Pith. sign in

REVIEW 3 major objections 7 minor 17 references

LLM-Powered Intent-Based Categorization of Phishing Emails

T0 review · 3 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper reports that modern large language models can detect phishing from the email's text alone, reaching up to 97% detection accuracy on a curated test set.

desk verdict Useful taxonomy and prompt design, but the evaluation is compromised by likely training-data contamination, so the accuracy claims don't hold yet. read the letter →

arxiv 2506.14337 v1 pith:LFCLK6FK submitted 2025-06-17 cs.CR cs.AI

Even Eilertsen , Vasileios Mavroeidis , Gudmund Grov This is my paper · ORCID
classification cs.CRcs.AI
keywords phishingdetectionlargelanguagemodelsintentclassificationzero-shotpromptingfew-shotlearningemailsecuritytaxonomycyberthreatintelligence
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that an LLM can act as an experienced reader of email, infer the sender's goal from the subject and body, and flag the message as phishing without any metadata such as sender authentication or IP addresses. It introduces an intent taxonomy with three categories—lure to a link, lure to open an attachment, and lure to move to an outside service—and tests four models in prompts with and without example emails. On a curated 100-email validation set, the three strongest models reach 88–97% binary detection accuracy and 76–95% category accuracy, while a smaller, older model fails badly. If the claim transfers, email defenses gain a text-only layer that complements metadata-based filters and outputs actionable triage information.

What carries the argument

The load-bearing objects are an intent taxonomy and a two-step prompting protocol. The taxonomy sorts phishing into three categories defined by the action requested of the reader: via link (click or visit a URL), via attachment (open a downloaded file), and via service (act outside the inbox, such as calling a number or using a third-party channel), with an Other bucket for clear phishing that fits none of these. The prompting protocol first asks for a binary malicious-or-not verdict with a short justification and then, only for malicious emails, assigns a category; each prompt is run both zero-shot (no examples) and few-shot (two labeled example emails per category). A held-out set of 100 manually labeled emails, curated from three public email collections, carries the final accuracy figures that constitute the paper's evidence.

What would settle it

Run the same prompts on a fresh, independently labeled set of several hundred recent phishing emails from live spam feeds mixed with benign corporate emails; if the three strong models' detection accuracy falls below 80% or their category accuracy approaches 25% (chance among the four labels), the reported text-only performance would not generalize.

Watch

Extended reading notes

Core claim

The central claim is that phishing can be recognized by asking an LLM what act the sender wants the recipient to perform, using only the subject line and body text. With a taxonomy transposed from an established attack-vector framework into three categories (via link, via attachment, via service), the study reports that three current models—GPT-4o-mini, Claude 3.5 Haiku, and Phi-4 (14B)—classify the curated validation emails with detection accuracy between 88% and 97% and category accuracy between 76% and 95%, while Qwen (7B) scores far lower and often fails to follow the required output format. The authors read this as evidence that inherent language knowledge is largely sufficient, because adding two labeled examples per category in few-shot prompts produced mixed results rather than consistent gains.

Load-bearing premise

The result depends on the 100 hand-labeled emails being a fair sample of the phishing and legitimate email that actually reaches real inboxes; if that sample or its labels are unrepresentative, the accuracy figures will not transfer.

Editorial extensions

If this is right

  • Text-only screening can catch phishing that slips past metadata-dependent filters, because it judges what the email asks the reader to do.
  • Category output gives security teams a triage head start: link, attachment, and external-service lures point to different investigation and response procedures.
  • Zero-shot performance is already high for the strongest models, so a deployment need not carry labeled example sets or risk few-shot prompt bloat.
  • Smaller or older models may be unsuitable for intent-based phishing detection, since the 7B model in this study failed on both accuracy and output format.
  • Cost and latency are practical: the reported API-based experiments took one to three minutes and roughly $0.01–$0.03 per experiment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that the reported accuracy figures should be read as evidence of capability on a curated sample, not as expected live-performance numbers, because the test set is one 100-email collection labeled by the authors.
  • An unstated consequence is that intent categories could help separate urgent-but-legitimate marketing from phishing; a test set built around such near-miss emails would stress the method harder than the current collection does.
  • If the mechanism generalizes, a natural extension is to route the model's free-text justification into the triage queue as structured indicators for analysts, a direction the paper itself flags for future work.
  • We infer that a sharper evaluation would include phishing emails generated by LLMs, since the taxonomy deliberately drops the 'spear' qualifier to cover such campaigns but the current test set appears not to contain them.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes using LLMs to detect phishing emails from subject and body text alone, and to categorize phishing emails into a MITRE ATT&CK-derived intent taxonomy (Phishing via Link, Attachment, Service, Other). The authors curate a 100-email validation set from LING, Nazario, and Enron, design zero-shot and few-shot prompts in three experiments, and evaluate GPT-4o-mini, Claude 3.5 Haiku, Phi-4, and Qwen. Table II reports detection accuracy of 88 to 97 percent and category accuracy of 76 to 95 percent for the three stronger models, with Qwen performing poorly. The paper concludes that LLMs can infer phishing intent and generate useful justifications, complementing metadata-based defenses.

Significance. If the experimental evidence were clean, the paper would be a useful practical contribution: a text-only, intent-focused LLM pipeline with a released 100-email dataset and a simple MITRE-aligned taxonomy. The authors deserve credit for releasing the dataset, for specifying the prompts in the text, and for holding out the validation set until the final evaluation phase. However, the central claim is currently undercut by the lack of evidence that the 100-email validation set is unseen by the models, by the small sample size and absence of uncertainty quantification, and by the absence of a non-LLM baseline. These issues are fixable, so the paper merits revision rather than rejection.

major comments (3)
  1. [Section IV-A, preprocessing step 4] The evaluation set is not shown to be unseen by the models. The validation set is manually selected from LING, Nazario, and Enron, all public corpora that predate the evaluated models, and the paper itself reports that Enron emails were removed because LLMs recognized them. This is direct evidence of memorization leakage within the evaluation pipeline. Because no decontamination is reported for the remaining 100 emails, the high accuracies in Table II may reflect retrieval of memorized text rather than inference of phishing intent. The authors should either evaluate on newly collected or private emails, or systematically quantify exact and near-duplicate overlap with model training data, and they should report the class balance and source composition of the 100-email set.
  2. [Section V, Table II] The evaluation rests on a single 100-email validation set with no confidence intervals, no repeated runs, and no inter-annotator agreement. For example, Exp1-Zero reports 97%, 96%, 90%, and 44% across models; with n=100 the standard error around a 96% accuracy is roughly two percentage points, so differences among the top models are not statistically meaningful. Category accuracy denominators are also unexplained (e.g., 86.05% suggests 37/43 phishing emails in some condition). Please report per-class counts, binomial confidence intervals, repeated sampling with fixed decoding parameters, and label agreement between the annotators.
  3. [Section VI, RQ1] The conclusion states that LLMs achieved above 95% accuracy in phishing detection, but Table II shows phi-4 at 90% in Exp1-Zero and the category accuracy for several conditions falls below 80%. Moreover, no baseline (e.g., a keyword classifier, a traditional machine-learning detector, or a random-guess level) is reported, so the practical significance of the absolute accuracies is not established. A comparison against at least one non-LLM baseline would support the claim that the approach complements existing metadata-based defenses and would make the abstract's assessment of 'potential in this domain' more convincing.
minor comments (7)
  1. [Section IV-C] The exact full prompts used in the experiments are not reproduced; only templates are shown, and the source of the few-shot examples (which dataset, how selected) is not stated. Please include the actual prompts and the example-selection procedure for reproducibility.
  2. [Section IV-D] Sampling temperatures and other decoding parameters are not reported for either API or local inference. LLM outputs are stochastic, and the few-shot results (e.g., Qwen's 2% vs. 0%) may depend on these settings.
  3. [Section V, Table II] The table would benefit from explicit row and column labels and from separating detection accuracy from category accuracy in the same cell; the current 'Detection / Category' notation and missing per-class breakdown make it difficult to interpret.
  4. [Section III] The categories are described as intent types but are defined primarily by delivery vector (link, attachment, service). The authors should clarify the relationship between 'intent' and delivery mechanism, as this directly affects the interpretation of RQ4 and RQ5.
  5. [Section VI, RQ3] The conclusion that justifications reveal the model's reasoning is stronger than the evidence presented; the paper states that justification quality was only preliminarily examined and no rubric was used. Please temper this claim or add a structured evaluation.
  6. [Section IV-A] The paper cites a single Kaggle dataset for LING, Nazario, and Enron; separate primary citations and version identifiers would help readers verify the data sources and reconstruction.
  7. [Throughout] Minor typographical and formatting issues include 'a intent category' in Section IV-B1, inconsistent capitalization in the prompt text ('To CLICK'), and a dangling quotation mark at the end of the Phishing via Link definition in Section III.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is an empirical benchmark on a held-out manually labeled validation set, with an externally sourced taxonomy and no fitted parameters.

full rationale

The paper's central claim is that modern LLMs can detect and categorize phishing emails from subject and body text alone. This claim is evaluated by prompting the models on a held-out validation set of 100 manually labeled emails described in Section IV-A. The accuracy numbers in Table II are direct outputs of the models on that set, not quantities reconstructed from the models' own definitions or from fitted parameters. No parameter is fitted to the validation set, and the few-shot examples are drawn from the separately curated dataset rather than from the 100-email test set, so the evaluation is not circular. The intent taxonomy is explicitly adopted from the external MITRE ATT&CK T1566 framework in Section III, rather than invented from the models' outputs or from the authors' prior definitions, so there is no self-definitional loop. The paper contains no load-bearing self-citations: the cited works are external phishing studies, MITRE documentation, and prior LLM phishing-detection work, and none of the authors' own prior results is invoked to justify the central capability claim. The preprocessing note in Section IV-A stating that some Enron emails were removed and replaced because the LLMs recognized them is a genuine threat to external validity and could indicate training-data memorization or leakage, but that is a data-contamination and representativeness concern, not a circularity of the derivation chain. The human-assigned labels are independent of the models' outputs, and the reported accuracies are not defined in terms of the predictions they are said to validate. Therefore, no specific circular reduction can be exhibited, and the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper's results rest on the manually labeled validation set, the MITRE-derived taxonomy, and a set of data filtering choices. No numeric free parameters are fit, and no new objects such as forces or particles are introduced.

assumptions (4)
  • domain assumption The MITRE ATT&CK T1566 sub-techniques form a valid basis for categorizing phishing intent.
    Section III derives the three categories from MITRE ATT&CK; the paper assumes these categories capture the relevant attacker intent for LLM detection.
  • domain assumption The manually labeled 100-email validation set is correctly labeled and representative.
    Section IV-A introduces the validation set; all reported accuracies depend on this assumption.
  • domain assumption LLM outputs were parsed faithfully and formatting failures reflect model inability rather than parsing errors.
    Section V counts Qwen's format failures as zero accuracy; this assumes the parsing is fair and complete.
  • ad hoc to paper Removing Enron emails with recognizable company references does not bias the phishing and legitimate distinction.
    Section IV-A1 describes filtering; this is a paper-specific data handling choice that affects the test distribution.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLM-Powered Intent-Based Categorization of Phishing Emails." pith.science (2026). https://pith.science/paper/LFCLK6FK

@misc{pith2026250614337,
  author       = {Pith},
  title        = {Pith review of: LLM-Powered Intent-Based Categorization of Phishing Emails},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LFCLK6FK}},
  note         = {Machine review of arXiv:2506.14337}
}
read the original abstract

Phishing attacks remain a significant threat to modern cybersecurity, as they successfully deceive both humans and the defense mechanisms intended to protect them. Traditional detection systems primarily focus on email metadata that users cannot see in their inboxes. Additionally, these systems struggle with phishing emails, which experienced users can often identify empirically by the text alone. This paper investigates the practical potential of Large Language Models (LLMs) to detect these emails by focusing on their intent. In addition to the binary classification of phishing emails, the paper introduces an intent-type taxonomy, which is operationalized by the LLMs to classify emails into distinct categories and, therefore, generate actionable threat information. To facilitate our work, we have curated publicly available datasets into a custom dataset containing a mix of legitimate and phishing emails. Our results demonstrate that existing LLMs are capable of detecting and categorizing phishing emails, underscoring their potential in this domain.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 14 canonical work pages

  1. [1]

    Early phishing,

    K. Rekouche, “Early phishing,” *arXiv preprint arXiv:1106.4692*, 2011

    arXiv 2011

  2. [2]

    Alkhalil, C

    Z. Alkhalil, C. Hewage, L. Nawaf, and I. Khan, ”Phishing attacks: A recent comprehensive study and a new anatomy,” *Frontiers in Computer Science*, vol. 3, p. 563060, 2021

    work page 2021

  3. [3]

    Cofense, ”2024 Cofense Annual State of Email Security Report,” Cofense, Feb. 2024. [Online]. Available: https: //cofense.com/getmedia/db5a5ad7-b39a-45f5-bab7-eb165b9a0685/ 2024-cofense-annual-state-of-email-security-report.pdf. [Accessed: Apr. 25, 2025]

    work page 2024

  4. [4]

    Microsoft, ”Microsoft Digital Defense Report 2024,” Microsoft, Oct

    work page 2024

  5. [5]

    Available: https://attack.mitre.org/techniques/T1566/

    MITRE Corporation, ”MITRE ATT&CK: Phishing (T1566),” [Online]. Available: https://attack.mitre.org/techniques/T1566/. [Accessed: Feb. 28, 2025]

    work page 2025

  6. [6]

    J. C. Brickley, K. Thakur, and A. S. Kamruzzaman, ”A comparative analysis between technical and non-technical phishing defenses,” *Int. J. Cyber-Security and Digital Forensics*, vol. 10, no. 1, pp. 28–41, 2021

    work page 2021

  7. [7]

    Durumeric *et al.*, ”Neither snow nor rain nor MITM

    Z. Durumeric *et al.*, ”Neither snow nor rain nor MITM... an empirical analysis of email delivery security,” in *Proc. 2015 Internet Measure- ment Conf.*, pp. 27–39, 2015

    work page 2015

  8. [8]

    Hazell, ”Large language models can be used to effectively scale spear phishing campaigns,” *arXiv preprint arXiv:2305.06972*, 2023

    J. Hazell, ”Large language models can be used to effectively scale spear phishing campaigns,” *arXiv preprint arXiv:2305.06972*, 2023

    arXiv 2023

Show all 17 references
  1. [9]

    Heiding, B

    F. Heiding, B. Schneier, A. Vishwanath, J. Bernstein, and P. S. Park, ”Devising and detecting phishing emails using large language models,” *IEEE Access*, 2024

    2024

  2. [10]

    Derouet, ”Fighting phishing and securing data with email authen- tication,” *Computer Fraud & Security*, vol

    E. Derouet, ”Fighting phishing and securing data with email authen- tication,” *Computer Fraud & Security*, vol. 2016, no. 10, pp. 5–8, 2016

    2016

  3. [11]

    Koide, N

    T. Koide, N. Fukushi, H. Nakano, and D. Chiba, ”Chatspamdetector: Leveraging large language models for effective phishing email detec- tion,” *arXiv preprint arXiv:2402.18093*, 2024

    2024 arXiv

  4. [12]

    Y . Yao, J. Duan, K. Xu, Y . Cai, Z. Sun, and Y . Zhang, ”A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly,” *High-Confidence Computing*, p. 100211, 2024

    2024

  5. [13]

    Jampen, G

    D. Jampen, G. G ¨ur, T. Sutter, and B. Tellenbach, ”Don’t click: Towards an effective anti-phishing training. A comparative literature review,” *Human-centric Computing and Information Sciences*, vol. 10, no. 1, p. 33, 2020

    2020

  6. [14]

    Kojima, S

    T. Kojima, S. S. Gu, M. Reid, Y . Matsuo, and Y . Iwasawa, ”Large lan- guage models are zero-shot reasoners,” *Advances in Neural Information Processing Systems*, vol. 35, pp. 22199–22213, 2022

    2022

  7. [15]

    N. A. Alam, ”Phishing Email Dataset,” [Online]. Available: https: //www.kaggle.com/datasets/naserabdullahalam/phishing-email-dataset. [Accessed: Feb. 20, 2025]

    2025

  8. [16]

    Available: https:// attack.mitre.org/techniques/T1566/002/

    MITRE, ”Phishing: Spearphishing Link,” [Online]. Available: https:// attack.mitre.org/techniques/T1566/002/. [Accessed: Apr. 3, 2025]

    2025

  9. [2024]

    Available: https://cdn-dynmedia-1.microsoft.com/is/ content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/ Microsoft%20Digital%20Defense%20Report%202024%20%281%29

    [Online]. Available: https://cdn-dynmedia-1.microsoft.com/is/ content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/ Microsoft%20Digital%20Defense%20Report%202024%20%281%29. pdf. [Accessed: Apr. 25, 2025]

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.