Gl00be-Cybersecurity/Phishing-Guard

Gl00be Phishing Guard

Build AI agents that detect phishing.

Gl00be Phishing Guard specializes GLM-4.7-Flash for email phishing classification through supervised post-training on 14,000 labeled phishing and legitimate emails.

The adapter achieved 99.71% classification accuracy on an internal held-out test set of 1,750 English emails.

Why we built it

Phishing and identity compromise remain major cybersecurity challenges—and AI is helping attackers scale social engineering.

The Microsoft Digital Defense Report 2026 reports:

• 73.3% of initial access attempts collectively involve user execution, valid accounts, social engineering and phishing.
• More than 46 million business email impersonation attacks were detected.
• AI is accelerating and scaling phishing and social engineering.

These findings motivate Gl00be's contribution: a downloadable model adapter for developers building defensive email analysis and phishing-detection agents.

Source: Microsoft Digital Defense Report 2026, Executive Summary, pages 2–4. The 73.3% figure covers the combined categories, not phishing alone.

Designed for defensive agents

Phishing Guard provides a focused classification component for:

• Agents that triage suspicious emails.
• Security copilots that assist email reviewers.
• Workflows that route suspected phishing for investigation.
• Locally operated email-security applications.

Input: email text.

Expected output: PHISHING or LEGITIMATE.

Applications should validate the output and route unexpected responses for review. Classification should inform the agent's workflow; consequential actions should follow application policy.

Technical specifications

Component	Configuration
Base model	zai-org/GLM-4.7-Flash
Architecture	Mixture-of-experts causal language model
Base-model size	Approximately 30B total / 3B active parameters
Post-training	Supervised fine-tuning with completion-only loss
Adaptation	Attention-only LoRA
Trainable parameters	10,515,968
LoRA settings	Rank 8, alpha 16, dropout 0.05
Training	BF16, AdamW, initial learning rate 1e-4
Training schedule	One epoch; 875 optimizer updates
Effective batch size	16
Maximum sequence length	1,024 tokens
Hardware	NVIDIA DGX Spark / GB10

The base weights remain frozen. LoRA targets: q_a_proj, q_b_proj, kv_a_proj_with_mqa, kv_b_proj and o_proj.

Training data

The 14,000 training examples include both phishing and legitimate English emails, allowing the model to learn the distinction between malicious and ordinary correspondence.

Source: zefang-liu/phishing-email-dataset, whose publisher attributes the original corpus to Cyber Cop's “Phishing Email Detection” dataset on Kaggle.

Preparation removes normalized exact duplicates and groups with conflicting labels, then creates stratified splits:

Partition	Emails
Training	14,000
Validation	1,750
Test	1,750

Dataset revision and preparation metadata accompany the release.

Evaluation

Results for the trained adapter on the internal English test split:

Metric	Result
Accuracy	99.71%
Phishing precision	99.69%
Phishing recall	99.54%
Phishing F1	99.62%
False-positive rate	0.18%
Invalid outputs	0

The model correctly classified 1,745 of 1,750 emails: 649 phishing and 1,096 legitimate messages. It missed three phishing emails and flagged two legitimate emails.

Download and local reuse

This release distributes a PEFT LoRA adapter. Users must load it alongside the compatible GLM-4.7-Flash base model.

The local inference implementation uses Transformers and PEFT, with the base-model revision, tokenizer and prompt configuration recorded for reproducibility.

The adapter is lightweight relative to the base model; running it still requires computing resources sufficient for the underlying GLM model.

Gl00be provides the adapter download at no charge. Users supply their own inference infrastructure.

Scope and limitations

This version classifies English email text. Inputs are truncated to the configured token budget.

It does not verify sender identity, SPF/DKIM/DMARC, attachments or live URL reputation. LEGITIMATE is not a guarantee of safety.

Use alongside established email-security controls. Microsoft's report provides threat context; it does not endorse or evaluate Phishing Guard.

Attribution and terms

Base model: Z.ai's GLM-4.7-Flash. The training dataset publisher declares LGPL-3.0. Applicable upstream terms remain in effect; consult the repository's license files for release terms.

Developed by Gl00be.