Voice Shield — "Alexa, is this really my son calling?"

Alexa+ track · Amazon Developer Hackathon 2026 · self-hosted MCP server (spec 2025-11-25, Streamable HTTP)

A scammer clones your voice from a 10-second Instagram clip, calls your father and says "Papa, mera accident ho gaya, abhi ₹25,000 bhej do, kisi ko mat batana." Voice Shield listens to the real SIM call on the phone, scores the voice for AI-generation, reads the conversation for scam pressure, and, the part no clone can beat, asks the real son on his own phone: "Are you calling right now?" Alexa+ then tells Papa what to do.

India reported ₹22,495 crore of cyber-fraud losses in 2025; "digital arrest" alone peaked at 1.24 lakh complaints in 2024. Every official advisory (FBI, FTC, RBI, Indian police) says the same thing: don't trust the voice, call them back. Voice Shield automates exactly that advice.

What it does

 📞 live SIM call (Oppo, no root)     🎙️ laptop mic / 📁 clip
          └──────── 16 kHz PCM via ffmpeg ────────┘
                           │
        ┌──────────────────┼──────────────────────┐
  Layer 1: voice      Layer 2: words        Layer 0: caller
  DF_Arena_500M       scam-pressure         metadata (unknown /
  anti-spoof, 4 s     classifier (Bedrock   international number)
  windows, 3-of-5     Nova Micro or
  consensus           offline keywords)
        └──────────────────┼──────────────────────┘
                           ▼
                 MCP server  /mcp  (4 tools)
                           ▼
    Alexa+ (simulated web client, speaks Hindi/English)
                           ▼
  Layer 3: verify_with_family → Telegram "Are you calling?" ✅/❌

Fusion rule (engine.fuse): words risk ≥ 0.6 → alert; words ≥ 0.3 and voice alert → alert; voice alone → at most suspicious. A human decides via verify_with_family. The voice score alone never tells the user to hang up; it tells them to verify.

Related MCP server: Guardian MCP

MCP tools

All tools return structuredContent plus a text block, the shape Alexa+'s MCP client expects. SKILL.md teaches any agent how to use them.

Run it

Needs macOS/Linux, Python 3.12+, ffmpeg, ~3 GB disk for the model (downloaded on first run).

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/python test_engine.py        # detector self-check (synthetic → alert, silence → nothing)
.venv/bin/python test_mcp.py           # MCP 2025-11-25 handshake + tools over Streamable HTTP
.venv/bin/python server.py --source file:demo.wav   # replay a clip
.venv/bin/python server.py --source mic             # call on speakerphone, laptop listens
.venv/bin/python server.py --source phone           # live SIM call from a USB-connected Android (scrcpy)

Open http://localhost:8000/ — the page is a real MCP client (initialize → tools/list → tools/call) rendered as an Alexa light ring with spoken replies. Press "Alexa, is this call real?" and "Alexa, ask Rohan if it's him".

Public HTTPS for a remote client: cloudflared tunnel --url http://localhost:8000, then restart with PUBLIC_HOST=<name>.trycloudflare.com. The server runs in JSON-response, stateless mode because quick tunnels do not pass SSE.

Optional: .env with TELEGRAM_BOT_TOKEN / TELEGRAM_FAMILY_CHAT_ID (family verification) and AWS credentials (AWS_ACCESS_KEY_ID…) to route the words layer through Amazon Bedrock Nova Micro (code path written, not yet run against the live service); without them the words layer uses an offline keyword classifier, and only transcript text ever leaves the device, never audio.

Live SIM call capture (Android, no root)

scrcpy --audio-source=voice-call returns both sides of a VoLTE call on Oppo F25 Pro / ColorOS 16 / Android 16 with USB debugging on ("Disable permission monitoring" + USB mode File transfer). Many other OEM builds return silence; the engine is source-agnostic, so the mic path works everywhere. Production would move the same engine into an OEM dialer or carrier IMS layer, as Google's Pixel Scam Detection and LG U+ ixi-O do.

The numbers (measured, our own voice)

Test set: one consenting team member's voice (bona fide, 4 recordings, 512 four-second windows) versus clones of that voice made with two open tools on the same laptop, F5-TTS (MLX) and Chatterbox-Multilingual (Hindi + English), reading scam scripts from data/scripts.txt. Channel conditions simulated with ffmpeg (eval.py).

Read these honestly:

• On simulated codecs the detector works; on a real phone call it does not. Played over the air into a real call, clone scores fell from 0.95 to ≈0.45 and real speech rose to ≈0.30, so the two overlap. This matches the literature (SAFE 2025: over-the-air re-recording is the most damaging condition) and it is the most important number in this README.

• So the design does not trust audio: the voice layer alone can only raise "suspicious" ("verify this caller"), never "alert". An alert needs scam language in the live transcript (Whisper on-device → scam classifier) or a ❌ from the real family member. Both of those work identically on a bad phone line, because a clone can copy a voice but not the script it must say or the button on the real son's phone.

• Two clone families are seen only in the sense that we chose the calibration on them; the model was not trained on them. Published results for unseen 2024-era generators are 25–33 % EER and 40–50 % on multilingual in-the-wild sets that include Hindi (Deepfake-Eval-2024, ML-ITW). Real-time voice conversion (RVC/Seed-VC) was not tested.

• Model swap evidence: NII AntiDeepfake-Small (ported without fairseq in antideepfake.py) scored our own voice 0.00 but missed the F5 clones (0.02–0.47); DF_Arena_500M caught them all, so it is the live model.

• ffmpeg loudnorm on the real recordings turned them "synthetic" (logit margin −11 → +4.6). Static gain only. Details in docs/friction_log.md.

• Latency on M1 (8 GB): ~230 ms per 4 s window on MPS, 1 s hop → first alert 3–5 s after cloned speech starts.

Privacy

Audio is processed on the laptop and discarded after each window; only aggregate risk events are kept. The remote caller's voice is personal data under India's DPDP Act, so no audio is uploaded; the optional Bedrock call receives transcript text only. The clone test set was made from the author's own voice with consent; we declined services that required publishing the voice model.

What was built during the hackathon

Everything in this repository (21–23 Oct 2026). The idea descends from our SIH 2026 problem-statement design (voice-clone detection on cellular calls), of which no code survived; the capture path, detector evaluation, MCP server, Alexa+ client, Telegram verification and scam-language layer are new.

Licenses

Code: MIT. Model weights are downloaded at runtime and keep their own licenses: Speech-Arena-2025/DF_Arena_500M_V_1 (non-commercial), nii-yamagishilab/wav2vec-small-anti-deepfake (CC BY-NC-SA 4.0, evaluation only). Clone tools used for testing: F5-TTS (CC BY-NC weights), Chatterbox (MIT).