{"id":"453c9ed1-1c73-473a-b004-61a8605ac758","arxiv_id":"2411.11389","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"The PEEK framework uses GAN-style training and iterative pattern feedback to generate phishing emails, raising the usable sample share from 21.4% to 84.8% and improving detector robustness against evasion attacks.","lead":"Researchers built an AI pipeline that invents new phishing emails, then feeds the most convincing examples back into the system to create even more varied scams. The generated emails help phishing detectors stay accurate when attackers try to slip past them, though the main quality measurement relies on the same AI that does the filtering.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 84.8% usable-samples claim rests on the same gpt-3.5-turbo analyzer that filters the corpus, validated only on human emails; PEEK-specific analyzer bias is untested.","rationale":"The reader's weakest assumption is the correct place to look: the same ChatGPT analyzer both filters the generated corpus in Phase B and produces the PAS scores that support the headline 84.8% usability figure and the quality comparisons in Table VII. The paper validates this analyzer on 1,000 human-written emails (Appendix B-C) and reports F1=0.95, but it never validates the analyzer on PEEK-generated emails. Given the paper's own finding that PEEK phishing deliberately downplays urgency and uses subtler persuasive strategies, an analyzer calibrated on conventional phishing cues could systematically mislabel the very outputs PEEK is designed to produce. The IBM NLU check in the ablation is a genuinely useful external signal for existing topics, which is why I do not reject the paper; but it is not reported for the full corpus and it does not cover the extra-topic 88.1% PAS claim. Because the quality number feeds directly into the claim that PEEK provides usable phishing samples that improve detector robustness, the absence of a PEEK-specific analyzer validation is the most load-bearing uncertainty. My recommendation is unchanged: the paper should be CONDITIONAL pending this validation and a correction of the over-broad 70% adversarial-accuracy statement. I agree with the reader that this is the key weakness, and the proposed test would settle whether it is a real defect or merely a missing but harmless check.","tokens_in":28525,"tokens_out":6601,"duration_ms":97784,"concrete_test":"Run a PEEK-specific analyzer validation: sample about 400 PEEK-generated emails that passed Phase B, obtain independent labels from two human phishing experts (or a second analyzer with a different prompt, e.g., GPT-4o with a neutral rubric), and compute agreement (Cohen's kappa, F1) with the gpt-3.5-turbo/Koide analyzer, following the Appendix B-C protocol. Then rebuild the PEEK corpus using only samples that both human annotators label as phishing, and re-run Table VII's PAS and Table II and Appendix D fine-tuning results; if the usable rate drops materially below 84.8% or RoBERTa's ASR reduction (14.81% to 8.76%) is not reproduced, the central claims are conditional on analyzer permissiveness.","verdict_should_be":"UNCHANGED","load_bearing_attack":"PEEK's central quality claim—that the framework raises usable phishing samples from 21.4% to 84.8% (Section VI-A1, Table VII)—is produced by the same ChatGPT analyzer (gpt-3.5-turbo with Koide's prompt) that in Phase B (Section III-B) filters which generated emails are retained as PEEK phishing. If this analyzer is permissive or systematically biased toward its prompt's phishing cues, both the PAS filtering and the reported usability rate are inflated, and the detector fine-tuning in Section VI-C is performed on a corpus whose quality is not independently established. The analyzer's reliability is checked only on 1,000 labeled human emails (Appendix B-C, Table VI); no validation is reported on PEEK-generated text, where the paper itself claims different persuasive strategies (e.g., downplayed urgency). The ablation's IBM NLU check partially mitigates this for existing topics (88.2% vs 84.8%), but it is not used for the full corpus, and the extra-topic 88.1% PAS (Section VI-C2) has no independent check. A second, load-bearing inconsistency is that the abstract's maintaining 70% detection accuracy against adversarial attacks is contradicted by Table X: after PEEK fine-tuning, ALBERT's EVA-Acc under PWWS is 0.31 and SQ's is 0.55. This does not by itself sink the framework, but it means the headline robustness number is not the measured worst case.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"PEEK proposes an iterative framework for generating phishing emails with an LLM (Llama 3.1) trained under a GAN-style objective with a Bi-LSTM discriminator, followed by a ChatGPT-based analyzer that filters generated samples. The retained PEEK phishing corpus is then analyzed with isolation forests, LDA clustering, and LIWC/persuasion-principle tools to identify evolving phishing patterns, which are fed back into the generator prompts in a recurrent loop. The paper claims that PEEK raises the proportion of usable phishing samples from 21.4% to 84.8%, improves detector robustness after fine-tuning, and maintains 70% detection accuracy under adversarial attacks.","tokens_in":28777,"tokens_out":3354,"duration_ms":36315,"significance":"If the central claims hold, PEEK would be a valuable practical contribution: it provides a scalable method for generating diverse, realistic phishing emails and demonstrates that such data can improve the robustness of downstream detectors. The study evaluates multiple detectors, multiple adversarial perturbation attacks, and multiple benchmark datasets, and it includes an ablation comparing generator choices and prompt designs, which is commendable. The framework also incorporates an interpretable analysis of persuasion strategies, which is useful for understanding LLM-driven phishing evolution. However, the significance is currently conditional because the key quality metric is produced by the same analyzer used for filtering, and the GAN training mechanism for discrete text is not specified.","major_comments":[{"comment":"The GAN training procedure is underspecified for discrete text. The generator is Llama 3.1, which produces discrete tokens, and the discriminator is a Bi-LSTM, but the paper does not describe how discriminator gradients propagate through the discrete sampling process. The objective in Eq. (2) is the standard continuous GAN objective; without a concrete mechanism such as Gumbel-softmax, policy gradient, or a differentiable relaxation, the claim that adversarial training improves the generator is not established. The ablation in Table VII may reflect the benefit of fine-tuning plus filtering rather than GAN-specific training. Please specify the exact training algorithm, including how G(z) is sampled and how dD/dG is computed.","section":"Section III-A and Appendix B-A, Eq. (2)"},{"comment":"The headline usability rate of 84.8% is circular because the same ChatGPT analyzer (gpt-3.5-turbo with Koide's prompt) that filters the corpus in Phase B is used to compute the PAS scores reported in Section VI-A1. The analyzer's validation (Appendix B-C, Table VI) is on 1,000 human-labeled emails, not on PEEK-generated emails, where the paper itself argues the language differs (e.g., downplayed urgency). The IBM NLU result in Table VII (88.2%) provides partial external support for existing topics, but the extra-topic row shows a large discrepancy (57.4% IBM NLU vs. 88.1% analyzer), so the cross-topic PAS claim in Section VI-C2 is not independently validated. Please add an external validation of the analyzer on PEEK-generated samples and report per-topic agreement.","section":"Section III-B and Section VI-A1"},{"comment":"The abstract's statement that PEEK 'still maintain[s] 70% detection accuracy against adversarial attacks' is contradicted by the reported tables. After PEEK fine-tuning, ALBERT achieves EVA-Acc of 0.31 under PWWS (Table X, and Table XIV), and 0.55 under TextFooler (Table IX). The robustness gain is real for several model-attack combinations, but the headline number is not the measured worst case. The abstract and Section VI-C1 should either report the full range or explicitly state that the 70% figure is the best case or applies only to specific configurations.","section":"Abstract and Section VI-C1, Tables X and XIV"},{"comment":"The robustness results are reported without error bars or repeated-run variance, and the fine-tuning learning rate is selected separately for each attack type (Appendix D-C). This makes it difficult to assess whether the ASR improvements are statistically significant or partially due to per-attack hyperparameter tuning. Please report means and standard deviations over multiple random seeds and clarify whether the attack-specific hyperparameter search introduces optimism in the reported robustness gains.","section":"Section VI-C1 and Appendix D-C, Tables II-III, IX-XIV"}],"minor_comments":[{"comment":"The column headers 'FT-NLU%' and 'FT-Llama3.1%' are ambiguous; the text should clarify that these are fine-tuned IBM NLU and Llama 3.1 classifiers used as independent filters, not generator variants.","section":"Table VII caption and column headers"},{"comment":"The paper switches between 'PAS analysis identifies 84.8% realistic phishing mimicry' (Introduction) and '84.8% of PEEK-generated samples received PAS scores of 6 or higher' (Section VI-A1); please use one consistent definition and make the PAS threshold explicit wherever the number is cited.","section":"Section VI-A1 and Introduction"},{"comment":"There is a typo: 'Bi-LISM Attention' should be 'Bi-LSTM Attention'. Similar small typos appear in Table II ('Comapred') and in the text ('P EEKanml').","section":"Appendix B-A"},{"comment":"The discussion acknowledges that analyzers will evolve but does not address the circularity concern that the same analyzer both filters and evaluates the corpus. A sentence noting this limitation and the need for independent evaluators would strengthen the discussion.","section":"Section VII, 'Towards Future Phishing Analyzers'"},{"comment":"The Cambridge dataset is described as private, which limits reproducibility of the full pipeline. Please state explicitly which subsets of the results depend on the private dataset and whether the released corpus will include the processed Cambridge-derived samples.","section":"Appendix A-A and Table V"}],"recommendation":"major_revision","confidential_remarks":"This paper addresses a timely and practical problem, and the proposed framework is a plausible step toward scalable phishing data augmentation. The main concerns are fixable in a revision: the GAN training mechanism for discrete text must be concretely specified, the PAS circularity needs an external check on PEEK-generated samples, and the abstract's 70% robustness claim must be reconciled with the worst-case numbers. The extra-topic discrepancy between IBM NLU (57.4%) and the ChatGPT analyzer (88.1%) is the most worrying single result and should be investigated before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nPEEK is a serious attempt to solve a real problem: getting diverse, current phishing emails to train detectors. The idea of a recurrent framework that generates phishing with an LLM, filters by an analyzer, and feeds extracted persuasion patterns back into the prompt is new, and the authors ran a reasonable set of experiments across several datasets and attacks. The ablation against pre-trained/fine-tuned Llama and GPT-2 shows their configuration wins, and the IBM NLU check in Table VII is a genuinely useful external signal—it gives 88.2% for existing topics, close to the ChatGPT analyzer's 84.8%. That partially addresses the circularity concern.\n\nThe soft spots are real but not fatal. The biggest one is methodological: the paper calls the training \"GAN-based,\" but it never explains how gradients flow from the Bi-LSTM discriminator to the discretely sampled text of the Llama generator. LoRA tuning with a standard min-max objective doesn't obviously work for discrete tokens without some relaxation or policy-gradient trick. As written, the GAN claim is not verifiable. This is load-bearing because the paper attributes quality improvements to adversarial training.\n\nSecond, the central quality claim is still partly circular. The same gpt-3.5-turbo prompt filters the corpus and scores the retained samples, and its validation is on human email—not on PEEK-generated text, where the paper itself notes different persuasive strategies. The IBM NLU number helps, but it's only for existing topics and not used for the full corpus or the cross-topic set. The abstract's \"maintaining 70% detection accuracy\" is also not supported by every table (ALBERT under PWWS sits at 31% after fine-tuning). Error bars are absent throughout.\n\nThe persuasion-principle analysis is interesting and the direction is sound, though it leans on LLooM and LIWC without domain-specific validation. That's a minor issue.\n\nWho is this for? Researchers who want a practical dataset-augmentation tool or a baseline for LLM-generated phishing. It deserves a serious referee, but the authors need to provide the training details, validate the analyzer on generated text, and tone down the claims. I'd give it a \"major revision\" rather than a reject.\n\nBest,\n[You]","headline":"PEEK is a serious attempt at a real problem—diverse, current phishing data—but the GAN mechanics are underspecified and the headline quality numbers rest on a circular ChatGPT judge; worth a major revision, not a reject.","tokens_in":29346,"tokens_out":2515,"would_cite":true,"duration_ms":25314,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims its iterative GAN-plus-LLM loop generates phishing emails that are realistic enough (84.8% usable) and diverse enough to measurably harden detectors against text-perturbation attacks.","keywords":["phishing generation","large language models","adversarial training","GAN","persuasion principles","dataset augmentation","phishing detection","robustness"],"falsifier":"Take a random sample of the PEEK-generated corpus and have independent human phishing analysts (or a second, independently calibrated analyzer) label it; if the proportion judged realistic falls well below 84.8% or agreement with the PEEK analyzer is weak, the quality and downstream robustness claims built on the filtered corpus lose their support.","tokens_in":28300,"feed_emoji":"🎣","tokens_out":6540,"duration_ms":58726,"temperature":0.7,"pith_summary":"The paper proposes PEEK, a recurrent framework that combines large language models with adversarial training to generate phishing emails that are both realistic and diverse. The authors claim PEEK raises the fraction of generated samples judged usable by a phishing analyzer from 21.4% to 84.8%, surpassing prompt-only and fine-tuning-only LLM baselines, and that detectors fine-tuned on the resulting corpus are markedly harder to evade, with attack success rates falling by up to 70% (e.g., RoBERTa's ASR drops from 14.81% to 8.76% under DeepWordBug). The motivation is practical: public phishing data are scarce, outdated, and privacy-restricted, so detectors trained on static corpora miss evolving tactics. If the claims are right, PEEK supplies both a scalable data-augmentation route and a running analysis of how LLM-driven phishing persuasion changes over time.","feed_headline":"PEEK lifts usable phishing samples from 21.4% to 84.8%","feed_subtitle":"GAN-style training plus a ChatGPT filter yields diverse phishing emails that harden detectors against perturbations.","key_machinery":"The load-bearing mechanism is the iterative adversarial loop. A Llama 3.1 8B generator, fine-tuned with LoRA under a Chain-of-Thought style chat prompt, is trained against a Bi-LSTM discriminator with the GAN objective, so the discriminator's realism judgment pushes the generator toward human-like output. A ChatGPT-based analyzer, using the phishing-intent prompt of reference [5], then filters the outputs and assigns each a phishing authentication score; this same analyzer's judgment is what supports the 84.8% usability figure. The retained samples are fed into isolation forest and LDA clustering to find statistically distinct anomalies, which are annotated through six persuasion principles using LLOOM and LIWC-22; the extracted topic keywords are inserted back into the prompt to seed the next iteration. Everything downstream—the diversity analysis and the detector-robustness gains—rests on that loop.","core_discovery":"On its own terms, the paper's central claim is that an iterative generation-extraction loop produces phishing emails that are simultaneously more realistic and more diverse than what prior LLM-based generators produce, and that training detectors on these emails substantially improves robustness to text-perturbation attacks. The authors find that PEEK-generated emails cluster into new topic families beyond banking (shipment, university services, login failures) and that their persuasive style shifts from blunt urgency toward concrete, context-rich Authority and Reciprocity cues; 84.8% of generated samples receive a phishing authenticity score of 6 or higher from the analyzer, and 71.3% score 8 or higher. Fine-tuning experiments on six detectors across four perturbation frameworks show consistent gains, with F1-scores above 0.88 and best-case attack success rates near 1%. The paper also reports zero-shot topic transfer with 88.1% of cross-topic samples judged realistic.","pith_inferences":["An implication the paper does not spell out: because the same analyzer both filters the corpus and generates the PAS scores, the 84.8% figure is partially self-consistent; an independent judge could revise the number, and the ablation already shows the IBM NLU filter reports different rates.","Connected neighboring problem: the same generate-filter-extract-feedback loop should transfer to other text-based social engineering (SMS, chat, voicemail) as long as a judge of realism exists for that modality; the paper only demonstrates email.","Testable extension: the reported robustness gains are measured against four fixed perturbation tools; an adaptive adversary that knows PEEK was used in training could reveal whether the improvement persists under attack-specific tuning."],"forward_implications":["Fine-tuning existing detectors on PEEK-generated phishing should lower attack success rates under TextFooler, PWWS, Pruthi, and DeepWordBug compared with the IWSPA 2023 and DeepAI datasets.","The claimed 88.1% PAS on seven zero-shot topics implies the loop can generate fresh topics on demand, reducing the need to collect new real-world phishing data.","The observed shift from urgency to concrete authority and reciprocity phrasing suggests detectors that over-weight words like 'urgent' or 'immediately' will miss the next wave of LLM-crafted emails.","Because the extracted patterns are fed back into training, the framework is explicitly designed to track tactic drift across iterations, giving defense teams an observable signal of how LLM phishing changes."],"supporting_citations":[{"why":"Supplies the analyzer prompt and phishing authentication scoring used to filter and validate the generated corpus.","marker":"[5]"},{"why":"Provides the IWSPA 2023 phishing dataset and detector setup used as a baseline for robustness comparison.","marker":"[18]"},{"why":"Provides the DeepAI-phishing dataset used as the second comparison baseline.","marker":"[20]"},{"why":"Describes LoRA, the parameter-efficient fine-tuning method applied to the generator.","marker":"[29]"},{"why":"Introduces Chain-of-Thought prompting, which shapes the chat prompt template for generation.","marker":"[32]"},{"why":"Provides isolation forest, the anomaly detection method used to identify statistically distinct PEEK samples.","marker":"[33]"},{"why":"Defines the six persuasion principles used to annotate and interpret deceptive strategies.","marker":"[35]"},{"why":"Introduces LIWC-22, the linguistic tool used to quantify lexical differences aligned with persuasion principles.","marker":"[37]"},{"why":"Formulates the GAN objective that underpins the adversarial generator-discriminator training.","marker":"[79]"}],"fun_headline_variants":["PEEK quadruples usable phishing emails from LLMs","PEEK: 21% to 85% usable phishing emails","PEEK turns 1 in 5 phishing emails into 4 in 5","PEEK boosts phishing detector accuracy past 88%","PEEK cuts phishing attack sensitivity by 70%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The ChatGPT-based analyzer is an accurate and unbiased judge of whether a generated email is realistic phishing, because the same analyzer filters the corpus and produces the PAS scores behind the headline 84.8% and the robustness claims.","fun_headline_variants_meta":{"raw":{"variants":["PEEK quadruples usable phishing emails from LLMs","PEEK: 21% to 85% usable phishing emails","PEEK turns 1 in 5 phishing emails into 4 in 5","PEEK boosts phishing detector accuracy past 88%","PEEK cuts phishing attack sensitivity by 70%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001184,"raw_usage":{"total_tokens":4915,"prompt_tokens":999,"completion_tokens":3916,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":615,"completion_tokens_details":{"reasoning_tokens":3831}},"tokens_in":615,"tokens_out":3916,"duration_ms":28185,"temperature":1.0,"reasoning_tokens":3831,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:34:04.712270+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a random sample of the PEEK-generated corpus and have independent human phishing analysts (or a second, independently calibrated analyzer) label it; if the proportion judged realistic falls well below 84.8% or agreement with the PEEK analyzer is weak, the quality and downstream robustness claims built on the filtered corpus lose their support.","supporting_citations":[{"cited_title":"Adversarial robustness of phishing email detection models,","cited_arxiv_id":null,"evidence_quote":"Provides the IWSPA 2023 phishing dataset and detector setup used as a baseline for robustness comparison."},{"cited_title":"Analysis and prevention of ai-based phishing email attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the DeepAI-phishing dataset used as the second comparison baseline."},{"cited_title":"The development and psychometric properties of liwc-22,","cited_arxiv_id":null,"evidence_quote":"Introduces LIWC-22, the linguistic tool used to quantify lexical differences aligned with persuasion principles."}],"review_version":1}