Tripwire

• 

  tripwire_gallery_offline

• 

  tripwire_gallery_final

• 

  tripwire_gallery_cloud_sync

Inspiration

Most camera-based AI systems send all video to the cloud. This creates privacy risks, uses large amounts of bandwidth, and stops working when the internet connection fails.

Tripwire takes a different approach. It processes the camera feed directly on the phone. The phone then decides what information, if any, should be sent to the cloud.

What it does

Tripwire turns an ordinary smartphone into a privacy-focused edge agent. The live camera feed is processed locally in the browser, so raw video is never uploaded.

When the system detects an event, it records the detection in a tamper-evident ledger stored on the device. Only a short event summary and a small image from the video are sent to Qwen Cloud.

Qwen acts as an independent reviewer. Its vision model checks whether the image supports the claim made by the phone's detector. It then returns:

• the level of severity;
• an explanation of its decision; and
• a supports_claim result.

The server signs Qwen's decision and attaches it as separate metadata. It does not change the original detection record.

Tripwire also continues working without an internet connection. The phone keeps detecting events and recording them locally. Events that require cloud review are stored in a persistent queue.

When the connection returns, the queued events are sent to the cloud and the ledger is synchronised. The cloud recalculates the hash chain, verifies the device signatures and checks the signed cloud verdicts. It rejects missing data, rollbacks and attempts to rewrite earlier records.

Qwen then reviews the verified ledger and produces a clear incident summary.

How I built it

Tripwire was built using:

• Vite and TypeScript for the progressive web application;
• MediaPipe Tasks Vision for object detection on the phone;
• IndexedDB for the local ledger and offline queue;
• SHA-256 hash chaining to preserve the order of events;
• a non-extractable WebCrypto ECDSA P-256 key for device signatures;
• a Node.js backend deployed as an Alibaba Cloud Function Compute Web Function;
• Qwen Vision through Alibaba Cloud Model Studio and DashScope to review visual evidence;
• Qwen text generation to produce incident reports from verified ledgers; and
• server-side HMAC signatures to prove the source of cloud verdicts.

The trust model works in both directions. The device signs each detection, while the cloud signs each verdict. Qwen's analysis is stored separately, allowing the cloud to add context without changing the original signed evidence.

Challenges we ran into

The main challenge was combining cloud analysis, which may change as new information becomes available, with an evidence record that must remain unchanged.

We solved this by keeping the device's signed detection chain permanent. Qwen's verdicts are added separately and signed by the server.

Another challenge was maintaining reliable offline operation in a browser. The progressive web application caches the files it needs, stores events in IndexedDB and sends queued events only after the internet connection returns.

We also had to define the limits of the security model clearly. Tripwire can detect changes made after an event has been recorded. However, a fully compromised device could create a false history before its first trusted connection with the cloud. Hardware-backed device attestation is therefore an important future improvement.

Accomplishments that I am proud of

• Built a working edge-cloud agent using an ordinary smartphone.
• Kept all raw camera video on the device.
• Demonstrated that the system continues working in airplane mode with Wi-Fi disabled.
• Reduced bandwidth use by 99.7% during the recorded demonstration.
• Implemented signed and hash-chained detection records.
• Created append-only cloud verification.
• Used Qwen as both an evidence reviewer and an incident analyst.
• Deployed the backend using Alibaba Cloud Function Compute.
• Completed the prototype without spending money by using existing devices and hackathon credits.

What I learned

Privacy and cloud intelligence do not have to conflict.

An edge agent can process continuous video locally and send only the minimum evidence required for further analysis. It can also create a record that another system can verify independently.

We also learned that an effective agent needs more than the ability to detect objects. It needs reliable memory, clear trust boundaries and a recovery process for periods without internet access.

What is next for Tripwire

The next steps are to:

• store verified ledgers in Alibaba Cloud Object Storage Service;
• add hardware-backed device attestation;
• support the merging of ledgers from multiple devices;
• introduce policy-based escalation thresholds;
• support more detection categories; and
• create a tamper-testing interface that demonstrates the rejection of rollbacks and rewritten records.

Built With

• alibaba
• cryptography
• dashscope
• indexdb
• mediapipe
• node.js
• qwen
• typescript
• vite
• webcrypto