{"id":"e7d9b600-75d8-487a-8011-20c42c00aa41","arxiv_id":"1908.06893","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A word-level LSTM trained on a mixture of legitimate and phishing emails can produce short, partially coherent phishing-style texts, but the paper's evidence that these texts defeat statistical detectors is weak and ambiguous.","lead":"This paper trains a word-level LSTM on legitimate and phishing emails to automatically generate fake phishing-style messages. It then checks whether three simple text classifiers can spot the generated emails, and compares the output to a rule-based email generator.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed detector evasion is unsupported: Table 4 never states which class its metrics describe, and with 100 legitimate and 25 generated test emails, no fake-email detection rate is reported; precision/recall cannot even be mapped consistently to the fake class.","rationale":"The reader's REJECT verdict is well-founded and my stress-test does not change it. I agree that the weakest assumption is the interpretation of Table 4: the paper never states the class the metrics describe, and the reader's suggestion that they might describe the legitimate class is exactly on target. In fact, the numbers are even more suspicious: for 25 fake emails, fake-class recall can only be multiples of 4%, so values such as 85, 75, and 95 rule out a per-class fake reading. The natural conclusion is that the paper never demonstrates how many generated emails were flagged as fake. The only quantitative figure in the paper therefore fails to support the central claim. The LSTM itself and the qualitative examples show that text generation from mixed corpora works in a trivial sense, but that is not the paper's headline. A simple confusion-matrix rerun with confidence intervals and a real-phishing baseline would settle the matter. I keep the reader's REJECT.","tokens_in":10490,"tokens_out":12434,"duration_ms":127268,"concrete_test":"Re-run the exact Section 4.2 experiment and output a 2x2 confusion matrix with rows and columns labeled 'legitimate' and 'generated'. Report the generated-class recall (TP_generated/25) and precision with a 95% binomial confidence interval, and reconcile Table 4's accuracy/precision/recall values with the integer cell counts. Run the same three classifiers on 25 real phishing emails (or on the Dada-engine emails) as a baseline. If generated-class recall is near chance or not better than the real-phishing baseline, the 'defeating statistical detectors' claim is not supported; if it is high and significantly above baseline, the claim gains support.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim, in the abstract and Section 1, is that generated emails can defeat statistical detectors. The only quantitative support is Table 4 in Section 4.2. The evaluation uses 100 legitimate and 25 generated emails, but the table does not say which class its precision, recall, and F1 refer to. This matters because a classifier can score well on the legitimate class while mislabeling all generated emails as legitimate: with 25 fake items out of 125, even a trivial all-legitimate predictor reaches 80% accuracy and 100% legitimate recall. If the metrics are meant for the fake class, the reported recall values (85, 75, 95) are impossible with 25 fake examples, since recall would move in steps of 4%. If they are meant for the legitimate class, SVM's reported 85 recall and 72 precision would require more than the 25 fake emails as false positives. No averaging scheme is stated. Section 5's error analysis only quotes a few misclassified generated emails; that is anecdotal and does not quantify evasion. There is no baseline of real phishing emails and no confidence intervals, so the claimed detector evasion is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a word-level LSTM-based natural language generation system for producing 'fake' phishing emails, trained on a mixture of legitimate and malicious email corpora, with the stated goal of generating targeted, malicious emails that evade statistical detectors. The authors vary the proportion of malicious training content and the sampling temperature, then evaluate the generated emails against SVM, Naive Bayes, and logistic regression classifiers trained on a separate email dataset. They also compare their output qualitatively with emails from the Dada Engine baseline. The central claims are that the system can generate customized malicious emails and that these emails can defeat text-based statistical detectors.","tokens_in":10729,"tokens_out":3029,"duration_ms":32289,"significance":"If the claims were well supported, the paper would address a timely and important security problem: the automated generation of phishing emails that bypass machine-learning detectors. The authors use real datasets, provide qualitative examples, and are transparent about the incoherence of their generated text. However, the load-bearing evidence for detector evasion is a single table whose metrics are undefined with respect to class, evaluated on only 25 generated emails with no baseline on real phishing emails and no error bars. The qualitative examples show text that is largely incoherent and dominated by placeholder tags such as <NET>, <LINK>, and <EID>, which undermines the claim of 'targeted' attacks. The paper does not provide reproducible code, machine-checked proofs, or parameter-free derivations; its main empirical claim is therefore not currently verifiable.","major_comments":[{"comment":"The central claim that generated emails 'defeat statistical detectors' is unsupported because Table 4 does not state which class the precision, recall, and F1-scores refer to. The test set contains 100 legitimate and 25 generated emails, so an all-legitimate predictor would achieve 80% accuracy. If the metrics describe the legitimate class, they say nothing about the detection rate of the generated (fake) class, which is the quantity directly relevant to the claim. If they describe the fake class, then the reported recall values (85, 75, 95) are impossible for 25 examples because recall would change in increments of 4 percentage points. No averaging scheme or class designation is provided, and there are no confidence intervals or error bars. A baseline using real phishing emails is also absent. The detection-evasion claim must therefore be considered unverified.","section":"Section 4.2, Table 4"},{"comment":"The paper claims the system generates emails 'customized depending on the attacker's intent,' but the only mechanism described is varying the percentage of malicious training emails and the sampling temperature. There is no mechanism that targets a specific victim's style, content, or context, which is the essence of an email masquerading or targeted attack. Moreover, the examples in Section 4.1 are largely incoherent, with repeated placeholder tags and sentence fragments. These examples, which the paper itself acknowledges suffer from 'random strings and grammatical errors,' do not demonstrate the generation of realistic or targeted malicious emails.","section":"Section 3.3.3 and Section 4.1"},{"comment":"The comparison with the Dada Engine baseline is only qualitative, based on two representative examples, with no quantitative measure of coherence, maliciousness, or detection evasion. The error analysis in Section 5 discusses a few misclassified generated emails but does not quantify the misclassification rate for the fake class; the anecdotes do not establish that the proposed method is effective at evading classifiers. The paper's own statement that 'more experiments are needed to determine the actual causes' of repetitive text further underscores that the system is not yet demonstrated to be effective.","section":"Section 4.3 and Section 5"}],"minor_comments":[{"comment":"The title contains a spacing error: 'Natu ral Language' should be 'Natural Language'.","section":"Title"},{"comment":"The second example is labeled 'Example IT' rather than 'Example II'; this typo should be corrected.","section":"Section 4.1(D)"},{"comment":"The second example is captioned 'Example I at Temperature = 0.7' but it is clearly the second example in that subsection; the caption should read 'Example II'.","section":"Section 4.1(A)"},{"comment":"Some references are incomplete; for instance, the entry for Ghazvininejad et al. (2016) gives no publication venue, and the entry for Sidhaye and Cheung (2015) lacks full bibliographic details. The paper also uses inconsistent formatting for author names (e.g., 'Verma' appears as 'V erma' in several places).","section":"References"}],"recommendation":"reject","confidential_remarks":"The paper's core contribution is an empirical evaluation of LSTM-generated phishing emails against standard classifiers. The evaluation is not sufficient to support the claim of detector evasion, and the generation examples are too incoherent to demonstrate targeted attack capability. The manuscript also has a notable self-citation pattern: the 'proposed baseline' from Baki et al. (2017) is co-authored by the second author, but this does not itself indicate misconduct; it does, however, raise a question about the novelty of the comparison. Given that the load-bearing evidence is flawed and the scope of the claims exceeds what the experiments show, rejection is appropriate. If the authors later provide class-specific detection rates, a real-phishing baseline, and larger samples with confidence intervals, a revised submission could be reconsidered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper applies a standard word-level LSTM to generate email text from a mixed legitimate/phishing corpus, tuning the phishing percentage and sampling temperature. That part is a reasonable exercise. The problem is the paper's central claim—that generated emails defeat statistical detectors—rests on Table 4, and Table 4 cannot describe the experiment as written. The test set is 100 legitimate and 25 generated emails. If precision/recall/F1 refer to the fake class, recall would have to move in 4% steps; the reported values (85, 75, 95) are impossible. If they refer to the legitimate class, SVM's 85 recall and 72 precision imply 33 false positives, more than the 25 fake emails in the test set. The table never states which class it reports, and no confusion matrix or averaging scheme is given. So the evasion claim is unsupported.\n\nCredit where it's due: the authors are honest about the poor quality of the generated text. Their examples are largely incoherent, full of placeholder tags, and they say so explicitly. They also flag unresolved repetition problems and ask for more experiments. Comparing to the Dada engine is a sensible move, and varying the malicious content percentage is a reasonable knob to explore. But none of that makes a routine LSTM application a sound result.\n\nSoft spots are proportional: the generation side is an honest feasibility study with negative results, and the detection side is the load-bearing claim and it fails. No baselines with real phishing emails, no error bars, no per-class metrics for the fake class, and only 25 hand-picked generated emails. Section 5's error analysis is anecdotal. The citation pattern is fine; the co-authored Dada baseline is appropriately cited.\n\nWho should read this: people curious about early deep NLG phishing attempts, or instructors looking for a case study in evaluation pitfalls. Not anyone seeking evidence that LSTM-generated phishing emails evade detectors.\n\nRecommendation: desk reject is defensible. The core experiment is internally inconsistent, so referees would be asking for a full redo rather than evaluating a result. If the authors rerun the detection experiment properly and release data and code, the idea might deserve another look.","headline":"A routine LSTM email generator, but the claimed evasion result rests on a detection table that is internally inconsistent with the reported test set.","tokens_in":11233,"tokens_out":4559,"would_cite":false,"duration_ms":44836,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A word-level LSTM trained on a mix of legitimate and phishing emails can generate targeted phishing text, and some of those machine-written emails evade simple statistical classifiers.","keywords":["phishing","email masquerading","natural language generation","recurrent neural networks","LSTM","text generation","spam filtering","adversarial machine learning"],"falsifier":"Re-run the three classifiers on the same 25 generated emails and give the confusion-matrix row for the generated-email class: if most of those 25 are labeled as phishing, the claim that the emails defeat the detectors fails; if most are labeled legitimate, it holds. The published table does not say which class its scores describe, so this single row settles the point.","tokens_in":10280,"feed_emoji":"🎣","tokens_out":11405,"duration_ms":117110,"temperature":0.7,"pith_summary":"The paper sets out to show that automated text generation can produce fake, targeted phishing emails: a neural network trained on a mixture of legitimate and phishing correspondence learns to sample messages whose wording shifts toward malicious cues as the share of phishing training data rises. The authors vary the phishing inflow from 5% to 50%, sample at four levels of randomness, and then ask whether standard text classifiers—support vector machines, naive Bayes, and logistic regression—separate the machine-written emails from legitimate mail. They report accuracy, precision, recall, and F1 scores below perfect for all three detectors, and compare their output against a rule-based email generator. For a sympathetic reader, the point is that phishing intent can be injected at training time, making the generator a plausible new attack tool even though the sampled text is often incoherent.","feed_headline":"25 machine-written phishing emails slip past three text classifiers","feed_subtitle":"A word-level LSTM trained on mixed email data can carry phishing intent and evade simple filters some of the time.","key_machinery":"The load-bearing component is a two-layer word-level LSTM—a recurrent neural network that keeps a memory state while predicting the next word—with 512 nodes per layer, trained on email bodies after URLs, email addresses, and named entities are replaced by tags. Temperature controls the softmax sharpness at sampling time: low values give repetitive deterministic text, high values give more stochastic, less coherent output. The intent-injection mechanism is the percentage of phishing emails mixed into the training text (5%, 10%, 30%, 50%). For evaluation, the paper builds document-term matrices from word counts and feeds them to support vector machine, naive Bayes, and logistic regression classifiers.","core_discovery":"The central claim is that intent can be baked into a recurrent network's training set rather than hand-authored in grammar rules. Training one model on legitimate emails plus 50% of a cleaned phishing corpus yields generated bodies that use account-restriction language, urgency, and link-clicking prompts; training on 5% produces far weaker malicious signals. When 25 such samples from the 50% model are tested against three lexical classifiers trained on separate legitimate and phishing email data, the detectors' reported accuracy, precision, recall, and F1 stay below perfect separation, which the paper reads as evidence that some machine-generated emails evade statistical detection. The authors also position the LSTM output against a rule-based email generator, arguing that the recurrent text resembles phishing more closely while sacrificing the coherence that the rule-based baseline retains.","pith_inferences":["A testable extension is to train a detector on the generator's own output as an adversarial class; the LSTM makes near-miss phishing variants nearly free, which could harden classifiers instead of only attacking them.","The same word-level training recipe should transfer to chat or social-media messages, since the model learns from plain text streams rather than email-specific structure.","An attacker would likely choose the lowest sampling temperature that still reads as natural, and a defender could exploit that by flagging text that repeats training-like fragments or collapses into nonsense at higher temperatures."],"forward_implications":["An attacker could train on a victim's own sent mail plus a generic phishing corpus and automatically sample targeted emails with account-restriction and urgency cues, removing the human effort currently needed to hand-craft masquerade messages.","Detectors built only on word-count features are the stated target: the reported scores imply that such classifiers do not cleanly separate machine-written samples from legitimate email, so detection will need richer features or generated-text awareness.","The share of malicious training data acts as an intent dial: the paper's examples show 50% phishing inflow producing account-frozen and password-reset language that 5% inflow does not.","Because the LSTM output is often ungrammatical, the practical threat is not polished prose but volume: an attacker can generate many candidate messages cheaply and keep the ones that pass a detector."],"supporting_citations":[{"why":"Supplies the rule-based email generator and the 12 masquerade emails used as the comparison baseline.","marker":"(Baki et al., 2017)"},{"why":"Provides the anatomy of phishing emails used to judge whether generated text carries malicious cues.","marker":"(Drake et al., 2004)"},{"why":"Supports the choice of word-level over character-level LSTM text generation.","marker":"(Xie et al., 2017)"},{"why":"Offers the two-stage stochastic email synthesis methodology the paper says its system is aligned with.","marker":"(Chen and Rudnicky, 2014a)"},{"why":"Supplies the Cornell PhishBowl phishing emails used to train the detection classifiers.","marker":"(IT@Cornell, 2018)"},{"why":"Supplies legitimate Clinton emails used in training and as detector test data.","marker":"(WikiLeaks, 2016)"}],"fun_headline_variants":["AI-trained model writes phishing emails that slip past detectors","LSTM email generator evades three statistical text filters","Machine-written phishing text bypasses simple classifiers","Training on mixed data creates stealthy automated phishing","Recurrent neural network produces phishing emails that evade filters"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's quantitative evasion claim assumes the table's accuracy, precision, recall, and F1 scores describe how often the generated fake emails are the ones being detected, but the table never states which class those numbers refer to.","fun_headline_variants_meta":{"raw":{"variants":["AI-trained model writes phishing emails that slip past detectors","LSTM email generator evades three statistical text filters","Machine-written phishing text bypasses simple classifiers","Training on mixed data creates stealthy automated phishing","Recurrent neural network produces phishing emails that evade filters"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00081,"raw_usage":{"total_tokens":3501,"prompt_tokens":837,"completion_tokens":2664,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":453,"completion_tokens_details":{"reasoning_tokens":2591}},"tokens_in":453,"tokens_out":2664,"duration_ms":18576,"temperature":1.0,"reasoning_tokens":2591,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:31:42.447582+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the three classifiers on the same 25 generated emails and give the confusion-matrix row for the generated-email class: if most of those 25 are labeled as phishing, the claim that the emails defeat the detectors fails; if most are labeled legitimate, it holds. The published table does not say which class its scores describe, so this single row settles the point.","supporting_citations":[],"review_version":1}