VoxCPM2: Tokenizer-Free TTS for Multilingual Speech Generation, Creative Voice Design, and True-to-Life Cloning
This report summarizes scanner evidence for OpenBMB/VoxCPM, a Python project with 38,545 GitHub stars. SynthScan examined 14,861 lines of code across 65 source files, recording 202 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 18.3 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 101 finding(s).
Are imports declared and package/API names verified? 44 finding(s).
Are wrappers, guards, and repeated structures necessary? 133 finding(s).
Which changes need focused human review? 202 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 202 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lora_ft_webui.py | 131 | def load_lora_config_from_checkpoint(lora_path): | CODE |
| LOW | lora_ft_webui.py | 941 | def on_pretrained_path_change(path): | STRING |
| LOW | tests/test_training_data.py | 52 | def test_load_mixed_duration_manifest_and_fill_missing_metadata(tmp_path): | CODE |
| LOW | tests/test_training_data.py | 79 | def test_existing_duration_does_not_read_audio_file(tmp_path): | CODE |
| LOW | tests/test_training_data.py | 94 | def test_reference_duration_is_filled_and_used_for_length(tmp_path): | CODE |
| LOW | tests/test_training_data.py | 118 | def test_compute_lengths_rejects_missing_duration(): | CODE |
| LOW | tests/test_training_data.py | 131 | def test_relative_audio_paths_are_resolved_from_manifest_directory(tmp_path, monkeypatch): | CODE |
| LOW | tests/test_training_data.py | 150 | def test_rejects_non_positive_worker_count(tmp_path): | CODE |
| LOW | tests/test_lora_checkpoint_loading.py | 118 | def test_load_lora_weights_accepts_tensor_only_legacy_checkpoints(monkeypatch, tmp_path, module_name): | CODE |
| LOW | tests/test_lora_checkpoint_loading.py | 132 | def test_load_lora_weights_rejects_malicious_pickle_payloads(monkeypatch, tmp_path, module_name): | CODE |
| LOW⚡ | tests/test_model_utils.py | 23 | def test_resolve_runtime_device_auto_falls_back_to_cpu(monkeypatch): | CODE |
| LOW⚡ | tests/test_model_utils.py | 30 | def test_resolve_runtime_device_auto_uses_mps_when_available(monkeypatch): | CODE |
| LOW⚡ | tests/test_model_utils.py | 37 | def test_resolve_runtime_device_respects_explicit_cpu(monkeypatch): | CODE |
| LOW⚡ | tests/test_model_utils.py | 44 | def test_resolve_runtime_device_rejects_unavailable_explicit_cuda(monkeypatch): | CODE |
| LOW⚡ | tests/test_model_utils.py | 52 | def test_materialize_generation_seed_preserves_explicit_seed(): | CODE |
| LOW⚡ | tests/test_model_utils.py | 56 | def test_materialize_generation_seed_creates_concrete_seed_for_none(monkeypatch): | CODE |
| LOW⚡ | tests/test_model_utils.py | 62 | def test_apply_generation_seed_sets_cpu_and_cuda_rng(monkeypatch): | CODE |
| LOW | tests/test_timestamps.py | 14 | def test_split_word_items_to_chars_evenly_distributes_word_duration(): | CODE |
| LOW | tests/test_timestamps.py | 25 | def test_split_word_items_to_chars_skips_empty_text(): | CODE |
| LOW | tests/test_validate.py | 177 | def test_validation_result_properties(self): | CODE |
| LOW | tests/test_validate.py | 187 | def test_invalid_audio_not_counted_as_valid(self, tmp_dir): | CODE |
| LOW | tests/test_validate.py | 200 | def test_sample_rate_mismatch(self, tmp_dir): | CODE |
| LOW | tests/test_validate.py | 222 | def test_mixed_ref_audio_warns_for_each_missing(self, tmp_dir): | CODE |
| LOW | tests/test_validate.py | 241 | def test_cli_validate_exit_code(self, tmp_dir): | CODE |
| LOW | tests/test_cli.py | 71 | def test_load_model_respects_no_optimize_for_local_model(monkeypatch): | CODE |
| LOW | tests/test_cli.py | 99 | def test_load_model_defaults_optimize_for_hf(monkeypatch): | CODE |
| LOW | tests/test_cli.py | 125 | def test_load_model_respects_no_optimize_for_hf(monkeypatch): | CODE |
| LOW | tests/test_cli.py | 152 | def test_load_model_passes_explicit_device_to_hf(monkeypatch): | CODE |
| LOW | tests/test_cli.py | 179 | def test_design_subcommand_applies_control(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 202 | def test_clone_subcommand_reads_prompt_file(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 279 | def test_legacy_root_args_still_work_and_warn(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 299 | def test_batch_subcommand_applies_control(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 326 | def test_design_writes_timestamp_json_when_requested(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 370 | def test_timestamp_alignment_failure_warns_by_default(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 395 | def test_timestamp_alignment_failure_exits_in_strict_mode(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 420 | def test_batch_writes_one_timestamp_json_per_output(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 460 | def test_legacy_clone_with_prompt_file_still_works(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 489 | def test_invalid_prompt_text_and_prompt_file_combination(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 520 | def test_missing_prompt_file_reports_parser_error(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 546 | def test_design_rejects_prompt_audio_args(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 572 | def test_clone_rejects_prompt_audio_without_transcript(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 596 | def test_clone_rejects_transcript_without_prompt_audio(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 618 | def test_batch_rejects_control_with_prompt_transcript(monkeypatch, tmp_path, capsys): | CODE |
| LOW | tests/test_cli.py | 648 | def test_detect_model_architecture_uses_local_configs(): | CODE |
| LOW | tests/test_cli.py | 692 | def test_design_subcommand_passes_seed(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_cli.py | 713 | def test_batch_subcommand_passes_seed(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_torch_load_safety.py | 49 | def test_every_torch_load_sets_weights_only_true(): | CODE |
| LOW | tests/test_torch_load_safety.py | 67 | def test_torch_load_weights_only_blocks_malicious_pickle(tmp_path): | CODE |
| LOW | src/voxcpm/cli.py | 90 | def detect_model_architecture(args) -> str | None: | CODE |
| LOW | src/voxcpm/cli.py | 112 | def validate_prompt_related_args(args, parser, prompt_text: str | None): | CODE |
| LOW | src/voxcpm/cli.py | 123 | def validate_reference_support(args, parser): | CODE |
| LOW⚡ | src/voxcpm/cli.py | 398 | def _add_common_generation_args(parser): | CODE |
| LOW | src/voxcpm/cli.py | 426 | def _add_prompt_reference_args(parser): | CODE |
| LOW | src/voxcpm/timestamps/stable_ts.py | 81 | def split_word_items_to_chars(words: list[TimestampItem]) -> list[TimestampItem]: | CODE |
| LOW | src/voxcpm/training/packers.py | 322 | def process_tts_data_with_ref( | CODE |
| LOW⚡ | src/voxcpm/model/voxcpm.py | 596 | def generate_with_prompt_cache(self, *args, **kwargs) -> Tuple[torch.Tensor, torch.Tensor, torch.Tensor]: | CODE |
| LOW⚡ | src/voxcpm/model/voxcpm.py | 599 | def generate_with_prompt_cache_streaming( | CODE |
| LOW⚡ | src/voxcpm/model/voxcpm.py | 605 | def _generate_with_prompt_cache( | CODE |
| LOW | src/voxcpm/model/utils.py | 27 | def materialize_generation_seed(seed: Optional[int]) -> int: | CODE |
| LOW | src/voxcpm/model/utils.py | 40 | def mask_multichar_chinese_tokens(tokenizer: PreTrainedTokenizer): | CODE |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app_old.py | 56 | except Exception as e: | CODE |
| LOW | app.py | 419 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 81 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 141 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 217 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 227 | except Exception as e: | CODE |
| LOW⚡ | lora_ft_webui.py | 254 | except Exception as e: | CODE |
| LOW⚡ | lora_ft_webui.py | 260 | except Exception as e: | CODE |
| MEDIUM⚡ | lora_ft_webui.py | 261 | print(f"Error loading LoRA: {e}", file=sys.stderr) | CODE |
| LOW | lora_ft_webui.py | 289 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 305 | except Exception as e: | CODE |
| LOW | lora_ft_webui.py | 387 | except Exception: | CODE |
| LOW⚡ | scripts/train_voxcpm_finetune.py | 267 | except Exception: | CODE |
| LOW⚡ | scripts/train_voxcpm_finetune.py | 274 | except Exception as e: | CODE |
| MEDIUM⚡ | scripts/train_voxcpm_finetune.py | 275 | print(f"Error saving checkpoint on signal: {e}", file=sys.stderr) | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 475 | except Exception as e: | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 609 | except Exception as e: | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 665 | except Exception as e: | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 668 | except Exception as e: | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 683 | except Exception as e: | CODE |
| LOW | scripts/train_voxcpm_finetune.py | 851 | except Exception: | CODE |
| MEDIUM | scripts/train_voxcpm_finetune.py | 252 | def _signal_handler( | CODE |
| LOW | scripts/test_pick_runtime_dtype.py | 37 | except Exception as e: | CODE |
| LOW | scripts/test_pick_runtime_dtype.py | 56 | except Exception as e: | CODE |
| MEDIUM | scripts/test_pick_runtime_dtype.py | 31 | def expect_raises(fn, exc_type, label): | CODE |
| LOW | src/voxcpm/zipenhancer.py | 65 | except Exception as e: | CODE |
| LOW | src/voxcpm/cli.py | 203 | except Exception as e: | CODE |
| LOW⚡ | src/voxcpm/cli.py | 222 | except Exception as e: | CODE |
| LOW | src/voxcpm/cli.py | 352 | except Exception as e: | CODE |
| LOW | src/voxcpm/cli.py | 381 | except Exception as exc: | CODE |
| LOW | src/voxcpm/training/validate.py | 52 | except Exception as e: | CODE |
| LOW | src/voxcpm/training/validate.py | 63 | except Exception: | CODE |
| LOW | src/voxcpm/training/validate.py | 109 | except Exception as e: | CODE |
| LOW | src/voxcpm/training/data.py | 86 | except Exception as exc: | CODE |
| LOW | src/voxcpm/model/voxcpm.py | 248 | except Exception as e: | CODE |
| LOW | src/voxcpm/model/utils.py | 135 | except Exception as e: | CODE |
| LOW | src/voxcpm/model/voxcpm2.py | 78 | except Exception: | CODE |
| LOW | src/voxcpm/model/voxcpm2.py | 298 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_training_data.py | 3 | CODE | |
| LOW | tests/test_lora_checkpoint_loading.py | 1 | CODE | |
| LOW | tests/test_model_utils.py | 1 | CODE | |
| LOW | tests/test_validate.py | 3 | CODE | |
| LOW | tests/test_validate.py | 6 | CODE | |
| LOW | tests/test_cli.py | 1 | CODE | |
| LOW | src/voxcpm/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/timestamps/stable_ts.py | 1 | CODE | |
| LOW | src/voxcpm/timestamps/postprocess.py | 1 | CODE | |
| LOW | src/voxcpm/timestamps/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/timestamps/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/timestamps/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/timestamps/base.py | 1 | CODE | |
| LOW | src/voxcpm/training/config.py | 1 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 9 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 10 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 11 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 11 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 11 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 11 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 17 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 18 | CODE | |
| LOW | src/voxcpm/training/__init__.py | 18 | CODE | |
| LOW | src/voxcpm/training/tracker.py | 1 | CODE | |
| LOW | src/voxcpm/training/accelerator.py | 1 | CODE | |
| LOW | src/voxcpm/training/state.py | 1 | CODE | |
| LOW | src/voxcpm/model/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/model/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 236 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 286 | CODE | |
| LOW | src/voxcpm/modules/layers/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/audiovae/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/audiovae/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/audiovae/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/modules/audiovae/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/modules/locenc/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/minicpm4/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/minicpm4/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/modules/minicpm4/__init__.py | 3 | CODE | |
| LOW | src/voxcpm/modules/locdit/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/locdit/__init__.py | 1 | CODE | |
| LOW | src/voxcpm/modules/locdit/__init__.py | 2 | CODE | |
| LOW | src/voxcpm/modules/locdit/__init__.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/voxcpm/cli.py | 18 | # ----------------------------- | COMMENT |
| MEDIUM | src/voxcpm/cli.py | 20 | # ----------------------------- | COMMENT |
| MEDIUM | src/voxcpm/cli.py | 156 | # ----------------------------- | COMMENT |
| MEDIUM | src/voxcpm/cli.py | 158 | # ----------------------------- | COMMENT |
| MEDIUM⚡ | src/voxcpm/cli.py | 227 | # ----------------------------- | COMMENT |
| MEDIUM⚡ | src/voxcpm/cli.py | 229 | # ----------------------------- | COMMENT |
| MEDIUM⚡ | src/voxcpm/cli.py | 393 | # ----------------------------- | COMMENT |
| MEDIUM⚡ | src/voxcpm/cli.py | 395 | # ----------------------------- | COMMENT |
| MEDIUM | src/voxcpm/cli.py | 661 | # ----------------------------- | STRING |
| MEDIUM | src/voxcpm/cli.py | 663 | # ----------------------------- | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app_old.py | 152 | CODE | |
| LOW | app.py | 354 | CODE | |
| LOW | lora_ft_webui.py | 86 | CODE | |
| LOW | lora_ft_webui.py | 192 | CODE | |
| LOW | tests/test_torch_load_safety.py | 49 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 46 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 391 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 564 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 773 | CODE | |
| LOW | src/voxcpm/core.py | 207 | CODE | |
| LOW | src/voxcpm/training/validate.py | 67 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 360 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 605 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 881 | CODE | |
| LOW | src/voxcpm/model/utils.py | 141 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 468 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 797 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 1134 | CODE | |
| LOW | src/voxcpm/modules/audiovae/audio_vae_v2.py | 219 | CODE | |
| LOW | src/voxcpm/modules/audiovae/audio_vae_v2.py | 532 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | lora_ft_webui.py | 387 | except Exception: | CODE |
| HIGH | lora_ft_webui.py | 116 | except (json.JSONDecodeError, OSError): | CODE |
| HIGH | src/voxcpm/zipenhancer.py | 70 | except OSError: | CODE |
| HIGH | src/voxcpm/core.py | 341 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/voxcpm/zipenhancer.py | 41 | Audio denoising enhancement Args: input_path: Input audio file path output_path | STRING |
| HIGH | src/voxcpm/core.py | 150 | Instantiate ``VoxCPM`` from a Hugging Face Hub snapshot. Args: hf_model_id: Explicit Hugging Face r | STRING |
| HIGH | src/voxcpm/core.py | 348 | Load LoRA weights from a checkpoint file. Args: lora_weights_path: Path to LoRA weights (.pth file | STRING |
| HIGH | src/voxcpm/model/utils.py | 115 | Call the tokenizer and return token IDs. This method provides the same interface as the original tokenizer | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app.py | 301 | CODE | |
| LOW | lora_ft_webui.py | 312 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 46 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 391 | CODE | |
| LOW | scripts/train_voxcpm_finetune.py | 252 | CODE | |
| LOW | src/voxcpm/core.py | 137 | CODE | |
| LOW | src/voxcpm/core.py | 207 | CODE | |
| LOW | src/voxcpm/training/data.py | 118 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 360 | CODE | |
| LOW | src/voxcpm/model/voxcpm.py | 605 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 468 | CODE | |
| LOW | src/voxcpm/model/voxcpm2.py | 797 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/voxcpm/__init__.py | 3 | __all__ = [ | CODE |
| LOW | src/voxcpm/timestamps/__init__.py | 4 | __all__ = [ | CODE |
| LOW | src/voxcpm/training/__init__.py | 20 | __all__ = [ | CODE |
| LOW | src/voxcpm/model/__init__.py | 4 | __all__ = ["VoxCPMModel", "VoxCPM2Model"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/voxcpm/model/voxcpm2.py | 1053 | # - Reference-only / zero-shot (feat_mask ends with 0): start from scratch. | COMMENT |