Aryag1507/scamshield-0.5b

ScamShield 0.5B

A small language model, fine-tuned and then trained with reinforcement learning (GRPO), to read an email, text message, chat message, or web page and say whether it's a scam, suspicious, or safe, with one sentence naming the warning signs.

It's the model behind ScamShield, a browser extension and website that flags scams as you read them.

Illustrative input and output format:

Input:  Channel: sms
        From: TollAlert

        FINAL NOTICE. unpaid toll. amt 18.40. pay now or it goes to collections: tinyurl.com/tollpay-final

Output: scam
        Reason: Threatens collections over a small unpaid toll and pushes a shortened payment link, a common toll-fraud pattern.

Results

Test set: 362 held-out messages (81 scams, 76 suspicious, 205 safe). "Unseen": 115 scams from three scam types (fake jury-duty fines, rental deposit scams, crypto wallet drainers) excluded from all training. A scam is warned if the model says scam or suspicious (both show the user a warning).

Model	3-way accuracy	Scams warned	Scams missed	Safe messages warned	Safe called scam	Unseen scams warned	Explanation quality
v1: SFT	83.1%	98.8%	1.2%	8.8%	1.95%	100%	0.773
v2: SFT + GRPO (this revision)	85.1%	97.5%	2.5%	3.9%	0.98%	97.4%	0.785

Untrained Qwen2.5-0.5B-Instruct scores 55.5% 3-way accuracy and ranks scams at chance (AUC 0.51). Explanation quality is a 0-1 score from a teacher-model judge (specific, accurate, concise) on 150 test scams. The v1 weights remain available in this repo's commit history.

How to use

The verdict is not sampled. Score the likelihood of each verdict line (scam, suspicious, safe) and softmax over the three; this gives a calibrated probability you can threshold. thresholds.json in this repo holds the operating point tuned for ≤1% false positives on validation. Then generate the reason conditioned on the chosen verdict.

The full scoring code (scorer.py) and training pipeline are in the ScamShield repository. Inputs must be formatted as:

Channel: <email|sms|chat|webpage>
From: <sender, optional>
Subject: <subject, optional>

<message text, truncated to 4,000 characters>

with this system prompt:

You are ScamShield, a scam and phishing detector. Read the message and reply with exactly two lines:
line 1: one word - scam, suspicious, or safe
line 2: Reason: <one sentence naming the concrete warning signs, or why it looks legitimate>

Training

• Base model: Qwen2.5-0.5B-Instruct, full-parameter fine-tune (not LoRA), loss on the answer tokens only.
• Data (4,544 training examples):
  • ~3.9k messages from public phishing-email and SMS-spam datasets, re-labeled into three classes with a one-sentence reason by a larger teacher model (Claude Haiku 5.5). The original binary labels lumped ordinary marketing spam in with fraud.
  • ~1.5k synthetic messages generated by the teacher across 47 categories: modern scams (toll texts, package redelivery, pig-butchering crypto, task scams, verification-code theft, wallet drainers, and more) plus hard negatives (real one-time codes, real bank alerts, real recruiter outreach).
• Splits: grouped so near-duplicates never cross train/test; three scam categories held out entirely.
• Compute: 2 epochs on one NVIDIA L4 GPU, about 28 minutes.

Stage 2: GRPO (reinforcement learning)

Group Relative Policy Optimization, implemented from scratch, starting from the SFT model:

• Each step samples 8 training messages and generates 8 answers per message (temperature 1.0).
• Reward: verdict +1 correct, +0.25 scam↔suspicious, −1 wrong, −1.5 for calling a safe message a scam; plus 0.5 × an explanation-quality score from a teacher judge (Claude Haiku 5.5) grading specificity, accuracy, and concision.
• Advantage: each answer's reward minus its group's mean, divided by the group's standard deviation. No value network.
• Regularization: k3 KL penalty (coefficient 0.04) toward the frozen SFT model.
• 150 steps (9,600 graded answers), learning rate 1e-6, one L4 GPU, about 55 minutes.

Effect: false warnings on legitimate messages fell from 8.8% to 3.9% and 3-way accuracy rose 2 points; in exchange the model hedges more real scams to "suspicious" and misses slightly more (1.2% → 2.5% of scams). The reward made a false alarm cost more than hedging a scam, and the policy learned exactly that trade-off. Explanation quality rose during training on sampled answers (0.645 → 0.717) but only slightly on greedy decoding (0.773 → 0.785).

Limitations

• English only.
• Test sets are small (81 test scams), so a one-message difference moves rates by ~1.2 points.
• Unseen-category scams were generated by the same teacher as the training data, so these rates likely overstate real-world generalization to brand-new scam styles.
• Much of the public data is from the 2000s; real 2026 legitimate email may differ in style.
• A verdict is a warning, not proof. Don't use it as the only basis for blocking messages or accusing a sender.