Push model using huggingface_hub.

README.md

@@ -1,252 +1,27 @@
----
-language:
-  - en
-license: mit
-library_name: phishbyte
-pipeline_tag: text-classification
-tags:
-  - phishing-detection
-  - email-security
-  - cybersecurity
-  - security
-  - pytorch
-  - from-scratch
-  - no-pretrained-weights
-  - cascading-inference
-  - lightweight
-  - explainable-ai
-  - nlp
-  - phishing
-  - spam-detection
-  - malware-detection
-  - threat-detection
-  - email-classification
-  - text-classification
-  - feature-engineering
-  - interpretable-ml
-  - tfidf
-  - residual-network
-  - context-gating
-  - calibrated-probabilities
-  - dmarc-alignment
-datasets:
-  - ceas-2008
-  - enron-email
-  - spamassassin
-  - ling-spam
-  - nazario-phishing
-  - nigerian-fraud
-metrics:
-  - f1
-  - precision
-  - recall
-  - accuracy
-model-index:
-  - name: phishbyte
-    results:
-      - task:
-          type: text-classification
-          name: Phishing Email Detection
-        dataset:
-          name: 7-source benchmark (CEAS, Enron, SpamAssassin, Ling-Spam, Nazario, Nigerian, farshad72, puyang2025)
-          type: ceas-2008
-        metrics:
-          - type: f1
-            value: 0.9445
-            name: F1 Score
-          - type: accuracy
-            value: 0.9477
-            name: Accuracy
-          - type: precision
-            value: 0.9402
-            name: Precision
-          - type: recall
-            value: 0.9489
-            name: Recall
-widget:
-  - text: "From: PayPal Security <security@paypa1-alert.tk>\nReply-To: attacker@evil-domain.ru\nSubject: URGENT: Your account will be suspended\n\nDear Customer, your PayPal account has been suspended. Verify now at http://paypal-login.tk/verify"
-    example_title: "Phishing email example"
-  - text: "From: alice@company.com\nReply-To: alice@company.com\nSubject: Team lunch tomorrow\n\nHi everyone, lunch is at noon in the usual spot. See you there!"
-    example_title: "Legitimate email example"
----
-
-# Phish_Byte v10
-
-A from-scratch PyTorch model for **email phishing detection** — no pretrained weights, no transformers, no fine-tuning.
-
-**743K parameters.** Every signal is a feature computed directly from the email — domain consistency, live SPF/DKIM/DMARC validation, link forensics, character-level lexical analysis — fed through a **context-gating architecture** that learns how one signal should change the interpretation of another, rather than a fixed hand-written rule.
-
-> The only non-transformer phishing detection model on HuggingFace.
-
----
-
-## Install — no PyPI package yet
-
-`pip install phishbyte` does **not** work. Clone the source repository:
-
-```bash
-git clone https://github.com/AnonymousSingh-007/Phish_Byte.git
-cd Phish_Byte
-python -m venv venv && source venv/bin/activate   # Windows: .\venv\Scripts\Activate.ps1
-pip install -r requirements.txt
-python verify_install.py
-```
-
-`verify_install.py` checks every dependency and source file, then does a live test download from this Hub repo. Run it before anything else — it identifies exactly what's wrong instead of a confusing traceback.
-
----
-
-## Usage
-
-```python
-from phishbyte import PhishByteEngine
-
-engine  = PhishByteEngine.from_pretrained("SamSec007/phishbyte")
-verdict = engine.analyze(raw_email_string)
-
-print(verdict.label)             # "phishing" or "legitimate"
-print(verdict.probability)       # calibrated P(phish), 0.0–1.0
-print(verdict.confidence)        # "high" / "medium" / "low"
-print(verdict.layer_used)        # 1 = fast rule veto, 2 = full network
-print(verdict.feature_weights)   # every signal computed for this email
-```
-
-`from_pretrained()` downloads the weights, calibration thresholds, and TF-IDF vocabulary from this repo on first call and caches them locally — every call after that is instant.
-
-### Analyze a real email from Gmail
-
-1. Open the email → **⋮** → **Show original**
-2. Select all (Ctrl+A), copy (Ctrl+C)
-3. Run `python cli.py`, paste when prompted, press Enter then Ctrl+Z (Windows) or Ctrl+D (Mac/Linux)
-
-Or save as `.eml` and run:
-
-```bash
-python cli.py --file suspicious.eml
-```
-
-### CLI quick demo
-
-```bash
-python cli.py --demo phish     # a known phishing example, no files needed
-python cli.py --demo legit     # a known legitimate example
-```
-
----
-
-## How it works, in plain language
-
-Every email is analyzed by several small, independent checks — the sender's domain, the links in the body, whether the mail server proved its identity via SPF/DKIM/DMARC, the subject line, the wording of the message. Each check produces a handful of numbers between 0 and 1.
-
-The key design choice is what happens next. Rather than mixing every number together and hoping a network untangles the relationships on its own, Phish_Byte splits its evidence into two groups before the network ever sees them:
-
-- **Raw evidence** — facts about this specific email, like "the Reply-To address differs from the sender" or "the most common link goes somewhere else."
-- **Context evidence** — facts that change how the raw evidence should be read, like "the server cryptographically proved its identity via DMARC and DKIM," or "this urgency is coercive rather than just professionally formal."
-
-A dedicated layer in the network learns a *gate* — for every email, how much should the context evidence turn up or down the weight given to each piece of raw evidence. This isn't a hardcoded rule like "if DMARC passes, ignore link mismatches." The network learns the actual relationship from real data, so it can distinguish a Gmail Reply-To on an authenticated academic mailing list from a Gmail Reply-To on an unauthenticated bank impersonation attempt — two situations a fixed rule would treat identically.
-
----
-
-## Architecture
-
-```
-raw email
-  → domain / URL / auth (SPF+DKIM+DMARC) / subject / link-forensics / lexical analysis
-  → cross-signal agreement check
-  → context feature computation (coercive vs professional urgency,
-     auth-verified sender context, freemail Reply-To context)
-  → RAW evidence (38 numbers) and CONTEXT evidence (13 numbers), kept separate
-  → Context Fusion Layer: learns a gate deciding how context reweights raw evidence
-  → fused representation + 50 TF-IDF word signals
-  → residual MLP: 620 → 310 (×2 residual blocks) → 155 → 76 → 1
-  → temperature-calibrated confidence score
-  → PhishVerdict with every raw and context signal that fired
-```
-
----
-
-## Version history
-
-**v2 — 12K parameters, 29 features, single dataset (CEAS-2008, ~39K emails).** The original prototype: a small MLP over hand-picked domain, URL, and subject features. Established the cascading Layer 1 (cheap rules) → Layer 2 (neural network) design that every later version kept.
-
-**v7 — 254K parameters, 85 features, 83K emails across 6 datasets.** Added a TF-IDF vocabulary learned directly from the training corpus and Body Domain Identification (most-common-link-domain analysis). First version with real generalization testing beyond a single dataset.
-
-**v8 — 716K parameters, 104 features, 166K emails across 7 datasets.** Added character-level lexical domain analysis (digit runs, entropy, typosquat distance) and a cross-signal layer that checks whether independent modules agree with each other, rather than scoring each in isolation.
-
-**v9 — 718K parameters, 107 features.** Replaced a naive SPF-only authentication check — which misfired constantly on legitimate marketing platforms like Marketo and Mailgun that relay mail on a brand's behalf — with a proper DMARC/DKIM alignment check that reads what the receiving mail server already validated.
-
-**v10 (current) — 743K parameters, context-gated fusion architecture.** Split urgency detection into two independent signals (coercive pressure vs. professional formality, previously conflated into one number). Restructured the network so raw evidence and context evidence enter as separate inputs to a learned fusion layer, instead of being concatenated and left for the network to disentangle unaided.
-
----
-
-## Feature groups
-
-| Group | Count | What it measures |
-|-------|:-----:|-------------------|
-| Domain (raw) | 7 | header consistency, brand impersonation, display-name spoofing |
-| URL + body (raw) | 4 | link security, anchor/href mismatch, link density |
-| SPF (raw) | 3 | basic sender authorization signal |
-| Subject (raw) | 7 | brand mentions, currency, formatting, fake reply prefixes |
-| Char-level (raw) | 5 | capitalization, digit density, HTML/text ratio |
-| BDI (raw) | 5 | most-common-link-domain mismatch, IP-target forms, open redirects |
-| Lexical — sender domain (raw) | 6 | digit runs, hyphen runs, entropy, typosquat distance |
-| Coercive urgency (raw) | 1 | pressure/threat language |
-| Auth-verified ESP context | 1 | how strongly DMARC/DKIM validate the sender |
-| Professional formality (context) | 1 | independent of coercive urgency |
-| Freemail Reply-To context | 2 | raw fact + how much authentication offsets it |
-| Tracking pattern (observational) | 1 | structural resemblance to ESP tracking infrastructure — never used to exempt anything |
-| Cross-signal fusion (context) | 5 | agreement between independent modules |
-| Auth alignment (context) | 3 | DMARC pass, DKIM alignment, composite score |
-| TF-IDF | 50 | words learned directly from the training corpus |
-
----
-
-## Training data
-
-| Dataset | Source |
-|---------|--------|
-| CEAS-2008, Enron, SpamAssassin, Ling-Spam, Nazario, Nigerian Fraud | Kaggle |
-| farshad72/spam_email | HuggingFace, 83K rows |
-| puyang2025/seven-phishing-email-datasets | HuggingFace, 203K rows, 7-source unified |
-| **Combined, after deduplication** | **~166,000 emails, ~56% phishing / 44% legitimate** |
-
----
-
-## Benchmarks
-
-Evaluated on 12,000 held-out samples, self-reported.
-
-| Metric | Value |
-|--------|:-----:|
-| F1 score | 0.9445 |
-| Accuracy | 94.77% |
-| Precision | 0.9402 |
-| Recall | 0.9489 |
-| Parameters | 743K |
-| Model size | ~3 MB |
-| GPU required | No |
-
----
-
-## Limitations
-
-- **Most training data predates 2010.** Modern phishing (OAuth abuse, QR lures, redirect chains through legitimate cloud services) is underrepresented.
-- **False positives on legitimate marketing/notification email are reduced but not eliminated.** The context-gating architecture measurably helps but this remains an active area of work.
-- **No adversarial robustness testing has been performed.** Use as one signal in defence-in-depth, not a standalone gate.
-- **Benchmark numbers are self-reported**, not independently verified.
-- **English-language only.**
-
-## Citation
-
-```bibtex
-@software{phishbyte2026,
-  author = {Singh, Samratth},
-  title  = {Phish_Byte: Context-gated fusion architecture for from-scratch email phishing detection},
-  year   = {2026},
-  url    = {https://github.com/AnonymousSingh-007/Phish_Byte}
-}
-```
-
-## License
-
-MIT
+---
+library_name: phishbyte
+license: mit
+pipeline_tag: text-classification
+tags:
+- calibrated-probabilities
+- cascading-inference
+- context-gating
+- cross-signal-fusion
+- cybersecurity
+- dmarc-alignment
+- email-security
+- explainable-ai
+- from-scratch
+- model_hub_mixin
+- nlp
+- no-pretrained-weights
+- phishing
+- phishing-detection
+- pytorch
+- pytorch_model_hub_mixin
+---
+
+This model has been pushed to the Hub using the [PytorchModelHubMixin](https://huggingface.co/docs/huggingface_hub/package_reference/mixins#huggingface_hub.PyTorchModelHubMixin) integration:
+- Code: https://github.com/AnonymousSingh-007/Phish_Byte
+- Paper: [More Information Needed]
+- Docs: [More Information Needed]

config.json

@@ -1,10 +1,13 @@
 {
+  "context_dim": 13,
   "dropout1": 0.3,
   "dropout2": 0.2,
   "dropout3": 0.1,
+  "fusion_dim": 64,
   "hidden_1": 620,
   "hidden_2": 310,
   "hidden_3": 155,
   "hidden_4": 76,
-  "input_dim": 104
+  "raw_dim": 38,
+  "tfidf_dim": 50
 }

model.safetensors

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:99c2100af984fd5a4ea75e4b6ce74b61416846f18e0bd01ed88bbfd29e581e67
-size 2890612
+oid sha256:10304df2d5d30eb28a7cbabb41ce31ff64d764c66e4af3d9d90a6c33676de0c1
+size 3003164