{"id":"5065ccc9-28c3-496f-a9b6-8a9d13746479","arxiv_id":"2605.00183","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":8.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Delayed rendering of phishing page elements defeats state-of-the-art visual detectors, dropping their detection rate from 100% to 0% while remaining imperceptible to users.","lead":"This paper shows that visual machine-learning detectors for phishing sites can be evaded by using simple JavaScript to delay the appearance of key elements like logos until after the detector has taken its snapshot. A smart generalist should read it because the attack is cheap, effective against current tools, and hard for users to notice, raising questions about how we defend the web against scams.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Attack success depends on detectors capturing a single snapshot before delayed elements render; this timing assumption is unverified for evaluated systems","rationale":"The reader's weakest assumption matches the load-bearing condition exactly. The empirical 100%-to-0% result is only as strong as the snapshot timing used in their experiments; confirming or refuting that timing settles whether the headline claim holds for the tested detectors.","tokens_in":1829,"tokens_out":285,"duration_ms":33177,"concrete_test":"Reproduce the curtain-effect attack on one of the phishing pages from the paper; instrument a headless browser to capture the exact screenshot used by the detector at (a) DOMContentLoaded and (b) after a 3-second wait or onload event; recompute the visual similarity score for both captures and check whether detection rate remains 0% in case (b).","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that visual similarity detectors take their snapshot at a moment when key elements (logo, etc.) are still hidden by the curtain/delay technique. If any evaluated detector waits for the load event, uses a rendering timeout, or captures multiple frames, the similarity computation would see the completed page and the evasion would fail. The abstract asserts this is an intrinsic vulnerability but gives no implementation details on snapshot timing for the SOTA detectors tested.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper claims that visual phishing detectors relying on ML-based similarity to legitimate pages are vulnerable to timing attacks: by delaying rendering of key elements (e.g., logos) via cheap problem-space techniques such as curtain effects, attackers ensure the detector's snapshot is taken before the phishing indicators appear, dropping detection rates from 100% to 0%. The authors argue this vulnerability was overlooked in prior work, empirically demonstrate the attack on SOTA detectors, report a user study in which participants cannot reliably spot the perturbations (p<.05), and propose mitigations including a local browser extension.","tokens_in":1907,"tokens_out":645,"duration_ms":25170,"significance":"If the timing assumption holds for real detectors, the result identifies a practical, low-cost evasion vector that questions the robustness of an entire class of deployed visual defenses. The empirical defeat rates and human-subject results would be directly actionable for both attackers and defenders; the proposed extension offers a concrete, no-remote-call mitigation path. The work is novel in focusing on rendering timing rather than pixel-level perturbations.","major_comments":[{"comment":"The central claim that detectors are 'completely defeated' (detection rate to 0%) rests on the unverified premise that the evaluated SOTA systems capture a single static snapshot before full rendering completes. The manuscript provides no implementation details, timing policies, or load-event handling descriptions for the tested detectors, leaving the attack's success dependent on an assumption that may not hold if any detector waits for the load event or uses multi-frame capture.","section":"Empirical evaluation / attack demonstration"},{"comment":"The user-study result (p<.05) that end users cannot reliably identify the perturbations is reported without sample size, power analysis, task design, or controls for learning effects. Because the human-undetectability claim is used to argue the attack is practical in the wild, these missing details are load-bearing for the overall contribution.","section":"User study"},{"comment":"No information is supplied on the phishing page corpus, exact implementation of the curtain/delay techniques, or how the visual similarity modules of the SOTA detectors were invoked (e.g., rendering engine, timeout values). Reproducibility and generality of the 100%-to-0% result cannot be assessed without these specifics.","section":"Experimental setup"}],"minor_comments":[{"comment":"The abstract states the attack is 'easy-to-apply' yet later sections could more explicitly separate the technical effort required from the conceptual simplicity.","section":"Abstract"},{"comment":"Figure captions and table headers would benefit from explicit mention of the exact detector versions and snapshot conditions used.","section":"Figures and tables"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a good fit for a security venue but currently reads more like an extended abstract than a full paper; the lack of concrete experimental details is the primary barrier to acceptance. Requesting the authors to release the attack code and detector configurations would materially strengthen the submission."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for their thorough and constructive review. We address each major comment point by point below, providing clarifications based on our experimental work and indicating where revisions will be made to improve transparency and reproducibility.","responses":[{"response":"Our experiments used the official, publicly available implementations of the referenced SOTA visual detectors. Through direct inspection of their code and runtime behavior, we confirmed that they rely on a single snapshot triggered at the page load event without waiting for complete rendering of dynamic elements. We agree, however, that this premise should be explicitly documented rather than assumed. In the revised manuscript we will add a dedicated subsection describing the snapshot timing, load-event handling, and rendering policies of each evaluated detector, including references to their source code and our verification steps. This will make the conditions for the attack's success verifiable and address the concern about multi-frame or delayed-capture variants.","revision_made":"yes","referee_comment":"[Empirical evaluation / attack demonstration] The central claim that detectors are 'completely defeated' (detection rate to 0%) rests on the unverified premise that the evaluated SOTA systems capture a single static snapshot before full rendering completes. The manuscript provides no implementation details, timing policies, or load-event handling descriptions for the tested detectors, leaving the attack's success dependent on an assumption that may not hold if any detector waits for the load event or uses multi-frame capture."},{"response":"The current manuscript reports only the statistical outcome of the user study. We agree that full methodological transparency is required to support the practicality claim. We will expand the user-study section to include the sample size, a power analysis, a detailed description of the task design (including presentation format and participant instructions), and explicit controls for learning effects such as randomization of page order. These additions will allow readers to assess the robustness of the p < .05 result.","revision_made":"yes","referee_comment":"[User study] The user-study result (p<.05) that end users cannot reliably identify the perturbations is reported without sample size, power analysis, task design, or controls for learning effects. Because the human-undetectability claim is used to argue the attack is practical in the wild, these missing details are load-bearing for the overall contribution."},{"response":"We acknowledge that the manuscript lacks sufficient detail on the experimental setup to support reproducibility. We will add a new 'Experimental Setup' subsection that specifies the phishing page corpus (size, selection criteria, and construction method), the precise implementation of the curtain and delay techniques (technologies used and timing parameters), and the invocation parameters for each detector (rendering engine, timeout values, and API usage). This will enable independent replication of the reported detection-rate drop.","revision_made":"yes","referee_comment":"[Experimental setup] No information is supplied on the phishing page corpus, exact implementation of the curtain/delay techniques, or how the visual similarity modules of the SOTA detectors were invoked (e.g., rendering engine, timeout values). Reproducibility and generality of the 100%-to-0% result cannot be assessed without these specifics."}],"tokens_in":1590,"tokens_out":673,"duration_ms":29016,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main thing to know is that this work identifies a timing vulnerability in visual ML detectors for phishing. Attackers can delay rendering of key parts like logos with simple effects such as curtains, so the detector's snapshot sees an incomplete page and labels the site benign. The authors report this drops detection from 100% to 0% on current tools and that users in their study do not reliably notice the changes at p<0.05.","headline":"The paper shows a timing trick can defeat visual phishing detectors by hiding elements until after the snapshot, but only if the tested systems actually capture early.","tokens_in":2388,"tokens_out":163,"would_cite":false,"duration_ms":22369,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Visual phishing detectors can be defeated by delaying the rendering of key webpage elements until after the snapshot is taken.","keywords":["phishing detection","visual evasion","delayed rendering","timing attacks","machine learning security","webpage snapshots","curtain effects","user study"],"falsifier":"If a detector is modified to take its snapshot only after the full page has rendered or after monitoring for late-arriving elements, and it then correctly flags the delayed phishing pages, the vulnerability claim would be refuted.","tokens_in":2724,"feed_emoji":"⏱️","tokens_out":652,"duration_ms":25321,"temperature":0.7,"pith_summary":"The paper shows that machine-learning visual detectors for phishing sites overlook a simple timing vulnerability in how they inspect pages. Attackers delay the appearance of distinctive parts like logos so the detector captures an incomplete view and classifies the page as legitimate. This tactic uses basic techniques such as curtain effects and drops detection rates from 100 percent to zero. A user study confirms that people do not reliably notice the delays and still fall for the pages. The authors also outline client-side mitigations that do not require external services.","feed_headline":"Timing tricks let phishing sites fool visual AI detectors","feed_subtitle":"Attackers delay logos until after the snapshot so pages look safe to detectors while remaining convincing to users.","key_machinery":"Delayed rendering of key webpage elements such as logos, achieved through problem-space techniques like curtain effects, which prevents the detector's single snapshot from capturing the phishing indicators.","core_discovery":"The paper establishes that visual similarity detectors for phishing must take a snapshot of the target page before comparing it to known legitimate sites, and that attackers can exploit this by deliberately delaying the rendering of key phishing elements such as logos. When the snapshot occurs before these elements appear, the detector sees only benign content and misclassifies the page. Empirical tests show state-of-the-art systems can be reduced to zero detection rate with low-cost problem-space methods like curtain effects, and a user study finds the changes remain imperceptible to humans.","pith_inferences":["Other security tools that rely on static visual snapshots, such as certain malware image classifiers, could face similar timing-based evasions.","Detection systems might need to monitor page load progress continuously rather than at a single moment.","Combining delayed rendering with other low-visibility changes could further strengthen phishing campaigns.","This points toward a broader need for behavioral analysis during the entire rendering process instead of isolated checks."],"forward_implications":["Current snapshot-based visual detectors require updates to account for rendering timing to stay effective against phishing.","Attackers can evade detection with minimal changes that preserve the final visual appearance seen by users.","Browser extensions can warn about suspicious rendering behavior without contacting remote servers.","Visual-only defenses leave a gap that timing attacks can exploit in practice."],"fun_headline_variants":["Delayed rendering evades visual phishing detectors","Phishers exploit snapshot timing to bypass detectors","Key element delays defeat visual detectors","Curtain effects bypass visual phishing detectors"],"cache_read_input_tokens":64,"weakest_assumption_plain":"Visual phishing detectors rely on taking one static snapshot before the page finishes rendering, and attackers can introduce delays without breaking the page's function or alerting victims.","fun_headline_variants_meta":{"raw":{"variants":["Delayed rendering evades visual phishing detectors","Phishers exploit snapshot timing to bypass detectors","Key element delays defeat visual detectors","Curtain effects bypass visual phishing detectors"]},"model":"grok-4.3","cost_usd":0.009177,"raw_usage":{"total_tokens":4096,"prompt_tokens":797,"num_sources_used":0,"completion_tokens":50,"cost_in_usd_ticks":91765500,"prompt_tokens_details":{"text_tokens":797,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":3249,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":797,"tokens_out":50,"duration_ms":28270,"temperature":1.0,"reasoning_tokens":3249,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-09T20:28:00.979869+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"If a detector is modified to take its snapshot only after the full page has rendered or after monitoring for late-arriving elements, and it then correctly flags the delayed phishing pages, the vulnerability claim would be refuted.","supporting_citations":[],"review_version":1}