Pith. sign in

REVIEW 5 major objections 5 minor 29 references

Improving Phishing Email Detection Performance of Small Large Language Models

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that explanation-augmented LoRA fine-tuning lets small LLMs of 1.5–3.8 billion parameters match or exceed much larger models and traditional classifiers on phishing email detection.

desk verdict Plausible applied result showing explanation-augmented LoRA fine-tuning helps small LLMs on phishing benchmarks, but thin reporting and no contamination check leave the transfer claim unverified. read the letter →

arxiv 2505.00034 v2 pith:HIK7NU2J submitted 2025-04-29 cs.CL cs.AI

Zijie Lin , Zikang Liu , Hanbo Fan This is my paper · ORCID
classification cs.CLcs.AI
keywords phishingemaildetectionsmalllanguagemodelsexplanation-augmentedfine-tuningLoRAmodelensembletransferabilitypromptengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that small LLMs with roughly 1.5–3.8 billion parameters can become strong phishing detectors when fine-tuned with LoRA on a small set of emails whose labels are augmented with natural-language explanations. On SpamAssassin, Phi-4-mini-Instruct reaches 0.968 accuracy and 0.944 F1, and LLaMA-3.2-3B-Instruct reaches 0.963 and 0.928, beating the larger GPT-4o-mini and LLaMA-3.1-70B-Instruct in the authors' comparisons. The authors argue that the decisive ingredient is adding a human-readable explanation to each fine-tuning target so the task resembles the open-ended generation small LLMs were pretrained for; without the explanation, performance collapses. They also report that the fine-tuned models transfer to unseen Ling and Enron datasets better than SVM and XGBoost baselines. The upshot is a recipe for explainable phishing detection that runs on a single consumer-grade GPU.

What carries the argument

The load-bearing object is the explanation-augmented training instance: each email subject and body is paired with a label and a GPT-4o-mini-generated paragraph reasoning about whether it is a phishing attempt, and the small LLM is LoRA fine-tuned to reproduce both the reasoning and the label. This converts a closed-form classification target into an open-ended generative target, which the authors argue is better aligned with how the models were pretrained. The other components are a prompt that forces the final answer into a parseable '###Phishing###/###Safe###' wrapper, and a confidence ensemble that scores competing answers by the length-normalized geometric mean of token logprobabilities.

What would settle it

Re-run the SpamAssassin and CEAS_08 experiments with the same 1,000 emails but with explanations randomly swapped across emails or replaced by correct labels with misleading reasoning; if accuracy stays near 0.96, the explanation texts are not causally responsible. Separately, measure n-gram overlap between training and test splits; high overlap would make the reported gains and the transfer claims difficult to interpret.

Watch

Extended reading notes

Core claim

On the paper's own account, the central discovery is that the form of the fine-tuning target matters as much as the amount of data. When small instruction-tuned LLMs are fine-tuned with LoRA on just 1,000 emails annotated with both a label and a natural-language explanation of that label, their phishing detection accuracy jumps: on SpamAssassin, Phi-4-mini-Instruct goes from 0.647 accuracy and 0.537 F1 under vanilla prompting to 0.968 and 0.944, and LLaMA-3.2-3B-Instruct goes from 0.587 and 0.354 to 0.963 and 0.928. On CEAS_08, Phi-4-mini reaches 0.917 accuracy and 0.927 F1. The ablation shows label-only fine-tuning is far weaker, with LLaMA-3.2-3B dropping to 0.571 accuracy and 0.219 F1 on SpamAssassin, while ensemble voting adds only a small further gain. Transfer experiments on unseen Ling and Enron data find that the fine-tuned small models generalize across domains better than SVM and XGBoost baselines.

Load-bearing premise

The result collapses if the large gains come not from the explanations themselves but from test-set contamination, dataset-specific artifacts in the 1,000-sample training slice, or unreliable generated explanations, none of which the paper tests for.

Editorial extensions

If this is right

  • On the paper's evidence, a 3-billion-parameter model fine-tuned this way can replace a 70-billion-parameter model for phishing triage at a fraction of the compute, while still giving a human-readable explanation for each decision.
  • Because the method needs only about 1,000 labeled emails and LoRA adapters, fine-tuning on an organization's own mailbox distribution is feasible on a single RTX 3090 GPU.
  • The ablation implies that label-only fine-tuning is not enough for small LLMs, so deployment should keep explanation augmentation in the training loop.
  • The transfer results suggest one fine-tuned adapter may serve multiple mail domains, since the small LLMs generalized to unseen Ling and Enron data better than embedding-based SVM and XGBoost baselines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism is what the paper thinks, the fluency of generated explanations may matter more than their factual accuracy, because only the label is scored; a testable extension would fine-tune on deliberately wrong-but-plausible explanations and check whether accuracy survives.
  • The absence of contamination checks means the SpamAssassin gains could partly reflect dataset-specific artifacts; a clean test would train on a time-separated slice of emails and evaluate on later mail from the same organization.
  • The approach should extend naturally to other security text-classification tasks, such as malicious URL descriptions or smishing messages, where small explainable models are desirable, though that extension is not tested here.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a pipeline for improving phishing email detection with small LLMs (LLaMA-3.2-3B-Instruct, Phi-4-mini-Instruct, and Qwen-2.5-1.5B-Instruct), consisting of structured prompt engineering, explanation-augmented LoRA fine-tuning on 1,000-sample subsets, and two ensemble methods (confidence ensemble based on length-normalized logprobs, and majority vote). The authors report substantial gains on SpamAssassin and CEAS_08 over vanilla prompting, competitiveness with SVM/XGBoost baselines, and stronger transferability to unseen Enron and Ling datasets than traditional ML baselines. They also present an ablation showing that removing explanations degrades performance, and they list limitations on dataset coverage, transfer methods, cost quantification, and ensemble strategies.

Significance. If the reported results hold, the main contribution is a practical and interpretable recipe: explanation-augmented LoRA fine-tuning lets models with 1.5-3.8B parameters approach or exceed the accuracy of much larger zero-shot LLMs while retaining text explanations, and the transfer results suggest generalization beyond the training corpus. The ablation isolating the effect of explanation augmentation and the explicit limitation section are strengths. However, the paper ships no code, data splits, or hyperparameters, reports single runs without error bars, and does not verify that test sets are truly unseen; these omissions currently prevent verification of the central empirical claims. The paper's value is empirical rather than theoretical, so those missing pieces are material.

major comments (5)
  1. [Section 4.5 / Reference [12]] The transferability claim depends on Ling and Enron being truly unseen, yet the paper never demonstrates that the 1,000-sample fine-tuning subsets drawn from SpamAssassin and CEAS_08 are disjoint from the corresponding test sets or from the Ling and Enron evaluation sets. All datasets are cited from a single Kaggle aggregation (ref [12]), and public email corpora are known to contain duplicate or near-duplicate messages. Please add an overlap analysis using exact and normalized subject/body matching, report the number of overlapping messages, and rerun any affected results; otherwise the transfer gains could be inflated by memorization.
  2. [Section 4.2 / Table 1] There is an internal inconsistency in the reported improvements: Section 4.2 states that on SpamAssassin, LLaMA-3.2-3B-Instruct's F1 rose from 0.543 to 0.928, but Table 1 lists the SpamAssassin F1 as 0.354 and the value 0.543 is the CEAS_08 recall. This discrepancy must be corrected and explained, because it directly affects the claimed magnitude of the fine-tuning gain.
  3. [Sections 4.2-4.4] Tables 1-4 report a single run per configuration with no error bars, and the text does not specify the LoRA rank r, scaling alpha, learning rate, batch size, number of epochs, sequence-length truncation, train/test split construction, or the number of random seeds. Training on only 1,000 samples makes split and seed variance potentially material to the reported deltas; releasing code, data splits, and hyperparameters is necessary to support the quantitative claims.
  4. [Section 4.2] The claim that fine-tuned small LLMs 'outperform larger LLMs' compares LoRA-fine-tuned small models against zero-shot prompted GPT-3.5-Turbo, GPT-4o-mini, and LLaMA-3.1-70B-Instruct. This is not an apples-to-apples comparison; the large models are not fine-tuned on the same data. The claim should either be limited to zero-shot large-model baselines or the large models should be fine-tuned under comparable conditions.
  5. [Section 3.3] Explanation augmentation is the core intervention, but the paper provides no validation of the GPT-4o-mini-generated explanations: no human agreement study, no format-adherence check, and no analysis of whether explanation errors propagate into the fine-tuned model's decisions. The assertion that explanations 'mitigate hallucination' is unsupported. Please add at least a manual audit of a random sample of generated explanations and report the error rate.
minor comments (5)
  1. [Section 3.2 / Table 3] The prompt text contains stray spaces ('Y ou', 'Y our') and Table 3 and Figure 1 contain 'V ote' instead of 'Vote'; these typos should be corrected.
  2. [Section 4.5] The phrase 'regular-sized LLMs' is imprecise; the paper earlier uses 'standard-sized LLMs,' and the terminology should be consistent.
  3. [Section 3.2 / Section 4] The paper does not specify the exact parsing rule for extracting '###Phishing###' or '###Safe###' from model output, nor what happens when a model outputs neither marker; please state the extraction rule and any fallback or rejection procedure.
  4. [Table 3] Table 3 reports only accuracy and F1 for the ensemble methods, while Table 2 includes precision and recall; adding precision and recall for the ensembles would not affect any conclusions but would improve comparability.
  5. [Reference [12] / Section 4.1] Please describe the composition, label balance, and preprocessing of each dataset (SpamAssassin, CEAS_08, Ling, Enron), because class priors strongly affect F1 and accuracy interpretation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper’s empirical claims rest on held-out test evaluation, not on a derivation that reduces to its own inputs.

full rationale

This is an empirical benchmark paper rather than a theoretical derivation. The reported improvements (Tables 1–4) come from fine-tuning small LLMs on a 1,000-sample training subset and evaluating on separate test splits of SpamAssassin, CEAS_08, Ling, and Enron; the test labels are not used as training inputs. The only equations in the paper are standard LoRA weight updates (Eqs. 1–2), the length-normalized confidence score (Eq. 3), and standard precision/recall/F1 definitions; none of these define the reported accuracy or F1 in terms of the fitted parameters or the training labels. The explanations used for “explanation augmented fine-tuning” are generated by GPT-4o-mini from the training emails and their training labels, so they do not encode test-set outcomes. Ensemble methods also use only the fine-tuned models’ outputs or token logprobs on test inputs. No load-bearing step is justified by a self-citation chain, and no cited result is used as the basis of the empirical claim. Concerns about dataset overlap, pretraining contamination, or parsing artifacts would be correctness or validity risks rather than circularity, and the rules require reserving a nonzero circularity score for cases where the paper’s own equations or citations make a prediction equivalent to its input by construction. No such reduction is present, so the appropriate finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

This is an empirical machine-learning paper with no mathematical derivation. The listed free parameters are under-reported hyperparameters and data-selection choices that affect all reported results. The axioms are unverified background assumptions about label quality, data leakage, and the reliability of synthetic explanations. No new physical or conceptual entities are introduced.

free parameters (4)
  • LoRA rank r and scaling alpha
    Equation (2) defines the LoRA update using r and alpha, but the paper never reports their values. All fine-tuned results depend on these choices.
  • Fine-tuning subset size = 1,000 samples
    Section 4.2 states that only 1,000 training samples are extracted for explanation augmentation and fine-tuning. This choice is not varied or justified.
  • LoRA training hyperparameters
    Learning rate, number of epochs, batch size, and sequence length limits are not reported, so the exact training procedure is under-specified.
  • Confidence ensemble membership = LLaMA-3.2-3B and Phi-4-mini
    The confidence ensemble deliberately excludes Qwen-2.5-1.5B, while the majority vote includes it. This model-selection choice can affect the reported ensemble gains.
assumptions (3)
  • domain assumption Ground-truth labels in SpamAssassin and CEAS_08 are correct.
    All metrics treat these labels as truth; no manual verification or inter-annotator agreement is reported.
  • domain assumption Test sets are independent of fine-tuning data and of model pretraining.
    Transferability claims rely on Ling and Enron being 'unseen', but no contamination check against pretraining corpora is provided.
  • ad hoc to paper GPT-4o-mini-generated explanations are accurate and useful.
    The method augments training data with these explanations without validating their correctness; if explanations are hallucinated or biased, the fine-tuned model may learn incorrect reasoning patterns.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving Phishing Email Detection Performance of Small Large Language Models." pith.science (2026). https://pith.science/paper/HIK7NU2J

@misc{pith2026250500034,
  author       = {Pith},
  title        = {Pith review of: Improving Phishing Email Detection Performance of Small Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HIK7NU2J}},
  note         = {Machine review of arXiv:2505.00034}
}
read the original abstract

Large language models(LLMs) have demonstrated remarkable performance on many natural language processing(NLP) tasks and have been employed in phishing email detection research. However, in current studies, well-performing LLMs typically contain billions or even tens of billions of parameters, requiring enormous computational resources. To reduce computational costs, we investigated the effectiveness of small-parameter LLMs for phishing email detection. These LLMs have around 3 billion parameters and can run on consumer-grade GPUs. However, small LLMs often perform poorly in phishing email detection task. To address these issues, we designed a set of methods including Prompt Engineering, Explanation Augmented Fine-tuning, and Model Ensemble to improve phishing email detection capabilities of small LLMs. We validated the effectiveness of our approach through experiments, significantly improving both accuracy and F1 score on the SpamAssassin and CEAS\_08 datasets. Furthermore, the fine-tuned models demonstrated strong transferability, achieving robust performance across multiple unseen phishing datasets, outperforming traditional baselines and approaching standard-sized LLMs.

Figures

Figures reproduced from arXiv: 2505.00034 by the authors.

Figure 1
Figure 1. The workflow of improving phishing email detection performance of small LLMs [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Using GPT-4o-mini to augment the original phishing email dataset with explanation [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Accuracy and F1 scores of different models evaluated on multiple datasets. Note that small-scale LLMs and [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Accuracy and F1 scores of different models evaluated on multiple datasets. Note that small-scale LLMs and [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 22 canonical work pages

  1. [12]

    Phishing email dataset, https://www.kaggle.com/datasets/naserabdullahalam/phishing- email-dataset, 2024

    Naser Abdullah Alam. Phishing email dataset, https://www.kaggle.com/datasets/naserabdullahalam/phishing- email-dataset, 2024

    work page 2024

  2. [1]

    A bayesian approach to filtering junk e-mail

    Mehran Sahami, Susan Dumais, David Heckerman, and Eric Horvitz. A bayesian approach to filtering junk e-mail. proc aaai, 1998

    work page 1998

  3. [2]

    Drucker, Donghui Wu, and V .N

    H. Drucker, Donghui Wu, and V .N. Vapnik. Support vector machines for spam categorization.IEEE Transactions on Neural Networks, 10(5):1048–1054, 1999

    work page 1999

  4. [3]

    A comparison of machine learning techniques for phishing detection

    Saeed Abu-Nimeh, Dario Nappa, Xinlei Wang, and Suku Nair. A comparison of machine learning techniques for phishing detection. ACM, 2007

    work page 2007

  5. [4]

    Deep learning for phishing detection: Taxonomy, current challenges and future directions

    Nguyet Quang Do, Ali Selamat, Ondrej Krejcar, Enrique Herrera-Viedma, and Hamido Fujita. Deep learning for phishing detection: Taxonomy, current challenges and future directions. IEEE Access, 10:36429–36463, 2022

    work page 2022

  6. [5]

    Salinas Monroy

    Cameron McGinley and Sergio A. Salinas Monroy. Convolutional neural network optimization for phishing email classification. In 2021 IEEE International Conference on Big Data (Big Data) , pages 5609–5613, 2021

    work page 2021

  7. [6]

    Balachander

    Sohan Sarkar, Ankit Yadav, and T. Balachander. Email phishing detection using ai and ml. In International Conference on Deep Sciences for Computing and Communications , 2024

    work page 2024

  8. [7]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems , 30, 2017

    2017

Show all 29 references
  1. [8]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. ArXiv, abs/1810.04805, 2019

    2019 arXiv

  2. [9]

    Introducing ChatGPT, https://openai.com/index/chatgpt, 2022

    OpenAI. Introducing ChatGPT, https://openai.com/index/chatgpt, 2022

    2022

  3. [10]

    GPT-4, https://openai.com/index/gpt-4/, 2022

    OpenAI. GPT-4, https://openai.com/index/gpt-4/, 2022

    2022

  4. [11]

    Debate-driven multi-agent llms for phishing email detection

    Ngoc Tuong Vy Nguyen, Felix D Childress, and Yunting Yin. Debate-driven multi-agent llms for phishing email detection. 2025. 9

    2025

  5. [13]

    Introducing Llama 3.1, https://ai.meta.com/blog/meta-llama-3-1, 2024

    Meta. Introducing Llama 3.1, https://ai.meta.com/blog/meta-llama-3-1, 2024

    2024

  6. [14]

    Llama 3.2, https://ai.meta.com/blog/llama-3-2-connect-2024-vision-edge-mobile-devices, 2024

    Meta. Llama 3.2, https://ai.meta.com/blog/llama-3-2-connect-2024-vision-edge-mobile-devices, 2024

    2024

  7. [15]

    Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras

    Microsoft, Abdelrahman Abouelenin, Atabak Ashfaq, Adam Atkinson, Hany Awadalla, Nguyen Bach, Jianmin Bao, Alon Benhaim, Martin Cai, and Vishrav Chaudhary. Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras. 2025

    2025

  8. [16]

    GPT-4o-mini, https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence, 2024

    OpenAI. GPT-4o-mini, https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence, 2024

    2024

  9. [17]

    An experi- mental comparison of naive bayesian and keyword-based anti-spam filtering with personal e-mail messages

    Ion Androutsopoulos, John Koutsias, Konstantinos V Chandrinos, and Constantine D Spyropoulos. An experi- mental comparison of naive bayesian and keyword-based anti-spam filtering with personal e-mail messages. In Proceedings of the 23rd annual international ACM SIGIR conferenc...

    2000

  10. [18]

    An evaluation of naive bayesian anti-spam filtering

    Ion Androutsopoulos, John Koutsias, Konstantinos V Chandrinos, George Paliouras, and Constantine D Spyropou- los. An evaluation of naive bayesian anti-spam filtering. arXiv preprint cs/0006013, 2000

    2000 arXiv

  11. [19]

    Support vector machines for spam categorization

    Harris Drucker, Donghui Wu, and Vladimir N Vapnik. Support vector machines for spam categorization. IEEE Transactions on Neural networks, 10(5):1048–1054, 1999

    1999

  12. [20]

    Boosting trees for anti-spam email filtering

    Xavier Carreras and Lluis Marquez. Boosting trees for anti-spam email filtering. arXiv preprint cs/0109015, 2001

    2001 arXiv

  13. [21]

    Deep learning to filter sms spam

    Pradeep Kumar Roy, Jyoti Prakash Singh, and Snehasish Banerjee. Deep learning to filter sms spam. Future Generation Computer Systems, 102:524–533, 2020

    2020

  14. [22]

    Spam detection using bidirectional transformers and machine learning classifier algorithms

    Yanhui Guo, Zelal Mustafaoglu, and Deepika Koundal. Spam detection using bidirectional transformers and machine learning classifier algorithms. journal of Computational and Cognitive Engineering , 2(1):5–9, 2023

    2023

  15. [23]

    A thorough benchmark of automatic text classification: From traditional approaches to large language models

    Washington Cunha, Leonardo Rocha, and Marcos André Gonçalves. A thorough benchmark of automatic text classification: From traditional approaches to large language models. arXiv preprint arXiv:2504.01930, 2025

    2025 arXiv

  16. [24]

    Devising and detecting phishing emails using large language models

    Fredrik Heiding, Bruce Schneier, Arun Vishwanath, Jeremy Bernstein, and Peter S Park. Devising and detecting phishing emails using large language models. IEEE Access, 2024

    2024

  17. [25]

    Chatspamdetector: Leveraging large language models for effective phishing email detection

    Takashi Koide, Naoki Fukushi, Hiroki Nakano, and Daiki Chiba. Chatspamdetector: Leveraging large language models for effective phishing email detection. arXiv preprint arXiv:2402.18093, 2024

    2024 arXiv

  18. [26]

    Improving language understanding by generative pre-training

    Alec Radford and Karthik Narasimhan. Improving language understanding by generative pre-training. 2018

    2018

  19. [27]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. 2021

    2021

  20. [28]

    Introducing Qwen, https://qwenlm.github.io/blog/qwen, 2024

    Qwen Team. Introducing Qwen, https://qwenlm.github.io/blog/qwen, 2024

    2024

  21. [29]

    Sentence-bert: Sentence embeddings using siamese bert-networks

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. arXiv preprint arXiv:1908.10084, 2019. 10

    1908 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.