phish-structural

Small calibrated reviewers used by the Phish Space.

• tfidf_lr.joblib — TfidfVectorizer(char_wb 3-5) + logistic regression, sigmoid-calibrated
• lightgbm.joblib — LightGBM on structural features only, sigmoid-calibrated

Trained on the development campaigns of AriaAICompany/phish-messages (seed 3). Test campaigns are held out by campaign, sender group, and template.

Intended use

Decision support for a human reviewing a synthetic or already-shared message. Scores are not a safe/unsafe certificate and are not a probability of account compromise.

Out of scope

• Fetching or rendering live URLs
• Executing attachments
• Judging malice from a logo screenshot
• Treating copied SPF/DKIM/DMARC headers as a trusted receiver verdict
• Production mailbox enforcement

Metrics

See metrics.json written by scripts/build_artifacts.py and evaluations/evaluation.json in the Space. Lab PR-AUC on synthetic fixtures is not operational accuracy.