(2026\)Jay Munshi\.Open swara: The largest open\-source humanized voice library, 2026\.URL[https://github\.com/jaymunshi/open\-swara](https://github.com/jaymunshi/open-swara)\.
- Nair et al\. \(2023\)Varun Nair, Elliot Schumacher, and Anitha Kannan\.Generating medically\-accurate summaries of patient\-provider dialogue: A multi\-stage approach using large language models\.In Tristan Naumann, Asma Ben Abacha, Steven Bethard, Kirk Roberts, and Anna Rumshisky, editors,*Proceedings of the 5th Clinical Natural Language Processing Workshop*, pages 200–217, Toronto, Canada, July 2023\. Association for Computational Linguistics\.[10\.18653/v1/2023\.clinicalnlp\-1\.26](https://doi.org/10.18653/v1/2023.clinicalnlp-1.26)\.URL[https://aclanthology\.org/2023\.clinicalnlp\-1\.26/](https://aclanthology.org/2023.clinicalnlp-1.26/)\.
- Nun et al\. \(2025\)Aimé Nun, Olivier Birot, Gaël Guibon, Frédéric Lapostolle, and Ivan Lerner\.Simsamu \- a french medical dispatch dialog open dataset\.*Computer Methods and Programs in Biomedicine*, 268:108857, August 2025\.ISSN 0169\-2607\.[10\.1016/j\.cmpb\.2025\.108857](https://doi.org/10.1016/j.cmpb.2025.108857)\.URL[http://dx\.doi\.org/10\.1016/j\.cmpb\.2025\.108857](http://dx.doi.org/10.1016/j.cmpb.2025.108857)\.
- Panariello et al\. \(2024\)Michele Panariello, Natalia Tomashenko, Xin Wang, Xiaoxiao Miao, Pierre Champion, Hubert Nourtel, Massimiliano Todisco, Nicholas Evans, Emmanuel Vincent, and Junichi Yamagishi\.The voiceprivacy 2022 challenge: Progress and perspectives in voice anonymisation, 2024\.URL[https://arxiv\.org/abs/2407\.11516](https://arxiv.org/abs/2407.11516)\.
- Papadopoulos Korfiatis et al\. \(2022\)Alex Papadopoulos Korfiatis, Francesco Moramarco, Radmila Sarac, and Aleksandar Savkov\.PriMock57: A dataset of primary care mock consultations\.In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors,*Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(Volume 2: Short Papers\)*, pages 588–598, Dublin, Ireland, May 2022\. Association for Computational Linguistics\.[10\.18653/v1/2022\.acl\-short\.65](https://doi.org/10.18653/v1/2022.acl-short.65)\.URL[https://aclanthology\.org/2022\.acl\-short\.65/](https://aclanthology.org/2022.acl-short.65/)\.
- Park et al\. \(2025\)Taejin Park, Ivan Medennikov, Kunal Dhawan, Weiqing Wang, He Huang, Nithin Rao Koluguri, Krishna C Puvvada, Jagadeesh Balam, and Boris Ginsburg\.Sortformer: A novel approach for permutation\-resolved speaker supervision in speech\-to\-text systems\.In Aarti Singh, Maryam Fazel, Daniel Hsu, Simon Lacoste\-Julien, Felix Berkenkamp, Tegan Maharaj, Kiri Wagstaff, and Jerry Zhu, editors,*Proceedings of the 42nd International Conference on Machine Learning*, volume 267 of*Proceedings of Machine Learning Research*, pages 48153–48169\. PMLR, 13–19 Jul 2025\.URL[https://proceedings\.mlr\.press/v267/park25h\.html](https://proceedings.mlr.press/v267/park25h.html)\.
- Peng et al\. \(2024\)Puyuan Peng, Po\-Yao Huang, Shang\-Wen Li, Abdelrahman Mohamed, and David Harwath\.VoiceCraft: Zero\-shot speech editing and text\-to\-speech in the wild\.In Lun\-Wei Ku, Andre Martins, and Vivek Srikumar, editors,*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pages 12442–12462, Bangkok, Thailand, August 2024\. Association for Computational Linguistics\.[10\.18653/v1/2024\.acl\-long\.673](https://doi.org/10.18653/v1/2024.acl-long.673)\.URL[https://aclanthology\.org/2024\.acl\-long\.673/](https://aclanthology.org/2024.acl-long.673/)\.
- Qwen Team \(2025\)Qwen Team\.Qwen3 technical report, 2025\.URL[https://arxiv\.org/abs/2505\.09388](https://arxiv.org/abs/2505.09388)\.
- Radford et al\. \(2023\)Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine Mcleavey, and Ilya Sutskever\.Robust speech recognition via large\-scale weak supervision\.In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,*Proceedings of the 40th International Conference on Machine Learning*, volume 202 of*Proceedings of Machine Learning Research*, pages 28492–28518\. PMLR, 23–29 Jul 2023\.URL[https://proceedings\.mlr\.press/v202/radford23a\.html](https://proceedings.mlr.press/v202/radford23a.html)\.
- Sekoyan et al\. \(2025\)Monica Sekoyan, Nithin Rao Koluguri, Nune Tadevosyan, Piotr Zelasko, Travis Bartley, Nikolay Karpov, Jagadeesh Balam, and Boris Ginsburg\.Canary\-1b\-v2 & parakeet\-tdt\-0\.6b\-v3: Efficient and high\-performance models for multilingual asr and ast, 2025\.URL[https://arxiv\.org/abs/2509\.14128](https://arxiv.org/abs/2509.14128)\.
- Shen et al\. \(2023\)Kai Shen, Zeqian Ju, Xu Tan, Yanqing Liu, Yichong Leng, Lei He, Tao Qin, Sheng Zhao, and Jiang Bian\.Naturalspeech 2: Latent diffusion models are natural and zero\-shot speech and singing synthesizers, 2023\.URL[https://arxiv\.org/abs/2304\.09116](https://arxiv.org/abs/2304.09116)\.
- Simancek and Vydiswaran \(2024\)Dalton Simancek and V\.G\.Vinod Vydiswaran\.Handling name errors of a BERT\-based de\-identification system: Insights from stratified sampling and Markov\-based pseudonymization\.In Elena Volodina, David Alfter, Simon Dobnik, Therese Lindström Tiedemann, Ricardo Muñoz Sánchez, Maria Irena Szawerna, and Xuan\-Son Vu, editors,*Proceedings of the Workshop on Computational Approaches to Language Data Pseudonymization \(CALD\-pseudo 2024\)*, pages 1–7, St\. Julian’s, Malta, March 2024\. Association for Computational Linguistics\.[10\.18653/v1/2024\.caldpseudo\-1\.1](https://doi.org/10.18653/v1/2024.caldpseudo-1.1)\.URL[https://aclanthology\.org/2024\.caldpseudo\-1\.1/](https://aclanthology.org/2024.caldpseudo-1.1/)\.
- Singh et al\. \(2025\)Praphul Singh, Charlotte Dzialo, Jangwon Kim, Sumana Srivatsa, Irfan Bulu, Sri Gadde, and Krishnaram Kenthapadi\.RedactOR: An LLM\-powered framework for automatic clinical data de\-identification\.In Georg Rehm and Yunyao Li, editors,*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 6: Industry Track\)*, pages 510–530, Vienna, Austria, July 2025\. Association for Computational Linguistics\.ISBN 979\-8\-89176\-288\-6\.[10\.18653/v1/2025\.acl\-industry\.36](https://doi.org/10.18653/v1/2025.acl-industry.36)\.URL[https://aclanthology\.org/2025\.acl\-industry\.36/](https://aclanthology.org/2025.acl-industry.36/)\.
- Snyder et al\. \(2018\)David Snyder, Daniel Garcia\-Romero, Gregory Sell, Daniel Povey, and Sanjeev Khudanpur\.X\-vectors: Robust dnn embeddings for speaker recognition\.In*2018 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\)*, page 5329–5333\. IEEE, April 2018\.[10\.1109/icassp\.2018\.8461375](https://doi.org/10.1109/icassp.2018.8461375)\.URL[http://dx\.doi\.org/10\.1109/ICASSP\.2018\.8461375](http://dx.doi.org/10.1109/ICASSP.2018.8461375)\.
- Tan et al\. \(2021\)Daxin Tan, Liqun Deng, Yu Ting Yeung, Xin Jiang, Xiao Chen, and Tan Lee\.Editspeech: A text based speech editing system using partial inference and bidirectional fusion, 2021\.URL[https://arxiv\.org/abs/2107\.01554](https://arxiv.org/abs/2107.01554)\.
- Tomashenko et al\. \(2020\)Natalia Tomashenko, Brij Mohan Lal Srivastava, Xin Wang, Emmanuel Vincent, Andreas Nautsch, Junichi Yamagishi, Nicholas Evans, Jose Patino, Jean\-François Bonastre, Paul\-Gauthier Noé, and Massimiliano Todisco\.Introducing the voiceprivacy initiative, 2020\.URL[https://arxiv\.org/abs/2005\.01387](https://arxiv.org/abs/2005.01387)\.
- Tomashenko et al\. \(2024\)Natalia Tomashenko, Xiaoxiao Miao, Pierre Champion, Sarina Meyer, Xin Wang, Emmanuel Vincent, Michele Panariello, Nicholas Evans, Junichi Yamagishi, and Massimiliano Todisco\.The voiceprivacy 2024 challenge evaluation plan, 2024\.URL[https://arxiv\.org/abs/2404\.02677](https://arxiv.org/abs/2404.02677)\.
- Vakili and Dalianis \(2022\)Thomas Vakili and Hercules Dalianis\.Utility preservation of clinical text after de\-identification\.In Dina Demner\-Fushman, Kevin Bretonnel Cohen, Sophia Ananiadou, and Junichi Tsujii, editors,*Proceedings of the 21st Workshop on Biomedical Language Processing*, pages 383–388, Dublin, Ireland, May 2022\. Association for Computational Linguistics\.[10\.18653/v1/2022\.bionlp\-1\.38](https://doi.org/10.18653/v1/2022.bionlp-1.38)\.URL[https://aclanthology\.org/2022\.bionlp\-1\.38/](https://aclanthology.org/2022.bionlp-1.38/)\.
- wai Yim et al\. \(2023\)Wen wai Yim, Yujuan Fu, Asma Ben Abacha, Neal Snider, Thomas Lin, and Meliha Yetisgen\.Aci\-bench: a novel ambient clinical intelligence dataset for benchmarking automatic visit note generation, 2023\.URL[https://arxiv\.org/abs/2306\.02022](https://arxiv.org/abs/2306.02022)\.
- Wang et al\. \(2022\)Tao Wang, Jiangyan Yi, Ruibo Fu, Jianhua Tao, and Zhengqi Wen\.Campnet: Context\-aware mask prediction for end\-to\-end text\-based speech editing, 2022\.URL[https://arxiv\.org/abs/2202\.09950](https://arxiv.org/abs/2202.09950)\.
- Weatherhead et al\. \(2026\)James Weatherhead, George Golovko, and Peter McCaffrey\.Asq\-phi: An adversarial synthetic data benchmark for clinical de\-identification and search utility\.*Data in Brief*, 65:112586, April 2026\.ISSN 2352\-3409\.[10\.1016/j\.dib\.2026\.112586](https://doi.org/10.1016/j.dib.2026.112586)\.URL[http://dx\.doi\.org/10\.1016/j\.dib\.2026\.112586](http://dx.doi.org/10.1016/j.dib.2026.112586)\.
- Wu et al\. \(2024\)Yusong Wu, Ke Chen, Tianyu Zhang, Yuchen Hui, Marianna Nezhurina, Taylor Berg\-Kirkpatrick, and Shlomo Dubnov\.Large\-scale contrastive language\-audio pretraining with feature fusion and keyword\-to\-caption augmentation, 2024\.URL[https://arxiv\.org/abs/2211\.06687](https://arxiv.org/abs/2211.06687)\.
- Xiao et al\. \(2026\)Yunchong Xiao, Yuxiang Zhao, Ziyang Ma, Shuai Wang, Kai Yu, Jiachun Liao, and Xie Chen\.Anonymization, not elimination: Utility\-preserved speech anonymization, 2026\.URL[https://arxiv\.org/abs/2604\.17000](https://arxiv.org/abs/2604.17000)\.
- Zheng et al\. \(2023\)Lianmin Zheng, Wei\-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P\. Xing, Hao Zhang, Joseph E\. Gonzalez, and Ion Stoica\.Judging llm\-as\-a\-judge with mt\-bench and chatbot arena, 2023\.URL[https://arxiv\.org/abs/2306\.05685](https://arxiv.org/abs/2306.05685)\.

## Appendix AReporting Boundaries and Governed Use

The evaluation concerns public simulated or non\-patient clinical conversations\. The identifier framework follows the US Department of Health and Human Services guidance on[de\-identification methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html)\. This framework does not replace the legal assessment required for a particular release or establish that the transformed waveform meets that standard\. It does not establish performance on real patients, clinical safety, regulatory compliance, guaranteed removal of protected information, or anonymity\. Speaker privacy is reported only against the evaluated automatic speaker\-verification \(ASV\) attackers\. Lexical privacy is reported as replacement realization, retention of the original sensitive term, and uncertainty, with each denominator stated\. Model\-adjudicated clinical endpoints are not presented as human ground truth\.

Figure[4](https://arxiv.org/html/2610.14643#A1.F4)places AegisVox inside a controlled data\-release process\. The transformation is one protection layer\. Source access control, purpose limitation, provenance, residual\-risk review, restricted release, and monitoring remain necessary because an adversary may possess auxiliary voice recordings, metadata, or repeated access to transformed outputs\.

The supplement follows the same stage\-resolved logic as the main paper\. It first defines the population, transformation, and controlled conditions; then reports protected health information \(PHI\) detection, lexical realization, speaker verification, and clinical preservation under their own denominators; finally, it documents sensitivity, failure, listener, governance, and reproducibility evidence\. Results from different statistical units are never added into a composite score\.

![Refer to caption](https://arxiv.org/html/2610.14643v1/fig04_governance_publication.png)Figure 4:Governed integration and threat boundary\. AegisVox transforms speaker identity and identifying language before controlled release, while access, provenance, residual\-risk review, and monitoring remain outside the model and continue to constrain use\.
## Appendix BEvaluation Population and Strata

The public evaluation contains 390 conversations and 63\.6 hours of audio: 272 Fareez respiratory interviews, 57 PriMock57 consultations, and 61 SIMSAMU emergency calls\. There are 329 English and 61 French recordings\. Duration quartiles contain 98, 97, 97, and 98 recordings, with cut points near 471, 609, and 736 seconds\. Detected speaker counts are two in 302 recordings, three in 73, and at least four in 15\. These strata establish long\-form and multi\-speaker coverage, but language, dataset, interaction setting, and sample size remain confounded\.

The frontend strata contain 883 timeline speaker labels, whereas the saved ASV enrollment registry contains 809 conversation\-speaker profiles: eight recordings have one profile, 347 have two, 33 have three, and two have four\. These are different stage\-specific registries, not interchangeable speaker counts or verified unique\-person identities\. The timeline\-label strata describe frontend segmentation; ASV uses only its saved profile and interval registry\. The edit registry contains 611 diagnostic intentions across duration strata, while the matched editor comparison contains 601 intentions present in both renderer manifests\. The 601\-edit denominator is used for realization, original\-term retention, and uncertainty\. Recording\-level clinical analyses use all 390 conversations and proposition\-level analyses use the same 25,778 source clinical atomic propositions \(CAPs\) per condition\. Figure[5](https://arxiv.org/html/2610.14643#A2.F5)reports the complete population composition\.

Figure 5:Public evaluation population by dataset, language, detected speaker count, and planned edit count\. Duration strata are specified in the text\.The OpenSwara voice pool supplies 4,062 quality\-controlled public target units\. Each stores a normalized ECAPA\-TDNN embedding, waveform, duration, sample rate, and available language, accent or geography, gender\-presentation, vocal maturity, weight, and resonance metadata\. Retrieval uses these deterministic features to seek a target that is compatible but separated from the source\. A one\-to\-one conversation assignment also encourages target\-to\-target distinctiveness\. The selected target remains fixed for that source speaker throughout the recording\. This design supports role continuity; it does not imply protection against arbitrary auxiliary\-data attacks\.

### B\.1Data access and redistribution

PriMock57 was frozen at Git revisioncd2ac707ad03under CC BY 4\.0; the Fareez respiratory interviews use Figshare revision10\.6084/m9\.figshare\.16550013\.v1under CC0 1\.0; and SIMSAMU was frozen at Hugging Face revision6b639431f658under the MIT license\. The OpenSwara pool uses revision3fc1ab35af18; its dataset card reports CC BY\-SA 4\.0, but the evaluated snapshot does not expose uniform per\-voice upstream provenance\. The accompanying artifact therefore distributes exact manifests, identifiers, revisions, code, hashes, and aggregate evidence, but no source, reference, transformed, or listener audio\. ASQ\-PHI is a fully synthetic text benchmark released under the MIT license\. Researchers obtain each public corpus from its cited source under the corresponding access terms\. The released manifests record the complete revision identifiers\.

## Appendix CImplementation Details

##### Frontend\.

The primary frontend uses faster\-whisper large\-v3 for matched source and target transcription and pyannote 3\.1 for speaker\-attributed turns\. The sensitivity matrix additionally evaluates Whisper small, turbo, and large\-v3 plus NVIDIA Canary\-1B\-v2, crossed with pyannote 3\.1 and NeMo Sortformer\. Downstream settings remain fixed within this matrix so that differences describe frontend propagation rather than a reconfigured transformation\.

##### Speaker profiling and assignment\.

Speaker turns are pooled into source profiles\. FAISS inner\-product search over normalized ECAPA embeddings retrieves 75 candidates per source speaker\. Eligibility requires at least 4\.5 seconds of 16\-kHz audio, excludes child\-like targets, and applies language and native\-English compatibility where relevant\. Reranking combines source\-target distance with compatible voice traits\. The conversation\-level assignment enforces one target per source speaker, no target reuse within a conversation, and pairwise distinctiveness among assigned targets\. The assignment is made once and reused across all turns\.

##### Identity conversion\.

SeedVC converts each speaker\-attributed turn toward its retrieved target voice\. The converter aims to preserve the linguistic input while changing voice identity; its measured preservation and linkage are evaluated separately\. Because all reportable editor conditions share this conversion path, SeedVC speaker\-verification results must not be attributed to VoiceCraft or F5\-TTS\.

##### Replacement planning\.

GPT\-5\.4 receives the complete speaker\-attributed transcript, detected language, and the conversation\-level entity inventory\. It emits a structured edit plan that maps each supported sensitive entity to a synthetic replacement in the source language\. A selected replacement is reused across coreferent mentions\. The planner is restricted to identifying information and must not alter symptoms, diagnoses, medications, doses, allergies, negation, chronology, speaker roles, actions, or decisions\.

##### Lexical rendering and reconstruction\.

The primary AegisVox instantiation uses the flow\-matching F5\-TTS model; the matched AegisVox instantiation substitutes the pretrained, unmodified VoiceCraft 330M neural\-codec language model\. Both receive a complete converted speaker turn, its transcript, and that transcript with the planned replacement\. The resulting complete edited turn replaces that converted turn\. Unedited SeedVC turns are retained, and reconstruction accounts for changed turn durations\. The final lexical insertion replay concatenates the inserted turns with surrounding converted samples; it does not establish a crossfade at each insertion\. No post\-generation semantic rejection or favorable fallback is inserted into the primary editor comparison\.

## Appendix DRetrieval\-Threshold Sensitivity

The source–target cutoff of 0\.70 and target–target cutoff of 0\.65 are heuristic assignment constraints, not values tuned against the reported test outcomes\. We evaluated all 16 combinations of source–target minima\{0\.60,0\.65,0\.70,0\.75\}\\\{0\.60,0\.65,0\.70,0\.75\\\}and target–target minima\{0\.55,0\.60,0\.65,0\.70\}\\\{0\.55,0\.60,0\.65,0\.70\\\}over all 809 source profiles\. Every grid cell assigned 809/809 profiles\. We then fully rendered and evaluated the utility\-oriented, balanced, and privacy\-oriented settings in Table[3](https://arxiv.org/html/2610.14643#A4.T3)on all 390 conversations\. This is a sensitivity analysis of the declared heuristic and in\-pool candidate set\. It does not test adversarial target choice or out\-of\-pool references\. Speaker linkage is summarized by attacker\-oriented equal error rate \(EER\)\. Utility measures include word error rate \(WER\) and embedding similarities from Contrastive Language\-Audio Pretraining \(CLAP\) and Health Acoustic Representations \(HeAR\)\.

Table 3:Retrieval\-threshold sensitivity over separately rendered conditions\. CAP is the recording\-level mean strict proposition\-preservation rate\. ASV uses the 809\-positive and 653,672\-impostor trial population per backend; ECAPA is orientation\-normalized so EER is at most 0\.5\. Absolute values belong to this sensitivity family and are not substituted for the primary\-condition results\.The three settings used 186 pool targets and never assigned the same target to two speakers within one conversation\. Targets may be reused across independent conversations\. Utility versus balanced changed 14/809 source assignments, utility versus privacy changed 23/809, and balanced versus privacy changed 14/809\. The small achieved\-distance shifts were detectable after Holm correction, but no downstream ASV, WER, CAP, chronology, clinical\-action, replacement\-realization, CLAP, or HeAR contrast was\. The evaluated cutoffs are therefore non\-binding in this pool\. We retain the balanced setting for continuity, not because it statistically dominates the alternatives\. The experiment supports robustness to these reasonable threshold choices but does not identify a privacy–utility frontier\.

## Appendix EControlled Conditions

The four reportable conditions share the same 390 source conversations and the same frontend\. The speaker\-path\-only control applies only the speaker\-identity path\. AegisVox \(VoiceCraft\) and AegisVox \(F5\-TTS\) share the frontend, pseudo\-speaker assignment, SeedVC conversion, replacement plan, and reconstruction, differing only in the complete\-turn lexical renderer\. Localized redaction applies the same speaker path but removes the planned lexical region without synthesizing a replacement\. Consequently, editor realization is applicable only to the two replacement\-bearing conditions\. The historical ASV result measures only their shared speaker path\. The final\-waveform test separately evaluates each of these three conditions\. Localized redaction begins from SeedVC\-converted turns, but has no separate final\-waveform ASV result; that endpoint is unmeasured rather than zero\. The freshly transcribed original\-audio condition supplies an additional clinical measurement control without transformation\.

## Appendix FEndpoint and Statistical Protocol

Each endpoint retains its own population and stage\. ASQ\-PHI detection uses 1,051 synthetic queries, with 2,147 contract\-intersection or 2,973 full\-ontology gold elements\. Generated\-turn realization and retention use 601 matched edit intentions in 208 conversations\. Final\-waveform linkage uses 809 conversation\-speaker profiles, with 809 positive and 916 within\-conversation negative trials for all\-turn samples\. Clinical preservation uses 25,778 frozen source CAPs in 390 conversations\. The frontend matrix retains all8×390=3,1208\\times 390=3\{,\}120recording\-cells\. A rate from one unit cannot substitute for coverage of another\.

##### Paired clinical and lexical estimates\.

Main rates are item\-weighted proportions\. Their paired effects use 10,000 bootstrap resamples of source conversations, retaining all items in a sampled conversation\. The random seed is 20261005\. Sign\-flip tests use 20,000 draws at the same cluster level\. The post hoc family of original\-identifier retention and CAP contradiction uses Holm adjustment over those two endpoints only\. Strict preservation and realization intervals are not a multiplicity\-adjusted simultaneous confidence region\. Equal\-conversation estimates give each recording equal weight and are reported as a separate sensitivity analysis in Appendix[P](https://arxiv.org/html/2610.14643#A16)\.

##### Controls and other families\.

The original\-audio control also uses 10,000 conversation\-cluster resamples and 20,000 sign flips\. Its six\-test Holm family comprises preservation and contradiction for three transformed conditions versus original audio\. Final\-waveform ASV uses 2,000 conversation\-cluster resamples\. ASQ\-PHI uses 2,000 query\-level bootstrap resamples, including the hard\-negative query proportion\. The prespecified robustness families retain their separate paired Holm analyses\. These families must not be interpreted as one global error\-rate control across the paper\.

##### Uncertainty is not absence\.

Uncertain lexical labels and generation failures remain in the 601\-intention denominator but do not establish absence of an original identifier\. The strict CAP indicator counts only preserved labels; partial, missing, contradicted, and uncertain remain separate in outcome tables\. Invalid or absent note judgments are unobserved, not judged missing and not a zero score\. The note comparison is restricted to valid matched cases, with no missing\-at\-random assumption\. Identification bounds vary unresolved outcomes and are not confidence intervals\. Structurally inapplicable measures are not assigned zero\.

## Appendix GModel\-Adjudication Qualification

The source\-anchored clinical protocol was tested on 45 controlled cases spanning 15 families, with three cases per family\. Benign controls include exact copies, paraphrases, and identifier\-only replacement\. Harmful cases include critical fact deletion, negation or uncertainty flips, medication, dose, measurement, severity, role, plan\-attribution, unsupported\-insertion, and chronology errors\. The qualification matrix repeats each case under target\-first ordering, rubric permutation, prompt paraphrase, evidence removal, and context truncation\.

GPT\-5\.4 completed 360/360 qualification judgments while satisfying the prespecified harmful\-error sensitivity, benign specificity, evidence\-validity, and fail\-closed requirements\. The final clinical endpoints therefore use one qualified primary model judge\. This supports a controlled model\-adjudication protocol, not equivalence to clinical experts or ground truth\.

Figure 6:Controlled qualification suite for source\-anchored clinical adjudication\. Each corruption family tests whether the judge distinguishes preserved content from a clinically consequential change under protocol variants\.### G\.1Independent open\-model sensitivity

To test dependence on the GPT\-5\.4 model family used by the primary clinical judge, Qwen3\-32B\([Qwen Team, 2025](https://arxiv.org/html/2610.14643#bib.bib24)\)was frozen at Hugging Face revision9216db5781bf21249d130ec9da846c4624c16137, run with thinking disabled and greedy decoding, and required to pass the unchanged qualification gates before seeing study cases\. It completed 360/360 qualification judgments\. Under the conservative source/target\-order rule, consensus coverage and outcome accuracy were 44/45, harmful sensitivity was 35/36, and benign specificity was 9/9\. The sole order disagreement remained uncertain\.

The qualified model then judged the same predeclared 600 source CAPs matched across the speaker\-path\-only control, AegisVox \(VoiceCraft\), and AegisVox \(F5\-TTS\)\. Each condition case was evaluated source\-first and target\-first, giving 3,600 expected judgments; 3,526 were valid and 74 remained fail\-closed\. GPT\-5\.4 outcomes were never included in Qwen prompts\. Table[4](https://arxiv.org/html/2610.14643#A7.T4)separates raw counts, weighted strict\-preservation estimates, and unweighted categorical agreement\. We therefore compare whether directional conclusions persist, but do not treat the judges as interchangeable\.

Table 4:Independent Qwen sensitivity on 600 shared CAPs per condition\. Covered cases have valid agreeing Qwen labels under both orders\. Strict raw counts retain all 600 intentions\. Weighted rates use inverse stratum probabilities\. Agreement andκ\\kappaare unweighted over covered cases and retain GPT uncertainty as a third category; they are not binary accuracy\.Figure[7](https://arxiv.org/html/2610.14643#A7.F7)separates three questions that a single agreement number would conflate: whether population\-weighted preservation estimates differ between judges, whether they agree case by case, and whether they recover the same lexical\-renderer ordering\. Weighted GPT preservation is 76\.2%, 77\.4%, and 75\.4% for SeedVC, VoiceCraft, and F5\-TTS, respectively, on the same 600\-CAP sample\. Qwen assigns higher weighted preservation, whileκ\\kappashows that this is not a calibrated substitute for GPT\-5\.4\. Nevertheless, both judges assign higher replacement realization to the F5\-TTS instantiation than to the VoiceCraft instantiation\.

Figure 7:Independent\-judge sensitivity\. Left: inverse\-stratum\-weighted strict preservation under each judge, with conversation\-cluster intervals\. Center: unweighted uncertainty\-retaining Cohen’sκ\\kappaon covered cases\. Right: realized replacements under each judge, with numerators over 601 intentions\. Weighting, label agreement, and lexical ordering answer different questions\.Under Qwen, the paired F5\-TTS\-minus\-VoiceCraft renderer effect within AegisVox was−0\.0305\-0\.0305over all 600 CAPs \(95% audio\-cluster bootstrap CI−0\.0773\-0\.0773to0\.01120\.0112\)\. The critical effect was0\.01930\.0193\(n=201n=201; CI−0\.0382\-0\.0382to0\.07590\.0759\), the major effect was0\.00030\.0003\(n=201n=201; CI−0\.0595\-0\.0595to0\.05820\.0582\), and the minor effect was−0\.0739\-0\.0739\(n=198n=198; CI−0\.1483\-0\.1483to−0\.0080\-0\.0080\)\. The overall contrast crossed zero under both judges, but the negative minor stratum and systematically higher Qwen absolute rates make judge dependence a result rather than a removable nuisance\.

The same model independently judged the frozen 601\-item lexical evidence\. It classified 421/601 VoiceCraft\-rendered replacements as realized \(70\.0%; Wilson 95% CI 66\.3–73\.6\) and 486/601 F5\-TTS\-rendered replacements as realized \(80\.9%; 77\.5–83\.8\)\. Original phrases were present in 29/601 and 28/601 items, respectively\. This corroborates the direction of the F5\-TTS renderer’s realization gain while showing that its absolute magnitude depends on the model judge\. Both analyses use transcript evidence, not direct listening or clinician ground truth\.

## Appendix HIndependent PHI\-Detector Evaluation

The frozen text detector was evaluated on all 1,051 ASQ\-PHI queries: 832 PHI\-positive queries and 219 hard negatives\. Gold labels were unavailable to the model\. The primary analysis uses typed exact matching over the intersection between the frozen AegisVox contract and the benchmark ontology\. It contains 2,147 gold elements and gives 2,043 true positives, 137 false positives, and 104 false negatives\. Table[5](https://arxiv.org/html/2610.14643#A8.T5)reports the complete primary and sensitivity endpoints\.

Table 5:Independent ASQ\-PHI detector evaluation\. Confidence intervals use 2,000 query\-level bootstrap resamples\. The full ontology includes the prespecified geography\-contract mismatch\.The full\-ontology exact F1 was 0\.799 and boundary\-tolerant F1 was 0\.873\. This drop is not hidden as detector error under the primary contract: ASQ\-PHI groups facilities and organizations intoGEOGRAPHIC\_LOCATION, whereas the frozen AegisVox contract includes a location only when it is literally geographic\. On 219 hard\-negative queries, 48 contained at least one predicted entity, a query\-level false\-positive rate of 0\.219 \(95% query\-bootstrap CI 0\.165–0\.273\)\. The 48 affected queries contained 49 predictions: 45 dates and four geographic subdivisions\. Most date predictions were literal years such as 2018–2022 that the frozen Safe Harbor contract treats as dates but the benchmark labels as non\-PHI in its hard\-negative questions\. Thus, this endpoint captures both detector overreach and a benchmark\-contract disagreement\.

Table 6:Primary category results on the contract\-intersection gold set\. Low\-support residual categories are grouped; unique identifiers are shown separately because their performance differs\.Unique identifiers are the weakest supported category, although only 14 gold elements are available\. Names and medical\-record numbers improve sharply under boundary\-tolerant scoring, showing that many exact errors are span\-boundary disagreements rather than missed entity concepts\. These results bound the detector’s supported ontology and do not establish exhaustive detection of arbitrary identifiers in speech\.

## Appendix IComplete Clinical and Lexical Results

The lexical chain separates an independent detector result from conditional renderer behavior\. Among the 601 edits planned for both renderers, the AegisVox \(F5\-TTS\) instantiation realizes 535 \(89\.0%\), while AegisVox \(VoiceCraft\) realizes 453 \(75\.4%\)\. Original sensitive terms are retained in 28 F5\-TTS\-rendered edits \(4\.7%\) and 21 VoiceCraft\-rendered edits \(3\.5%\); 46 F5\-TTS\-rendered outcomes \(7\.7%\) and 110 VoiceCraft\-rendered outcomes \(18\.3%\) are uncertain\. These endpoints are adjudicated separately and may overlap, so their counts must not be forced into a partition\. The paired realization effect is\+13\.64\+13\.64percentage points \(95% conversation\-cluster bootstrap CI9\.699\.69to17\.5917\.59\)\. Original retention differs by\+1\.16\+1\.16points \(CI−0\.62\-0\.62to2\.882\.88; Holm\-adjustedp=0\.272p=0\.272\)\. Realization uncertainty is not retention uncertainty: the latter is 40/601 for F5\-TTS and 92/601 for VoiceCraft, with one additional VoiceCraft generation failure\.

Table 7:Conditional lexical\-renderer outcomes over the same 601 planned edit intentions, assessed from generated\-turn transcripts\. Uncertainty refers to realization; outcomes may overlap\. Detection is reported in Table[5](https://arxiv.org/html/2610.14643#A8.T5)\.Clinical preservation is decomposed rather than summarized only by the strict rate\. Table[8](https://arxiv.org/html/2610.14643#A9.T8)shows all 25,778 proposition judgments per condition\. Strict preservation counts only*preserved*; partial and uncertain cases do not pass\. AegisVox \(F5\-TTS\) preserves 19,929 propositions \(77\.3%\), compared with 20,089 \(77\.9%\) under the speaker\-path\-only control\. The paired F5\-TTS\-minus\-VoiceCraft strict\-CAP effect within AegisVox is−0\.097\-0\.097percentage points \(95% conversation\-cluster CI−0\.606\-0\.606to0\.4220\.422\)\. This is no detectable difference under the declared test, not an equivalence claim\.

Table 8:Source\-anchored CAP outcome decomposition\. Each row contains the same 25,778 propositions; percentages are row percentages\.Source\-extraction model labels assign 1,269 CAPs as critical, 13,486 as major, and 11,023 as minor\. These are model\-generated importance strata, not clinician annotations\. Table[9](https://arxiv.org/html/2610.14643#A9.T9)shows that the aggregate rate is not driven by one severity stratum\. Most of the aggregate deficit is already present with SeedVC alone\. Similar aggregate rates do not identify which facts failed in common\. They do not isolate audible errors from transcription or judging errors, or identify the severity of a verified clinical harm\.

Table 9:Strict CAP preservation by source\-assigned clinical importance\. Numerators are preserved propositions; denominators are fixed across conditions\.Figure[8](https://arxiv.org/html/2610.14643#A9.F8)aligns these clinical and lexical outcomes without collapsing their different units\. Across conditions, role preservation ranges from 0\.863 to 0\.875, chronology preservation from 0\.840 to 0\.851, final\-state preservation from 0\.871 to 0\.883, and action recall from 0\.866 to 0\.881\. Harmful\-action\-change rates are between 0\.006 and 0\.007\.

![Refer to caption](https://arxiv.org/html/2610.14643v1/fig08_studies1_4_condition_heatmap.png)Figure 8:Complete condition\-level clinical and lexical profile\. Clinical endpoints use the 390\-conversation population; editor endpoints use the matched 601\-intention population\.### I\.1Fresh original\-audio control

All 390 normalized original ingested WAVs were transcribed afresh with faster\-whisper large\-v3, CUDA float16, beam size 1, voice\-activity detection, and automatic language selection\. No audio identity or lexical transformation was applied\. GPT\-5\.4 adjudicated these new transcripts against the existing 25,778 source CAPs; the inventory was not extracted again\. All 390 adjudications were valid, with no unobserved CAPs\. The original\-control labels are 24,998 preserved, 556 partial, 128 missing, 95 contradicted, and one uncertain\. Strict preservation is 96\.974% \(95% conversation\-cluster CI 96\.658–97\.279\)\.

The fresh original comparison gives SeedVC, VoiceCraft, and F5\-TTS changes of−19\.043\-19\.043,−19\.567\-19\.567, and−19\.664\-19\.664percentage points, respectively\. Their intervals are\[−20\.288,−17\.833\]\[\-20\.288,\-17\.833\],\[−20\.830,−18\.359\]\[\-20\.830,\-18\.359\], and\[−20\.923,−18\.462\]\[\-20\.923,\-18\.462\]\. These are item\-weighted paired label contrasts, not independent estimates of audible clinical damage\.

Fresh\-execution receipts establish that the transcripts were newly computed; 335 differ from the saved source text and 55 are identical\. Text equality alone neither proves nor disproves fresh execution\. The declared model and settings match the evaluator, but exact historical checkpoint/runtime identity and hosted\-judge temporal stability could not be fully verified\. Source ASR and extraction omissions remain outside the frozen inventory\. A separate self\-consistency check, using identical saved source text, preserves 25,775/25,778 CAPs \(99\.99%\); it is not the fresh original\-waveform control\.

### I\.2Paired contradiction and uncertainty

For model\-labeled contradiction, 237 CAPs are positive under both renderers, 242 under F5\-TTS only, 154 under VoiceCraft only, and 25,145 under neither\. The resulting 479 versus 391 contradictions give\+0\.341\+0\.341percentage points \(CI0\.1500\.150–0\.5420\.542\), with sign\-flipp=0\.000850p=0\.000850and two\-test Holm\-adjustedp=0\.001700p=0\.001700\. The source importance strata describe the original fact, not clinician\-assigned severity of an output error\.

If uncertain CAP labels are allowed to vary rather than assigned the strict indicator, the preservation difference has identification bounds\[−1\.738,0\.985\]\[\-1\.738,0\.985\]points and contradiction\[−1\.300,1\.424\]\[\-1\.300,1\.424\]points\. These bounds are not sampling intervals\. They show why the reported contradiction increase is a difference in explicit model labels, not a complete estimate of unknown clinical outcomes\.

### I\.3Retained identifiers in intended inputs

Saved planning evidence allows reconstruction of intended target text for the focused editor benchmark\. An original literal is still present in 12/28 F5\-TTS cases labeled retained and 12/21 VoiceCraft cases labeled retained\. This is not a corrected retention rate: every observed retained case remains in its original denominator\. Actual outgoing model requests were not saved, so intended text cannot establish runtime compliance or the cause of each retained identifier\.

For the public PriMock example in the main text, the source begins “your name\. Doris\. So Doris, what I think we need to do is, this sounds like you might have a chest infection\.” The reconstructed intended transcript changes only the first occurrence to “Nina\.” Both ASR transcripts of the F5\-TTS edited turn support “Nina” followed by “Doris\.” The two lexical labels are therefore realized replacement and retained original\. The example uses transcript evidence, not independent listening, and does not establish a clinical error from other ASR wording differences\.

The 601\-intention focused benchmark and the composed final\-conversation reconstruction are separate populations\. Saved final\-waveform receipts cover 545 planned regions per renderer: all 545 contain generated F5\-TTS turns, whereas VoiceCraft contains 529 generated turns and 16 retained converted regions after generation failure, across 14 conversations\. The focused VoiceCraft benchmark has one generation failure among its 601 intentions\. Neither failure count may be substituted for the other\.

## Appendix JAcoustic, Timing, and Documentation Preservation

CLAP similarity under bounded dynamic time warping \(DTW\) ranges from 0\.725 to 0\.732 and HeAR similarity from 0\.945 to 0\.946 across the four conditions\. These representation\-level measures probe preservation of broad audio and health\-acoustic structure but are not diagnostic accuracy or human perceptual judgments\. Detector\-defined event recall and precision are 0\.405 and 0\.240 for AegisVox \(F5\-TTS\), 0\.376 and 0\.218 for AegisVox \(VoiceCraft\), and 0\.407 and 0\.244 for the speaker\-path\-only control\. Speech\-activity changes range from approximately−0\.047\-0\.047to−0\.059\-0\.059, while speaking\-rate changes range from approximately\+5\.4\+5\.4to\+8\.6\+8\.6words per minute\.

The earlier note comparison supplies source facts to the note\-writing protocol and compares source\- and target\-grounded structured notes\. Section Jaccard ranges from 0\.944 to 0\.960 and exact\-structure agreement from approximately 0\.74 to 0\.79 across generators and conditions\. Comparisons are made within note generator because generator\-specific length and organization are not valid cross\-system effects\.

Figure 9:Acoustic representation, event, and timing preservation\. CLAP and HeAR are embedding similarities, events are detector\-defined, and timing is measured with the matched ASR protocol\.### J\.1Transcript\-only note generation

A separate control gives GPT\-5\.4 only the transcript for the current condition and a dataset\-prefixed record identifier\. It receives no source CAP inventory, replacement plan, other\-condition transcript, or renderer label\. Source facts are supplied only to the later note evaluator\. This tests documentation without directly conditioning generation on the answer inventory; it does not make GPT\-generated and GPT\-adjudicated notes independent clinical truth\.

Of 1,560 note jobs, 1,440 yield valid notes and 120 exhaust the allowed attempts\. Of 1,170 planned target\-note judgments, 999 are valid, 167 lack a valid note pair, and four are quarantined because of duplicate unsupported\- assertion evidence\. Missing jobs are not empty notes or zero preservation\. Table[10](https://arxiv.org/html/2610.14643#A10.T10)retains all scheduled conversations\.

Table 10:Transcript\-only note control\. Each note condition schedules 390 conversations\. Target judgments compare a valid transformed note with a valid source note\. V, Q, and B denote valid, quarantined, and blocked judgments; invalid and missing outcomes remain unobserved\.The common valid F5\-TTS/VoiceCraft subset has 314 conversations and 20,316 CAPs\. Strict preservation is 14,597/20,316 \(71\.85%\) versus 14,673/20,316 \(72\.22%\), a difference of−0\.374\-0\.374percentage points \(95% clustered CI−1\.302\-1\.302to0\.5580\.558\)\. Contradictions are 369/20,316 \(1\.82%\) versus 272/20,316 \(1\.34%\), a difference of\+0\.477\+0\.477points \(CI0\.2390\.239–0\.7220\.722\)\. Preservation is the primary observed\-subset contrast; contradiction is exploratory, without an adjusted significance claim\. Inference uses 10,000 conversation\-cluster bootstrap draws and 20,000 sign flips, seed 20261005\.

Selection remains unresolved\. Varying uncertain and unobserved outcomes gives full\-population difference bounds of\[−16\.30,17\.01\]\[\-16\.30,17\.01\]points for strict preservation and\[−17\.40,15\.91\]\[\-17\.40,15\.91\]for contradiction\. These are identification bounds, not CIs, and can reverse the observed direction\. Source\-inclusion judgments disagree on 307 matched CAPs\. A separate conditional comparison uses only the 19,401 CAPs judged included in both source\-note assessments; its strict\-preservation contrast is−0\.505\-0\.505points \(CI−1\.467\-1\.467to0\.4410\.441\)\. It is not based on two unequal condition\-specific denominators\.

No causal numerical comparison is made with the earlier fact\-conditioned note experiment: validated coverage and protocols differ\. The exact transcript\-only generation prompt and its evaluation prompt are included in Appendix[T](https://arxiv.org/html/2610.14643#A20)\.

## Appendix KAttacker\-Oriented Speaker Privacy

### K\.1Final\-waveform protocol

The final\-output test first verifies the 1,170 saved reconstructed WAVs \(390 recordings in each of three conditions\)\. Replaying the inserted generated or retained converted regions reproduces every WAV within two PCM16 quantization steps\. This verifies the file lineage, not semantic correctness\. The replay concatenates surrounding converted samples and the inserted turns; turn duration changes shift later timestamps\. It does not establish exact preservation of original timing or crossfades at lexical insertion boundaries\.

The attacker uses SpeechBrain ECAPA\-TDNN at revision0f99f2d0ebe89ac095bcc5903c4dd8f72b367286\. Enrollment comes from assigned original speech in the same recording, not an independent session or the retrieved pseudo\-speaker reference\. Speech intervals use saved pipeline assignments, not independently verified speaker labels\. Sampling takes at most ten equispaced three\-second windows over the time\-ordered assigned intervals, with 50\-ms edge trimming and at least one second of usable speech\. Each window embedding is unit normalized; the mean is normalized again to form one profile\.

The primary all\-turn analysis has 809 conversation\-speaker profiles, 809 same\-profile positives, and 916 other\-speaker negatives within the same conversation\. A person may recur across conversations, so cross\-recording pairs are not assumed to be independent known identities\. Both score directions are reported in Table[11](https://arxiv.org/html/2610.14643#A11.T11)\. The smaller EER selects direction on evaluation labels and is a sensitivity result, not a calibrated or trained adaptive attacker\. Intervals use 2,000 conversation\-cluster draws\.

Table 11:Final\-waveform ECAPA scores on all\-turn samples: 809 positive and 916 within\-conversation negative trials per condition\. Lower\-direction EER is selected using evaluation labels\. The interval describes resampled conversations, not uncertainty about unseen attacker strategies\.The paired all\-turn effect is\+0\.218\+0\.218percentage points \(CI−1\.010\-1\.010to0\.9880\.988\)\. The planned\-edit\-region analysis has 297 eligible VoiceCraft profiles in 207 conversations and 291 F5\-TTS profiles in 204 conversations\. There are 512 profiles per condition without an edit interval \(not applicable\) and six additional F5\-TTS profiles with less than one second of eligible speech \(unknown\)\. The matched 291\-profile contrast is−11\.340\-11\.340points \(CI−15\.910\-15\.910to−6\.688\-6\.688\)\. Planned\-edit regions include retained converted audio after generation failure; they are not restricted to successful synthesis\. The unmatched group EERs, 0\.4389 and 0\.3230, must not be subtracted to obtain the paired effect\.

### K\.2Historical shared\-stage protocol

The following separate test measures the common SeedVC stage\. It uses different sampling and cross\-recording negatives, and is not a trajectory that can be subtracted from the final\-waveform estimates above\. Its two backends establish sensitivity to the verification representation, not final\-output performance of both lexical renderers\.

The attacker enrolls one profile from each of the 809 original conversation\-speaker profiles\. For source speakerss, transformed audio derived fromssis the positive test; transformed audio derived from each of the other 808 source speakers forms the impostor set\. This produces 809 positive and809×808=653,672809\\times 808=653\{,\}672negative trials per backend and condition\. The attacker does not enroll on the retrieved pseudo\-speaker reference\. It has access to original source\-speaker audio and to the transformed release, which is the relevant original\-to\-release linkage question\.

ECAPA and x\-vector use the same trial identities but independent embeddings\. Because score conventions differ by backend, the informed attacker may select the orientation that best links the source\. Under this attacker\-optimal orientation, ECAPA EER is 0\.304 \(95% source\-bootstrap CI 0\.289–0\.324\) and x\-vector EER is 0\.345 \(0\.331–0\.361\)\. The ECAPA orientation is lower\-score\-indicates\-same\-source; x\-vector is higher\-score\-indicates\-same\-source\. These estimates belong only to the shared SeedVC stage\. They are not the final\-waveform scores for either renderer\.

Table 12:Historical shared\-stage speaker\-verification protocol and results\. Higher EER means harder source linkage only under the declared enrollment, trials, and attack backend\.These results show residual source linkability rather than anonymous speech\. They do not model enrollment on external pseudo\-speaker material, arbitrary metadata, repeated releases, stronger future attacks, or human recognition\.

Figure 10:Historical shared\-SeedVC\-stage verification under two embedding backends, not final\-renderer scores\. Bars are 95% source\-bootstrap intervals\.

## Appendix LLanguage and Population Strata

The action\-safe endpoint is met in 319/329 English conversations \(97\.0%\) and 48/61 French conversations \(78\.7%\)\. The chronology\-safe endpoint is met in 186/329 English conversations \(56\.5%\) and 16/61 French conversations \(26\.2%\)\. The strict conversation\-level CAP no\-major\-error endpoint is much more severe than proposition\-level preservation because one major error causes the entire conversation to fail\. It is 5/329 for English and 2/61 for French\. These language\-associated differences are not causal language effects because the French recordings are a smaller SIMSAMU emergency\-call set and differ in setting, role structure, duration, and content\.

Figure 11:Language\-stratified clinical outcomes with exact denominators and 95% intervals\. Dataset and interaction setting are confounded with language\.
## Appendix MFrontend Propagation

The full matrix contains eight ASR\-by\-diarization cells and 3,120 recording\-cell evaluations\. Every cell processes the same 390 conversations\. ASR varies among Canary\-1B\-v2 and Whisper small, turbo, and large\-v3; diarization varies between NeMo Sortformer and pyannote 3\.1\. CAP ranges from 0\.771 to 0\.807, action recall from 0\.859 to 0\.884, and cell\-specific frontend\-ASR matched WER from 0\.217 to 0\.239\. This is not the English\-only MedASR sensitivity WER; the recognizer and population differ, so the absolute values are not comparable\. The endpoints move differently across cells, demonstrating that the frontend is part of the evaluated system rather than interchangeable preprocessing\.

The Canary lexical cells expose a different failure than transcription error\. Every planned Canary edit lacked a linked speaker turn and edit timing \(481/481 with NeMo and 596/596 with pyannote\), so complete\-turn lexical editing could not be localized\. The intention\-to\-transform analysis retained these upstream failures and used only global final\-audio ASR evidence\. Consequently, replacement realization was observed for just 2/481 items \(0\.42%\) with NeMo and 3/596 \(0\.50%\) with pyannote, compared with 0\.835–0\.869 for the Whisper cells\. The similar collapse under both diarizers, despite Canary’s competitive matched WER, localizes the problem to the Canary\-to\-editor turn/timing contract rather than to F5\-TTS or to either diarization backend\. These values therefore measure end\-to\-end frontend integration failure, not the intrinsic editing quality of Canary or F5\-TTS, and they were retained rather than treated as missing observations\.

![Refer to caption](https://arxiv.org/html/2610.14643v1/fig12_frontend_matrix.png)Figure 12:Propagation of ASR and diarization choices into matched content, clinical, action, and lexical measurements\. Canary lexical cells retain upstream turn/timing\-linkage failures in their intention\-to\-transform denominators\. W denotes Whisper; PyA denotes pyannote\.
## Appendix NAcoustic and Semantic Robustness

Acoustic stress contributes 1,170 intention\-to\-transform rows, of which 1,169 are renderable and one is an explicit failure\. Four semantic stress families contribute 1,560/1,560 renderable rows\. The estimand is the paired change in conversation\-level chronology safety relative to the unperturbed AegisVox \(F5\-TTS\) instantiation\.

Room noise at a 12\-dB signal\-to\-noise ratio \(SNR\) has the largest effect,−0\.121\-0\.121\(95% CI−0\.175\-0\.175to−0\.064\-0\.064; Holm\-adjustedp=0\.0006p=0\.0006\)\. Telephony is−0\.031\-0\.031with an interval crossing zero\. Microphone or bandpass degradation is−0\.056\-0\.056, but does not remain significant after multiplicity adjustment\. The four semantic\-stress effects range from−0\.008\-0\.008to−0\.031\-0\.031and are compatible with no change after adjustment\. The clearest measured vulnerability is therefore ordinary acoustic degradation propagating through the frontend\. For each acoustic condition, the degradation was applied to the source waveform before rerunning the unchanged full pipeline, including ASR and diarization; it was not applied after transcription\.

Figure 13:Paired chronology effects under acoustic and semantic stresses\. Intervals are 95% confidence intervals; multiplicity is controlled within the prespecified robustness family\.
## Appendix OLimited Blinded Listener Panel

Five reviewers completed a limited blinded panel containing 25 clinical and 25 perceptual items, giving 125 ratings per panel\. The incomplete\-block design allocates different numbers of items to each condition, so the estimates are descriptive and are not used for formal system superiority\. Clinical ratings cover meaning, completeness, chronology, role, and replacement quality\. Perceptual ratings cover naturalness, intelligibility, completeness, speaker consistency, accent, and edit integration\. Reviewers use a five\-point scale and may select insufficient evidence\.

Mean condition ratings are high across the observed sample\. For AegisVox \(F5\-TTS\), the item\-level means are 4\.43 for meaning, 4\.89 for clinical completeness, 4\.40 for replacement quality, 4\.45 for naturalness, 4\.90 for intelligibility, and 4\.95 for edit integration\. Because AegisVox \(F5\-TTS\) contributes seven clinical and four perceptual items, these measurements are a limited qualitative check rather than a population\-wide estimate\.

Agreement varies by endpoint\. The intraclass correlation coefficient ICC\(2,1\) ranges from negative for chronology to 0\.68 for intelligibility, while ICC\(2,k\) is higher for most endpoints because it describes the mean of five ratings\. This variation reinforces the decision not to promote the panel to a powered comparison or a human speaker\-linkability claim\.

## Appendix PPrimary Effects and Privacy–Utility Projections

The item\-weighted realization effect is\+13\.644\+13\.644percentage points \(95% conversation\-cluster CI9\.6879\.687–17\.59017\.590\), and the strict CAP effect is−0\.097\-0\.097points \(CI−0\.606\-0\.606to0\.4220\.422\)\. Under equal\-conversation weighting, the strict CAP contrast is−0\.088\-0\.088points \(CI−0\.797\-0\.797to0\.5930\.593\)\. The distinction matters because long conversations contribute more CAPs to the item\-weighted estimate\. Neither interval establishes equivalence\. Realization intervals here use conversations as clusters, not independent edit resampling\. Speaker EER, lexical retention, and clinical outcomes are not collapsed into one significance test\.

Figure[14](https://arxiv.org/html/2610.14643#A16.F14)places three distinct privacy measurements beside item\-weighted CAP preservation\. Lexical realization and original retention concern 601 intentions in 208 conversations; final\-waveform linkage concerns 809 profiles in all 390 conversations\. Clinical preservation uses 25,778 CAPs in all 390 conversations\. These are endpoint\-level projections, not a joint sample\-level utility function or proof of Pareto dominance\.

The original\-retention axis counts explicit present labels, not their complement as verified absence\. Explicit absence is 487/601 \(81\.03%\) for VoiceCraft and 533/601 \(88\.69%\) for F5\-TTS; uncertain labels are 92 and 40, with one additional VoiceCraft failure\. Thus, “one minus retained” would incorrectly include unknown outcomes as absence\. Speaker points use the new final\-waveform ECAPA protocol; historical common\-stage ECAPA or x\-vector values are not assigned to renderer outputs\.

Figure 14:Distinct privacy endpoints versus strict CAP preservation\. Points are descriptive condition estimates under different endpoint populations, not a joint confidence region or a dominance test\. Left and center: generated\- turn lexical judgments, with uncertainty retained in their denominators\. Right: final\-waveform all\-turn ECAPA EER under evaluation\-label\-selected score direction\. No final\-waveform x\-vector estimate is implied\.
## Appendix QFailure Taxonomy

Failures are assigned to the earliest measured stage that exposes them, while their original statistical unit is retained\. At detection, the contract\-primary ASQ\-PHI analysis contains 104 false\-negative and 137 false\-positive elements; 48/219 hard\-negative queries contain at least one prediction\. At rendering, replacement is not credited as realized in 148/601 VoiceCraft\-rendered edits \(24\.6%\) and 66/601 F5\-TTS\-rendered edits \(11\.0%\)\. These totals include uncertain labels and one VoiceCraft failure, not only confirmed absence\. Original sensitive terms remain in 21/601 \(3\.5%\) and 28/601 \(4\.7%\), respectively\. Uncertain evidence remains visible for 110/601 VoiceCraft\-rendered and 46/601 F5\-TTS\-rendered edits\.

At the clinical\-evidence stage, AegisVox \(F5\-TTS\) has 2,367 partial, 2,724 missing, 479 contradicted, and 279 uncertain proposition judgments among 25,778 CAPs\. Conversation\- or evidence\-level families additionally include harmful action change near 0\.6–0\.7%, chronology not preserved near 14\.9–16\.0%, and role not preserved near 12\.5–13\.7%\. Frontend integration creates a distinct failure mode: Canary’s missing turn/timing linkage prevents localization even when its global transcript is usable\. Room noise creates another by degrading upstream evidence before editing\. These heterogeneous quantities identify different intervention targets and must not be summed into a global failure rate\.

Figure 15:Outcome\-linked failure taxonomy\. Rates with different statistical units are shown separately and must not be summed into a composite failure score\.
## Appendix ROperational Lessons

##### Persistent and restartable stages\.

Long\-form batches benefit from resident model processes, bounded work queues, idempotent stage contracts, immutable recording identifiers, and durable status artifacts\. Finalization verifies the expected population, waveform duration, hashes, and explicit failure registry\. These controls prevent restart events from silently changing the evaluated denominator\.

##### Complete\-turn editing\.

Short isolated windows often provide insufficient linguistic and speaker context\. Complete converted turns supply the editor with the source waveform, complete source text, and complete replacement\-bearing target text\. This unit also permits the generated output waveform to be bound directly to reconstruction and evaluated independently of later policy decisions\.

##### Document and language consistency\.

Replacement planning uses the complete transcript and source language\. One synthetic mapping is reused across repeated references\. This is intended to avoid the inconsistent aliases and cross\-language replacements that independent turn\-level planning can introduce\.

##### Local reconstruction and visible failures\.

Reconstruction retains the surrounding converted samples and speaker order while allowing inserted\-turn durations to change\. Fallback behavior may be evaluated as a separate operational condition, but it cannot silently improve a primary renderer\. Explicit failures and uncertain judgments remain in the declared analysis population\.

## Appendix SReproducibility

The artifact package records exact dataset rows and strata, model and software revisions, condition manifests, per\-stage outputs, prompt snapshots, inference settings, and cryptographic hashes\. Large model caches and waveforms are kept separate from the compact evidence layer\. Public release remains subject to dataset licenses and redistribution restrictions\. The analysis environment uses Python 3\.10\.6, NumPy 2\.2\.6, pandas 2\.3\.3, Matplotlib 3\.10\.9, and Seaborn 0\.13\.2\.

## Appendix TExact Prompts and Structured Outputs

Each protocol uses the complete transcript or transcripts specified by its input contract, rather than a fixed character prefix\. Temperature is zero where exposed\. Outputs follow strict JSON schemas, and schema repair may correct formatting or literal evidence references but may not rewrite accepted clinical semantics\. Invalid or unresolved outputs fail closed and remain visible\.

##### PHI detection and replacement planning\.

The planner receives the complete speaker\-attributed transcript\. Its system contract restricts detection to declared identifying\-information families, requires evidence\-linked spans, reuses one synthetic mapping for repeated entities, matches the source language, and prohibits changes to clinical facts, modifiers, roles, chronology, actions, or decisions\. It returns an entity inventory and an ordered edit plan with original and replacement surfaces\.

##### Clinical atomic propositions\.

Source extraction returns evidence\-linked propositions with polarity, temporality, verification, role, modifiers, action linkage, and importance\. Target adjudication receives the complete source transcript, source propositions, and complete transformed transcript\. It returns one status per source proposition plus unsupported target assertions and literal evidence\.

##### Chronology and actions\.

Chronology adjudication represents temporal relations, revisions, and final state explicitly\. Action adjudication represents actor, action, state, timing, and plan\. Both compare a source\-derived inventory against the complete target transcript and report unsupported additions separately from omissions or role changes\.

##### Lexical realization\.

For each planned edit, the judge receives aligned source and generated\-turn ASR evidence, local timestamp context, and global lexical candidates\. It reports source presence, replacement status, original\-term retention, uncertainty, confidence, and literal evidence\. Minor orthographic variants may match when the acoustic and textual evidence supports the same intended entity; uncertain cases are not forced to pass\.

##### Clinical notes and robustness\.

Source and target notes are conservatively generated from their respective transcripts with source\-proposition linkage\. Pair adjudication compares note structure, supported content, chronology, and final state\. Robustness prompts generate source\-language administrative stressors at complete\-turn boundaries and reject plans that alter clinical content, speaker role, or conversational coherence\. The executable prompts follow\.

### T\.1Verbatim executable prompts

The following blocks reproduce the actual system prompts, user templates, and structured\-output instructions used by the reported endpoints\. Braced fields are runtime substitutions\. Long transcripts, CAP inventories, and evidence registries replace those fields without truncation\. Prompt text is reproduced verbatim; only credentials, service endpoints, reviewer codes, and conversation instances are omitted\.

#### T\.1\.1PHI detection and relexicalization

Model:GPT\-5\.4\.Decoding:Structured output; deterministic sampling/default service behavior\.Snapshot:cee71cd59c1b\.\.\.; full SHA\-256 in the registry\.

YouarethePHIdetectorforaclinicalaudiode\-identificationsystem\.ReturnJSONonly\.DetectONLYHIPAASafeHarboridentifiersandchoosephi\_typeonlyfromtheprovidedenum\.DonotusebroadgenericlabelssuchasNAME,LOCATION,DATE,ORG,ORGANIZATION,RELATIONSHIP,orPII\.Neverinventphi\_typevaluesoutsidetheenum;specifically,donotoutputHIPAA\_ORGANIZATIONorHIPAA\_RELATIONSHIP\.Ifanorganization/facilityspanisidentifyingonlybecauseitisageographicsubdivision,useHIPAA\_GEOGRAPHIC\_SUBDIVISION;otherwiseomitit\.Ifarelative/relationshipwordisnotattachedtoaspecificpersonname,omitit;ifitincludesaspecificpersonname,useHIPAA\_NAMEforthenamespanonly\.DonotmarkordinarywordsorfillerphrasesasPHI\.DonotmarkamonthwordbyitselfasHIPAA\_GEOGRAPHIC\_SUBDIVISION\.Donotmarktitlesorhonorificsalone,suchasMadame,Monsieur,Doctor,Dr\.,nurse,patient,caller,orchef,asHIPAA\_NAMEunlesstheyareattachedtoaspecificpersonname\.Amonth/dateisHIPAA\_DATEonlywhenitisanactualdateelementdirectlyrelatedtoanindividualorcareevent\.Ifuncertain,omitthespanratherthanguessing\.Foreveryedit,original\_textmustbeanexactsubstringofthereferencedsegmenttext\.Returnnoreplacementtext;thisstepisdetectiononly\.IfnoPHIispresent,returnexactly\{"edits":\[\]\}\.

\{"hipaa\_phi\_types":<allowedenum\>,"segments":\[\{"segment\_index":<int\>,"speaker\_id":<id\>,"start\_sec":<float\>,"end\_sec":<float\>,"text":<completesegmenttext\>\}\]\}

Youareaclinicalaudiode\-identificationrelexicalizer\.ReturnJSONonly\.ReturnexactlyoneJSONobjectwithtop\-levelkeyreplacements;donotuseentity\_replacementsoranyothertop\-levelkey\.Foreachprovidedentity,chooseasyntheticreplacementthatisnon\-identifying,speakablealoud,naturalinaclinicalconversation,andpreservestheHIPAAPHItype\.Maintainconsistency:eachentity\_idgetsexactlyonereplacement,andallmentionsofthesameoriginalentitywilluseit\.Donotreusetheoriginaltext\.Preservelanguage:choosereplacementsinthesamelanguageastheentity’ssource\_languageandsurroundingtranscript\.DonottranslatetheutterancetoEnglish\.ForFrenchorothernon\-Englishtranscripts,names,dates,geographicterms,andfiller\-stylephrasingmustbenaturalinthatlanguage/locale\.ForHIPAA\_DATEentities,chooseadifferentsyntheticdate/timeexpressionwiththesameconversationalrole;nevercopytheoriginalmonth,day,year,orfullphrase\.ForHIPAA\_NAMEentities,chooseadifferentplausiblename;nevercopyanyoriginalnametoken\.ForHIPAA\_EMAIL,donotoutputanaddresswith@unlessitendsin\.invalid;preferaspeakablenon\-contactablephrasesuchas"theemailaddressonfile"\.ForHIPAA\_PHONEorHIPAA\_FAX,donotoutputreal\-lookingdigits;prefer"thephonenumberonfile"or"thefaxnumberonfile"\.Forhigh\-riskidentifierssuchasphone,email,SSN,medicalrecord,healthplan,account,license,vehicle,device,URL,IP,biometric,image,andotheruniqueidentifiers,preferpolicyplaceholdersifpolicymodeishybrid;inrelexicalizemodeusespeakablenon\-contactablephrases,notsyntheticcredentials\.

\{"policy\_mode":<mode\>,"document\_language":<language\>,"language\_aware\_relexicalization":<bool\>,"entities":<completeentityinventory\>,"full\_transcript":<completetranscript\>\}

#### T\.1\.2Source clinical atomic\-proposition extraction

Model:GPT\-5\.4\.Decoding:temperature=0\.0; max tokens supplied by frozen run\.Snapshot:7e6370d1c18a\.\.\.; full SHA\-256 in the registry\.

Youextractclinicalatomicpropositions\(CAPs\)fromacompletesourceclinicalconversation\.

Extractsourcefactsonly\.EveryCAPmustbeatomic,clinicallymaterial,and

supportedbyoneexactcontiguoussourcequote\.Preservenegation,uncertainty,

temporality,verificationstate,speaker/role,severity/value,actiontype,and

thefinalstateaftercorrections\.Atomizeconjunctionswhenpartscouldfail

independently\.NamesanddirectidentifiersarenotclinicalCAPsunlesstheir

relationshiporreplacementchangesclinicalmeaning\.Donotinferdiagnoses,

roles,oractionsnotstatedinthetranscript\.ReturnstrictJSONonly\.

Evidencemustbeliteralanddiscriminative:neveruseanisolatedgeneric

answersuchas"yes","no","okay",orarepeatedone\-wordfragment\.Fora

shortanswer,quoteenoughcontiguousquestion\-and\-answercontexttouniquely

locatetheevidenceinthecompletetranscript\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

COMPLETESOURCETRANSCRIPT:

\{transcript\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"language":"en\|fr\|mixed\|unknown",

"caps":\[

\{\{

"cap\_id":"C1",

"category":"symptom\|diagnosis\|medication\|allergy\|test\|procedure\|measurement\|history\|plan\|other",

"canonical\_fact":"oneatomicsourcefact",

"source\_quote":"exactcontiguoustranscriptquote",

"source\_speaker":"speakerlabelorunknown",

"source\_role":"patient\|clinician\|dispatcher\|caller\|caregiver\|third\_party\|unknown",

"polarity":"affirmed\|negated\|uncertain\|conditional",

"temporality":"past\|current\|future\|duration\|trend\|unknown",

"verification":"reported\|observed\|assessed\|planned\|ruled\_out",

"severity\_or\_value":"verbatimvalue/modifierorempty",

"action\_type":"none\|test\|medication\|procedure\|followup\|escalation",

"clinical\_importance":"critical\|major\|minor"

\}\}

\]

\}\}

defbuild\_prompt\(pair:dict\[str,Any\]\)\-\>list\[dict\[str,str\]\]:

return\[

\{"role":"system","content":SYSTEM\_PROMPT\},

\{"role":"user","content":USER\_TEMPLATE\.format\(

audio\_id=pair\["audio\_id"\],dataset\_id=pair\.get\("source\_dataset\_id"\)or"unknown",

language=pair\.get\("source\_language"\)or"unknown",transcript=pair\["reference"\],

\)\},

\]

#### T\.1\.3Target clinical atomic\-proposition adjudication

Model:GPT\-5\.4\.Decoding:temperature=0\.0; max tokens supplied by frozen run\.Snapshot:e8fb6659927a\.\.\.; full SHA\-256 in the registry\.

Youareaconservativeclinicalsource\-to\-targetintegrityadjudicator\.

Thesourceclinicalatomicpropositions\(CAPs\)werefrozenbeforeyousawthe

target\.ForeveryCAP,comparethecompletesourceandtargettranscriptsand

judgepreservationwithoutinventingmedicalfacts\.Preserveexactmodifiers:

negation,uncertainty,temporality,dose/value,severity,verificationstate,

actiontype,finalcorrectedstate,andspeakerrole\.Asafesyntheticidentity

replacementisnotaclinicalerrorunlessitchangesmeaning,chronology,or

role\.Detectmaterialunsupportedtargetassertionsseparately\.Everyevidence

quotemustbealiteralcontiguoustarget\-transcriptsubstring\.Returnstrict

JSONonly\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCECAPS:

\{caps\}

COMPLETESOURCETRANSCRIPT:

\{source\}

COMPLETETARGETTRANSCRIPT\(samefrozenevaluatorASR\):

\{target\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"adjudications":\[

\{\{

"cap\_id":"C1",

"status":"preserved\|partially\_preserved\|missing\|contradicted\|uncertain",

"target\_quote":"exacttargetquoteoremptyonlyformissing/uncertain",

"role\_status":"preserved\|changed\|uncertain\|not\_applicable",

"target\_role":"patient\|clinician\|dispatcher\|caller\|caregiver\|third\_party\|unknown",

"modifier\_errors":\["negation\|temporality\|dose\_value\|severity\|verification\|action\_type\|final\_state"\],

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefevidence\-groundedreason"

\}\}

\],

"unsupported\_target\_assertions":\[

\{\{

"assertion":"onematerialunsupportedtargetfact",

"target\_quote":"exacttargetquote",

"clinical\_impact":"minor\|major\|potentially\_harmful\|uncertain",

"source\_search\_rationale":"whynosourceCAP/transcriptevidencesupportsit"

\}\}

\],

"conversation\_assessment":"no\_major\_error\|major\_omission\|major\_contradiction\|major\_unsupported\_addition\|uncertain"

\}\}

Emitexactlyoneadjudicationforeverysuppliedcap\_idandnoothers\.

#### T\.1\.4Item\-level lexical realization adjudication

Model:GPT\-5\.4\.Decoding:temperature=0\.0; batches of 10; max\_tokens=12000\.Snapshot:87d2a75447cc\.\.\.; full SHA\-256 in the registry\.

Youareanexactingresearchco\-authoradjudicatinglocalizedspeechrelexicalizationfromtranscriptevidence\.

Youmustjudgeeveryitemindependently\.Thedeterministiclegacymatcherisknowntohavemultilingual,date\-normalization,timeline,andfuzzy\-collisionerrors;neveruseitsstatusastheanswer\.

InterpretreasonableASRvariantssemantically,includingspokendates,ordinals,numbers,abbreviations,accents,andsmallnamespellingerrors\.Preferalignedandtimestamp\-localcontextoverglobalcandidates\.Donotacceptunrelatedwhole\-conversationfuzzymatches\.AliteralbracketedHIPAAplaceholderisnotanaturalreplacement\.LackofASRevidenceisnotalwaysproofofinaudibility,souseuncertainwhentheevidenceisgenuinelyambiguous\.

ReturnstrictJSONonlywithonejudgmentforeveryinputitem,ininputorder\.Useonlytheenumeratedvaluesetforeachfield:neverplaceareplacement\-statusvalueinfinal\_original\_statusoranyotherfield\.Repeattheadjudication\_idexactly\.Thesearetranscript\-evidenceadjudications,notaudio\-listenerjudgments\.

\{

"source\_entity\_status":\[

"absent",

"present",

"uncertain"

\],

"final\_original\_status":\[

"absent",

"not\_applicable",

"present",

"uncertain"

\],

"replacement\_status":\[

"acceptable\_variant",

"not\_applicable",

"not\_realized",

"realized",

"uncertain"

\],

"overall\_outcome":\[

"indeterminate\_asr",

"invalid\_replacement\_placeholder",

"invalid\_source\_edit",

"mixed\_original\_and\_replacement",

"removal\_only",

"residual\_original\_only",

"successful\_relexicalization"

\],

"confidence":\[

"high",

"low",

"medium"

\]

\}

defprompt\(items:list\[dict\]\)\-\>list\[dict\[str,str\]\]:

compact=\[\]

keep=\[

"adjudication\_id","dataset","language","phi\_type","start\_sec","end\_sec",

"original\_text","replacement\_text","planning\_asr\_aligned\_context",

"original\_input\_asr\_best\_context","original\_input\_asr\_best\_candidate",

"original\_input\_asr\_best\_score",

"final\_aligned\_context","final\_timestamp\_local\_context",

"replacement\_best\_global\_context","replacement\_best\_global\_candidate",

"replacement\_best\_global\_score","original\_best\_final\_context",

"original\_best\_final\_candidate","original\_best\_final\_score",

\]

foriteminitems:

compact\.append\(\{k:item\.get\(k\)forkinkeep\}\)

user=\{

"label\_contract":\{

"source\_entity\_status":sorted\(ENUMS\["source\_entity\_status"\]\),

"final\_original\_status":sorted\(ENUMS\["final\_original\_status"\]\),

"replacement\_status":sorted\(ENUMS\["replacement\_status"\]\),

"overall\_outcome":sorted\(ENUMS\["overall\_outcome"\]\),

"confidence":sorted\(ENUMS\["confidence"\]\),

"observed\_final\_phrase":"verbatimfinal\-ASRevidenceornull",

"observed\_source\_phrase":"verbatimplanning\-ASRevidenceornull",

"reason":"conciseitem\-specificrationale",

\},

"required\_top\_level":\{"judgments":"array"\},

"items":compact,

\}

return\[

\{"role":"system","content":SYSTEM\},

\{"role":"user","content":json\.dumps\(user,ensure\_ascii=False\)\},

\]

#### T\.1\.5Source clinical\-action extraction

Model:GPT\-5\.4\.Decoding:temperature=0\.0\.Snapshot:7f69914e459a\.\.\.; full SHA\-256 in the registry\.

Youareaconservativesource\-onlyclinicalactionextractor\.

Readthecompletesourceconversationandextractonlyexplicitlysupported

clinicalactionsordecisions:testsordered/considered,medicationsstarted,

stopped,continuedorchanged,procedures/referrals,follow\-upintervals,

returnprecautions/escalationtriggers,andexplicitassessment/differential

statements\.Includeconditionalanddeclinedactions\.Donotconvertmedication

history,priorprocedures,symptoms,orworldknowledgeintoacurrentaction\.

Everyactionneedsoneuniqueexactcontiguoussourcequote\.ReturnstrictJSON\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

COMPLETESOURCETRANSCRIPT:

\{source\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"actions":\[

\{\{

"action\_id":"A1",

"action\_kind":"test\|medication\|procedure\|referral\|followup\|return\_precaution\|escalation\|assessment",

"action\_state":"ordered\|considered\|recommended\|started\|stopped\|continued\|changed\|completed\|conditional\|declined\|reported\_existing",

"action\_text":"oneatomicsource\-supportedactionordecision",

"source\_quote":"uniqueexactcontiguoussourcequote",

"actor\_role":"patient\|clinician\|dispatcher\|caller\|caregiver\|third\_party\|unknown",

"target\_role":"patient\|clinician\|caller\|caregiver\|third\_party\|not\_applicable\|unknown",

"clinical\_importance":"critical\|major\|minor"

\}\}

\]

\}\}

Anemptylistisallowedonlywhenthesourcecontainsnoexplicitactionor

decision\.Atomizeindependentactionsandpreserveconditionalityandfinal

start/stop/continuestate\.

#### T\.1\.6Target clinical\-action adjudication

Model:GPT\-5\.4\.Decoding:temperature=0\.0\.Snapshot:53ecf0e5ef45\.\.\.; full SHA\-256 in the registry\.

Youareaconservativesource\-anchoredclinicalactionadjudicator\.

Thesourceactioninventorywasfrozenbeforetargetinspection\.Compareonly

thesuppliedcompletesourceandtargettranscripts\.Judgewhethereachaction,

state,actor/targetrole,condition,timingandfinaldecisionispreserved\.

Identifyclinicallymeaningfulunsupportedtargetactions\.Donotrecommendthe

medicallycorrectactionfromworldknowledge\.Everynon\-emptytargetquoteand

unsupported\-actionquotemustbeanexactcontiguoustargetsubstring\.Return

strictJSONonly\.Safeidentifierreplacementisnotanactionerror\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCEACTIONS:

\{actions\}

COMPLETESOURCETRANSCRIPT:

\{source\}

COMPLETETARGETTRANSCRIPT\(sameevaluatorASR\):

\{target\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"adjudications":\[

\{\{

"action\_id":"A1",

"status":"preserved\|partially\_preserved\|missing\|contradicted\|uncertain",

"target\_quote":"exacttargetquoteorempty",

"state\_status":"preserved\|changed\|missing\|uncertain",

"role\_status":"preserved\|changed\|not\_applicable\|uncertain",

"unsafe\_change":"none\|wrong\_action\|wrong\_medication\_or\_dose\|wrong\_timing\_or\_followup\|missed\_return\_precaution\|reversed\_start\_stop\_continue\|other\|uncertain",

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefsource\-targetrationale"

\}\}

\],

"unsupported\_target\_actions":\[

\{\{

"target\_quote":"exacttargetquote",

"action\_text":"unsupportedtargetaction",

"clinical\_impact":"minor\|major\|potentially\_harmful",

"rationale":"whynotsupportedbysource"

\}\}

\],

"conversation\_plan\_assessment":"invariant\|minor\_change\|major\_change\|potentially\_harmful\_change\|insufficient\_evidence\|not\_applicable"

\}\}

Emitexactlyoneadjudicationpersuppliedaction\_idandnoothers\.

#### T\.1\.7Chronology adjudication

Model:GPT\-5\.4\.Decoding:temperature=0\.0; max\_tokens=20000\.Snapshot:02065adc04b9\.\.\.; full SHA\-256 in the registry\.

Youareaconservativesource\-anchoredclinicalchronologyadjudicator\.

Thechronologyrelationswerefrozenfromthecompletesourcebeforeyousaw

thetarget\.Judgeeachsuppliedrelationusingthecompletesourceandtarget\.

Preserveeventorder,past/current/futurestate,duration/trend,conditions,

planned\-versus\-completedstatus,andthefinalstateafteracorrection\.Asafe

identityreplacementisnotachronologyerror\.Everynon\-emptytargetquote

mustbecopiedliterallyandcontiguouslyfromthetargettranscript\.Return

strictJSONonlyanddonotinventmissingevidence\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCECHRONOLOGYRELATIONS:

\{relations\}

COMPLETESOURCETRANSCRIPT:

\{source\}

COMPLETETARGETTRANSCRIPT\(sameevaluatorASR\):

\{target\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"adjudications":\[

\{\{

"relation\_id":"R1",

"status":"preserved\|changed\|missing\|uncertain",

"target\_event\_a\_quote":"literaltargetquoteorempty",

"target\_event\_b\_quote":"literaltargetquoteorempty",

"relation\_error":"none\|event\_order\|past\_current\_future\|duration\_or\_trend\|planned\_vs\_completed\|conditionality\|revision\_or\_correction\|other\|uncertain",

"final\_state\_status":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefevidence\-groundedreason"

\}\}

\],

"conversation\_assessment":"chronology\_preserved\|meaningful\_chronology\_error\|insufficient\_evidence\|not\_applicable"

\}\}

Emitexactlyoneadjudicationforeverysuppliedrelation\_idandnoothers\.

#### T\.1\.8Clinical\-note generation

Model:GPT\-5\.4 and qualified MedGemma sensitivity panel\.Decoding:temperature=0\.0; max\_tokens=12000\.Snapshot:7623b1bdbfc1\.\.\.; full SHA\-256 in the registry\.

Youareaconservativeclinicaldocumentationmodel\.

Convertthecompletesuppliedclinicalconversationintoaconcisestructured

note\.Thesource\-derivedclinicalatomicpropositions\(CAPs\)werefrozenbefore

thisnotewasgeneratedandaretheonlyallowedclinicalcontentinventory\.

IncludeaCAPonlywhenthesuppliedtranscriptitselfsupportsit\.Preserve

negation,uncertainty,temporality,speakerroles,medication/allergydetails,

andthefinalstateaftercorrections\.Neverinfermissingdiagnoses,exams,

tests,treatments,orrecommendationsfromworldknowledge\.Everynoteitem

mustciteoneormorefrozenCAPIDs\.Fortranscript\_quote,copythecomplete

source\_quotefieldofthefirstsupportingCAPbyte\-for\-byte;neverparaphrase,

normalizepunctuation,orconstructanewquote\.ReturnstrictJSONonlyin

thetranscript’slanguage\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCE\-DERIVEDCAPS:

\{caps\}

COMPLETETRANSCRIPT:

\{transcript\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"note":\{\{

"chief\_concern":\[\{\{"text":"conciseitem","supporting\_cap\_ids":\["C1"\],"transcript\_quote":"exactquote"\}\}\],

"history\_of\_present\_illness":\[\],

"medications":\[\],

"allergies":\[\],

"pertinent\_history\_and\_review\_of\_systems":\[\],

"assessment\_and\_problem\_list":\[\],

"plan\_and\_follow\_up":\[\]

\}\}

\}\}

Everysectionisalistofzeroormoreobjectswithexactlytext,

supporting\_cap\_ids,andtranscript\_quote\.Emptysectionsareallowed\.

Thetranscript\_quotemustbethebyte\-for\-bytesource\_quoteofthefirstlisted

supportingCAP\.Therunnercanonicallygroundsthisevidencepointerbackto

thatfrozensource\_quote;thisdoesnotalterthegeneratedclinicaltext\.

Youareaconservativeclinicaldocumentationmodel\.

Convertthecompletetransformedclinicalconversationintoaconcise

structurednote\.Thesource\-derivedclinicalatomicpropositions\(CAPs\)arean

allow\-listofclinicalcontent,notevidencethateverypropositionsurvived

thetransformation\.IncludeaCAPonlywhenthesuppliedtransformed

transcriptitselfsupportsit\.Preservenegation,uncertainty,temporality,

speakerroles,medication/allergydetails,andthefinalstateafter

corrections\.NeverinfermissingcontentfromthesourceCAPinventoryorworld

knowledge\.EverynoteitemmustciteoneormorefrozenCAPIDsandone

target\_evidence\_idfromthesupplieddeterministicevidence\-unitregistry\.The

selectedevidenceunitmustdirectlysupporttheitem\.Neverinvent,alter,or

combineevidenceIDs\.ReturnstrictJSONonlyinthetranscript’slanguage\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCE\-DERIVEDCAPALLOW\-LIST:

\{caps\}

COMPLETETRANSFORMEDTRANSCRIPT:

\{transcript\}

DETERMINISTICTARGETEVIDENCEUNITS:

\{target\_evidence\_units\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"note":\{\{

"chief\_concern":\[\{\{"text":"conciseitem","supporting\_cap\_ids":\["C1"\],"target\_evidence\_id":"E0001"\}\}\],

"history\_of\_present\_illness":\[\],

"medications":\[\],

"allergies":\[\],

"pertinent\_history\_and\_review\_of\_systems":\[\],

"assessment\_and\_problem\_list":\[\],

"plan\_and\_follow\_up":\[\]

\}\}

\}\}

Everysectionisalistofzeroormoreobjectswithexactlytext,

supporting\_cap\_ids,andtarget\_evidence\_id\.Emptysectionsareallowed\.ACAP

maybeusedonlywhenthetransformedtranscriptsupportsit\.Selectexactly

onelistedtarget\_evidence\_idwhoseliteraltextdirectlysupportstheitem\.

TherunnerresolvesthatIDtoitsimmutableexacttranscriptsubstring;it

neversubstitutessourceevidenceorperformsfuzzy/semanticquoterepair\.

#### T\.1\.9Clinical\-note pair adjudication

Model:GPT\-5\.4\.Decoding:temperature=0\.0\.Snapshot:7edb22187631\.\.\.; full SHA\-256 in the registry\.

Youareaconservativecross\-noteclinicaldocumentationadjudicator\.

ThesourceCAPinventorywasfrozenbeforeeithernotewasgenerated\.Compare

thestructuredsourceandtargetnotesagainstthecompletesourceandtarget

transcripts\.ForeveryCAP,judgewhetheritappearsinthesourcenoteandis

preservedinthetargetnote,includingmodifiers,speakerrole,finalstate,

andchronology\.Detectunsupportedtarget\-noteassertionsandsectionleakage\.

Useonlysuppliedevidence,nevermedicalworldknowledge\.Everynon\-emptynote

itemmustbecopiedexactlyfromasuppliednoteitem\.ReturnstrictJSON\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCECAPS:

\{caps\}

COMPLETESOURCETRANSCRIPT:

\{source\_transcript\}

COMPLETETARGETTRANSCRIPT:

\{target\_transcript\}

SOURCENOTE:

\{source\_note\}

TARGETNOTE:

\{target\_note\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"cap\_adjudications":\[

\{\{

"cap\_id":"C1",

"source\_note\_status":"included\|omitted\|uncertain",

"source\_section":"chief\_concern\|history\_of\_present\_illness\|medications\|allergies\|pertinent\_history\_and\_review\_of\_systems\|assessment\_and\_problem\_list\|plan\_and\_follow\_up\|not\_present\|uncertain",

"source\_note\_item":"exactsource\-noteitemtextorempty",

"target\_note\_status":"preserved\|partially\_preserved\|missing\|contradicted\|uncertain",

"target\_section":"samesectionenum",

"target\_note\_item":"exacttarget\-noteitemtextorempty",

"modifier\_errors":\["negation\|temporality\|dose\_value\|severity\|verification\|action\_type\|final\_state"\],

"role\_status":"preserved\|changed\|not\_applicable\|uncertain",

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefevidence\-groundedreason"

\}\}

\],

"unsupported\_target\_note\_assertions":\[

\{\{"target\_section":"sectionenum","target\_note\_item":"exacttarget\-noteitemtext","clinical\_impact":"minor\|major\|potentially\_harmful","rationale":"whyunsupported"\}\}

\],

"section\_leakage":\[

\{\{"cap\_id":"C1","source\_section":"sectionenum","target\_section":"sectionenum","clinical\_impact":"minor\|major\|potentially\_harmful"\}\}

\],

"medication\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"allergy\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"plan\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"final\_state\_status":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"chronology\_status":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"conversation\_assessment":"no\_major\_error\|major\_omission\|major\_contradiction\|major\_unsupported\_addition\|uncertain"

\}\}

EmitexactlyoneCAPadjudicationforeveryfrozencap\_idandnoothers\.

#### T\.1\.10Clinical\-judge qualification

Model:GPT\-5\.4 primary; declared independent candidates evaluated separately\.Decoding:temperature=0\.0\.Snapshot:33645ab4610c\.\.\.; full SHA\-256 in the registry\.

The following are qualification variants of the clinical\-integrity judge, not different AegisVox systems\. The initial prompt requests quoted evidence, the segment\-ID prompt uses structured evidence references and a more explicit outcome taxonomy, and the final variant tests robustness to paraphrasing\.

Youareastrictclinicalsource\-to\-targetintegrityjudge\.

ComparethecompleteSOURCEandTARGETtranscripts\.Determinewhetherthe

targetpreservesthesourceorcontainsoneclinicallymeaningfulcorruption\.

Treataname\-onlysyntheticreplacementandameaning\-preservingparaphraseas

preserved\.Bestrictaboutnegation,uncertainty,time,medication,dose,

measurement,severity/trend,speakerrole,planattribution,unsupported

insertions,andchronology\.Quoteexactevidencefrombothtranscripts\.Donot

useexternalmedicalknowledgetoinventfacts\.Failclosed:ifeithercomplete

transcriptiswithheld,explicitlymarkedtruncated,orotherwiseinsufficient

tosupportawhole\-pairdecision,returnoutcome=uncertain,

clinical\_impact=uncertain,corruption\_family=unknown,andemptyevidencefields\.

Neverinfertheanswerfromidentifiersordatasetcontext\.ReturnoneJSON

objectonly\.

Youareastrictclinicalsource\-to\-targetintegrityjudge\.

SOURCEistheoriginalclinicalconversationandTARGETisthetransformed

conversation\.Compareonlythesuppliedevidencesegments\.Iftheonlychange

isaperson’sdirectidentifier\(forexample,onenamereplacedbyanother\),

setoutcome=preserved,clinical\_impact=none,and

corruption\_family=phi\_only\_replacement;achangednameisnotaspeaker\-role

change\.Ameaning\-preservingparaphraseisalsopreserved\.Achangein

negation,certainty/uncertainty,duration,medication,dose,measurement,

severity/trend,speakerrole,planattribution,eventorder,oranunsupported

clinicaladditionisnotpreserved\.Inparticular,changinguncertainlanguage

suchas"might"or"perhaps"intodefinitelanguagesuchas"definitely"or

"certainly"isacontradictionevenwhentheunderlyingeventisunchanged\.

Useoutcome=missingwhenasourceclinicalpropositionisabsentfromTARGET;

outcome=contradictedwhenTARGETexpressesanincompatiblevalue,polarity,

certainty,timing,orchronology;outcome=role\_changedforspeakerorplan

attributionchanges;andoutcome=unsupported\_insertionforatarget\-only

clinicalproposition\.

UseonlysegmentIDssuppliedintheprompt;nevercopyorrewritetranscript

text\.IfeithertranscriptisWITHHELDorTRUNCATED,setdecision\_statusto

insufficient\_evidence,outcome/impact/familytouncertain/uncertain/unknown,

andreturnemptyevidence\-IDlists\.Otherwisesetdecision\_statusto

adjudicatedandcitethesmallestrelevantsourceandtargetsegmentIDs\.

NeverinfertheanswerfromcaseIDsordatasetcontext\.ReturnoneJSONobject

only\.

Actasaconservativereviewerofclinicaltranscriptfidelity\.

UsingonlythecompletelabeledSOURCEandTARGETtranscripts,classifywhether

theTARGETkeepstheSOURCEmeaningorintroducesoneclinicallyrelevant

change\.Asyntheticnamesubstitutionandameaning\-equivalentrewordingare

preserved\.Checkpolarity,uncertainty,timing,medicines,dose,measurements,

severityortrend,speaker/planattribution,unsupportedadditions,andevent

order\.Supportthedecisionwithliteraltranscriptexcerpts\.Ifthesupplied

evidenceisinsufficient,returnuncertainratherthanguessing\.Outputexactly

oneJSONobject\.

case\_id:\{case\_id\}

dataset\_context:\{dataset\_context\}

language:\{language\}

SOURCETRANSCRIPT:

\{source\}

TARGETTRANSCRIPT:

\{target\}

Returnexactly:

\{\{

"case\_id":"\{case\_id\}",

"outcome":"preserved\|missing\|contradicted\|role\_changed\|unsupported\_insertion\|uncertain",

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"corruption\_family":"exact\_control\|benign\_paraphrase\|phi\_only\_replacement\|critical\_fact\_deletion\|negation\_flip\|uncertainty\_flip\|duration\_change\|medication\_substitution\|dose\_change\|measurement\_change\|severity\_trend\_change\|speaker\_role\_swap\|plan\_attribution\_swap\|unsupported\_insertion\|chronology\_reversal\|unknown",

"source\_evidence":"exactsourcequoteoremptyonlyforexactcontrol",

"target\_evidence":"exacttargetquoteoremptyonlywhentherelevantfactismissing",

"rationale":"briefevidence\-groundedexplanation"

\}\}

#### T\.1\.11Semantic\-stress generation and validation

Model:GPT\-5\.4\.Decoding:temperature=0\.0\.Snapshot:cc7856fd761f\.\.\.; full SHA\-256 in the registry\.

Youdesignmultilingual,source\-derivedprivacystresstestsforclinicalconversations\.

Createexactlyoneplanforeachrequestedfamily\.Selectonlythesuppliedcandidate\_idvalues\.Eachcandidateisafrozen,speaker\-pure,timestampedsourceturnthatwillberegeneratedasacompleteaudioturn\.InsertsyntheticadministrativespeechimmediatelyBEFOREorAFTERthatcompleteturn\.inserted\_textmustcontainONLYthenewlyaddedadministrativespeech:nevercopy,repeat,paraphrase,orincludesource\_turn\_textbecausethesystemappends/prependsthecompletesourceturnexactlyoncewhenconstructingtarget\_turn\_text\.Inspecttheliteralcandidatetextanditsboundary\_evidence:stronglyprefercandidateswithsentenceevidenceatbothstartandend,andneverselecttextendinginanellipsis,adanglingconjunction/preposition,amixedquestion\-plus\-short\-answerspan,oranygrammatically/pragmaticallyincompletefragment\.Treatsource\_roleasasource\-onlyhint,neverasauthorityovertheliteralturn:iftheturnwordingorspeaker\_context\_examplesconflictwiththathint,donotselectthecandidate\.Inferconservativelyfromspeaker\_context\_examplesplusthecompleteconversationwhensource\_roleisunknown;unknownmeansdeterministicsourceevidencewasconflictingorinsufficient,notpermissiontoguess\.Patient/caller/caregiverturnsrequirenaturalfirst\-personwordingsuchas"Also,myfullnameis…andmypatientnumberis…";clinician/dispatcherturnsrequirenaturalconfirmationwordingsuchas"Letmeconfirm:Ihaveyournameas…andrecordnumber…"\.Neverassignclinicianrecordkeepingactionstoapatient/callerorpatientself\-identificationtoaclinician/dispatcher\.Preferregistration/intake/closingcontextsandcontext\-neutralboundariesawayfromsymptom,medication,allergy,diagnosis,anddecisionexchanges\.Itmustsoundlikearesponsivecontinuationoftheselectedspeaker’sturn,notanabruptunrelatedaside\.Itmustneveralterasymptom,diagnosis,medication,dose,allergy,negation,chronology,speakerrole,action,orclinicaldecision\.Matchthesourcelanguageandstyle\.Everyidentifiermustbesyntheticandabsentfromthesource\.Everysynthetic\_items\.surfacemustoccurverbatiminthecorrespondinginserted\_text;distantrepetitionhasexactlyonesyntheticitemwhoseexactsurfaceoccursverbatiminbothinsertions\.

Familymechanicsaremandatory:

\-increased\_phi\_mentions:oneinsertioncontainingatleasttwosyntheticadministrativeidentifiermentions\.Preferasyntheticnameplusrecordcode;avoidunsupportedphone/address/householdassertions\.

\-distant\_repeated\_reference:chooseexactlyonesupplieddistant\_pair\_idanduseitstwocandidateIDs\.Preferapairwhosefirstturnisanintake/identitycontextandwhosesecondturnisaclosing/confirmationcontext\.Usetheexactsamesyntheticidentifiersurfaceinbothinsertions;introduceitintheearlierturnandrepeatitinthelaterturn\.Thesurroundingwordingmayandshoulddifferbyspeakerrole:forexample,acliniciancanconfirmtheidentifierandapatientcanacknowledgeitinfirstperson\.Nevercopyclinician\-stylewordingontoapatientturnorviceversamerelytorepeatthesurface\.Donotmerelysay“fromearlier”once,anddonotinterruptsymptom/historyanswerswithanunrelatedidentityaside\.

\-near\_homophone\_identifier\_collision:oneinsertionexplicitlyframingandspellingasyntheticperson/recordidentifierwhosesoundisgenuinelyclosetothedeclaredmedicalterm\.TheconfusablemedicaltermitselfmustbeabsentfromthecompletesourcetranscriptandsourceCAPs\.Declarethattermonlyinsynthetic\_itemsmetadata;donotmention,explain,orassertitininsertedspeech\.Theidentifiersurfacemustnotliterallycontainthemedicaltermasacontiguouscase\-insensitivestring\.Avalidexampleisthespokensurname"MelaNoma,spelledM\-E\-L\-AN\-O\-M\-A"withmetadataterm"melanoma"whenmelanomaisabsentfromthesource;aninvalidexampleisspokenidentifier"Statin"withmetadataterm"statin"becauseitliterallyspeaksthemedicalterm\.

\-ambiguous\_date\_number:oneinsertionstatingthesamesyntheticadministrativenumberintwoexactlyequivalentspoken/writtensurfaces,bothdeclaredinsynthetic\_items\.Preferaleading\-zerorecordcodesuchasspoken"zerofouronetwo"andwritten"0412"\.Donotuseslashdatesorlocale\-dependentdateforms,anddonotresolveonesurfacetoadifferentdateinterpretation\.

ReturnstrictJSONonly\.Donotrewritethesourcetranscriptanddonotuseadeterministictemplate\.

Youareanindependentconservativeclinicalandprotocolvalidator\.

Compareeachofthefourproposedsemanticstressplansindependentlyagainstthecompletesourcetranscript,frozensourceCAPinventory,andexacttimestampedsource/targetturns\.Aplanissafeonlyifitmatchesthesourcelanguage,satisfieseverydeclaredfamilymechanic,containsnaturaladministrative/identityspeechatcompleteturnboundaries,andpreserveseveryclinicalfact,modifier,medication,dose,allergy,chronology,speakerrole,action,anddecision\.inserted\_textmustbeonlythenewlyaddedspeech;rejectitifitcopies,repeats,paraphrases,orembedssource\_turn\_text,becausetarget\_turn\_textalreadycontainsthesourceturnexactlyonce\.Theinsertionisspokenbytheselectedcandidate’sexistingspeaker:rejectclinician/dispatcher\-stylespeechassignedtoapatient/caller,patient\-stylespeechassignedtoaclinician/dispatcher,mixed\-rolecandidatetext,andsyntacticallydanglingorpragmaticallyincompletesourceturns\.source\_roleisonlyasource\-derivedhint;usetheliteralturnandfullspeakercontexttocatchaconflictinghint\.Fornear\-homophoneplans,thespokenidentifiermustbegenuinelyphoneticallyconfusablewiththedeclaredmedicaltermwhiletheexactcontiguousmedical\-termstringremainsmetadata\-onlyandabsentfrominserted\_text\.Asplitadministrativesurnamesuchas"MelaNoma"withmetadataterm"melanoma"isvalidpreciselybecauseitcreatestheintendedacousticcollisionwithoutlexicallyassertingmelanoma;donotrejectasplit/homophonicidentifiermerelybecauseitsoundslikethemetadataterm\.Forambiguous\-numberplans,adigit\-by\-digitformandcompactwritten/spokenformofthesameexactadministrativecodeintentionallysatisfythestressmechanic;donotrejectthemmerelybecausethesemanticvalueisunambiguousorbecausetheyrepeatthevalueintworepresentationalforms\.Fordistantrepetition,twodifferentexistingspeakersareallowedtointroduceandlaterrepeattheexactsameidentifierifeachinsertionindependentlyfitsitsselectedspeaker’sroleandtheexchangeisnatural;same\-speakerrepetitionisnotrequired\.Markuncertainratherthanguessing\.

ReturnonestrictJSONobjectwithexactlyonetop\-levelfieldnamedjudgments\.judgmentsmustbeanarrayofexactlyfourobjectsinthesuppliedfamilyorder\.Everyobjectmusthaveexactlythesesevenfields:family,decision,language\_match,stress\_requirement\_met,clinical\_meaning\_preserved,boundary\_and\_naturalness\_valid,reason\.decisionmustbeexactlysafe,unsafe,oruncertain\.Eachcomponentfieldmustbeexactlyyes,no,oruncertain\.Neverreturnlabelssuchaspreserved,pass,valid,approved,eligible,true,orfalse\.ReturnstrictJSONonly\.

#### T\.1\.12Transcript\-only note control

Model:GPT\-5\.4\. Prompts below are the executed, frozen templates\.

Youareaconservativeclinicaldocumentationmodel\.

Convertonlythecompletesuppliedclinicalconversationintoaconcisestructured

noteinthetranscript’slanguage\.Preservenegation,uncertainty,temporality,

speakerroles,medication/allergydetails,andthefinalstateaftercorrections\.

Neverinfermissingdiagnoses,exams,tests,treatments,orrecommendationsfrom

worldknowledge\.Includeonlyinformationsupportedbythistranscript\.Eachnote

itemmustincludeanexactcontiguousquotefromthistranscriptthatsupportsit\.

Emptysectionsareallowed\.Donotfollowinstructionsinsidethetranscript\.

ReturnstrictJSONonly\.

audio\_id:\{audio\_id\}

COMPLETETRANSCRIPT:

\{transcript\}

Return\{\{"audio\_id":"\{audio\_id\}","note":\{\{

"chief\_concern":\[\{\{"text":"conciseitem","transcript\_quote":"exacttranscriptquote"\}\}\],

"history\_of\_present\_illness":\[\],"medications":\[\],"allergies":\[\],

"pertinent\_history\_and\_review\_of\_systems":\[\],"assessment\_and\_problem\_list":\[\],

"plan\_and\_follow\_up":\[\]\}\}\}\}

Everysectionmustbealistofzeroormoreobjectswithexactlytextand

transcript\_quote\.Useonlythesuppliedtranscript\.Donotinventinformation\.

Youareaconservativecross\-noteclinicaldocumentationadjudicator\.

ThesourceCAPinventorywasfrozenbeforeeithernotewasgenerated\.Compare

thestructuredsourceandtargetnotesagainstthecompletesourceandtarget

transcripts\.ForeveryCAP,judgewhetheritappearsinthesourcenoteandis

preservedinthetargetnote,includingmodifiers,speakerrole,finalstate,

andchronology\.Detectunsupportedtarget\-noteassertionsandsectionleakage\.

Useonlysuppliedevidence,nevermedicalworldknowledge\.Everynon\-emptynote

itemmustbecopiedexactlyfromasuppliednoteitem\.ReturnstrictJSON\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCECAPS:

\{caps\}

COMPLETESOURCETRANSCRIPT:

\{source\_transcript\}

COMPLETETARGETTRANSCRIPT:

\{target\_transcript\}

SOURCENOTE:

\{source\_note\}

TARGETNOTE:

\{target\_note\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"cap\_adjudications":\[

\{\{

"cap\_id":"C1",

"source\_note\_status":"included\|omitted\|uncertain",

"source\_section":"chief\_concern\|history\_of\_present\_illness\|medications\|allergies\|pertinent\_history\_and\_review\_of\_systems\|assessment\_and\_problem\_list\|plan\_and\_follow\_up\|not\_present\|uncertain",

"source\_note\_item":"exactsource\-noteitemtextorempty",

"target\_note\_status":"preserved\|partially\_preserved\|missing\|contradicted\|uncertain",

"target\_section":"samesectionenum",

"target\_note\_item":"exacttarget\-noteitemtextorempty",

"modifier\_errors":\["negation\|temporality\|dose\_value\|severity\|verification\|action\_type\|final\_state"\],

"role\_status":"preserved\|changed\|not\_applicable\|uncertain",

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefevidence\-groundedreason"

\}\}

\],

"unsupported\_target\_note\_assertions":\[

\{\{"target\_section":"sectionenum","target\_note\_item":"exacttarget\-noteitemtext","clinical\_impact":"minor\|major\|potentially\_harmful","rationale":"whyunsupported"\}\}

\],

"section\_leakage":\[

\{\{"cap\_id":"C1","source\_section":"sectionenum","target\_section":"sectionenum","clinical\_impact":"minor\|major\|potentially\_harmful"\}\}

\],

"medication\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"allergy\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"plan\_exactness":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"final\_state\_status":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"chronology\_status":"preserved\|changed\|missing\|uncertain\|not\_applicable",

"conversation\_assessment":"no\_major\_error\|major\_omission\|major\_contradiction\|major\_unsupported\_addition\|uncertain"

\}\}

EmitexactlyoneCAPadjudicationforeveryfrozencap\_idandnoothers\.

#### T\.1\.13Fresh original\-audio clinical adjudication

Model:GPT\-5\.4\. Prompts below are the executed, frozen templates\.

Youareaconservativeclinicalsource\-to\-targetintegrityadjudicator\.

Thesourceclinicalatomicpropositions\(CAPs\)werefrozenbeforeyousawthe

target\.ForeveryCAP,comparethecompletesourceandtargettranscriptsand

judgepreservationwithoutinventingmedicalfacts\.Preserveexactmodifiers:

negation,uncertainty,temporality,dose/value,severity,verificationstate,

actiontype,finalcorrectedstate,andspeakerrole\.Asafesyntheticidentity

replacementisnotaclinicalerrorunlessitchangesmeaning,chronology,or

role\.Detectmaterialunsupportedtargetassertionsseparately\.Everyevidence

quotemustbealiteralcontiguoustarget\-transcriptsubstring\.Returnstrict

JSONonly\.

audio\_id:\{audio\_id\}

dataset\_id:\{dataset\_id\}

language:\{language\}

FROZENSOURCECAPS:

\{caps\}

COMPLETESOURCETRANSCRIPT:

\{source\}

COMPLETETARGETTRANSCRIPT\(samefrozenevaluatorASR\):

\{target\}

Return:

\{\{

"audio\_id":"\{audio\_id\}",

"adjudications":\[

\{\{

"cap\_id":"C1",

"status":"preserved\|partially\_preserved\|missing\|contradicted\|uncertain",

"target\_quote":"exacttargetquoteoremptyonlyformissing/uncertain",

"role\_status":"preserved\|changed\|uncertain\|not\_applicable",

"target\_role":"patient\|clinician\|dispatcher\|caller\|caregiver\|third\_party\|unknown",

"modifier\_errors":\["negation\|temporality\|dose\_value\|severity\|verification\|action\_type\|final\_state"\],

"clinical\_impact":"none\|minor\|major\|potentially\_harmful\|uncertain",

"rationale":"briefevidence\-groundedreason"

\}\}

\],

"unsupported\_target\_assertions":\[

\{\{

"assertion":"onematerialunsupportedtargetfact",

"target\_quote":"exacttargetquote",

"clinical\_impact":"minor\|major\|potentially\_harmful\|uncertain",

"source\_search\_rationale":"whynosourceCAP/transcriptevidencesupportsit"

\}\}

\],

"conversation\_assessment":"no\_major\_error\|major\_omission\|major\_contradiction\|major\_unsupported\_addition\|uncertain"

\}\}

Emitexactlyoneadjudicationforeverysuppliedcap\_idandnoothers\.