{"id":"064a7b24-b0c5-4f92-990d-ec780771de17","arxiv_id":"2506.14337","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"On a curated 100-email test set, three of four evaluated LLMs detected phishing intent from email text with 88 to 97 percent accuracy and categorized attacks into link, attachment, or service types.","lead":"We tested several large language models on the task of reading the subject and body of an email and deciding whether it is a phishing attempt. The best models, GPT-4o-mini, Claude 3.5 Haiku, and Phi-4, scored over 88 percent accuracy on a small 100-email set, while a smaller Qwen model largely failed. The results suggest that language models could complement metadata-based filters by catching phishing emails that a human reader would recognize from the text alone.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Training-data contamination may explain the high accuracies: the validation set draws on public LING/Nazario/Enron emails that predate the models' training, and the paper itself reports filtering Enron emails the models recognized.","rationale":"The reader's verdict of CONDITIONAL rests on the representativeness and label correctness of the 100-email validation set. My stress-test identifies a sharper and more decisive threat: training-data contamination. The paper itself provides evidence of this threat when it describes filtering out Enron emails that the LLMs recognized, yet no systematic leakage check is applied to the LING and Nazario phishing emails or to the remaining validation items. Because all three datasets are public and far predate the evaluated models' training, the high accuracy in Table II may be an artifact of memorization rather than evidence of intent-based generalization. This does not make the authors dishonest or the taxonomy useless; the taxonomy and prompt designs are reasonable, and the qualitative justifications are plausible. But the central empirical claim—that LLMs are capable of detecting and categorizing phishing emails from text alone—is not supported until the evaluation is repeated on genuinely unseen, contemporaneous emails. That is why I move the verdict from CONDITIONAL to UNVERDICTED: the manuscript provides no valid empirical basis to confirm or refute the claim as it stands. A concrete fresh-data test, as described above, would settle the concern.","tokens_in":7951,"tokens_out":4639,"duration_ms":50817,"concrete_test":"Build a fresh validation set of 100 phishing emails harvested from a live feed (e.g., PhishTank or a mail provider's spam trap) with send dates after the models' knowledge cutoffs, plus 100 legitimate emails from the same period; have two independent analysts label them with the paper's binary and category schema; run the exact Exp3 zero-shot and few-shot prompts from Section IV-C on the three strong models. If detection accuracy on this fresh set is materially lower than Table II (e.g., below 85%), the original result is explained by training-data leakage rather than generalized intent inference.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"The central claim—that modern LLMs detect phishing by inferring intent from text—requires that the validation emails be unseen by the models. Section IV-A states that the validation set was manually selected from LING, Nazario, and Enron, all public datasets that predate GPT-4o-mini, Claude 3.5 Haiku, and Phi-4 and are widely mirrored in training corpora. The paper's own preprocessing step 4 admits that LLMs recognized Enron emails and that such emails were removed and replaced. That is direct evidence of memorization leakage in the very pipeline used for evaluation. No systematic decontamination is reported for the remaining 100 emails. If the models have memorized exact bodies or near-duplicates, Table II's 88–97% accuracies reflect retrieval, not intent inference. The Qwen contrast and category accuracies are likewise uninterpretable under this confound. Additionally, the class balance of the 100-email set is not reported, so accuracy alone can mislead even absent leakage. The reader's concern about representativeness is real, but the more load-bearing issue is that the evaluation set is not shown to be unseen, making the central capability claim unverified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes using LLMs to detect phishing emails from subject and body text alone, and to categorize phishing emails into a MITRE ATT&CK-derived intent taxonomy (Phishing via Link, Attachment, Service, Other). The authors curate a 100-email validation set from LING, Nazario, and Enron, design zero-shot and few-shot prompts in three experiments, and evaluate GPT-4o-mini, Claude 3.5 Haiku, Phi-4, and Qwen. Table II reports detection accuracy of 88 to 97 percent and category accuracy of 76 to 95 percent for the three stronger models, with Qwen performing poorly. The paper concludes that LLMs can infer phishing intent and generate useful justifications, complementing metadata-based defenses.","tokens_in":8191,"tokens_out":5540,"duration_ms":57524,"significance":"If the experimental evidence were clean, the paper would be a useful practical contribution: a text-only, intent-focused LLM pipeline with a released 100-email dataset and a simple MITRE-aligned taxonomy. The authors deserve credit for releasing the dataset, for specifying the prompts in the text, and for holding out the validation set until the final evaluation phase. However, the central claim is currently undercut by the lack of evidence that the 100-email validation set is unseen by the models, by the small sample size and absence of uncertainty quantification, and by the absence of a non-LLM baseline. These issues are fixable, so the paper merits revision rather than rejection.","major_comments":[{"comment":"The evaluation set is not shown to be unseen by the models. The validation set is manually selected from LING, Nazario, and Enron, all public corpora that predate the evaluated models, and the paper itself reports that Enron emails were removed because LLMs recognized them. This is direct evidence of memorization leakage within the evaluation pipeline. Because no decontamination is reported for the remaining 100 emails, the high accuracies in Table II may reflect retrieval of memorized text rather than inference of phishing intent. The authors should either evaluate on newly collected or private emails, or systematically quantify exact and near-duplicate overlap with model training data, and they should report the class balance and source composition of the 100-email set.","section":"Section IV-A, preprocessing step 4"},{"comment":"The evaluation rests on a single 100-email validation set with no confidence intervals, no repeated runs, and no inter-annotator agreement. For example, Exp1-Zero reports 97%, 96%, 90%, and 44% across models; with n=100 the standard error around a 96% accuracy is roughly two percentage points, so differences among the top models are not statistically meaningful. Category accuracy denominators are also unexplained (e.g., 86.05% suggests 37/43 phishing emails in some condition). Please report per-class counts, binomial confidence intervals, repeated sampling with fixed decoding parameters, and label agreement between the annotators.","section":"Section V, Table II"},{"comment":"The conclusion states that LLMs achieved above 95% accuracy in phishing detection, but Table II shows phi-4 at 90% in Exp1-Zero and the category accuracy for several conditions falls below 80%. Moreover, no baseline (e.g., a keyword classifier, a traditional machine-learning detector, or a random-guess level) is reported, so the practical significance of the absolute accuracies is not established. A comparison against at least one non-LLM baseline would support the claim that the approach complements existing metadata-based defenses and would make the abstract's assessment of 'potential in this domain' more convincing.","section":"Section VI, RQ1"}],"minor_comments":[{"comment":"The exact full prompts used in the experiments are not reproduced; only templates are shown, and the source of the few-shot examples (which dataset, how selected) is not stated. Please include the actual prompts and the example-selection procedure for reproducibility.","section":"Section IV-C"},{"comment":"Sampling temperatures and other decoding parameters are not reported for either API or local inference. LLM outputs are stochastic, and the few-shot results (e.g., Qwen's 2% vs. 0%) may depend on these settings.","section":"Section IV-D"},{"comment":"The table would benefit from explicit row and column labels and from separating detection accuracy from category accuracy in the same cell; the current 'Detection / Category' notation and missing per-class breakdown make it difficult to interpret.","section":"Section V, Table II"},{"comment":"The categories are described as intent types but are defined primarily by delivery vector (link, attachment, service). The authors should clarify the relationship between 'intent' and delivery mechanism, as this directly affects the interpretation of RQ4 and RQ5.","section":"Section III"},{"comment":"The conclusion that justifications reveal the model's reasoning is stronger than the evidence presented; the paper states that justification quality was only preliminarily examined and no rubric was used. Please temper this claim or add a structured evaluation.","section":"Section VI, RQ3"},{"comment":"The paper cites a single Kaggle dataset for LING, Nazario, and Enron; separate primary citations and version identifiers would help readers verify the data sources and reconstruction.","section":"Section IV-A"},{"comment":"Minor typographical and formatting issues include 'a intent category' in Section IV-B1, inconsistent capitalization in the prompt text ('To CLICK'), and a dangling quotation mark at the end of the Phishing via Link definition in Section III.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The contamination issue is the main gating concern: because the paper itself provides evidence that the models recognized Enron emails, the onus is on the authors to demonstrate that the remaining 100 validation emails are not memorized. I would not accept the paper without a decontamination analysis or evaluation on a fresh, non-public set. The small sample and missing baselines also make the current claims stronger than the evidence supports. The released dataset and the MITRE-aligned taxonomy are useful, so revision rather than rejection seems appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe useful part of this paper is the intent taxonomy and the three-experiment design: they operationalize MITRE ATT&CK sub-techniques into three phishing intent categories and test four LLMs under zero- and few-shot prompting. The binary detection result is not new — ChatSpamDetector already showed LLMs can do that — but the per-category accuracy measurements across models and prompting modes are a reasonable addition. The paper is honestly written and reports its curation steps, including the fact that the authors filtered Enron emails that the models recognized.\n\nThat last detail is the problem. The validation set is built from LING, Nazario, and Enron, all public datasets that predate the models' training and are widely mirrored online. The authors' own preprocessing step 4 says they removed emails where the LLMs \"recognized the text.\" That is direct evidence of memorization leakage in the evaluation pipeline. A hundred held-out emails from public datasets is not a clean test of intent inference unless the authors systematically decontaminate them, and they don't report doing that. So Table II's 88–97% accuracies for the three strong models are uninterpretable as evidence about inference; they may largely reflect retrieval. The Qwen contrast and the category accuracies suffer the same confound. The reader's concern about representativeness is real, but the more load-bearing issue is that the evaluation set is not shown to be unseen.\n\nOther soft spots are minor by comparison: there is no baseline (traditional ML or keyword-based), no confidence intervals, no repeated runs, no inter-annotator agreement on the manual labels, and the class balance of the 100 emails isn't reported. Accuracy alone can mislead even without leakage.\n\nThe paper is not circular — the taxonomy comes from MITRE and the few-shot examples come from a separate training split, so that concern doesn't land. The central argument is plausible but unverified. I'd like to see the authors redo the evaluation on truly unseen emails (recent phishing from real inboxes, with a decontamination check) and add baselines and error bars.\n\nWho is this for? Researchers working on LLM-based email defense will find the taxonomy and prompt designs useful, but they should not cite the accuracy numbers as evidence. I'd send it to peer review because the question is timely and the taxonomy is a concrete contribution, but with the expectation of major revision.\n\nRecommendation: engage with it as a promising work-in-progress, not as a demonstrated result.","headline":"Useful taxonomy and prompt design, but the evaluation is compromised by likely training-data contamination, so the accuracy claims don't hold yet.","tokens_in":8692,"tokens_out":2101,"would_cite":false,"duration_ms":19614,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper reports that modern large language models can detect phishing from the email's text alone, reaching up to 97% detection accuracy on a curated test set.","keywords":["phishing detection","large language models","intent classification","zero-shot prompting","few-shot learning","email security","phishing taxonomy","cyber threat intelligence"],"falsifier":"Run the same prompts on a fresh, independently labeled set of several hundred recent phishing emails from live spam feeds mixed with benign corporate emails; if the three strong models' detection accuracy falls below 80% or their category accuracy approaches 25% (chance among the four labels), the reported text-only performance would not generalize.","tokens_in":7765,"feed_emoji":"🎣","tokens_out":7931,"duration_ms":71277,"temperature":0.7,"pith_summary":"The paper tries to establish that an LLM can act as an experienced reader of email, infer the sender's goal from the subject and body, and flag the message as phishing without any metadata such as sender authentication or IP addresses. It introduces an intent taxonomy with three categories—lure to a link, lure to open an attachment, and lure to move to an outside service—and tests four models in prompts with and without example emails. On a curated 100-email validation set, the three strongest models reach 88–97% binary detection accuracy and 76–95% category accuracy, while a smaller, older model fails badly. If the claim transfers, email defenses gain a text-only layer that complements metadata-based filters and outputs actionable triage information.","feed_headline":"Three LLMs catch phishing intent in text up to 97% of the time","feed_subtitle":"Subject and body alone let three modern LLMs flag phishing and sort it by attack vector.","key_machinery":"The load-bearing objects are an intent taxonomy and a two-step prompting protocol. The taxonomy sorts phishing into three categories defined by the action requested of the reader: via link (click or visit a URL), via attachment (open a downloaded file), and via service (act outside the inbox, such as calling a number or using a third-party channel), with an Other bucket for clear phishing that fits none of these. The prompting protocol first asks for a binary malicious-or-not verdict with a short justification and then, only for malicious emails, assigns a category; each prompt is run both zero-shot (no examples) and few-shot (two labeled example emails per category). A held-out set of 100 manually labeled emails, curated from three public email collections, carries the final accuracy figures that constitute the paper's evidence.","core_discovery":"The central claim is that phishing can be recognized by asking an LLM what act the sender wants the recipient to perform, using only the subject line and body text. With a taxonomy transposed from an established attack-vector framework into three categories (via link, via attachment, via service), the study reports that three current models—GPT-4o-mini, Claude 3.5 Haiku, and Phi-4 (14B)—classify the curated validation emails with detection accuracy between 88% and 97% and category accuracy between 76% and 95%, while Qwen (7B) scores far lower and often fails to follow the required output format. The authors read this as evidence that inherent language knowledge is largely sufficient, because adding two labeled examples per category in few-shot prompts produced mixed results rather than consistent gains.","pith_inferences":["We infer that the reported accuracy figures should be read as evidence of capability on a curated sample, not as expected live-performance numbers, because the test set is one 100-email collection labeled by the authors.","An unstated consequence is that intent categories could help separate urgent-but-legitimate marketing from phishing; a test set built around such near-miss emails would stress the method harder than the current collection does.","If the mechanism generalizes, a natural extension is to route the model's free-text justification into the triage queue as structured indicators for analysts, a direction the paper itself flags for future work.","We infer that a sharper evaluation would include phishing emails generated by LLMs, since the taxonomy deliberately drops the 'spear' qualifier to cover such campaigns but the current test set appears not to contain them."],"forward_implications":["Text-only screening can catch phishing that slips past metadata-dependent filters, because it judges what the email asks the reader to do.","Category output gives security teams a triage head start: link, attachment, and external-service lures point to different investigation and response procedures.","Zero-shot performance is already high for the strongest models, so a deployment need not carry labeled example sets or risk few-shot prompt bloat.","Smaller or older models may be unsuitable for intent-based phishing detection, since the 7B model in this study failed on both accuracy and output format.","Cost and latency are practical: the reported API-based experiments took one to three minutes and roughly $0.01–$0.03 per experiment."],"supporting_citations":[{"why":"Supplies the attack-technique framework whose phishing technique the paper transposes into its three intent categories.","marker":"[5]"},{"why":"Argues that LLMs can scale spear phishing and proposes LLM-based detection, motivating the defensive use of LLMs.","marker":"[8]"},{"why":"Provides empirical precedent for LLM-generated phishing and argues that communicative intent separates malicious email from marketing.","marker":"[9]"},{"why":"Recent LLM phishing detector with very high accuracy on real-world emails, the closest strong baseline for the paper's approach.","marker":"[11]"},{"why":"Source of the public phishing and benign email collections from which the paper's curated training and validation sets are drawn.","marker":"[15]"},{"why":"Defines the link-delivery subtechnique whose delivery-vector logic becomes the 'phishing via link' category.","marker":"[16]"}],"fun_headline_variants":["LLMs flag phishing emails by reading sender intent in text alone","Phishing intent detected up to 97% accuracy using LLMs on text","Intent-based LLM screening catches phishing without metadata","Three LLMs read email text to spot phishing intent 97% of the time"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result depends on the 100 hand-labeled emails being a fair sample of the phishing and legitimate email that actually reaches real inboxes; if that sample or its labels are unrepresentative, the accuracy figures will not transfer.","fun_headline_variants_meta":{"raw":{"variants":["LLMs flag phishing emails by reading sender intent in text alone","Phishing intent detected up to 97% accuracy using LLMs on text","Intent-based LLM screening catches phishing without metadata","Three LLMs read email text to spot phishing intent 97% of the time"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00114,"raw_usage":{"total_tokens":4690,"prompt_tokens":860,"completion_tokens":3830,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":476,"completion_tokens_details":{"reasoning_tokens":3764}},"tokens_in":476,"tokens_out":3830,"duration_ms":22326,"temperature":1.0,"reasoning_tokens":3764,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:52:18.089873+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same prompts on a fresh, independently labeled set of several hundred recent phishing emails from live spam feeds mixed with benign corporate emails; if the three strong models' detection accuracy falls below 80% or their category accuracy approaches 25% (chance among the four labels), the reported text-only performance would not generalize.","supporting_citations":[{"cited_title":"Available: https://attack.mitre.org/techniques/T1566/","cited_arxiv_id":null,"evidence_quote":"Supplies the attack-technique framework whose phishing technique the paper transposes into its three intent categories."},{"cited_title":"Heiding, B","cited_arxiv_id":null,"evidence_quote":"Provides empirical precedent for LLM-generated phishing and argues that communicative intent separates malicious email from marketing."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Source of the public phishing and benign email collections from which the paper's curated training and validation sets are drawn."},{"cited_title":"Available: https:// attack.mitre.org/techniques/T1566/002/","cited_arxiv_id":null,"evidence_quote":"Defines the link-delivery subtechnique whose delivery-vector logic becomes the 'phishing via link' category."}],"review_version":1}