Automated email Generation for Targeted Attacks using Natural Language

Avisha Das; Rakesh Verma

REVIEW 3 major objections 4 minor 13 references

Automated email Generation for Targeted Attacks using Natural Language

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A word-level LSTM trained on a mix of legitimate and phishing emails can generate targeted phishing text, and some of those machine-written emails evade simple statistical classifiers.

desk verdict A routine LSTM email generator, but the claimed evasion result rests on a detection table that is internally inconsistent with the reported test set. read the letter →

arxiv 1908.06893 v1 pith:4HHJFTVA submitted 2019-08-19 cs.CL cs.CR

Avisha Das , Rakesh Verma This is my paper · ORCID

classification cs.CLcs.CR

keywords phishingemailmasqueradingnaturallanguagegenerationrecurrentneuralnetworksLSTMtextspamfilteringadversarialmachinelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that automated text generation can produce fake, targeted phishing emails: a neural network trained on a mixture of legitimate and phishing correspondence learns to sample messages whose wording shifts toward malicious cues as the share of phishing training data rises. The authors vary the phishing inflow from 5% to 50%, sample at four levels of randomness, and then ask whether standard text classifiers—support vector machines, naive Bayes, and logistic regression—separate the machine-written emails from legitimate mail. They report accuracy, precision, recall, and F1 scores below perfect for all three detectors, and compare their output against a rule-based email generator. For a sympathetic reader, the point is that phishing intent can be injected at training time, making the generator a plausible new attack tool even though the sampled text is often incoherent.

What carries the argument

The load-bearing component is a two-layer word-level LSTM—a recurrent neural network that keeps a memory state while predicting the next word—with 512 nodes per layer, trained on email bodies after URLs, email addresses, and named entities are replaced by tags. Temperature controls the softmax sharpness at sampling time: low values give repetitive deterministic text, high values give more stochastic, less coherent output. The intent-injection mechanism is the percentage of phishing emails mixed into the training text (5%, 10%, 30%, 50%). For evaluation, the paper builds document-term matrices from word counts and feeds them to support vector machine, naive Bayes, and logistic regression classifiers.

What would settle it

Re-run the three classifiers on the same 25 generated emails and give the confusion-matrix row for the generated-email class: if most of those 25 are labeled as phishing, the claim that the emails defeat the detectors fails; if most are labeled legitimate, it holds. The published table does not say which class its scores describe, so this single row settles the point.

Watch

Extended reading notes

Core claim

The central claim is that intent can be baked into a recurrent network's training set rather than hand-authored in grammar rules. Training one model on legitimate emails plus 50% of a cleaned phishing corpus yields generated bodies that use account-restriction language, urgency, and link-clicking prompts; training on 5% produces far weaker malicious signals. When 25 such samples from the 50% model are tested against three lexical classifiers trained on separate legitimate and phishing email data, the detectors' reported accuracy, precision, recall, and F1 stay below perfect separation, which the paper reads as evidence that some machine-generated emails evade statistical detection. The authors also position the LSTM output against a rule-based email generator, arguing that the recurrent text resembles phishing more closely while sacrificing the coherence that the rule-based baseline retains.

Load-bearing premise

The paper's quantitative evasion claim assumes the table's accuracy, precision, recall, and F1 scores describe how often the generated fake emails are the ones being detected, but the table never states which class those numbers refer to.

Editorial extensions

If this is right

An attacker could train on a victim's own sent mail plus a generic phishing corpus and automatically sample targeted emails with account-restriction and urgency cues, removing the human effort currently needed to hand-craft masquerade messages.
Detectors built only on word-count features are the stated target: the reported scores imply that such classifiers do not cleanly separate machine-written samples from legitimate email, so detection will need richer features or generated-text awareness.
The share of malicious training data acts as an intent dial: the paper's examples show 50% phishing inflow producing account-frozen and password-reset language that 5% inflow does not.
Because the LSTM output is often ungrammatical, the practical threat is not polished prose but volume: an attacker can generate many candidate messages cheaply and keep the ones that pass a detector.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable extension is to train a detector on the generator's own output as an adversarial class; the LSTM makes near-miss phishing variants nearly free, which could harden classifiers instead of only attacking them.
The same word-level training recipe should transfer to chat or social-media messages, since the model learns from plain text streams rather than email-specific structure.
An attacker would likely choose the lowest sampling temperature that still reads as natural, and a defender could exploit that by flagging text that repeats training-like fragments or collapses into nonsense at higher temperatures.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the paper applies a standard word-level LSTM to generate email text from a mixed legitimate/phishing corpus, tuning the phishing percentage and sampling temperature. That part is a reasonable exercise. The problem is the paper's central claim—that generated emails defeat statistical detectors—rests on Table 4, and Table 4 cannot describe the experiment as written. The test set is 100 legitimate and 25 generated emails. If precision/recall/F1 refer to the fake class, recall would have to move in 4% steps; the reported values (85, 75, 95) are impossible. If they refer to the legitimate class, SVM's 85 recall and 72 precision imply 33 false positives, more than the 25 fake emails in the test set. The table never states which class it reports, and no confusion matrix or averaging scheme is given. So the evasion claim is unsupported.

Credit where it's due: the authors are honest about the poor quality of the generated text. Their examples are largely incoherent, full of placeholder tags, and they say so explicitly. They also flag unresolved repetition problems and ask for more experiments. Comparing to the Dada engine is a sensible move, and varying the malicious content percentage is a reasonable knob to explore. But none of that makes a routine LSTM application a sound result.

Soft spots are proportional: the generation side is an honest feasibility study with negative results, and the detection side is the load-bearing claim and it fails. No baselines with real phishing emails, no error bars, no per-class metrics for the fake class, and only 25 hand-picked generated emails. Section 5's error analysis is anecdotal. The citation pattern is fine; the co-authored Dada baseline is appropriately cited.

Who should read this: people curious about early deep NLG phishing attempts, or instructors looking for a case study in evaluation pitfalls. Not anyone seeking evidence that LSTM-generated phishing emails evade detectors.

Recommendation: desk reject is defensible. The core experiment is internally inconsistent, so referees would be asking for a full redo rather than evaluating a result. If the authors rerun the detection experiment properly and release data and code, the idea might deserve another look.

Referee Report

3 major / 4 minor

Summary. The paper proposes a word-level LSTM-based natural language generation system for producing 'fake' phishing emails, trained on a mixture of legitimate and malicious email corpora, with the stated goal of generating targeted, malicious emails that evade statistical detectors. The authors vary the proportion of malicious training content and the sampling temperature, then evaluate the generated emails against SVM, Naive Bayes, and logistic regression classifiers trained on a separate email dataset. They also compare their output qualitatively with emails from the Dada Engine baseline. The central claims are that the system can generate customized malicious emails and that these emails can defeat text-based statistical detectors.

Significance. If the claims were well supported, the paper would address a timely and important security problem: the automated generation of phishing emails that bypass machine-learning detectors. The authors use real datasets, provide qualitative examples, and are transparent about the incoherence of their generated text. However, the load-bearing evidence for detector evasion is a single table whose metrics are undefined with respect to class, evaluated on only 25 generated emails with no baseline on real phishing emails and no error bars. The qualitative examples show text that is largely incoherent and dominated by placeholder tags such as <NET>, <LINK>, and <EID>, which undermines the claim of 'targeted' attacks. The paper does not provide reproducible code, machine-checked proofs, or parameter-free derivations; its main empirical claim is therefore not currently verifiable.

major comments (3)

[Section 4.2, Table 4] The central claim that generated emails 'defeat statistical detectors' is unsupported because Table 4 does not state which class the precision, recall, and F1-scores refer to. The test set contains 100 legitimate and 25 generated emails, so an all-legitimate predictor would achieve 80% accuracy. If the metrics describe the legitimate class, they say nothing about the detection rate of the generated (fake) class, which is the quantity directly relevant to the claim. If they describe the fake class, then the reported recall values (85, 75, 95) are impossible for 25 examples because recall would change in increments of 4 percentage points. No averaging scheme or class designation is provided, and there are no confidence intervals or error bars. A baseline using real phishing emails is also absent. The detection-evasion claim must therefore be considered unverified.
[Section 3.3.3 and Section 4.1] The paper claims the system generates emails 'customized depending on the attacker's intent,' but the only mechanism described is varying the percentage of malicious training emails and the sampling temperature. There is no mechanism that targets a specific victim's style, content, or context, which is the essence of an email masquerading or targeted attack. Moreover, the examples in Section 4.1 are largely incoherent, with repeated placeholder tags and sentence fragments. These examples, which the paper itself acknowledges suffer from 'random strings and grammatical errors,' do not demonstrate the generation of realistic or targeted malicious emails.
[Section 4.3 and Section 5] The comparison with the Dada Engine baseline is only qualitative, based on two representative examples, with no quantitative measure of coherence, maliciousness, or detection evasion. The error analysis in Section 5 discusses a few misclassified generated emails but does not quantify the misclassification rate for the fake class; the anecdotes do not establish that the proposed method is effective at evading classifiers. The paper's own statement that 'more experiments are needed to determine the actual causes' of repetitive text further underscores that the system is not yet demonstrated to be effective.

minor comments (4)

[Title] The title contains a spacing error: 'Natu ral Language' should be 'Natural Language'.
[Section 4.1(D)] The second example is labeled 'Example IT' rather than 'Example II'; this typo should be corrected.
[Section 4.1(A)] The second example is captioned 'Example I at Temperature = 0.7' but it is clearly the second example in that subsection; the caption should read 'Example II'.
[References] Some references are incomplete; for instance, the entry for Ghazvininejad et al. (2016) gives no publication venue, and the entry for Sidhaye and Cheung (2015) lacks full bibliographic details. The paper also uses inconsistent formatting for author names (e.g., 'Verma' appears as 'V erma' in several places).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the generation and detection results are empirical and self-contained; the only co-authored citation (Baki et al. 2017) is a comparative baseline, not load-bearing.

full rationale

The paper makes no formal derivation whose conclusion is built into its inputs. The LSTM generator is trained on legitimate and phishing email text (Section 3.3.3), sampled under temperature-controlled softmax (Section 3.3.2), and evaluated by training SVM, Naive Bayes, and Logistic Regression classifiers on separate WikiLeaks/Cornell data (Section 3.4). No parameter is fitted to the reported detection metrics, and no equation defines a claimed output in terms of the quantity it is supposed to predict. The self-citation to Baki et al. (2017), co-authored by the second author, supplies only the Dada Engine comparison baseline and 12 example emails; it does not justify the central evasion claim, which stands on the paper's own empirical comparison. Table 4's ambiguity about which class the precision/recall values describe is a measurement-interpretation or correctness concern, not circular reasoning. Accordingly, no circular step is identified.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new theoretical quantities or entities. Its load-bearing choices are hand-set training configurations (malicious percentage, temperature, LSTM size) and the domain assumption that text quality and malicious intent follow from corpus mixing. The evaluation additionally rests on an unstated assumption about what the reported metrics measure.

free parameters (4)

malicious_content_percentage = 5%, 10%, 30%, 50%
The authors train separate models with varying percentages of phishing emails mixed with legitimate emails (Section 3.3.3). The final detection test uses the 50% model, chosen by the authors after inspecting outputs, not by a principled criterion.
temperature = 0.2, 0.5, 0.7, 1.0
Sampling temperature controls randomness of generated text (Section 3.3.2). The 25 evaluation samples use a hand-picked distribution: 2 at 0.2, 10 at 0.5, 5 at 0.7, 8 at 1.0.
evaluation sample temperature distribution = 2 at 0.2, 10 at 0.5, 5 at 0.7, 8 at 1.0
The set of 25 generated emails tested by the classifiers was randomly selected with this temperature mix after generation (Section 3.3.2 and 4.2). This post hoc selection can bias the reported detection results.
LSTM hyperparameters = 2 layers, 512 nodes, 100 epochs, lr 2e-3, seq len 20, batch 10
These are empirically chosen (Section 3.3.1). They are not fitted to any target output, but they are hand-set choices that affect the generated text.

assumptions (4)

domain assumption A word-level RNN/LSTM trained on email text can produce coherent and representative email content.
The whole approach depends on this (Section 3.3); the paper's own examples show the assumption only weakly holds.
domain assumption Mixing a larger proportion of phishing emails into the training corpus causes the generated text to carry malicious intent.
Section 3.3.3 states this as the mechanism for intent injection, but no quantitative measure of intent is provided.
domain assumption Simple word-count based SVM, Naive Bayes and Logistic Regression classifiers are a meaningful stand-in for 'statistical detectors' of phishing email.
Section 3.4 and 4.2 use these as the detection baseline; no state-of-the-art filter is tested.
standard math The softmax temperature sampling distribution and standard LSTM training assumptions (cross-entropy, Adam) hold.
Standard ML machinery invoked in Section 3.3.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Automated email Generation for Targeted Attacks using Natural Language." pith.science (2026). https://pith.science/paper/4HHJFTVA

@misc{pith2026190806893,
  author       = {Pith},
  title        = {Pith review of: Automated email Generation for Targeted Attacks using Natural Language},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4HHJFTVA}},
  note         = {Machine review of arXiv:1908.06893}
}

read the original abstract

With an increasing number of malicious attacks, the number of people and organizations falling prey to social engineering attacks is proliferating. Despite considerable research in mitigation systems, attackers continually improve their modus operandi by using sophisticated machine learning, natural language processing techniques with an intent to launch successful targeted attacks aimed at deceiving detection mechanisms as well as the victims. We propose a system for advanced email masquerading attacks using Natural Language Generation (NLG) techniques. Using legitimate as well as an influx of varying malicious content, the proposed deep learning system generates \textit{fake} emails with malicious content, customized depending on the attacker's intent. The system leverages Recurrent Neural Networks (RNNs) for automated text generation. We also focus on the performance of the generated emails in defeating statistical detectors, and compare and analyze the emails using a proposed baseline.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 12 canonical work pages

[1]

With the immense boom in usage and adaptation of the Internet, staggering numbers of individuals and organizations have fallen prey to targeted attacks like phishing and pharming

Introduction The continuous adversarial growth and learning has been one of the major challenges in the ﬁeld of Cybersecu- rity. With the immense boom in usage and adaptation of the Internet, staggering numbers of individuals and organizations have fallen prey to targeted attacks like phishing and pharming. Such attacks result in digital identity theft ca...

work page 2013
[2]

A study of the feasibility and effectiveness of deep learning techniques in email generation

work page
[3]

Demonstration of an automated system for generation of ‘fake’ targeted emails with a malicious intent

work page
[4]

Fine-tuning synthetic email content depending on training data - intent and content parameter tuning

work page
[5]

Comparison with a baseline - synthetic emails gener- ated by Dada engine (Baki et al., 2017)

work page 2017
[6]

Detection of synthetic emails using a statistical detec- tor and investigation of effectiveness in tricking an ex- isting spam email classiﬁer (built using SVM)

work page
[7]

Despite the development of a large number of phishing detection tools, many victims are still falling prey to these attacks

Related Works Phishing detection is one of the widely researched areas of cybersecurity. Despite the development of a large number of phishing detection tools, many victims are still falling prey to these attacks. Researchers in (Drake et al., 2004) explicitly break down the structure of a phishing email, de- scribing in detail the modus operandi of a phi...

work page 2004
[8]

We de- scribe the nature and source of the training and evaluation data in Section 3.1

Experimental Methodology The section has been divided into four subsections. We de- scribe the nature and source of the training and evaluation data in Section 3.1. The pre-processing steps are demon- strated in Section 3.2. The system setup and experimental settings have been described in Section 3.3. 3.1. Data description To best emulate a benign email,...

work page 2011

Show all 13 references

[9]

Malicious dataset

(Enron Corpus, 2015). Malicious dataset. The malicious dataset was difﬁcult to acquire. We used two malicious sources of data mentioned below: • 197 Phishing emails collected by the second author - called V erma phish below. • 3392 Phishing emails from Jose Nazario’s Phishing ...

2004
[10]

We give examples of the email text generated with various training models and varying temperatures

Analysis and Results We discuss the results of the generative RNN model in this section. We give examples of the email text generated with various training models and varying temperatures. We also provide the accuracy of the trained classiﬁers on a subset of these generated em...

2004
[11]

First, the text generated by multiple RNN models suffer from repetitive tags and words

Error Analysis We review two types of errors observed in the evaluation of our RNN text generation models developed in this study. First, the text generated by multiple RNN models suffer from repetitive tags and words. The example of the email body below demonstrates an incohe...

2000
[12]

We de- signed an RNN based text generation system for generating targeted attack emails which is a challenging task in itself and a novel approach to the best of our knowledge

Conclusions and Future Work While the RNN model generated text which had ‘some’ malicious intent in them - the examples shown above are just a few steps from being coherent and congruous. We de- signed an RNN based text generation system for generating targeted attack emails w...
[13]

Bibliographical References Baki, S., V erma, R., Mukherjee, A., and Gnawali, O. (2017). Scaling and effectiveness of email masquerade attacks: Exploiting natural language generation. In Pro- ceedings of the 2017 ACM on Asia Conference on Com- puter and Communications Security ...

2017 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

With the immense boom in usage and adaptation of the Internet, staggering numbers of individuals and organizations have fallen prey to targeted attacks like phishing and pharming

Introduction The continuous adversarial growth and learning has been one of the major challenges in the ﬁeld of Cybersecu- rity. With the immense boom in usage and adaptation of the Internet, staggering numbers of individuals and organizations have fallen prey to targeted attacks like phishing and pharming. Such attacks result in digital identity theft ca...

work page 2013

[2] [2]

A study of the feasibility and effectiveness of deep learning techniques in email generation

work page

[3] [3]

Demonstration of an automated system for generation of ‘fake’ targeted emails with a malicious intent

work page

[4] [4]

Fine-tuning synthetic email content depending on training data - intent and content parameter tuning

work page

[5] [5]

Comparison with a baseline - synthetic emails gener- ated by Dada engine (Baki et al., 2017)

work page 2017

[6] [6]

Detection of synthetic emails using a statistical detec- tor and investigation of effectiveness in tricking an ex- isting spam email classiﬁer (built using SVM)

work page

[7] [7]

Despite the development of a large number of phishing detection tools, many victims are still falling prey to these attacks

Related Works Phishing detection is one of the widely researched areas of cybersecurity. Despite the development of a large number of phishing detection tools, many victims are still falling prey to these attacks. Researchers in (Drake et al., 2004) explicitly break down the structure of a phishing email, de- scribing in detail the modus operandi of a phi...

work page 2004

[8] [8]

We de- scribe the nature and source of the training and evaluation data in Section 3.1

Experimental Methodology The section has been divided into four subsections. We de- scribe the nature and source of the training and evaluation data in Section 3.1. The pre-processing steps are demon- strated in Section 3.2. The system setup and experimental settings have been described in Section 3.3. 3.1. Data description To best emulate a benign email,...

work page 2011