Qwen3-TTS의 버그로 인해 음성이 생체 인식됩니다.

The trained voice cloning model for my project is 50 megabytes. Anyone with those 50 megabytes can convincingly be me on a phone call.

I did not build the project to prove this point. I built it because every AI voice cloning tool I tried erased my Nigerian accent. ElevenLabs, XTTS, F5-TTS — Western English training data, generic African-accented output. The pipeline that finally worked chains Qwen3-TTS (Alibaba’s 1.7B voice cloning model, released January 2026) with a reference clip of my own voice. Runs on free Kaggle GPU. Full write-up at github.com/dannwaneri/naija-voice.

The technical hurdle was small and specific. Qwen3-TTS ships with a hardcoded min_new_tokens=2 at line 2046 of modeling_qwen3_tts.py. The README documents that you can pass Hugging Face generate() kwargs, but this line silently overrides min_new_tokens no matter what you pass. Half the seeds I tried produced mid-sentence truncation because the model was free to emit EOS within a few tokens. Once I patched that line, the pipeline held. Voice consistent across a full minute. Nigerian accent intact.

Issue #55 on the repo has been open since January, filed by a Korean user reporting the same truncation symptom in a different language. Six months, no maintainer response, no root cause identified. I commented with the diagnosis and opened a PR.

That is the surface story.

The .pth file is me

The trained model weights are 50 megabytes. That file, run through the pipeline, produces audio indistinguishable from my voice. It carries my accent. It handles the way I compress vowels. Anyone with those bytes can generate audio of “me” saying anything. A phone call to my bank. A video message to my mother. A confession to a crime.

I did not commit the weights to GitHub. The repo has the code and the notebooks. It does not have the file that IS me. This is the first line of the README:

The trained voice model (models/) is intentionally not published — a voice fingerprint is biometric data and should not be committed to public repositories. If you fork this, generate your own from your own voice.

I wrote that line before I understood what it meant. I understand it now.

Voice is not like a password

You can rotate a password. If your Gmail password leaks, you change it and the leak is contained. The new password does not carry any history of the old one.

You cannot rotate a voice. If someone has a working clone of my voice today, that clone works for the rest of my life. Every phone call I make afterward has to compete with a generated version indistinguishable from the real one. I cannot upload a new voice next Tuesday.

Fingerprints have this same property, but fingerprint capture requires physical proximity. Voice capture requires 60 seconds of clean audio. I have posted 60 seconds of clean audio on the internet. Every podcast host has. Every Twitter Spaces speaker has. Every founder pitching on Loom has.

The threat model is not exotic. It is a scammer with a phone, my mother’s number, and 60 seconds of me talking about AI voice cloning on YouTube.

What I do about it

Publishing the weights to a public Hugging Face space would be the standard AI-project move. Star count, forkability, community reach. I am not doing it.

I documented the pipeline and the training procedure. Anyone who wants their own voice can build it. Anyone who wants my voice specifically has to compromise my laptop.

That is a small mitigation. It does not defend against the 60 seconds of audio I have already released. It does not defend against a service that offers cheap voice cloning to anyone with a URL. But it means the artifact I control is not the source of the leak.

If you are building anything voice-related: do not publish the weights of a specific person’s voice unless that person has explicitly consented in writing. If you clone your own voice for your own content, keep the weights on hardware you control. If you offer voice cloning as a service, refuse the “clone this pastor” and “clone this politician” requests. One viral misuse case poisons the entire category.

The tooling to clone voices well is now open source, small enough to run on a free GPU, and documented well enough that a solo developer can figure it out in a weekend. The tooling to defend against voice cloning misuse does not exist yet.

That is not a call to arms. It is where we are.