Research prototype. Synthetic data and simulated payments only — not an official or production security service. Limitations

Limitations

What Tumaini does not do (yet)

We would rather you trust Tumaini a little less and verify a little more.

This is a research prototype

  • It is not an official, government-endorsed or production security service. It is not affiliated with the UAE Cyber Security Council, TDRA, Dubai Electronic Security Center or any bank.
  • “Falcon Demo Bank” and “Demo Federal Services Authority” are fictional. All people, messages and money are synthetic. No real payments are made; message delivery to trusted contacts is simulated.

Detection limits

  • Voice analysis uses an open pretrained model (MMS-300M-AntiDeepfake). Its test sets contain pre-2023 fakes; it can miss modern voice clones and can flag genuine speech, especially over compressed channels (about a quarter of genuine WhatsApp-quality English clips come back “inconclusive”). Measured performance — including poor results — is on the evaluation page.
  • The model weights are licensed CC BY-NC-SA 4.0 (non-commercial). That is fine for this research prototype; a commercial service would need a licensed or self-trained model.
  • Arabic detection was measured on one public dataset (ArAD: Levantine dialect, voice conversion, short clips). Gulf dialects and Arabic text-to-speech were not tested, so we make no general Arabic accuracy claim.
  • Image and video deepfake detection are not implemented. Images and video get C2PA provenance checks only.
  • Request extraction uses rules. Unusual phrasing can be missed; the payment hold applies regardless whenever money is requested.

Product limits

  • The Tumaini Assist mobile app is in development and not available in any app store. Every phone screen on this site is a labelled concept design, not a screenshot of a released app.
  • There is no iOS share extension or Android share option yet. Today you check content by uploading it on the website.
  • “Read aloud” is planned, not built. The child-friendly wording in the children’s example is written for that example, not generated for each child.
  • Contextual analysis with Google Gemini is built but not switched on. When it is, it will ask for your consent each time and can never approve a payment or confirm who sent something.
  • Webhooks and production API keys for developers are not built yet.

Provenance limits

  • Missing provenance is normal and means “unknown”. A valid signature proves who sent the content and that it was not altered — not that every claim in it is true.
  • The trust registry and C2PA trust anchors are demo-only and expire. A real registry needs governance.

Operational limits

  • Uploads up to 4 MB; audio analysed up to 60 seconds; inference on a shared CPU server, so analysis can take several seconds and may queue under load.
  • Arabic is supported for explanations, safety guidance, request extraction and the demo voice note; the rest of the interface is English.