REVIEW 2 major objections 4 minor 45 references
Conversational scams, which unfold over weeks, can be caught early by a system that keeps a compact evolving summary of the dialogue instead of rereading the full transcript — the paper reports catching all 83 real romance-fraud conversatio
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · deepseek-v4-flash
2026-08-02 06:47 UTC pith:XUQ5A2EC
load-bearing objection A serious, honestly reported systems paper on conversational scam detection that deserves a real referee, even though the deployment-critical false-positive rate is still unmeasured on naturally occurring benign traffic. the 2 major comments →
An Explainable Agentic System for Detection of Conversational Scams with Summary-Based Memory
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that long-horizon conversational scams are detectable from a bounded running summary rather than from the raw transcript. An investigator agent periodically rewrites a compact state — claimed versus inferred sender identity, threat level, notable events — and the conversation scam detector combines that summary with a short recent window; the schedule tightens as the threat level rises. The paper reports that this summary-based memory catches all 83 scams in a public romance-fraud corpus (median detection at turn 6, before the fraud is consummated), matches or beats a full-transcript classifier on a new eight-family benchmark (97.8% accuracy, 98.4% recall), and does so a
What carries the argument
The load-bearing mechanism is the summary-based memory loop: an investigator agent maintains an incrementally updated summary of the conversation (identity claims, threat level, salient events), and the conversation scam detector consumes that summary plus a short recent window on an adaptive cadence — every five turns at low threat, every turn at high threat. This replaces the two failing extremes: a fixed recent window, which loses long-range signals, and full-transcript prompting, whose cost grows quadratically in conversation length. The mechanism is what lets the system detect delayed scam signals such as grooming, identity inconsistency, and redirection to external channels.
Load-bearing premise
The deployable version of the claim rests on how often benign conversations arriving through the same channels as scams would trigger a warning; the paper measures false alarms on generic dialogue and an authored stress test, not on naturally occurring benign traffic from scam-bearing channels.
What would settle it
Run the frozen system on a naturally occurring corpus of benign conversations drawn from scam-bearing channels (e.g., real wrong-number threads that stay benign); if the false-alarm rate is materially above the 6.6% stress-test bound — or if the 98.4% recall on the released benchmark does not reproduce with the released prompts and harness — the deployable-detector framing fails, even though the recall numbers on the romance corpus may stand.
If this is right
- Catching scams during grooming, at a median of 6 turns for real romance-fraud conversations, means warnings can arrive before any money or credentials change hands, not after the fraud is consummated.
- A bounded summary is sufficient: the system matches a full-transcript classifier on a 278-conversation benchmark, beats it on the 83-conversation romance corpus, and uses roughly 22 times less input context on long conversations.
- The memoryless recent-window baseline finds only 48.2% of romance-fraud scams, so keeping an evolving summary is what makes long-conversation scams detectable at all.
- The conversation-level detector catches 94 of 126 scams that the single-message path alone would miss, so multi-turn reasoning contributes most of the recall.
- Because the pipeline transfers across two open-weight backends with about one point of accuracy loss, the detection behavior is attributable to the architecture rather than a single model, supporting self-hosted privacy-oriented deployment.
Where Pith is reading between the lines
- Our inference: the sharpest open question is not recall but nuisance alarms on live benign traffic; the paper's own stress test puts the false-positive rate at 6.6% on conversations deliberately shaped like scams, but real-channel benign traffic could differ. A natural next experiment is a field trial on unsolicited benign wrong-number conversations.
- Testable extension: because the system's main false-positive pattern is benign wrong-number continuation, a targeted rule distinguishing "stranger prolongs contact benignly" from "stranger grooms toward a request" could cut the false-alarm rate without sacrificing the grooming-phase detection.
- Benchmark consequence: the mixed real and LLM-simulated composition of the released benchmark gives future detectors a controlled way to measure robustness to AI-assisted scams, and the paper's perfect recall on LLM-generated conversations suggests detectors can track synthetic persuasion; whether that holds for future-generation LLM scams is open.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. Adnan et al. present an LLM-based, explainable agentic system for conversational scam detection. The system extends an existing single-message SMS detector with a sender-verification agent, a summary-based memory, an adaptive conversation-level investigator/CSD, and a user-facing advice generator. The SMD is evaluated on an audited SMS dataset; the CSD is evaluated on LoveFraud02 (83/83 scam conversations detected, median first detection at turn 6) and on the authors' new ConScamBench-278 (97.8% accuracy, 98.4% scam recall, 2.7% FPR). The paper also reports ablations, recent-window and full-transcript baselines, a backend portability check, a 76-conversation scam-adjacent benign stress test, and two user studies (N=100 and N=45). The authors release ConScamBench-278 and implementation artifacts.
Significance. If accepted, this is a meaningful step: 100% recall on a naturally occurring 83-conversation romance-fraud corpus is strong evidence that long-horizon conversational scams can be detected in principle, and the multi-category benchmark fills a real gap. The paper's transparency is a notable strength: it reports real-sourced-only metrics for the synthetic portion, runs a second-backend check, performs component ablations, and explicitly labels the user-study pre/post comparison as exploratory. The reproducibility package (prompts, orchestration logic, harness, label diffs) is commendable. The main qualifications are that the deployment-critical false-positive rate on naturally occurring scam-adjacent benign traffic is not measured, and the differences from the full-transcript baseline are not shown to be statistically significant. These limit the strength of the deployment-oriented conclusions but do not undermine the core detection results.
major comments (2)
- [§5.8, Table 20; §7] The deployment-critical false-positive rate is not measured on naturally occurring benign conversations from scam-bearing channels. The 6.6% FPR in Table 20 comes from 76 author-written conversations with no contact artifacts, and the paper's own Section 7 concedes that 'Establishing deployable false-alarm rates on live traffic will require a real benign conversational corpus drawn from scam-bearing channels.' Calling 6.6% 'a realistic upper bound' in Section 5.8 is therefore not supported: an authored adversarial probe can underestimate or overestimate the operational rate, especially because real benign traffic often contains links, phone numbers, and wrong-number openers. Since the practical value of a warning system depends on not alarming benign users, this is a load-bearing gap for the 'practical value' conclusion. Please either add a natural scam-adjacent benign sample or substant
- [§5.4, Tables 11–12] The comparative claims against the full-transcript classifier are made without significance testing. On ConScamBench-278 the proposed system detects 126/128 scams vs. the baseline's 124/128; on LoveFraud02 it detects 83/83 vs. 81/83. These differences are small relative to the sample sizes, and a McNemar/Fisher exact test would likely not reach significance; the full-transcript baseline also has a lower FPR (1.3% vs. 2.7%) on ConScamBench-278. The text states that the proposed system 'catches more scams on both corpora' and 'beats' the baseline, which overstates the support. Please report exact tests or confidence intervals for these differences and temper the wording to point-estimate statements where significance is absent. The cost advantage of summary-based memory (Section 5.9) is unaffected, but the recall advantage is not established.
minor comments (4)
- [Abstract] The abstract reports p<0.001 for pre/post trust increases without repeating the body's caveat that the design is uncontrolled and that r=1.00 suggests demand or acquiescence effects. Please either add a brief qualifier (e.g., 'exploratory') or remove the p-values from the abstract.
- [§5.2, Table 3] The SMD comparison is performed on a re-audited, re-labeled, and augmented dataset. Please state explicitly that SmishX's original published numbers were on the original labels, and report the class distribution of the 10 added messages, so readers do not mistake this for a head-to-head on the unmodified dataset.
- [§5.4, Table 13] The recent-window sweep reports 100% precision and 0% FPR at every k. With 150 benign conversations this is a finite-sample result; a Wilson CI on zero would be helpful to avoid overstating the perfect specificity.
- [§5.8, Table 20] The stress-test row labels (sab_*) are not defined; a one-line description of how the 76 conversations were constructed and selected would aid reproducibility. Also, consider moving the Section 7 caveat about live benign corpora into Section 5.8 itself.
Circularity Check
No significant circularity: the central detection claims are empirical evaluations on external corpora, and the paper's admitted false-positive-rate limitation is an external-validity concern, not a circular step.
full rationale
The central claims are empirical evaluation results, not derived quantities. The conversation-level detector is tested on the external LoveFraud02 corpus (83 real conversations) and on ConScamBench-278; although the latter is introduced by the authors, 110 of its 128 scam conversations are real-sourced, and the paper reports metrics on the real-sourced subset in addition to the fully external LoveFraud02 corpus. The SMD is evaluated on the baseline SmishX dataset after an audited relabeling, and the 100% phishing recall is also reported on the 259 phishing messages whose labels were left unchanged, so the headline is not an artifact of relabeling. Prompts, thresholds, verification rules, and scheduling were frozen before evaluation, as stated in Section 5.1 ('Development and test separation'), so there is no fitted-parameter-then-predicted-same-data pattern. Section 7 explicitly concedes that deployable false-alarm rates on live traffic will require a real benign conversational corpus drawn from scam-bearing channels; that is an external-validity limitation and does not create a circular reduction, and it does not undercut the external recall evidence. The user-study trust gains are explicitly described as uncontrolled and interpreted as reception rather than a controlled effect. No load-bearing self-citation, imported uniqueness theorem, or ansatz-via-citation is present. I find no step where a predicted quantity equals an input by construction.
Axiom & Free-Parameter Ledger
free parameters (2)
- Adaptive scheduling thresholds =
min-conversation 3 messages; re-analysis every 5/3/2/1 turns for none/low/medium/high threat
- Threat-level discretization =
none/low/medium/high
axioms (5)
- domain assumption ConScamBench-278 and LoveFraud02 ground-truth labels are correct
- domain assumption Truncating LoveFraud02 to pre-scam turns does not create label leakage or inflate recall
- domain assumption LLM-generated conversations (18) are realistic adversarial proxies for AI-assisted scams
- domain assumption Benign corpora (DailyDialog, MultiWOZ, etc.) and the authored stress test are adequate proxies for non-scam traffic
- domain assumption The LLM backends (deepseek-v3.1:671b, qwen3-vl:30b) produce faithful structured extraction and verification summaries
invented entities (2)
-
Summary-based memory
no independent evidence
-
Threat level (none/low/medium/high)
no independent evidence
read the original abstract
Following the rapid progress of generative Artificial Intelligence, there is a growing threat posed by conversational scams. These scams often span over multiple weeks or months, gradually build trust and request for money or sensitive information. Existing scam-detection systems mainly focus on isolated messages, which renders them inadequate against this evolving threat. This paper extends single-message phishing detection and presents an explainable agentic system for detecting sophisticated conversational scams. It also introduces ConScamBench-278, an initial public multi-category benchmark for conversational scam detection spanning eight scam types, released to support reproducible evaluation and future expansion. On isolated messages the single-message detector attains 100% phishing recall, while the conversation-level detector identifies all conversational scams in the public LoveFraud02 corpus (83/83) and reaches 97.8% accuracy (95% CI [95.4, 99.0]) on ConScamBench-278. Two user studies (N = 100 and N = 45) further motivate the system: participants report frequently experiencing uncertainty when judging suspicious conversations. In an uncontrolled pre/post comparison, users self-reported trust, self-confidence, and perceived need for AI-based scam detection all increased (p < 0.001, Wilcoxon signed-rank). The system also receives a System Usability Scale score of 74.7 (95% CI [72.5, 76.9]), above the established usability benchmark.
Figures
Reference graph
Works this paper leans on
-
[1]
Moral panic: Its origins in resistance, ressentiment and the translation of fantasy into reality.The British Journal of Criminology, 49(1):4–16, 11 2008
Jock Young. Moral panic: Its origins in resistance, ressentiment and the translation of fantasy into reality.The British Journal of Criminology, 49(1):4–16, 11 2008
2008
-
[2]
Jagatic, Nathaniel A
Tom N. Jagatic, Nathaniel A. Johnson, Markus Jakobsson, and Filippo Menczer. Social phishing.Commun. ACM, 50(10):94–100, October 2007
2007
-
[3]
Internet crime report
Federal Bureau of Investigation, Internet Crime Complaint Center (IC3). Internet crime report
-
[4]
Large language models can be used to effectively scale spear phishing campaigns
Julian Hazell. Large language models can be used to effectively scale spear phishing campaigns. arXiv preprint, May 2023
2023
-
[5]
Stephen E. G. Lea, Peter Fischer, and Kath M. Evans. The psychology of scams: Provoking and committing errors of judgement. Technical Report OFT1070, Office of Fair Trading, 2009
2009
-
[6]
Ai-generated phishing: The top enterprise threat of 2026, December
Gabrielle Letain-Mathieu. Ai-generated phishing: The top enterprise threat of 2026, December
2026
-
[7]
Cohen, Roopa Foulger, Jonathan A
Yizhu Wang, Haoyu Zhai, Chenkai Wang, Qingying Hao, Nick A. Cohen, Roopa Foulger, Jonathan A. Handler, and Gang Wang. Can you walk me through it? explainable sms phishing detection using llm-based agents. InProceedings of the 21st Symposium on Usable Privacy and Security (SOUPS 2025), Seattle, WA, USA, August 2025. USENIX Association
2025
-
[8]
Haoyang Luo et al. The anatomy of conversational scams: A topic-based red teaming analysis of multi-turn interactions in llms.arXiv preprint arXiv:2601.03134, 2026
Pith/arXiv arXiv 2026
-
[9]
An explorative study of pig butchering scams.arXiv preprint arXiv:2412.15423, December 2024
Bhupendra Acharya and Thorsten Holz. An explorative study of pig butchering scams.arXiv preprint arXiv:2412.15423, December 2024
Pith/arXiv arXiv 2024
-
[10]
Gilad Gressel, Rahul Pankajakshan, Shir Rozenfeld, Ling Li, Ivan Franceschini, Krishnasree Achuthan, and Yisroel Mirsky. Love, lies, and language models: Investigating ai’s role in romance-baiting scams.arXiv preprint arXiv:2512.16280, December 2025
Pith/arXiv arXiv 2025
-
[11]
Lovextortion: Persuasion strategies in romance cybercrime.Discourse, Context & Media, 35:100398, 2020
Patrizia Anesa. Lovextortion: Persuasion strategies in romance cybercrime.Discourse, Context & Media, 35:100398, 2020
2020
-
[12]
Monica T. Whitty. The scammers persuasive techniques model: Development of a stage model to explain the online dating romance scam.British Journal of Criminology, 53(4):665–684, 2013
2013
-
[13]
Ai-driven fraud as an emerging cyber risk: Evidence from a global incident-based analysis.EDPACS, 0(0):1–12, 2026
Ahmet Yiğitalp Tulga. Ai-driven fraud as an emerging cyber risk: Evidence from a global incident-based analysis.EDPACS, 0(0):1–12, 2026
2026
-
[14]
Llms get lost in multi-turn conversation
Philippe Laban, Hiroaki Hayashi, Yingbo Zhou, and Jennifer Neville. Llms get lost in multi-turn conversation. InInternational Conference on Learning Representations (ICLR), 2026
2026
-
[15]
Evaluating very long-term conversational memory of llm agents
Adyasha Maharana, Brenda Ku, and Mohit Bansal. Evaluating very long-term conversational memory of llm agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), pages 12821–12843, 2024. 32
2024
-
[16]
Centralized intelligence, decentralized risk: The security implications of third-party api dependency in enterprise ai
Florian Tramer et al. Centralized intelligence, decentralized risk: The security implications of third-party api dependency in enterprise ai. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 412–429, 2025
2025
-
[17]
Glorin Sebastian. Privacy and data protection in chatgpt and other ai chatbots: Strategies for securing user information.International Journal of Security and Privacy in Pervasive Computing, 15:1–14, 07 2023
2023
-
[18]
Alzamil, Areej M
Laila M. Alzamil, Areej M. Alhasani, and Sarah Alshehri. Privacy concerns in chatgpt data collection and its impact on individuals.Future Internet, 17(11):511, 2025
2025
-
[19]
Extracting training data from large language models
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In30th USENIX Security Symposium (USENIX Security 21), pages 2633–2650. USENIX Association, August 2021
2021
-
[20]
Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. Are large pre-trained language models leaking your personal information? In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Findings of the Association for Computational Linguistics: EMNLP 2022, pages 2038–2047, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics
2022
-
[21]
An empirical analysis of memorization in fine-tuned autoregressive language models
Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David Evans, and Taylor Berg- Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1816–1826, Abu Dhab...
2022
-
[22]
Davidson, Kate Muir, Florian A
Brittany I. Davidson, Kate Muir, Florian A. D. Burnat, and Adam N. Joinson. Regulatory gray areas of LLM terms.arXiv preprint arXiv:2601.08415, 2026
arXiv 2026
-
[23]
Sok: The privacy paradox of large language models: Advancements, privacy risks, and mitigation
Yashothara Shanmugarasa, Ming Ding, Chamikara Mahawaga Arachchige, and Thierry Rako- toarivelo. Sok: The privacy paradox of large language models: Advancements, privacy risks, and mitigation. InProceedings of the 20th ACM Asia Conference on Computer and Communications Security, ASIA CCS ’25, pages 425–441. ACM, August 2025
2025
-
[24]
On protecting the data privacy of large language models (llms) and llm agents: A literature review.High-Confidence Computing, 5(2):100300, June 2025
Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. On protecting the data privacy of large language models (llms) and llm agents: A literature review.High-Confidence Computing, 5(2):100300, June 2025
2025
-
[25]
A future role for health applications of large language models depends on regulators enforcing safety standards.The Lancet Digital Health, 6(9):e662–e672, September 2024
Oscar Freyer, Isabella Catharina Wiest, Jakob Nikolas Kather, and Stephen Gilbert. A future role for health applications of large language models depends on regulators enforcing safety standards.The Lancet Digital Health, 6(9):e662–e672, September 2024
2024
-
[26]
Images and vision, 2026
OpenAI. Images and vision, 2026. OpenAI API documentation. Accessed: 2026-03-22
2026
-
[27]
Deepseek-v3
DeepSeek-AI. Deepseek-v3. https://github.com/deepseek-ai/DeepSeek-V3, 2024. GitHub repository. Accessed: 2026-03-22
2024
-
[28]
Qwen3-vl-30b-a3b-instruct
Qwen Team. Qwen3-vl-30b-a3b-instruct. https://huggingface.co/Qwen/ Qwen3-VL-30B-A3B-Instruct, 2025. Hugging Face model card. Accessed: 2026-03-22. 33
2025
-
[29]
Jina reader api: Convert any url to an llm-friendly input.https://jina.ai/reader/,
Jina AI. Jina reader api: Convert any url to an llm-friendly input.https://jina.ai/reader/,
-
[30]
A new tool to unlock data from enterprise documents for generative ai.https: //research.ibm.com/blog/docling-generative-AI, November 2024
IBM Research. A new tool to unlock data from enterprise documents for generative ai.https: //research.ibm.com/blog/docling-generative-AI, November 2024. Accessed: 2026-03-22
2024
-
[31]
Accessed: 2026-07-12
2026
-
[32]
Google Knowledge Graph Search API.https://developers.google.com/ knowledge-graph, 2024
Google Developers. Google Knowledge Graph Search API.https://developers.google.com/ knowledge-graph, 2024. Accessed: 2026-06-19
2024
-
[33]
Docling: Get your documents ready for gen ai
docling-project. Docling: Get your documents ready for gen ai. https://github.com/ docling-project/docling, 2026. Accessed: 2026-03-22
2026
-
[34]
Streamlit Documentation
Streamlit. Streamlit Documentation. https://docs.streamlit.io/, 2026. Accessed: 2026- 06-19
2026
-
[35]
Google Search API.https://serper.dev/, 2026
Serper.dev. Google Search API.https://serper.dev/, 2026. Accessed: 2026-06-19
2026
-
[36]
DailyDialog: A manually labelled multi-turn dialogue dataset
Yanran Li, Hui Su, Xiaoyu Shen, Wenjie Li, Ziqiang Cao, and Shuzi Niu. DailyDialog: A manually labelled multi-turn dialogue dataset. InProceedings of the Eighth International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 986–995, Taipei, Taiwan, November 2017. Asian Federation of Natural Language Processing
2017
-
[37]
LoveFraud02, 2024
Pamela Faber. LoveFraud02, 2024. Published: 15 July 2024
2024
-
[38]
Towards empathetic open-domain conversation models: A new benchmark and dataset
Hannah Rashkin, Eric Michael Smith, Margaret Li, and Y-Lan Boureau. Towards empathetic open-domain conversation models: A new benchmark and dataset. InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 5370–5381, Florence, Italy, July 2019. Association for Computational Linguistics
2019
-
[39]
MultiWOZ – a large-scale multi-domain wizard-of-oz dataset for task-oriented dialogue modelling
PawełBudzianowski, Tsung-HsienWen, Bo-HsiangTseng, IñigoCasanueva, StefanUltes, Osman Ramadan, and Milica Gašić. MultiWOZ – a large-scale multi-domain wizard-of-oz dataset for task-oriented dialogue modelling. InProceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 5016–5026, Brussels, Belgium, October-November 2018...
2018
-
[40]
Individual comparisons by ranking methods
Frank Wilcoxon. Individual comparisons by ranking methods. InBreakthroughs in statistics: Methodology and distribution, pages 196–202. Springer, 1992
1992
-
[41]
Deal or no deal? end-to-end learning of negotiation dialogues
Mike Lewis, Denis Yarats, Yann Dauphin, Devi Parikh, and Dhruv Batra. Deal or no deal? end-to-end learning of negotiation dialogues. InProceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 2443–2453, Copenhagen, Denmark, September
2017
-
[42]
Kortum, and James T
Aaron Bangor, Philip T. Kortum, and James T. Miller. An empirical evaluation of the system usability scale.International Journal of Human–Computer Interaction, 24(6):574–594, 2008. 34
2008
-
[44]
SUS: A quick and dirty usability scale
John Brooke. SUS: A quick and dirty usability scale. In Patrick W. Jordan, B. Thomas, B. A. Weerdmeester, and I. L. McClelland, editors,Usability Evaluation in Industry, pages 189–194. Taylor and Francis, London, 1996
1996
-
[2017]
Association for Computational Linguistics
-
[2024]
Technical report, Federal Bureau of Investigation, Washington, DC, 2025
2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.