Pith. sign in

REVIEW 2 major objections 5 minor 49 references

Beyond Detection: Evaluating Defensive LLMs Against AI-Generated Social Engineering in Live Turn-by-Turn Interaction

T0 review · 2 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Defensive LLMs frequently intervene in AI-generated social-engineering conversations without correctly identifying which trust component failed, and can diagnose the failure without taking protective action.

desk verdict A carefully built benchmark that makes a genuine point about separating intervention from structural diagnosis; the main caveats are annotation provenance and a sloppy supplementary inconsistency. read the letter →

arxiv 2608.10239 v1 pith:C5PHKHZJ submitted 2026-08-10 cs.AI

Yuqiao Xu , Osama Zafar , Alexander Nemecek , Erman Ayday This is my paper · ORCID
classification cs.AI
keywords trust-chainlocalizationlivescamresistanceLLMsafetyevaluationsocialengineeringturn-by-turninteractionasset-controlfailuresurfacesensitivityfalsepositives
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether LLM-based defenders resist AI-generated social engineering by understanding the structural source of risk or by reacting to surface cues. It formalizes trust-chain localization, identifying which of four trust components fails: actor authority, asset control, verification sufficiency, or transaction path, and measures it separately from intervention. On 300 frozen online-housing conversations, five models were evaluated turn-by-turn and in one-shot; intervention rates ranged from 0% to 96.3%, yet correct localization at the first intervention lagged behind. The paper's central claim is that protective action and structural diagnosis are distinct capabilities, so live scam resistance must be measured along several axes at once.

What carries the argument

The central object is trust-chain localization: classifying an unfolding interaction by which of four trust-chain components fails, namely actor authority, asset control, verification sufficiency, or transaction path. The paper operationalizes this with a frozen 300-case benchmark in online housing, crossing 20 scenario families with five structural conditions (legitimate, L1, L2, L3, L4) and three surface presentations (overt risk, neutral, legitimacy-preserving). A hidden ground-truth registry records the compromised component, the first checkpoint at which it becomes localizable, and the first turn containing the consequential request. Each defender is prompted at every checkpoint to choose continue, verify, warn, or stop and to predict one component, so intervention is scored independently of localization. The 'first localizable checkpoint' annotation is what converts timing into a measurable metric: pre-request intervention ($PRI = 1$) only when the first protective intervention precedes the consequential-request turn.

What would settle it

Have independent annotators re-label the trust-chain component and first-localizable checkpoint on the 300 frozen cases without seeing the authors' registry; if inter-annotator agreement with the registry is low (for example kappa below 0.7), or if the observed decoupling shrinks or disappears when the previously rejected multi-failure cases are scored instead of excluded, the central claim would lose its current empirical support.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central finding is that protective intervention and trust-chain localization are not the same capability and in practice frequently come apart. Models sometimes warned or stopped while naming the wrong compromised component, as when Claude Sonnet 4.6 intervened in 231 of 240 scam cases but localized correctly at first intervention in only 195. Models also sometimes identified the correct component while still selecting continue, as GPT-4.1-mini did for the 31 L1 cases it correctly localized in static evaluation. No model ever explicitly endorsed the harmful action, yet intervention rates ranged from 0% for Qwen2.5-7B to 96.3% for Claude Sonnet 4.6. The paper therefore argues that safe-looking behavior, such as issuing warnings, is insufficient evidence that a defender understands the structural source of risk, and that live scam resistance must be evaluated as separate dimensions: intervention, timing, localization, and false-positive behavior.

Load-bearing premise

The load-bearing premise is that the benchmark's ground-truth labels and 'first localizable checkpoint' annotations are reliable; the authors authored them under a defined taxonomy, and cases that do not fit that taxonomy were revised or rejected rather than scored, so if those annotations are wrong or do not translate to real housing scams, both the localization and timing metrics lose meaning.

Editorial extensions

If this is right

  • Deployment evaluations that report only refusal or intervention rates will overstate safety; they should separately report whether the defender correctly identified the failed trust component before the consequential request.
  • Defenders can be improved by explicitly tracking the trust chain, actor authority, asset control, verification, and transaction path, rather than emitting generic warnings, since asset-control failures were the recurring blind spot.
  • Live turn-by-turn and static full-transcript protocols are not interchangeable; one-shot diagnosis can over- or under-estimate live resistance depending on the model, so both should be reported.
  • Legitimate-case false positives must be part of the scorecard, since a model that intervenes in 31.7% of legitimate conversations imposes real user friction even when its scam coverage is high.
  • A model can correctly localize a failure yet recommend no protective action, so evaluation must treat diagnosis and intervention as separate, independently reported outcomes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely consequence is that safety training which rewards warnings will optimize intervention coverage without teaching models which trust link is broken; user-facing defenses should be tested on whether their stated reason matches the actual failure, not just on whether they interrupt.
  • Because asset-control cases were a bottleneck in both the housing benchmark and the job-search transfer probe, a small probe built around 'real actor, real asset, broken link' cases could screen future defenders cheaply.
  • The action-versus-structural false-positive split suggests a two-axis safety profile: a defender can be uselessly alarmist even while correctly refusing nothing, so evaluations should report both forms of false positives rather than merging them.
  • One could test whether the decoupling is behaviorally meaningful by showing users a defender's correct or incorrect localization alongside a generic warning and measuring how often users complete the risky action; if users follow a wrong-component warning just as readily, the distinction remains diagnostic but may not change user outcomes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This paper introduces a benchmark for evaluating defensive LLMs against AI-generated social engineering in live, turn-by-turn interaction. The authors formalize "trust-chain localization" as the task of identifying which of four components of a trust chain has failed: actor authority, asset control, verification sufficiency, or transaction path. They construct a 300-case frozen online-housing corpus with 20 scenario families, five structural conditions (legitimate plus four failure modes), and three surface conditions, and evaluate five models under both live turn-by-turn and one-shot static full-transcript protocols, yielding 1,500 model-case evaluations per protocol. The central empirical claim is that protective intervention and correct structural localization are distinct capabilities: models sometimes intervene while identifying the wrong trust component, and sometimes identify the correct component without recommending protective action. Secondary findings include component-dependent difficulty (with asset-control cases being a recurring bottleneck for strong hosted models), model-dependent surface sensitivity, and model-dependent live-static differences. A preliminary job-search transfer probe is included.

Significance. If the results hold, the paper makes a useful contribution to LLM-safety evaluation by separating dimensions that prior work tends to conflate: whether a model intervenes, when it intervenes, whether it identifies the correct failure mechanism, and whether it over-warns on legitimate interactions. The benchmark construction is careful in several respects: the corpus is frozen and cryptographically hashed, the scoring rules are explicit and deterministic, the bootstrap resamples at the scenario-family level to respect the matched factorial design, and the authors report exact counts alongside rates. There is no circularity concern: models are scored against hidden ground-truth labels, and no fitted constants appear in the derivation. The finding that intervention coverage and localization can diverge is clearly falsifiable and is supported by multiple consistent tables. The job-search probe, while preliminary, strengthens the paper by showing that the taxonomy can be transferred to another domain and that intervention sensitivity does not automatically transfer to localization accuracy.

major comments (2)
  1. [Supplementary A.3, B, E] The decoupling result is scored entirely against author-defined ground-truth component labels and timing annotations, and the corpus is explicitly filtered to cases with a unique, cleanly localizable label: cases that do not fit the four-component taxonomy are revised or rejected rather than scored. No inter-annotator reliability study, blind adjudication, or independent audit is reported anywhere in the manuscript. Since both directions of the central claim ('intervenes while identifying the wrong trust component' and 'correct localization without protective action') are defined relative to these labels, the observed decoupling could in principle be an artifact of the annotation scheme rather than a property of the models. Section 6's statement that independent annotation remains future work is not sufficient for a benchmark whose main conclusion is a capability distinction. The manuscript should add an independent annotation study on a random sample, with agreement coefficients for the component label and the first-localizable checkpoint, and a sensitivity analysis that re-scores borderline or ambiguous cases rather than excluding them.
  2. [Supplementary A.3 and E.1] The relationship between the first-localizable checkpoint and the consequential-request checkpoint needs to be stated explicitly and verified for all 240 scam cases. The PRI definition in E.1 uses only t_req (the first consequential-request turn), while A.3 introduces the first-localizable checkpoint as an annotation used to exclude cases. If in some cases the decisive evidence becomes available at the same checkpoint as t_req, then pre-request intervention is impossible by construction, and the high PRI rates (which equal live intervention for GPT-4.1-mini, GPT-4o, and Claude) would be a corpus artifact rather than evidence about timing behavior. The authors should either state that the first-localizable checkpoint strictly precedes t_req for every scam case, with a verification count, or adjust the metric definition and conclusions accordingly.
minor comments (5)
  1. [Supplementary G.1] The text says Claude Sonnet 4.6 'correctly localized the compromised component at its first intervention in 295 cases,' which is impossible because there are only 240 scam cases and 231 interventions, and it contradicts Table 5's 195/240. Supplementary G.2 also says Claude intervened in 52 L2 cases while Table 6 reports 51. All counts in the supplementary results should be reconciled against the tables.
  2. [Supplementary B, G.3, G.4] There are numerous typos and formatting errors: 'must nit add' in Section B; 'udnerthe' in G.3; 'stetting' in G.4; 'GOT-4.1-mini' and 'interventon' in G.1; and 'ases' in G.2. A thorough proofread of the supplementary material is needed.
  3. [Section 4.4] The sentence defining static full-transcript localization is duplicated verbatim, which makes the metric definition section look unfinished.
  4. [Supplementary A.3 and A.4] The paragraph beginning 'Exclusion of ambiguous cases' appears twice, and Section B opens by repeating the first sentence of A.4's surface-condition discussion. This duplication should be removed so the construction rules are described once.
  5. [Table 1] Conditional first-intervention localization is a headline metric for the decoupling claim, but Table 1 reports only point estimates for it. Since the bootstrap procedure in F.3 can produce intervals for conditional metrics, please report confidence intervals for all models with a nonzero intervention denominator, or explain why the subset is too small for stable intervals.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; the benchmark is a self-contained empirical evaluation with no fitted parameters or load-bearing self-citations.

full rationale

No circularity found. This is an empirical benchmark paper; it contains no equations that reduce a predicted quantity to a fitted input. The trust-chain taxonomy (L1-L4) is the evaluation construct, and the hidden registry's ground-truth component and 'first localizable checkpoint' are the scoring labels. Models never see these labels, and the labels are fixed before evaluation; the claim that intervention and localization are distinct capabilities is a measured behavioral finding on that corpus, not a consequence of a derivation. The benchmark's annotation conventions (rejecting or revising cases without a unique ground-truth label) affect external validity but are standard benchmark practice and are not circular. The paper explicitly flags 'independent annotation ... remain future work' in Section 6, which is a validity limitation rather than a circular step. There are no load-bearing self-citations: the cited prior work is external (SEConvo, SEVSim, Fraud-R1, etc.), and no 'uniqueness theorem' or ansatz is imported from the authors' own prior derivations. The one notable internal inconsistency, Supplementary G.1's '295 cases' count for a 240-case scam set, is a transcription error, not evidence of circularity. Score 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces a conceptual taxonomy (trust-chain localization) but no new physical or computational entity requiring independent falsifiable evidence. No numeric parameters are fitted to data; design choices such as five checkpoints, four components, and three surface conditions are structural rather than fitted values.

assumptions (3)
  • domain assumption The four trust-chain components (actor authority, asset control, verification sufficiency, transaction path) are mutually exclusive and exhaustive for the housing domain.
    Section 3.2 defines these as the failure modes. Supplementary A.3 excludes cases with multiple or ambiguous primary failures, so the benchmark only tests cases where this taxonomy cleanly applies.
  • domain assumption The 'first localizable checkpoint' can be objectively determined for every scam case.
    Supplementary A.3 defines it as 'the first checkpoint at which the component can be distinguished from the other structural conditions'. This annotation underpins the pre-request intervention metric and is author-defined without inter-annotator agreement.
  • ad hoc to paper Cross-surface invariants preserve the structural label and evidence timing across surface variants.
    Supplementary B defines cross-surface invariants. The validity of the surface-sensitivity analysis depends on these invariants being met, which is asserted but not independently audited.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Detection: Evaluating Defensive LLMs Against AI-Generated Social Engineering in Live Turn-by-Turn Interaction." pith.science (2026). https://pith.science/paper/C5PHKHZJ

@misc{pith2026260810239,
  author       = {Pith},
  title        = {Pith review of: Beyond Detection: Evaluating Defensive LLMs Against AI-Generated Social Engineering in Live Turn-by-Turn Interaction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C5PHKHZJ}},
  note         = {Machine review of arXiv:2608.10239}
}
read the original abstract

Generative AI makes social-engineering attacks more fluent, adaptive, and scalable, increasing the need for LLM-based de- fenders that can protect users during ongoing interactions. We ask whether such defenders identify the structural source of risk or merely react to surface cues. We formalize trust-chain localization: identifying whether an interaction fails at actor authority, asset control, verification sufficiency, or transaction path. We construct a controlled 300-case online-housing corpus spanning 20 scenario families, legitimate cases, four structural failure modes, and three surface conditions. Five defender models are evaluated on the same corpus in state- ful turn-by-turn and one-shot static settings, yielding 1,500 model-case evaluations per protocol and 3,000 in total. No model produced explicit unsafe compliance, yet defensive effectiveness varied sharply: intervention rates ranged from 0% to 96.3%. Protective action and correct structural localization were frequently decoupled, with models sometimes intervening while identifying the wrong trust component or recognizing a structural failure without taking protective action. Asset-control failures were a major localization bottleneck, surface sensitivity varied across models, and live-static differences were model-dependent. These findings show that safe-looking behavior alone is insufficient; live scam resistance must separately measure intervention, timing, structural localization, and false-positive behavior.

Figures

Figures reproduced from arXiv: 2608.10239 by the authors.

Figure 1
Figure 1. Overview of the controlled Live evaluation framework. Each scenario is instantiated as a validated, frozen multi-turn [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Trust-chain components and primary failure modes. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Joint first-intervention localization by model and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Transitions from the component predicted at the [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Transitions from the component predicted at the [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Joint distribution of action and structural false pos [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 4
Figure 4. Figure 4: Turn-by-turn intervention and first-intervention localization by failed trust-chain component. Intervention and correct [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 40 canonical work pages

  1. [1]

    Defending Against Social Engineering Attacks in the Age of LLMs

    Defending Against Social Engineering Attacks in the Age of LLMs , author =. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , year =. 2406.12263 , archivePrefix =

    work page Pith review arXiv 2024

  2. [2]

    Findings of the Association for Computational Linguistics: ACL 2025 , year =

    Fraud-R1: A Multi-Round Benchmark for Assessing the Robustness of LLM Against Augmented Fraud and Phishing Inducements , author =. Findings of the Association for Computational Linguistics: ACL 2025 , year =. 2502.12904 , archivePrefix =

    arXiv 2025

  3. [3]

    2025 , eprint =

    Personalized Attacks of Social Engineering in Multi-turn Conversations: LLM Agents for Simulation and Detection , author =. 2025 , eprint =

    work page 2025

  4. [4]

    Proceedings of the SIGCHI Conference on Human Factors in Computing Systems , pages =

    Why Phishing Works , author =. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems , pages =. 2006 , publisher =

    work page 2006

  5. [5]

    Communications of the ACM , volume =

    Social Phishing , author =. Communications of the ACM , volume =. 2007 , doi =

    work page 2007

  6. [6]

    Proceedings of the SIGCHI Conference on Human Factors in Computing Systems , pages =

    Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions , author =. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems , pages =. 2010 , publisher =

    work page 2010

  7. [7]

    IEEE Access , volume =

    Devising and Detecting Phishing Emails Using Large Language Models , author =. IEEE Access , volume =. 2024 , doi =

    work page 2024

  8. [8]

    2024 , eprint =

    Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects , author =. 2024 , eprint =

    work page 2024

Show all 49 references
  1. [9]

    IEEE Access , volume =

    Lateral Phishing With Large Language Models: A Large Organization Comparative Study , author =. IEEE Access , volume =. 2025 , doi =

    2025

  2. [10]

    2026 , eprint =

    The End of Trust: How Agentic AI Breaks Security Assumptions , author =. 2026 , eprint =

    2026

  3. [11]

    Rental Scams , year =

  4. [12]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , pages=

    XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models , author=. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , pages=. 2024 , publisher=

    2024

  5. [13]

    Proceedings of the 41st International Conference on Machine Learning , pages=

    HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal , author=. Proceedings of the 41st International Conference on Machine Learning , pages=. 2024 , volume=

    2024

  6. [14]

    International Conference on Learning Representations , year=

    Identifying the Risks of LM Agents with an LM-Emulated Sandbox , author=. International Conference on Learning Representations , year=

  7. [15]

    Frontiers of Computer Science , volume =

    A Survey on Large Language Model based Autonomous Agents , author =. Frontiers of Computer Science , volume =

  8. [16]

    arXiv preprint arXiv:2309.07864 , year =

    The Rise and Potential of Large Language Model Based Agents: A Survey , author =. arXiv preprint arXiv:2309.07864 , year =

    arXiv

  9. [17]

    International Conference on Learning Representations , year =

    MINT: Evaluating LLMs in Multi-turn Interaction with Tools and Language Feedback , author =. International Conference on Learning Representations , year =

  10. [18]

    arXiv preprint arXiv:2503.22458 , year =

    Evaluating LLM-based Agents for Multi-Turn Conversations: A Survey , author =. arXiv preprint arXiv:2503.22458 , year =

  11. [19]

    Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics , year =

    REL-A.I.: An Interaction-Centered Approach To Measuring Human Reliance on LLM Advice , author =. Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics , year =

    2025

  12. [20]

    Artificial Intelligence Review , year=

    Digital deception: Generative artificial intelligence in social engineering and phishing , author=. Artificial Intelligence Review , year=

  13. [22]

    arXiv preprint arXiv:2508.21457 , year=

    SoK: Large Language Model-Generated Textual Phishing Campaigns: End-to-End Analysis of Generation, Characteristics, and Detection , author=. arXiv preprint arXiv:2508.21457 , year=

    arXiv

  14. [23]

    ACM Transactions on Internet Technology , volume =

    Teaching Johnny Not to Fall for Phish , author =. ACM Transactions on Internet Technology , volume =. 2010 , publisher =

    2010

  15. [24]

    2003 , publisher =

    The Art of Deception: Controlling the Human Element of Security , author =. 2003 , publisher =

    2003

  16. [25]

    2010 , publisher =

    Social Engineering: The Art of Human Hacking , author =. 2010 , publisher =

    2010

  17. [26]

    2014 Information Security for South Africa , pages =

    Social Engineering Attack Framework , author =. 2014 Information Security for South Africa , pages =. 2014 , publisher =

    2014

  18. [27]

    Computers & Security , volume =

    Social Engineering Attack Examples, Templates and Scenarios , author =. Computers & Security , volume =

  19. [28]

    Statistical Science , volume =

    Statistical Fraud Detection: A Review , author =. Statistical Science , volume =

  20. [29]

    Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages =

    Uncovering Large Groups of Active Malicious Accounts in Online Social Networks , author =. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages =. 2014 , publisher =

    2014

  21. [30]

    Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages =

    Dialing Back Abuse on Phone Verified Accounts , author =. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages =. 2014 , publisher =

    2014

  22. [31]

    Black Hat USA , year =

    Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter , author =. Black Hat USA , year =

  23. [32]

    Proceedings of the National Academy of Sciences , volume =

    Human Heuristics for AI-Generated Language Are Flawed , author =. Proceedings of the National Academy of Sciences , volume =

  24. [33]

    Workshop on the Economics of Information Security , year =

    Why Do Nigerian Scammers Say They Are from Nigeria? , author =. Workshop on the Economics of Information Security , year =

  25. [34]

    arXiv preprint arXiv:2305.06972 , year =

    Spear Phishing with Large Language Models , author =. arXiv preprint arXiv:2305.06972 , year =

    arXiv

  26. [35]

    Large Language Models in Cybersecurity: Threats, Exposure and Mitigation , pages =

    Phishing and Social Engineering in the Age of LLMs , author =. Large Language Models in Cybersecurity: Threats, Exposure and Mitigation , pages =. 2024 , publisher =

    2024

  27. [36]

    arXiv preprint arXiv:2412.00586 , year =

    Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects , author =. arXiv preprint arXiv:2412.00586 , year =

    arXiv

  28. [37]

    Patterns , volume =

    AI Deception: A Survey of Examples, Risks, and Potential Solutions , author =. Patterns , volume =

  29. [38]

    arXiv preprint arXiv:2303.11156 , year =

    Can AI-Generated Text Be Reliably Detected? , author =. arXiv preprint arXiv:2303.11156 , year =

    arXiv

  30. [39]

    Advances in Neural Information Processing Systems , volume =

    Paraphrasing Evades Detectors of AI-Generated Text, but Retrieval Is an Effective Defense , author =. Advances in Neural Information Processing Systems , volume =

  31. [40]

    ACM Computing Surveys , volume =

    The Creation and Detection of Deepfakes: A Survey , author =. ACM Computing Surveys , volume =. 2021 , publisher =

    2021

  32. [41]

    Computer Vision and Image Understanding , volume =

    Deep Learning for Deepfakes Creation and Detection: A Survey , author =. Computer Vision and Image Understanding , volume =

  33. [42]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages =

    Defending against Social Engineering Attacks in the Age of LLMs , author =. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages =

    2024

  34. [43]

    Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , pages =

    Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned , author =. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , pages =. 2022 , publisher =

    2022

  35. [44]

    International Conference on Financial Cryptography and Data Security , pages =

    Understanding Craigslist Rental Scams , author =. International Conference on Financial Cryptography and Data Security , pages =. 2016 , publisher =

    2016

  36. [45]

    Journal of King Saud University - Computer and Information Sciences , volume =

    A systematic literature review on phishing website detection techniques , author =. Journal of King Saud University - Computer and Information Sciences , volume =

  37. [46]

    2016 , eprint =

    An Intelligent Classification Model for Phishing Email Detection , author =. 2016 , eprint =

    2016

  38. [47]

    2024 , eprint =

    Can LLMs be Scammed? A Baseline Measurement Study , author =. 2024 , eprint =

    2024

  39. [48]

    arXiv preprint arXiv:1605.04717 , year =

    Do Users Focus on the Correct Cues to Differentiate Between Phishing and Genuine Emails? , author =. arXiv preprint arXiv:1605.04717 , year =

    arXiv

  40. [49]

    SN Computer Science , volume =

    How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society , author =. SN Computer Science , volume =. 2022 , doi =

    2022

  41. [50]

    arXiv preprint arXiv:2208.06792 , year =

    Improving Phishing Detection Via Psychological Trait Scoring , author =. arXiv preprint arXiv:2208.06792 , year =

    arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.