---
license: apache-2.0
library_name: scikit-learn
pipeline_tag: text-classification
language:
  - en
  - fa
tags:
  - cybersecurity
  - phishing-detection
  - text-classification
  - multilingual
datasets:
  - AriaAICompany/phish-messages
---

# phish-structural

Small calibrated reviewers used by the Phish Space.

- `tfidf_lr.joblib` — `TfidfVectorizer(char_wb 3-5)` + logistic regression, sigmoid-calibrated
- `lightgbm.joblib` — LightGBM on structural features only, sigmoid-calibrated

Trained on the development campaigns of `AriaAICompany/phish-messages` (seed 3). Test campaigns are held out by campaign, sender group, and template.

## Intended use

Decision support for a human reviewing a **synthetic or already-shared** message. Scores are not a safe/unsafe certificate and are not a probability of account compromise.

## Out of scope

- Fetching or rendering live URLs
- Executing attachments
- Judging malice from a logo screenshot
- Treating copied SPF/DKIM/DMARC headers as a trusted receiver verdict
- Production mailbox enforcement

## Metrics

See `metrics.json` written by `scripts/build_artifacts.py` and `evaluations/evaluation.json` in the Space. Lab PR-AUC on synthetic fixtures is not operational accuracy.