VoxShield — Trust the Voice. Verify the Risk.

The problem

A few seconds of audio is now enough

Cloning a voice no longer needs a studio or a data scientist. It needs a few seconds of speech — a voicemail, a reel, a recorded meeting — and the result is convincing enough to carry an instruction that a human will act on.

01 A few seconds of voice Public audio of the person being impersonated.

02 AI voice clone Synthesised speech in that voice, on demand.

03 Trusted identity The caller now sounds like someone the target already trusts.

04 Fraud under time pressure A transfer, an OTP, an access grant — requested urgently.

Executive impersonation

A voice with authority asks finance to move money outside the normal process, today.

Customer impersonation

A cloned customer voice passes a call-centre check that was designed for humans.

Family-member scam

A familiar voice in distress asks for money immediately, and doubt feels cruel.

Official impersonation

A caller claiming police or government authority manufactures urgency and compliance.

Social engineering

The voice is only the opener; the attack is the sequence of requests that follows.

Why caller ID does not help

Number spoofing and a familiar voice defeat both halves of the check most people actually run — who the screen says is calling, and whether they sound right.

Why detection alone is not enough

Detectors get worse outside the lab

Published research shows the same detector performing far better on clean test sets than on real audio. Add a phone line, background noise and a short call, and the gap grows again. That gap is what VoxShield is designed around.

01 Clean test audio Where published results come from.

02 Real recordings Noise, distance, interruptions, short answers.

03 A phone line Compression strips detail the models rely on.

04 A number you cannot trust Still printed as a confident answer.

A detector that is often wrong but still prints “SAFE” is more dangerous inside a bank than no detector at all.

This is why VoxShield publishes no accuracy figure and treats “I cannot tell” as a real answer.

We do not publish an accuracy number

Not claimed

A single accuracy figure hides the conditions it was measured under, so VoxShield does not advertise one. Test results, their datasets and their limits are written up separately, for people who want to check the work.

See the measurements

We do not claim language coverage

Not claimed

VoxShield only gives a verdict when it has a detector it has actually checked for that audio. Everything else returns LOW_CONFIDENCE — which, on a high-value transfer, still stops the transaction.

How it stays silent

Section 1 of 2 · The claim

What VoxShield claims

One claim, in plain words — and the list of things we deliberately do not say.

VoxShield does not claim to always know whether a voice is real. It claims to be honest about when it does not know — and to make that honesty stop the transaction.

That is the whole product. Everything below is either part of it or explicitly not claimed.

What we do claim

Claimed

Four things, all of them checkable:

A check runs on call audio and produces a verdict about once a second.
The system refuses to answer when the audio cannot support an answer, and says why.
A refusal is not a pass — at high stakes it holds or blocks, like a detection would.
Nothing is uploaded: audio is analysed and dropped, and the decision is written to a tamper-evident log.

What we do not claim

Not claimed

Said plainly, so nobody has to guess:

No accuracy figure. We do not advertise a percentage.
No language coverage. We do not claim detection across languages.
No replay-attack detection.
No live carrier or bank integration — nothing here has ever stopped a real payment.
No certification, and no “blockchain”. The audit log is a hash chain.

Architecture

Where the audio goes, and where it stops

Two inputs, one pipeline, and a gate that decides whether a score may be read at all. Nothing on this diagram leaves the machine it runs on.

Runs on one machine Gate — runs before any model score is read Planned link, not built

Product-level architecture. Mobile analyses on the phone; the Console analyses on one offline laptop. Both paths pass the gate before any score is read, and both end in an audit entry with the audio window discarded.

The solution

One pass of audio, twelve stages

Every four-second window walks the same path, on one laptop, with no outbound network call. Select a stage to read what it actually does.

Full technology breakdown

Precondition gate

Is this audio worth trusting at all?

The gate asks whether the window can support a conclusion — before any model score is read. Four checks, and a failure is never resolved in the reassuring direction.

Speech present≥ 2.5 s voiced in the 4.0 s window

Channel qualitySNR ≥ 10 dB

Clipping≤ 2% of samples

EnrolmentA voiceprint exists to compare against

Pass Analysis continues Signals are scored, fused and turned into a risk number with a verdict.

Fail LOW_CONFIDENCE A numeric range and one of six reason codes — INSUFFICIENT_SPEECH, CHANNEL_DEGRADED, NO_ENROLMENT, ANALYSIS_TIMEOUT, SIGNAL_DISAGREEMENT, NO_VALIDATED_SIGNAL.

A score that cannot be trusted should never become SAFE.

Enforced in three places: a database CHECK constraint, the gate itself, and the test suite.

Verdict system

Five answers, and one of them is “I cannot tell”

LOW_CONFIDENCE is not a softer SAFE. It carries no risk number, sets is_fake to null, and at high-stakes profiles it stops the transaction exactly as a detection would.

SAFE 0–39 is_fake boolean · nothing in the window argued for a clone

SUSPICIOUS 40–69 is_fake boolean · enough signal to change how the call is handled

HIGH_RISK 70–100 is_fake boolean · treat as an impersonation attempt

LOW_CONFIDENCE null + range is_fake: null · a reason code, never a score · not SAFE

ERROR null is_fake: null · the system failed, and says so

Three-valued by design. No failure path produces SAFE — not too little speech, not a degraded channel, not a model throw, a GPU out-of-memory, a queue overflow or signals that disagree by more than 45 points. A missing model file stops the process from starting at all.

Risk profile & mitigation

The same verdict, four different stakes

Detection produces a verdict. The risk profile decides what that verdict costs. This table is the product in one screen.

Prescribed action by risk profile and verdict
Risk profile	SUSPICIOUS	HIGH_RISK	LOW_CONFIDENCE
Routine enquiry	Log	Flag to agent	Log
Account change	Flag to agent	Hold + callback	Prompt secondary question
High-value transfer	Hold + callback	Block + escalate	Hold + callback
Privileged access	Block + escalate	Block + escalate	Block + escalate

At the two strictest profiles, LOW_CONFIDENCE and SUSPICIOUS produce the identical action — which is the entire argument for making the refusal a first-class verdict.

Prescribed action

Implemented

The pipeline returns the verdict and the action the active profile prescribes, and the Console displays both. Changing the profile on a live call changes the prescribed action end to end.

Automated mitigation

Specified

Step-up verification, incidents, alerts and the mitigation engine are written up in the enterprise specification and are not built yet. When they land, every mitigation carries an integration_mode of simulated, pending_approval or integrated, and the UI prints it. No demo of this ever claims a real bank transaction was blocked.

Enterprise layer status

Products

Four surfaces, one decision layer

Each carries its real build status, not its intended one.

VoxShield Mobile

Built

Capture. Analyse. Protect. An Android app that runs both models inside the APK through ONNX Runtime Mobile — no server, no network round trip. Live-call capture is device dependent and still under validation; recording analysis and test-file mode are the supported paths today.

Product detail

VoxShield Console

Built

Detect. Decide. Respond. The offline analysis console: 17 endpoints, five verdict states, profile actions, enrolments, and an audit chain you can verify from the Settings screen. One laptop, one process, zero outbound sockets at runtime.

Console tour

VoxShield SDK

Planned

Integrate voice security anywhere. The intended path for banks, telecom operators and contact centres. It does not exist yet — no package, no key, no endpoint. The REST and WebSocket contract the Console already serves is what it would be built on.

What is decided so far

VoxShield Assistant

Built

Understand risk. Investigate faster. An offline, grounded assistant inside the Console. It returns a verbatim passage from the project's own documents with a citation, or it refuses with NO_GROUNDED_ANSWER. It never generates prose — the help system refuses to guess, exactly like the detector.

How it answers

Section 2 of 2 · Current stage

Where the project actually is

A hackathon project, mid-build. This is the state on 23 September 2026, not a roadmap and not a wish list.

Current build state of each VoxShield surface
Part	Stage	What that means today
Console	Working	Runs offline on one laptop. Takes call audio, produces verdicts, records every decision. Tested in code; a human sign-off pass is still outstanding.
Mobile app	Working, with a limit	Both models run inside the Android app. Checking a saved recording works; capturing audio during a live call is blocked by the phone's own audio rules on the one device tested so far.
Sign-in & roles	Working	Enterprise sign-in, one-time codes, sessions and five roles are built and tested.
Assistant	Working	Answers questions using the project's own documents, with citations, or says it does not know. Saved chat history is not built.
Incidents & automatic response	Designed only	Written up in detail; no code yet. The Console shows the recommended action, a person carries it out.
Phone → Console hand-off	Designed only	Sending a recording from the app to the Console is designed, not built.
SDK	Not started	No package, no key, no endpoint. Only the data format it would use is settled.
Public hosting	None	There is no VoxShield service to sign into. It runs on the demo machine, offline, by design.

Why this section exists. A demo can make anything look finished. Keeping the claim and the current stage in two separate places means neither one has to be read carefully to avoid being misled.

Detailed build state What we do not claim

How it is built

Constraints we chose on purpose

Offline, unpaid and un-framework’d — not because it was easier, but because each constraint removes a claim we would otherwise have to defend.

Frozen constants, never literals

Every threshold lives in one constants file. A literal anywhere else is treated as a bug.

One outbound call in the entire codebase

It downloads model weights at install time. At runtime the process makes none — pull the network mid-demo and nothing changes.

351 tests, 91.97% coverage

Against an 80% threshold, plus 54 assertions that enforce which layer may import which.

Plain HTML, CSS and vanilla JS. Zero lock-in.

render.js · no build step

// a refused verdict never gains a score
if (verdict === "LOW_CONFIDENCE") {
  renderRange(call.risk_range);
  renderReason(call.reason_code);
  return;
}

21 dependencies, every licence read from source

All permissive. A model with no licence file was dropped rather than shipped.

₹0, on one 6 GB laptop GPU

Both models loaded occupy 85 MB of 6 081 MB VRAM. No cloud bill, no API key, no quota.

Measured, not asserted

What we can show you

Speed, capacity and privacy facts — all reproducible from the repository on one laptop (RTX 4050, 6 GB). None of these are accuracy claims.

308 ms End-to-end verdict VAD, gate, both signals, fusion, persistence and audit append.

64 Concurrent calls measured 0 dropped windows, p95 1.168 s. Where we stopped, not where it breaks.

₹0 Cost to run No cloud bill, no API key. 21 dependencies, all permissive licences.

0 Bytes of raw audio stored Not to the database, not to a log, not to a surviving temp file.

Measurements & limits What we do not claim

Security & privacy

Offline is enforced, not asserted

One outbound call exists in the entire codebase, in the model download script, at install time. Pull the network during the demo and nothing changes.

Memory only

Audio is analysed in memory and the window is discarded. No transcription, so no new class of personal data.

AES-256-GCM

Voiceprints are 192 floats, encrypted at rest, never returned by any API, and erasable cryptographically.

Hash-chained audit

SHA-256 chain; verification names the first broken link. Tamper-evident — and not called a blockchain.

15 / 15 hashes

Every model file is SHA-256 verified at load. A missing or altered model refuses to start the process.

Security architecture

VoxShield

It does not claim to always know

It claims to always be honest about whether it knows — and to make that honesty actionable. Team Innovexa, SIH 2026, PS 26104, built for ₹0.

Open the Console Read the documentation Contact the team