Patient Zero

Inspiration

Scam texts are not sent one at a time - they're blasted to thousands of people in minutes. We realized that traditional scam filters all make the same mistake: they look at one message and ask "does this look like a scam?" But every new campaign is a zero-day. Its wording has never been seen before, and AI now lets scammers rephrase every message to slip past content filters. At the same time, we cannot invade user privacy by reading their texts; so we built a system that can prevent and protect with just the breadcrumbs.

What it does

Patient Zero detects scam campaigns by their spread and fingerprint; not their content. A scammer blasts slightly nuanced messages across the network; each phone turns its message into a privacy-preserving fingerprint (never the raw text). Our detector watches for a cluster of similar fingerprints growing fast across many strangers - the moment that burst crosses a threshold, it flags the campaign, warns everyone who hasn't opened it yet, and gives a recovery checklist to those already hit. In our simulation of UT Dallas, we catch a campaign after ~6 messages and protect the other 4,994 residents before they ever open it.

When a campaign is flagged, an NVIDIA Nemotron agent investigates - reasoning purely over behavioral metadata (velocity, timing, sender patterns, cluster overlap), since the messages themselves are end-to-end encrypted. It identifies when several differently-worded clusters are actually one coordinated attack that used an LLM to rephrase itself and evade fingerprint detection, then writes a human-readable incident report.

How we built it

Detection (Python): character n-gram SimHash fingerprinting, sliding-window velocity + distinct-recipient clustering, and a sender-reputation guard that ignores legitimate bulk senders like newsletters.
State + real-time sync (SpacetimeDB): residents, messages, campaigns, and warnings all live in SpacetimeDB, which streams state changes live to the frontend. Reducers handle the scam blast and the protective warning dispatch.
AI investigation (NVIDIA Nemotron): an agent that reasons over cluster metadata to detect coordinated, LLM-rephrased campaigns without ever reading message content.
Attacker simulation (Gemini): generates realistic reworded scam variants to stress-test the detector.
Frontend (deck.gl + MapLibre): a live 3D map of the UT Dallas campus where normal traffic flows calmly and a scam attack erupts in real time - residents turn red as they're hit and green as they're shielded.

Challenges we ran into

Privacy vs. detection. Our whole premise is never reading users' messages - but that meant we couldn't use embeddings or semantic similarity. We had to design detection entirely around privacy-preserving fingerprints and behavioral metadata.
SimHash on short, reworded text. Heavy LLM rephrasing split our fingerprints apart, which turned into a feature: we use Nemotron to re-unify the clusters by behavior.
A brand-new database. None of us had used SpacetimeDB; getting Python to read and write to it over HTTP (no official Python SDK) took real debugging.

Accomplishments that we're proud of

A detection pipeline that catches a zero-day campaign after ~6 messages and protects 99% of the network.
A genuinely privacy-preserving design: we never read a single message, only fingerprints and metadata.
A live 3D map of HackUTD's fictional Avnon city under attack that makes the whole system tangible.

What we learned

How real-world scam detection actually works, and why spread-based detection beats content filters for zero-day campaigns.
The privacy tradeoffs behind similarity search - why fingerprints and metadata are the right tool when you can't (and shouldn't) read content.
Standing up a reactive, real-time backend in SpacetimeDB from scratch.

What's next for Patient Zero

Real carrier-scale deployment with client-side fingerprinting and differential privacy on the fingerprints themselves.
Campaign attribution - linking separate attacks to the same threat actor over time.
A confidence-tiered response: auto-protect on high confidence, human review on the edge cases.