Weights
HeuristicSynthesis 0.45 · speaker 0.25 · phase 0.20 · prosody 0.10. Uncalibrated, and stated as such. Calibrating them by logistic regression on a held-out set, and reporting Cllr, is on the measurement roadmap.
Technology
One laptop.
One honest answer.
VoxShield Console runs one OS process, one CUDA context and one GPU worker. A four-second window of audio walks twelve stages and leaves behind a verdict, a prescribed action and an audit entry — then the audio is gone.
Product-level description. Constants, model names and licences on this page come from the Console repository's frozen constants and claims pack. Where something is heuristic, unvalidated or unbuilt, it is labelled on this page rather than smoothed over.
Detection pipeline
Twelve stages, in order
Select any stage for the detail. The order is not cosmetic — the gate before the score is the design.
Model stack
Six components, no fine-tuning
Every licence was read from source. Total new weights are about 177 MB, and all 15 model hashes are verified at load.
| Signal | Model | Licence | Weights | Device |
|---|---|---|---|---|
| Voice activity | Silero VAD v5 (ONNX) | MIT | 2.3 MB | CPU |
| Speaker identity | speechbrain/spkrec-ecapa-voxceleb | Apache-2.0 | 89.1 MB | GPU |
| Synthesis artefacts | AASIST (clovaai/aasist) | MIT | 1.28 MB | GPU |
| Language check | speechbrain language-id model — used only to route, never to claim coverage | Apache-2.0 | 86.4 MB | GPU |
| Phase (MGD) | librosa + numpy — excluded from fusion | ISC | 0 | CPU |
| Prosody (6 features) | librosa — excluded from fusion | ISC | 0 | CPU |
Phase and prosody are our own signals. They were built, tested, and left switched off because they performed no better than a coin toss — rather than quietly included to make the architecture diagram look fuller. 21 dependencies, all permissive licences.
Precondition gate
Before any score is read
The gate is the reason this product is defensible. It decides whether the window can support a conclusion at all, and it runs first — because a score that exists is a score someone will eventually display.
Speech presentMIN_VOICED_SECONDS = 2.5
Signal-to-noiseMIN_SNR_DB = 10.0
ClippingMAX_CLIPPING_RATIO = 0.02
EnrolmentMIN_ENROLMENT_SECONDS = 5.0
Pass
Signals are scored
Fusion produces a risk number, a verdict and the profile's prescribed action.
Fail
LOW_CONFIDENCE
Risk is null, a numeric range is returned instead, and the reason code says which check failed.
| Reason code | Trigger |
|---|---|
| INSUFFICIENT_SPEECH | Under 2.5 s of voiced audio in the window |
| CHANNEL_DEGRADED | SNR below 10 dB, or clipping above 2% |
| NO_ENROLMENT | No voiceprint to compare the speaker against |
| ANALYSIS_TIMEOUT | Analysis exceeded 2 500 ms |
| SIGNAL_DISAGREEMENT | Signals disagree by more than 45 points |
| NO_VALIDATED_SIGNAL | No detector validated for the detected language |
Validation gate
Answer only where we have checked
A detector that has not been tested on the kind of audio in front of it is not evidence. So the system carries a short list of cases it has actually validated, and everything outside that list returns no score.
Inside the checked case
The signal is used
The synthesis score joins fusion and contributes to a risk number.
Outside it
NO_VALIDATED_SIGNAL
The score is withheld, the verdict is LOW_CONFIDENCE, and at high stakes the transaction still stops.
This is why the site claims no language coverage. The validated set is deliberately narrow, and widening it requires new measurement, not a configuration change. Until that measurement exists, those calls get a refusal rather than a number.
Risk fusion
The range is arithmetic, not a guess
When a signal is missing, VoxShield does not substitute a neutral value. It reports the interval the evidence actually supports.
# i = signals that completed, j = signals that are missing
low = 100 × Σ(w_i · s_i)
high = 100 × (Σ(w_i · s_i) + Σ w_j)
# A missing signal contributes 0 at the low end
# and its full weight at the high end.
# No signal completed ⇒ exactly [0, 100]Disagreement
ImplementedIf the signals disagree by more than 45 points the fused number is not reported as a verdict at all — it returns SIGNAL_DISAGREEMENT.
Verdict system
Five verdicts, three-valued truth
is_fake is true,
false or null. A client that treats
null as false is a broken client.
SAFE0–39
SUSPICIOUS40–69
HIGH_RISK70–100
LOW_CONFIDENCEnull + range
ERRORnull
No failure path produces SAFE. Too little speech, a degraded channel, a model throw, GPU out-of-memory, queue overflow or signal disagreement all land on LOW_CONFIDENCE with is_fake = null. A missing model file refuses to start the process. The rule is enforced in the database schema, in the gate and in the test suite.
Risk profiles
What a verdict costs
Four profiles turn the same verdict into four different actions.
| Profile | SUSPICIOUS | HIGH_RISK | LOW_CONFIDENCE |
|---|---|---|---|
| Routine enquiry | Log | Flag to agent | Log |
| Account change | Flag to agent | Hold + callback | Prompt secondary question |
| High-value transfer | Hold + callback | Block + escalate | Hold + callback |
| Privileged access | Block + escalate | Block + escalate | Block + escalate |
Audit chain
Tamper-evident, and not a blockchain
Each entry carries the hash of the one before it, starting from a genesis hash of 64 zeros. Verification does not just say “broken” — it names the sequence number of the first entry that does not line up.
01Decision
Verdict, reason, profile, action.
02Hash
SHA-256 over the payload plus the previous hash.
03Append
Written once; rows are never updated.
04Verify
Names the first broken seq.
05Discard
The audio window leaves memory.
Three corruption paths are covered by tests: a rewritten payload, a forged header and an excised row. Verification is exposed in the Console's Settings view, so it can be run in front of an evaluator rather than described to one.
Evidence
Every number here is reproducible
Nine benchmark harnesses, one reference machine, dates on everything.