Audio System Evaluation, Robustness, Fairness, and Deployment

Component evaluation isolates one module — VAD, ASR, diarization, TTS — and asks whether it works. That question has an answer, and the answer is a diagnosis. It tells you where to look when something is wrong.

Two other questions look similar and are not. System evaluation asks what happens once the modules are wired to each other and to the people working alongside them. Post-deployment assurance asks what happens across the years the whole thing is left running. A clean component score answers neither. Almost everything in this lesson lives in that gap.

One study measured all three on the same audio. 217 dictated notes from 144 physicians at two health care organisations were annotated against a criterion standard built from the original audio. Zhou and colleagues published the result in JAMA Network Open in 2018: “The error rate in SR notes was 7.4% (ie, 7.4 errors per 100 words). It decreased to 0.4% after transcriptionist review and 0.3% in SNs.”

Three numbers, one pipeline. 7.4 errors per 100 words is the component score for the recogniser. 0.4% is the system — the recogniser plus the medical transcriptionist editing behind it. 0.3% is what the physician signs, and the signed note is what the record carries for as long as anyone reads it. Ask which of the three is the accuracy of the dictation system. There is no answer that is not first a question about which boundary you drew.

The same study says something none of its three headline numbers says. Of the notes the speech-recognition stage produced, 96.3% contained at least one error. Of the errors at that stage, 5.7% were clinically significant.

Hold those against the averages. A per-word rate of 0.4% or 0.3% is a true number, and it is a rate over words. It cannot report how many documents contain at least one error. It cannot report which errors change clinical meaning. The recogniser's 7.4 per 100 words is a diagnosis that stops at the seam with the transcriptionist. The post-edit average describes the middle of a distribution and is silent about its tail. Neither is a count of notes. Neither is a count of significant errors.

None of this is mysterious once the numbers are broken out. Breaking them out is exactly what a single figure per stage cannot do. A reviewer reading only 7.4, 0.4 and 0.3 sees three correct numbers and none of the three failures underneath them. It took 217 notes and 144 physicians, annotated against the original audio, to make the tail reportable at all.

True, and still not an answer to the question a release asks. That is the distinction worth holding on to. Audio-system evaluation has to match the deployed decision chain, and a component metric does not. A component metric diagnoses. It tells you which module to open.

Releasing needs a different set of things entirely: representative continuous audio rather than clips, interaction traces, the hardware constraints the system will actually run under, subgroup analysis, privacy review, and incident preparedness. Component evaluation, system evaluation and post-deployment assurance answer to different audiences. All three should be settled before the architecture is, not discovered afterwards.

Underneath sits a limit that no amount of testing removes, and it has been measured across an entire field at once. The ASVspoof 2021 challenge drew 54 participating teams. Its summary paper says of the deepfake track: “While 23 (out of 33) systems have EERs of less than 10% for the progress subset, and while the best performing system even has an EER of less than 1%, all have EERs exceeding 15% for the evaluation set.” Not one weak entry among the 33. All 33 exceeded 15% equal error rate on the evaluation set, and the best of them had been under 1% on the progress subset. The systems did not change between those two numbers. The audio did.

So no finite benchmark certifies every future room, device, speaker, language, attack or generator. Those keep arriving after the evidence was collected. What evidence can do is state where it stops applying — its operating boundary — and come with a plan for noticing when the system has walked outside it.

Four words carry that repair. They are the four that decide whether a release argument can still be audited a year later. Used loosely they quietly move evidence and decision rights around, and it happens without anyone noticing.

None of them is house vocabulary. Model cards have been a published proposal since January 2019. Mitchell and colleagues put the case in a sentence: “In order to clarify the intended use cases of machine learning models and minimize their usage in contexts for which they are not well suited, we recommend that released models be accompanied by documentation detailing their performance characteristics.”

Those four words get used in a fixed order of work. First you map the system and the claims made for it. That map decides what the evidence portfolio will contain. The portfolio is then what release and change decisions are argued from.

The sequence is not this lesson's scheme. The US National Institute of Standards and Technology published its Artificial Intelligence Risk Management Framework. That was on 26 January 2023. It gives the reason for the order: “While measuring AI risks in a laboratory or a controlled environment may yield important insights pre-deployment, these measurements may differ from risks that emerge in operational, real-world settings.” It then hangs the work on numbered subcategories a reviewer can cite. MEASURE 2.3 requires performance to be “demonstrated for conditions similar to deployment setting(s)”. MEASURE 2.5 requires that “Limitations of the generalizability beyond the conditions under which the technology was developed are documented”. MANAGE 4.1 requires post-deployment monitoring plans covering appeal and override, decommissioning, incident response, recovery and change management. Retirement sits in the framework, rather than being left to whoever is still on the team.

The order matters because the first step is silently subtractive. Whatever the map leaves out is not evidence collected late. It is evidence nobody gathers, and its absence never announces itself. The aggregate word error rate reported none of what Martin and Tang found in habitual “be”. The measurement was not wrong. No map had asked for that slice. The omission surfaces at the last step, in the governance meeting, where there is nothing to argue about because there is nothing to show.

So the portfolio has to be assembled on purpose, in four kinds, and a reviewer reads them in that order. The first is a claim. The three that follow decide whether the claim gets to stand.

The fourth kind usually arrives as a metric name — incident severity — with nothing attached to it. It has a price list. Two days before New Hampshire's 2024 Democratic presidential primary, robocalls carrying a generative-AI deepfake of President Biden's voice told recipients not to vote. On 26 September 2024 the Federal Communications Commission adopted Forfeiture Order FCC 24-104: “We impose a penalty of $6,000,000 against Steve Kramer (Kramer) for effectuating an illegal robocall campaign that targeted potential New Hampshire voters two days before the state's 2024 Democratic Presidential Primary Election (Primary Election) in violation of the Truth in Caller ID Act of 2009”.

The arithmetic is worth reading, because it is the arithmetic of an audio incident. A $1,000 base forfeiture with a 100% upward adjustment is $2,000 per call. That was applied to a sample of 3,000 verified spoofed calls, drawn from the 9,581 calls Voice Broadcasting initiated on 21 January 2024. The Commission had already ruled, on 8 February 2024, that AI-generated voices are “artificial” under the Telephone Consumer Protection Act.

Put together, the four kinds are what stops a headline number from carrying a release on its own. A single accuracy figure was doing exactly that for each of those five commercial services.

Write yours for a reviewer who is hunting for the group or the rare event your averages have covered up. Say what your map of the system and its claims assumes, and say which conditions it claims performance for.

Then give one counterexample. 0.35 against 0.19 will do until you have found one of your own. So will 7.4 errors per 100 words at the recogniser against 0.3% in the signed note, or 23 of 33 detectors under 10% equal error rate on one subset and all 33 above 15% on the next. Then say what governing release and change is supposed to do the moment it meets that counterexample: which of release, limited pilot, redesign or non-deployment follows, and which stop rule would reverse it.