5-day proof of concept for the YC Fall 2026 "Proving You're Human" request for startups.
"Whoever builds this becomes the layer every bank, app, and video call checks before it trusts anyone." Max Kolysh, YC Partner
An API that proves there's a real human behind a voice interaction. No hardware, no iris scans, no crypto, no stored biometrics.
Deepfakes cost $1.6B in financial losses in 2025. Someone wired $25M on a video call where everyone else was a deepfake. Voice clones cost $20 a month now. Anyone can fake anyone's voice.
Every trust signal we have, seeing a face or hearing a voice, was built for a world where faking a human was expensive. That world is gone.
What's out there
Reality Defender, GetReal, and the others are enterprise only. $50K a year, 6 month sales cycles. World ID needs a physical Orb to scan your iris, stores biometric data, got banned in 6 countries, and forces crypto on you. POY Verify and BrightID live in Web3 land. Nobody built this for regular developers.
The "Stripe for human verification" doesn't exist. An API you integrate in 5 minutes, pay as you go, get on with your life.
GET /v1/challenge → "piano seven sunset orange" (random, expires 5 min)
User says it out loud
POST /v1/verify → is_human: true, confidence: 0.87
Three checks run in parallel
Speech to text. Whisper tiny transcribes the audio, then fuzzy matching compares it to the expected phrase. Tolerates accents, phonetic differences, number normalization ("19" becomes "nineteen").
Voice activity detection. Silero VAD (a real deep learning model, 2MB) checks if the speech pattern looks natural. Real humans pause, vary segment lengths, don't have perfect padding between words.
Anti-spoof. 12 spectral and temporal features analyzed: MFCC, spectral centroid, bandwidth, rolloff, flatness, contrast, ZCR, RMS dynamics, silence ratio, attack, HF energy, harmonic periodicity. Catches replay attacks, basic TTS, vocoder artifacts, dead silence.
No biometric data stored anywhere. Challenges are ephemeral, 5 minute TTL. No PII collected. GDPR compatible by default. Works on any smartphone microphone. No crypto tokens, no wallets, no blockchain. A plain REST API with 3 endpoints.
This is a 5 day proof of concept. I'm not going to pretend otherwise.
The challenge-response architecture works. Random phrases with TTL mean you can't pre-record. The fuzzy STT handles real world accents and Whisper's phonetic quirks. The VAD catches synthetic padding and unnatural patterns. Basic TTS, replay attacks, and silence all get rejected.
But good TTS, like ChatGPT voice or ElevenLabs, still gets through. The 12 spectral heuristics catch basic synthesis but modern neural TTS is too clean. The real defense needs a deep learning model trained on ASVspoof datasets, something like AASIST or RawNet3. SpeechBrain has these but it doesn't work on Windows without Developer Mode (symlink issue). On Linux it's a straight install.
The other gap is video. Voice only right now. Video liveness (blink detection, micro-movements, gesture challenges) is the obvious next layer.
I know exactly what needs to be fixed. It's engineering, not research.
The moat isn't the detection algorithm. It's the architecture.
Active, not passive. Reality Defender and GetReal observe existing audio. HumanLayer generates an unpredictable challenge. A deepfake has to respond in real time to words it's never seen. That's an order of magnitude harder than faking a conversation you already know about.
Privacy by design. Nothing stored, nothing leaked, nothing to regulate. This avoids the exact backlash that got World ID banned in Spain, Portugal, France, Germany, Brazil, and Kenya.
The network. Every verification feeds back. More apps integrating means more data on real vs fake voice patterns. A moat no single enterprise deployment can build.
The RFS says it straight. "We don't know exactly what the solution looks like. Ideally it's one that doesn't make everyone give up their privacy."
I built the simplest thing that could work, found exactly where it breaks, and know precisely what it takes to fix it. Cybersecurity background, offensive and defensive, understand both sides of the attack. PoC in 5 days with API, demo, tests, and deploy scripts.
git clone https://github.com/VagabondSEC/humanlayer
cd humanlayer
python -m venv venv
source venv/Scripts/activate
pip install -r requirements.txt
python -m api.main
# → http://localhost:8000/demoGET /health
GET /v1/challenge?lang=fr
POST /v1/verify multipart: audio (file) + challenge_id (string)
Python 3.11, FastAPI, Uvicorn. faster-whisper tiny for STT. Silero VAD via PyTorch. librosa for spectral forensics. pydub for multi-format audio. rapidfuzz for matching. ECAPA-TDNN and AASIST planned for anti-spoof v2.
bash deploy.shSystemd, gunicorn, nginx, certbot on GCP VM.
MIT