Abstract: Training a user-specific perturbation generator for an audio feature detection model includes receiving one or more positive audio samples of a user, each of the one or more positive audio samples including an audio feature; receiving one or more negative audio samples of the user, each of the one or more negative audio samples sharing an acoustic similarity with at least one of the one or more positive audio samples; and adversarially training a user-specific perturbation generator model to generate a user-specific perturbation, the training based on the one or more positive audio samples and the one or more negative audio samples. Perturbing audio samples of the user with the user-specific perturbation can cause an audio feature detection model to recognize the audio feature in audio samples that include the audio feature and/or to refrain from recognizing the audio feature in audio samples that do not include the audio feature.