💡 Inspiration

YouTube comment sections on popular channels are plagued by scam bots impersonating creators. These bots copy creator profile pictures, use lookalike Unicode homoglyphs (e.g., Cyrillic а instead of Latin a), insert invisible zero-width characters, and promote WhatsApp/Telegram crypto scams.

Existing solutions rely on slow, expensive LLM calls or basic keyword blockers that fail against obfuscated text. We built CommentGuard to provide a 100% deterministic, ultra-fast 7-signal forensic engine that detects and eliminates scam impersonators before they can harm creator communities.

🛡️ What it does

CommentGuard automatically fetches YouTube video comments and evaluates each commenter against a deterministic 7-signal scoring pipeline:

Character-Level Name Forensics: Scans display names for substituted homoglyphs (Cyrillic, Greek, Mathematical Unicode) and invisible zero-width characters.
64-bit DCT pHash Avatar Comparison: Computes discrete cosine transform perceptual image hashes (pHash) to compare commenter avatars against the real creator's profile picture using Hamming Distance.
Handle & Channel ID Verification: Validates exact @handle matches and checks against creator allowlists.
Scam Language & Contact Scraping: Detects Telegram/WhatsApp phone numbers, payment handles, and high-risk financial keywords.
Intent Classification & Category Breakdown: Categorizes comments into Scam & Spam, Questions, Feedback, Complaints, and General.
Bulk Moderation & Dry-Run Mode: Allows creators to reject or hold suspicious comments in bulk with full dry-run safety toggles.
CSV Export & Audit Logging: Exports detailed forensic reports with codepoint-level evidence for community moderation logs.

🛠️ How we built it

Backend Core: Python, FastAPI, Async Httpx with semaphore connection pooling for sub-second avatar fetching.
Forensic Package (packages/scorer): Custom 7-signal deterministic scoring engine written with strict unit testing and 100% Precision/Recall verification gates.
Perceptual Hashing: OpenCV & PIL image processing for 64-bit DCT-II pHash calculation.
Frontend Dashboard: React 18, Tailwind CSS, Google Fonts (Plus Jakarta Sans & JetBrains Mono), and Glassmorphism design system with Light/Dark theme switching.
Database & Storage: SQLite audit logging for local scan persistence.
Integration: YouTube Data API v3 for fetching live video threads and comment metadata.

🚧 Challenges we ran into

Avatar Download Bottlenecks: Downloading hundreds of commenter avatars per scan initially caused latency. We solved this by implementing a shared HTTP/2 keep-alive client session with a 15-worker semaphore, dropping avatar comparison time from 12 seconds to under 0.8 seconds.
Preventing False Positives on Generic Names: Short creator titles (e.g., < 5 chars) can match innocent commenters. We implemented a dynamic weight damping rule that lowers Signal 1 contribution when channel titles are prone to collisions.
Handling Unicode Obfuscation: Building a comprehensive Unicode homoglyph map to normalize mixed-script strings back to their base ASCII skeletons.

🏆 Accomplishments that we're proud of

100% Deterministic & Non-LLM: Zero API cost per score, sub-millisecond scoring latency, and predictable 0-100 risk scoring.
Sub-Second pHash Matching: Accurate visual stolen avatar detection with a Hamming distance threshold of $\le 6$.
High-Precision Scorer: Achieved 1.00 Precision and 1.00 Recall on evaluation test suites.
Sleek UX: Interactive dashboard with character-level forensic pills, side-by-side avatar comparisons, and bulk moderation workflows.

📚 What we learned

How subtle Unicode character substitutions (Bidi overrides, zero-width joiners) are exploited in modern social engineering.
Best practices for combining perceptual hashing (pHash) with text forensics for multi-modal identity protection.
Optimizing Python async I/O pipelines for high-concurrency API workloads.

🚀 What's next for CommentGuard

Direct YouTube OAuth2 Integration for automated real-time background comment deletion.
Browser Extension for creator Studio dashboard overlay.
Multi-platform support for Instagram, TikTok, and X (Twitter) comment protection.