Trust layer Request a pilot
L0 · the decisionobey · confirm · block

Every spoken command is checked before your agent acts.

01

Hears everyone.
Obeys one.

VerbriskEvery command, verified
  • Decision
  • Signal
  • Speaker
  • Source
  • Content
Scroll
Sound, defined01 / 05

A voice is a pattern in time: syllables rising and falling over a ladder of harmonics. Every command your agent hears starts as one.

The trust gate —

An inaudible carrier lifts speech above 20 kHz. You can't hear it. The microphone can, and quietly turns it back into words.

Live monitor —

Two speakers: the person who woke the agent, and the one who gave the command. They are not always the same voice.

Solutions —

A room is full of voices: a television, a visitor, a phone on speaker. The agent hears every one of them.

Where it matters —

One decision. Four checks settle into a single answer your agent can act on: obey, confirm or block.

The trust gate —

Verbrisk listens to a command the way a physicist would: as a signal, a voice, a room and a sentence. Each has a measurement and a threshold.

SignalSpeakerSourceContent

Why now

Voice agents now pay bills, unlock doors and send messages. They act on whatever the microphone hears.

In 2017 the worst case of a hijacked voice assistant was a prank call. Today the same microphone sits in front of an agent that can move money, open a door or email a customer record.

Every attack below has been demonstrated in public research. None of them needs the attacker to touch the device. Most need nothing more than a speaker in the room.

Four ways a stranger
gives your agent orders.

Each one ends the same way without a trust layer: the agent hears a clear instruction and carries it out. Each one leaves a different mark.

A1 · ultrasonic commandsspectrogram · 0–24 kHz

signaturea carrier at 20 kHz, with speech mirrored in its sidebands

  1. A1

    Ultrasonic commands

    Speech modulated onto a carrier above human hearing, demodulated by the microphone itself.

    block · ultrasonic injection
  2. A2

    Your voice, not you

    A recording of the user, or a synthetic voice trained on a few seconds of it, played back through a speaker.

    block · replayed audio
  3. A3

    Another voice in the room

    The user says the wake word. A visitor, a child or the television says the command.

    confirm · second speaker
  4. A4

    Words aimed at the model

    "Ignore your previous instructions." Prompt injection, delivered by voice, to an agent that listens to everyone.

    block · spoken injection

Inside one decision

One command, taken apart.

"Unlock the front door", heard by a kitchen hub. Scroll to see every layer Verbrisk weighs before the agent acts.

Layer 1 · The audio

The capture, as the device heard it.

48 kHz, 2.4 seconds. Sample rate matters: below 36 kHz the ultrasonic band is gone, and Verbrisk says "could not check" rather than "clean".

Layer 2 · The checks

Four answers, each with a score.

Signal integrity finds a 20.0 kHz carrier with speech sidebands. The voice does not match the enrolled user. The transcript itself is harmless.

Layer 3 · The policy

Your rules, per action.

Unlocking is a critical action. Under the policy, any hostile signal on a critical action is a refusal, with no prompt to the user.

Layer 4 · The verdict

Blocked, with the reason.

The agent gets one answer it can act on, and your team gets an audit record of why.

input"Unlock the front door" · kitchen hub

Measured,
not claimed.

Every number on this page comes from public benchmark data and our own open-source engine. Results on your devices come from a pilot, and we will say so when they do.

0

false alarms on real speech

3,230 segments · 5,000 voice commands · public sets
0.83

speaker equal error rate

ECAPA-TDNN · LibriSpeech held-out speakers
13

unseen spoofing attacks separated

ASVspoof 2019 LA evaluation
0

attack trials executed

T1–T6 scenario harness · proxy corpus

For your agent

One tool call
before every action.

Your agent calls check_voice_command with the audio and what it understood. Verbrisk answers obey, confirm or block, with the reason and the evidence. No change to your speech stack.

REST APIPython SDKLLM tool schemaOn-prem or cloud
Read the developer docs
agent → tool call

    

  







  

    
Where a spoken command
can cost you.
Anywhere a voice can move money, open something, or reach a customer record.

    

      01
Banking and payments
Voice payments, transfers and account changes over app and phone.

      02
Contact centres and telco
Voice agents on phone lines, where audio arrives at 8–16 kHz.

      03
Healthcare
Records, prescriptions and appointments behind a spoken request.

      04
Automotive
In-car assistants that navigate, call and pay while driving.

      05
Smart home and devices
Locks, alarms and purchases from hubs, earbuds and glasses.

    

  







  

    
Open at the core
Built on EchoGuard.

    
The signal engine behind Verbrisk is EchoGuard, open source and benchmarked in public. Read the detector, rerun our numbers, see exactly where it stops working. Verbrisk adds speaker, source and content checks, policy, audit and the review workflow your team runs on.

      EchoGuard on GitHub 

  







  

    

      
Pilot programme
Put a trust layer in front of your agent.

      
Three handsets, one week, your real channel. You get false-accept and false-reject rates measured on your own audio, not ours.

      
Request a pilot See the product