AI2TALE: An Innovative Information Theory-based Approach for Learning to Localize Phishing Attacks
Authors: Van Nguyen
Tingmin Wu
Xingliang YUAN
Marthie Grobler
Surya Nepal
Carsten Rudolph
Venue: ICLR 2025 Poster (2025)
Keywords: Phishing Attacks
Email Phishing Attack Localization
Interpretability and Explainable AI
Deep Learning
Primary area: interpretability and explainable AI
TL;DR: We study an important problem of phishing attack localization aiming to tackle and improve the explainability (transparency) of email phishing detection. AI-based techniques for this problem have not yet been well studied.

Abstract: Phishing attacks remain a significant challenge for detection, explanation, and defense, despite over a decade of research on both technical and non-technical solutions. AI-based phishing detection methods are among the most effective approaches for defeating phishing attacks, providing predictions on the vulnerability label (i.e., phishing or benign) of data. However, they often lack intrinsic explainability, failing to identify the specific information that triggers the classification. To this end, we propose AI2TALE, an innovative deep learning-based approach for email (the most common phishing medium) phishing attack localization. Our method aims to not only predict the vulnerability label of the email data but also provide the capability to automatically learn and identify the most important and phishing-relevant information (i.e., sentences) in the phishing email data, offering useful and concise explanations for the identified vulnerability. 

Extensive experiments on seven diverse real-world email datasets demonstrate the capability and effectiveness of our method in selecting crucial information, enabling accurate detection and offering useful and concise explanations (via the most important and phishing-relevant information triggering the classification) for the vulnerability of phishing emails. Notably, our approach outperforms state-of-the-art baselines by 1.5% to 3.5% on average in Label-Accuracy and Cognitive-True-Positive metrics under a weakly supervised setting, where only vulnerability labels are used without requiring ground truth phishing information.

Published as a conference paper at ICLR 2025
AI2TALE: AN INNOVATIVE INFORMATION THEORY- BASED APPROACH FOR LEARNING TO LOCALIZE PHISHING ATTACKS
Van Nguyen1.2 1.2
Tingmin Wu² Xingliang Yuan Marthie Grobler"
Surya N
Carsten Rudolph
Monash University
CCIRO'ss Data61
The University of Melbourne, Australia
ABSTRACT
Phishing attacks remain a significant challenge for detection, explanation, and defense, despite over decade of research on both technical and non-technical solutions, Al-based phishing detection methods are among the most effective ap- proaches for defeating phishing attacks. providing predictions on the vulnerability label (i.e., phishing or benign) of data. However, they often lack intrinsic explain- ability, failing identify the specific information that triggers the classification. To this end, we propose A AI2TALE, an innovative deep learning-basee approach for email (the most common phishing medium) phishing attack localization. Our method aims to not only predict the vulnerability label of the email data but also provide the capability to automatically learn and identify the most important and phishing-relevant information (i.e., sentences) in the phishing email data, offering useful and concise explanations for the identified vulnerability.
Extensive experiments on seven diverse real-world email datasets demonstrate the capability and effectiveness of our method in selecting crucial information, en- abling accurate detection and offering useful and concise explanations (via the most important and phishing-releve relevant information triggering the classification) for the vulnerability of phishing emails. Notably, our approach outperforms state-of- the-art baselines by 1.5% to 3.5% on average in Label-Accuracy and Cognitive- Prue-Positive metrics under weakly supervised setting, where only vulnerability labels are used without requiring ground truth phishing information.
INTRODUCTION
Phishing attacks (i.e., attempts to deceitfully get personal and financial information such user- names, passwords, and bank accounts through electronic communication with malicious intentions) have become a serious issue. Nowadays, there various ways conduct phishing attacks, while the most common method is through the use of emails. Email phishing is crafted to trigger psycho- logical reactions in the users by using persuasion techniques via cognitive principles (Van Der Hei- jden & Allodi 2019) such as scarcity, consistency, and authority. According to recent reports (Fed- eral Bureau of Investigation, 2022 Anti-Phishin Working Group 2022), there has been notable rise in the occurrence of increasingly sophisticated phishing attacks, presenting more formidable challenges for detection and defense.
The widespread adoption of Al (i.e., using machine learning and deep learning approaches) has brought substantial influences and great success various domain applications such autonomous driving (Chen et al.) (202a)), data generation (Devlin et al. 2019 Radford et al. 2019 Raffel et al.) 2020), drug discovery (Paul al. 202T), and software vulnerability and malware detection (Li al,,
2018 Nguyen et al. [2022] 2024 Bensaoud et al. 2024). By leveraging the power of machine learn- ing and deep learning, there have been many efforts proposed for solving phishing attack problems
from the investigation of the cognitive bias's 's impact used in email phishing (Parsons et al. [2015] Van
Der Heijden & Allodi 2019) to phishing attack detection (Ramanathan & Wechsler [003 Tyagi
et al.
2018 Rao & Pais 2019 Yang al. 2019 Xiao et al. 2020; Lin et al. 202 Asiri et al.) Recent advancements in natural language processing (NLP) and the growing popularity of
2024
large language models (LLMss), such BERT (Devlin et al. 2019 GPT-2 (Radford et al. 2019

---

Published as a conference paper at ICLR 2025
T5 (Raffel al. 2020). and GPT-4 (OpenAl al. 2024). have led to initial attempts to leverage these models for phishing attack mitigation. For instance, scam baitiiiting mail servers were developed to autonomously engage in scam-baiting activities (Chen et al. 2023b). Additionally. approaches for devising and detecting phishing emails using LLMs were introduced in (Heiding et al. 2024).
It has been proven that utilizing Al-based approaches (i.e., machine learning and deep learning- based algorithms) to detect phishing attacks in the early stages is one of the effective solutions for preventing and reducing the negative effects caused (Basit et al. 2020; Naqvi et al.] 2023 Asiri et al., 2024). Although Al-based phishing detection methods can predict the vulnerability label of the data (i.e., phishing or benign) and have shown promising performances, they often lack the intrinsic ability to provide explanations that offer concise and meaningful interpretations (i.e., the information causing the data phishing) to the users. Motivated by this problem, in this paper, we study the following topical research question:
In addition to predicting the vulnerability label (i.e., phishing benign) of the data, how to derive an effective deep learning- branning-based method that also has the capability to automatically learn and identify the most important and phishing-relevant information (i.e., sentences) triggering the classification for providing a useful and concise explanation about the vulnerability of the phishing data users? (in our paper, name this problem phishing attack localization)
To this end, in the scope of our paper, we study the phishing attack localization problem on emails (i.e.. the most common medium for phishing attacks) where we propose an innovative information theory-based model solve the problem. Our method can detect the vulnerability (i.e., phishing or benign) of the email data as well as automatically learn and identify the most important and phishing-relevant information (e.g., sentences) in phishing emails. The selected information helps provide useful and concise explanations about the vulnerability of the phishing data. It is worth noting that the ability to identify the important and phishing-roe relevann information that causes the email data to be classified phishing to provide corresponding useful and concise interpretation the main difference between phishing attack localization and phishing attack detection.
In summary, key contributions
follows:
We study an important problem of phishing attack localization aiming to tackle and improve the explainability (transparency) of email phishing detection. Automated machine learning and deep learningbbased based techniques for this problem have not yet been well studied.
We propose AI2TALE, an innovative deep learning-based framework derived from an information-theoretiic perspective and information bottle-neck theory for phishing attack localization. Our method can work effectively in a weakly supervised setting (details in Section 3.1p. hence providing important practical solution for defeating phishing attacks.
Based on the explainable machine learning and email phishing domain knowledge, we pro- pose using appropriate measures, including Label-Accuracy and Cognitive- Trsiiiosiivee (please refer to Section 4.2 for details), for the phishing attack localization problem.
We comprehensively evaluate our method on seven real-world diverse email datasets. The rigorous and extensive experiments demonstrate the effectiveness and superiority of our method over the state-of-the-arr baselines.
RELATED WORK
Phishing detection methods (Le et al., 2018 Sahingoz et al., 2019 Li et al.
2019
Das et al. 2019
Abdelnabi et al.
2020
Zamir et al. 2020; Alam et al. [2200] Yang al.
Salahdine et al. 2024 have been prevent and mitigate their negative effects.
2021
2021 Lin et al.
2021:
Chrysanthou et al., 2024 Asiri et al.) 2024 Heiding et al.
widely applied detect phishing attacks, helping
While achieving promising performances, they often lack the intrinsic ability to provide concise and meaningful explanations (i.e., the information causing the data phishing) to the users.
Automated deep learning-based techniques for the phishing attack localization problem have not yet been well studied. The interpretable machine-learning research appears to be an appropriate direction for addressing the phishing attack localization problem. In short, interpreting approaches
(e.g.. CCaruaaa al. 2015 Rich 2016 Marco T. Ribeiro 2016 Chen et al.) 2018 Bang et al.
2021
Yoon et al.) 2019; Nguyen et al. Jethani et al.) [2021] Vo et al. 2023a Qian et al,
2024
Choi al. 2024) used for explaining the behavior of deep Caariing-based systems or
2

---

Published as a conference paper at ICLR 2025
the ground truth label of the data by automatically learning and identifying the most important information (e.g., attributions or features) existing from the data that are responsible in causing the corresponding decision of black-box models and the ground truth label. For example. in sentiment analysis, interpretable machine-learning approaches (e.g.. (Chen et al., 2018 Vo et al., (023b) help to give comprehensive explanation for a movie review (posirive or negative) by identifying and highlighting the most important keywords or sentences.
In practice, explaining models can be divided into two categories including "post-hoc explainabil- ity techniques" and "intrinsic explainability techniques". Post-hoc explainability techniques (e.g., LIME (Ribeiro et al., 2016) and SHAP (Lundberg & Leel 2017)) aim to elucidate the decisions of a black-bor model (e.g., a deep learning model, where the internal workings are not easily under- standable or interpretable) without modifying the model itself. The techniques are often applied externally to the black-box model to generate explanations specific to its predictions but do not offer comprehensive understanding of the black-box model's internal architecture. In contrast, intrinsic explainability techniques, a.k.a. self-explanatory models, (e.g., deep neural network- based methods with interpretable components such as L2X (Chen al. 2018) and AIM (Vo et al. 2023b) are inte- grated directly into model architecture, providing interpretability as inherent features, and offering explainability as part of their design.
is evident that intrinsic interpretable machine learning methods, a.k.a. self-explanatory models, are strongly suitable for phishing attack localization because they are only able make predictions themselves but also to automatically learn and identify the most important information of the data obtained from the models to explain the model's prediction decision. In our paper, we compared the performance of our method with several recent, popular, and state-of-the-- art interpretable machine learning approaches falling into the category of intrinsic interpretable models including L2X (Chen et al., 2018), INVASE ( (Yoon et al. 2019), ICVH (Nguyen et al., (021), VIBI (Bang et al. 2021 and AIM (Vo al. 2023b) (refer the appendix, Section 6.4| for their brief descriptions).
3 THE PROPOSED APPROACH
3.1 THE PROBLEM STATEMENT
We denote an email data sample as X [x,] consisting of L sentences. In the scope of our paper, we consider each email as a sequence of sentences. We assume that X's vulnerability label Y E {0, 1} (i.e., 1: phishing and O: benign). In the context of phishing attack localization, aim to develop an automatic Al-based approach that can not only detect the vulnerability Y of the email X but also provide the capability to automatically learn and identify the important and phishing-relevant information (i.e., sentences) denoted by X (a subset of X) causing X phishing.
It is worth noting that for almost all publicly available relevat data (e.g., emails), there are only labels related to the data's vulnerability (phishing or benign) by domain experts with the assistance of machine learning or deep learning tools. We almost do not have the ground truth of phishing information (i.e.. the information truly causes the data to be classified as phishing). In the phishing attack localization problem, during the training process, we only use the vulnerability label Y of the data while not requiring the ground truth of phishing information of the data.
name this context a weakly supervised setting where
3.2 METHODOLOGY
Here we present how our AI2TALE method, named after the initials of some words in the pa- per's title, works and addresses the phishing attack localization problem tackle and improve the explainability (transparency) of phishing detection. An overall visualization is depicted in Figure [
3.2.1 LEARNING TO SELECT THE IMPORTANT AND -EEEEVAT INFORMATION AND THE TRAINING PRINCIPLE
Phishing-relevant information selection process As shown in Figure the first part of our method is the selection network Ç. aims to learn and identify the most important and label-relevant information (i.e., sentences) in each email in automatic and trainable manner. Note that, in terms of the phishing email, the key selected information stands for the phishing-relevar information causing the email phishing.
3

---

Published as a conference paper at ICLR 2025
Given email X consisting of L sentences from X1 to X (i.e., each sentence x; is represented as a vector using a learnable embedding method, refer to the data processing and embedding in the appendix. Section 6.2 for details), to identify the important and label-relevant sentences in X, we introduce selection process < (i.e., it is learnable and maps R + [0. 1J4) aiming learn set of independent Bernoulli latent variables 2 E {0, 1) representing the importance of the sentences to the email's vulnerability Y. Specifically, each element 2; in { indicates whether x; is related to the vulnerability Y of X (i.e., if 2; is equal to 1, the sentence x; plays an important role).
We model
MultiBernoull((p)
I1 Bernoulli(p:). indicating æ; re- lated to the vulnerability Y with proba- bility Ps. where Pt = wi (x) Here, is neural network parameterized by a (i.e., w takes as input and outputs corresponding p (1)) With z, construct X < (X) (i.e., the subset statements that lead to the vulnerability by X = oz, where @ represents the element-wiie product. To make this com- putational process (involving sampling from a tinuous and differentiable during train- ing, we apply the Gumbel-Softmax trick @Jag al. 2016 Maddison et al. 2016) for relaxing each Bernoulli variable 24 (refer to the appendix, Sectionf6.11 for de-
max Bay Resesttdkoe (1gg
(log (YP: 1B wi a) 2 |x
Classifier ((:88)
MultBernoulliip)
parameterized by w(.:e)
IP.
independent latent
distribution) con-
variables a- (Ri) (during the training process, we apply Gumbei-Softmax Softmax to relex continuous optimization)
Figure 1: Visualization of our A12TALE method.
tails). Note that we can view the selector model as a distribution [set(2) X; over a selector variable which indicates the important features for a given sample X.
Mutual information for guiding the selection process In information theory (Shannon 1998
Cover Thomas 2006), mutual information is used to measure the mutual dependence between two random variables. In particular, it quantifies the information obtained about one random variable by observing the other. To illustrate, consider a scenario where A denotes the outcome of rolling standard 6-sided die, and B represents whether the roll results in an even number (0 for even, for odd). Evidently, the information conveyed by B provides insights into the value of A, and vice versa. In other words, these random variables possess mutual information.
Leveraging this property of mutual information and inspired by (Chen et al. 2018, Nguyen et al. 2021), we maximize the mutual information between X and Y as mentioned in Eq. (1) with the intuition is that by using the information from Y, the selection process Ç will be learned and enforced to obtain the most meaningful X (i.e., X can predict the vulnerability Y of X correctly). By viewing X and Y random variables, the selection process (model) is learned by maximizing the mutual information between X and Y as follows:
max Y)
(1)
Following (Cover& & Thomas 2006), we expand Eq. ① as the Kullback-Leible divergence, measur- ing the relative entropy or difference in information represented by two distributions, of the product of marginal distributions of X and Y from their joint distribution:
I(X, (X,-) ((X, log p(X,)) p(X,)) dddY 2 P)Y, log pYX)p(Y)
q(Y X)) dY dx p(Y)
In practice, estimating mutual information is challenging as we typically only have access to samples but not the underlying distributions. Therefore, in the above derivation, we apply to use variational distribution q())x) to approximate the posterior p(Y hence deriving variational lower bound of I(X, Y) for which the equality holds if (( = pYY|)) This can be further expanded as:
4

---

Published as a conference paper at ICLR 2025
g(Y X) p(Y)
I(X x) 2 XX),X,X) log
dY dY Ex,y xix flog [X)])(((())) + const
(2)
To model the conditional variational distribution [))))), we introduce a classifier implemented with neural network [(X;9) (8), which takes X as input and outputs its corresponding label Y (i.e.,
we view the classifier model as distribution yclass (Y| 3)). Our objective is to learn the selection
8)).
process (model) as well as the classifier to maximize the following objective function:
max Ex,y Ex-que (x) (a) loggelase (Y @ z; 3)]}
(3)
The mutual information facilitates joint training process for the classifier and the selection process. The classifier learns to identify a subset of features leading to a data's 's label while the selection process is designed select the best subset of features according the feedback of the classifier.
3.2.2 BENEFITS AS WELL AS POTENTIAL WEAKNESSES OF THE MUTUAL INFORMATION TRAINING PRINCIPLE AND OUR INNOVATIVE SOLUTIONS
With the training principle mentioned in Eq. we aim to maximize the mutual information be- tween X and Y for guiding the whole training process to identify the sentences related to an email's vulnerability. Recall that during this training process, the classifier learns identify subset of sentences leading to an email sample's vulnerability label while the selection process is designed to select the best subset according to the feedback of the classifier.
In short, this joint training process between the classifter ((, and the selection network w(., o:) brings benefits for selecting the important and phishing-relewe sentences from phishing emails; However, we observe two potential limitations of this training principle as follows:
Obtaining a superset of phishing-relevant sentences The first limitation of the training principle mentioned in Eq. 47) is that it does not theoretically guarantee eliminate sentences unrelated to the vulnerability of a specific email. Therefore, the set of selected sentences can be a superset of the true phishing-relevant sentences. In the worst case, selection process always select all the sentences in an email, which is still a valid solution for the above maximization mentioned in Eq. (I. To deal with this problem and enable the model to successfully select and highlight truly important and phishing-relevant information, inspired by (Tishby et af. 2000); Slooni & Tishby] (2000) about using information bottleneck theory, we propose an additional term for training the selection process (model) Ç, derived from the following principle:
max (I(X,Y) AI(X, X))
where À is hyper-parameter indicating the weight of the second mutual information.
By minimizing the mutual information between X and X, we encourage X to be as "different" to X as possible. In other words, the selection process prefers select smaller subset that excludes the sentences unrelated to vulnerability Y of the corresponding data X. Accordingly, we can derive an upper bound of the minimization of the mutual information between X and X:
I(XXx) = p(XX p(X(x) dxdx < Ex (log p(X[x) x(X)
(5)
r(X)
for any distribution r(X).
We then further derive I(X, X) as the Kullback Leiblerr divergence of the product of marginal dis- tributions of X and X from their joint distribution:
p(X r(X)
pl c X)
L
Ex E Ex
= Ex XIX
log
Σ i=1
Ex Ex (6)
r ((xx))
5

---

Published as a conference paper at ICLR 2025
Minimizing I(X,, X) is now equivalent to minimizing the KL divergence between [Xx;[X) and r(á,) with i from 1 to L. Therefore, one can view r(æ;) as the prior distribution, which con- structed by r(æ,,) between p:V (0: a.; )²) and (1 ps (0,
(T; 0, )²). Given that p( is Gaussian mixture distribution (i.e.,
where d > 0 is a small number), the intuition is that the prior prefers the small values centered at 0. In this way, pX) is encouraged to select fewer sentences. (p((p( X) (ā;)) can be computed by the following approximation (Gal & Ghahramani 2016):
wi (X; a))
1 -00)) + const
||a;1| + (log +
20²
Combining I(X,Y) and X) by max I) X)), get unified training objective:
wi (X;a)
max a.9
Eexyeer (oggaa))llggaae.. (Y 2; 8)] - AE
||<;;|²3
(8)
20
Encoding the vulnerability label via its selections instead of via truly meaningful information The selected features obtained from the joint training process of the classifier (), and the selec- tion network w(., a) cause the other potential limitation for the training principle mentioned in Eq. (I). In particular, the predictions of the classifier f(., .8) can be based more on the features selected from the selection network wi., ax) than the underlying information contained the features. this case, the selected information (i.e., sentences) can be any subset of the sentences and may be less likely to be meaningful subsets from the data.
To deal with this problem and ensure the learnable selection process respecting the data distribution to select the meaningful and label-relevant information (e.g., sentences) of the data, in addition to learning the classifier jointly with the selection network as mentioned in Eq. (8) inspired by (Jethani et al., 2021). we propose to learn the classifier model f(. 3) disjointly to approximate the ground truth conditional distribution of Y given Xa where Xx X @ r with ~ MultiBermoull((0 (denoted by r ~ B(0.5) for short). This procedure helps adjust the classifter to let it not only be affected by the information obtained from the selection network but also based on the information from the data to update its parameters. That helps prevent the problem of encoding the vulnerability label via its selections to improve the data representation learning process. We name this procedure as data-distribution mechanism. This procedure is expressed as learning (: 3) to maximize:
Ex.y En-n( floggciass (Y O 0r;
To make this computational procedure (i.e., it consists of sampling operations from a Multi- Bernoulli distribution) continuous and differentiable during the training process, apply the temperature-deeendern Gumbel-Softmax trick (Jang et al., 2016; Maddison et al.] (2016) for relax- ing each Bernoulli variable r; E using the RelaxedBernnullii distribution function from Tensor- FlowAPI 2203).. Noting that in 19). by setting r ~ B0055) to randomly select sentences from each email instead of using the entire email content, we also aim to introduce randomness into the training corpus, akin to data augmentation, which helps enhance the generalization capability of the selection network that facilitates the performance of the classifier.
3.2.3 A SUMMARY OF OUR AI2TALE METHOD
Algorithm shows the details of our proposed AI2TALE method in the training phase. It is worth noting that during the training process, our model is trained to learn and identify the most important and phishing-relevane ground truth of phishing-relevan sentences. This shows a great advantage of using our method for phishing attack localization in real-world scenarios because in practice, to almost all publicly available email datasets, there is only information about the vulnerability Y (i.c., phishing or benign) of the data by domain experts with the help of machine learning and deep learning tools.
sentences in corresponding emails without using any information about the
The inference (testing) phase After the training phase, the selection network Ç is capable of selecting the most important and phishing-relevant sentences of a given email data X by offering high value for the corresponding coordinates wi (X;a), meaning that wi (X;a) represents the

---

Published as a conference paper at ICLR 2025
influence level of the sentence z;. We hence can pick out the most relevant sentences based on the magnitude of wi (X; Using the selected information, the trained classifier then can predict the vulnerability of the associated email data. In our paper, with the aim of providing the most highly qualified and concise explanation of the vulnerability of email data to users, we primarily assess the model's performance based on the most important (top-1) selected sentence from each email.
Algorithm 1: The algorithm of our proposed AI2TALE method for the phishing attack local- ization problem.
Input:
An email dataset = ((X, Vi). :...... (X.....,,,, YNs)] where each email X; = (x,,..xx.) consisting of I. sentences while its label Y; E (0. 1 (i.e., 1: phishing and O: benign). We denote the number training iterations nf; the mini-batch size m:; the trade-off hyper-parameter A. We randomly partition S into three different sets including the training set Strain (for training the model), the validation set Deat (for model selection during training), and the testing set Dtest (for evaluating the model).
We initialize the parameters and 3 of the selection model (i.e., parameterized by w(., a)) and the classifier model f(.. 9), respectively.
for t t= to ntt do
Choose mini-batch of embedded emails denoted by {(,,, Y:)
Update the classifier's s parameter 3 via minimizing the following cross-entropy loss
BEx.,.5 (Y, Ja r) using Adam optimizer (Kingma & Ba 2014).
Minimizing this function is equivalent to maximizing the objective function in Eq.
Update the classifier's 's parameter ,3 and the selection model parameter's a via minimizing the following objective function
1x.yy (Y: [x @ x))] + Xxx
(X 20 ||a: [|"] using Adam
optimizer. Minimizing this function is equivalent to maximizing the objective function in Eq. 8
end
Output: The trained model for phishing attack localization.
4 EXPERIMENTS
4.1 STUDIED DATASETS
We conducted experiments seven diverse real-world email datasets including IWSPA-AP (i.e., the dataset was collected as part of a shared task to address phishing scam emails), Nazario Phishing Corpus (i.e., the dataset was received by user, comprising a diverse collection of phishing emails), Miller Smiles Phishing Email (i.e., the dataset contains various examples of phishing emails to trick recipients into engaging with malicious links or providing sensitive information), Phish Bowl Cornell University (i.e., the dataset contains phishing emails that have been spotted and reported by students and staff at Cornell University), Fraud emails (i.c., the dataset contains fraudulent emails attempting Nigerian Letter where all the emails are in one text file and contain a large amount of header data), Cambridge (i.e., the dataset contains large number of email headers (involving information such as sending and receiving addresses and email subjects) and the body content of phishing emails), and Enron Emails (i.e., the dataset was released as part of an investigation into Enron, consisting of emails from mostly senior management of Enron). Refer to the appendix, Section 6.2 for details on the links, processing, and characteristics of these datasets.
4.2 MEASURES
In addition to our AI2TALE method, interpretable machine learning approaches, particularly intrin- sic interpretable models, can be adopted and applied to solve the email phishing attack localization problem. Our study also introduces and discusses appropriate measures to evaluate the performance of our method and the baselines, which is another contribution of our work.
7

---

Published as a conference paper at ICLR 2025
To evaluate the performance of our AI2TALE method and the baselines in phishing attack localiza- tion, based on the explainable machine learning and email phishing domain knowledge, we introduce and utilize two main metrics including Label-Aceuracy and Cognitive- Cognitive-True-PPe Prsitvvsi
Via the caber-Accuracy metric, we measure whether the selected sentences obtained from each model are truly important and help accurately predict the true vulnerability label (i.e., phishing or benign) of the associated emails. The intuition is that the most important sentences contribute the most the emails' vulnerability, especially to phishing emails. In our experiments, we assess each model's top-1 selected sentence and measure if this sentence can effectively predict the email's vulnerability without considering all sentences in the email. The higher the value of the Label- Accuracy measure, the better the model's performance in identifying and selecting crucial and label- relevant information from the data, For the Cognitive- Sognitive-True-Pee True-Positive metric, we investigate the top-1 selected sentences from each method also reflect the human cognitive principles, exploiting psychological triggers to deceive recipients, used in phishing emails (i.e., Reciprocity, Consistency, Social Proof, Authority, Liking, and Scarcity (Akbar 2014 Butavicius et al. 2015 Ferreira et al. 2013 Heijden & Allodi 2019) based on the associated keywords, refer to the appendix, Section for the computation). In our experiments, we consider the most important (top-1) selected sentences of phishing emails and calculate how many percent of these reflect and consist of cognitive triggers. The source code and data for reproducing the experiments of our A12TALE method are publicly available at bhttps://gt ttt..b....uu.../gg com/ hwtpp//aanngy/d/aaaaeatte iclr
4.3 BASELINE METHODS
The baselines of our method are recent, popular, and state-of-the art interpretable machine learning approaches falling into the category of intrinsic interpretable models including L2X (Chen et al., 2018), INVASE Yoon et al., 2019), ICVH (Nguyen et al.) 2021]. VIBI (Bang et al.) [202]]. and AIM (Vo et al., 2023b) that we apply to solve the email phishing attack localization problem. As mentioned in Section intrinsic interpretable machine learning techniques, a.k.a. self-explanatory models, are strongly suitable for phishing attack localization because they can not only make pre- dictions themselves but also identify the most important features of the data to explain the model's predictive decision. See the appendix, Section 6.4 for the baselines' descriptions.
4.4 EXPERIMENTAL RESULTS
We compare the performance of our AI2TALE method with the baselines including L2X (Chen al. 2018). INSE Yoon al. 2019. ICVH (Nguyen et al. 202I). VIBI (Bang et al. 2021), and AIM (Vo et al. 2023b) in the task of phishing attack localization (in terms of not only predicting the vulnerability of the email data but also learning and identifying the most important (top-1) and phishing-relevan information existing in the data. The selected information helps provide useful and concise explanations about the vulnerability of the phishing email data for the users) using the Label-Accuracy and Cognitive-Trues True- measures.
Quantitative Results The experimental results in Table T show that our A12TALE method ob- tains the best performance on both Lccel-Accuracy and Segnitive-True-Pssiiie compared to the baselines. Importantly, our method achieves significantly higher performance, with improvements ranging from approximately 1.5% to 3.5% compared to state-of-the-art baselines, measured by the combined average performance of two main metrics, i.c., Label-Accuran and Cognitive-Truu Positive. The results demonstrate the effectiveness and advancement of our method for phishing attack localization in learning and identifying the most meaningful and crucial information leading to the vulnerability of the email data, especially for phishing ones, compared to the baselines.
Table 1:
The performance of our AI2TALE method and the baselines for the Label- Label-Accuracy (Label-Acc) and Cognitive-True-PPsiinn True-Positive (Cognitive-TPP) measures, as well as their combined av- erage results (denoted as Average), on the testing set (the best results in bold).
Methods
Label-Ace
Cognitive- TP
Average
INVASE Yoon et al.
2019
98.30%
97. 97.20%
97.75%
ICVH (Nguyen et all
2021
96.72%
98. 10%
97.4%%
L.2X (Chen et al. 2018
98.25%
97.20%
97.73%
VIBI (Hang al. 2021
96.65%
94.99%
95.82%
AIM Vo al.
20236
98.40%
97.10%
97.75%
A12TALLE (Ours)
99.33%
98.95%
99.14% ~ (1.5% -+3.5%
8

---

Published as a conference paper at ICLR 2025
In addition, the results the Cognitive- True-Posidee measure of our AI2TALE method and the baselines shown in Table also indicate that the most important (top-1) 1) selected sentences from our method and the baselimes also reflect the cognitive triggers used in phishing emails. Com- pared to the baselines, our proposed A A12TALE method achieves the highest performance on the Cognitive-True-Postttv measure. Under the weakly supervised setting, when dealing with com- plex data (e.g., emails written from various writing styles, structures, and sources) and only the most important (top-1) selected sentences from emails are utilized, the observed improvement of our AI2TALE method from around 1.5% to 3.5% in the combined average performance of the Label-Accuracy and Cognitive-Truu True- Posiiivs measures, especially within the range over 99% and approaching 100%, signifies substantial advancement.
Table 2: The ground truth and the predicted label based on the most important (top-1) selected sentence (highlighted in yellow) of each email from our AI2TALE method. The top-1 selected sentence provides concise and useful information. However, to further aid in label explanation, we also show the second and third most relevant sentences. See the appendix. Section for details.
Truth
Model
Emails
phishing phishing
The email: "Please confirm your online banking records! Dear customer of natwest bank, we are running a scheduled muintenance on our servers. We want make sure your money and your personal details safe and segure. Due to new security policies all natwest bank customers must complete the natwest customer form. To complete the form, please use the link below natwest customer form this should take you directly to the natwest customer form. Sincerely, natwest customer service good."
Note: The phishing email poses as legitimate message from natwest bank, requesting confirmation of the guise of security.
banking records. Its goal to trick individuals into providing personal information
emphusizing the need to verify the authenticity of such communications. Our method successfully figures out the sentence "Pleuse confirm your online banking records!" representing the key message of the phishing email. serves create urgency and prompt the recipient take action, suggesting that there is a need to verify their record information.
phishing phishing
The email: "Teeppourrlyy suspended, Dear customer, customer advice, pleuse address the following issues. The details that you have entered have not been recognized. For your security, your online service has been temporarily locked, No further attempes will be accepted. If you provide us with the following details, you should be able to access the service in just few minutes, Click here to get sturted legal info privacy security 2005 2010."
Note: This phishing email tries convey (i) the action taken is intended to protect recipient's 's well-being and (ii) sense of urgency, encouraging the recipient to address the issue promptly to regain access to their caline service. Our method successfully figures out the sentence "For your security, your online service has been temporarily locked." representing the key message of the phishing email.
phishing
phishing
The email: "Bulk attention! Your discover account will close soon! Dear member, have faced some
problems with your account, please update the account, you do update will be closed. To update your account, just confirm your information. (it only takes minute). It's easy. 1. Click the link below to open secure browser window. 2. Confirm that you't re the owner of the account, and then follow the instructions." " Note: The messuge from the selected sentence obtained from our method exhibits cognitive triggers com- monly associated with phishing attempts used in the phishing email. In particular, it implies sense of ugency (concern) via problems with your account while "Dear member" aims to establish a connection with the recipient and imply that the message comes from trusted source. The phrase "please update the account" creates sense of familiarity and consistency.
henign
phishing
The email: "I "Lower your mortgage payment! Bad credit, no problem! Lower your mortgage payment! Bad credit, problem! Whether your credit excellent or less than perfect, loanweb has a lender can help you! Lowest rates the web! Bad credit? Refinance to get cash! Lower monthly payments! Bad credit? Refinance to consolidate bills! Click here for lower morigage payment! Win a free bread maker! Win free bread mukers, toaster ovens, cookware and more get free subscription cooking pleasures magazine get free multi purpose grater test and keep free cooking products get free recipes from world famous chefsplus get free 90 day membership in the cooking club of america. Home equity loans without perfect credit! Click here for home equity loan! Free application! Home equity loans up 125 potential tax deductible interest! Customized, competítive equity lines and loans. Apply now!"
Note: the datasets we utilized, the ground truth labe] for email is benign. However, our method predicts phishing due to the detection of potential phishing indicators, such as the use of enticing offers "lowering morigage payments" and the presence of "suspicious links" potentially prompting users to provide personal information and bank account details via the phrase "Click here for lower mortgage payment!" Although the email's ground truth classification was incorrect, deem the predicted label the highlighted sentence from our model valuable in alerting users to potential phishing attempts.
Qualitative Results To further demonstrate the effectiveness of our AI2TALE method in solving the phishing attack localization problem, in Table 2 we present various email samples alongside the most important (top-1) selected sentences extracted by our method as well as the predicted labels of the corresponding emails based on the selected sentences. Via these qualitative results, method showcases its effectiveness in learning and identifying the most important and phishing- relevant information (i.e. sentences) from phishing emails. That helps provide useful and concise interpretations for the phishing prediction, offering valuable insights into the nature of the attacks.

---

Published as a conference paper at ICLR 2025
In addition, to investigate the characteristics of the selected information in false positive examples (i.e.. where our method incorrectly predicts emails as phishing when they are benign, resulting in false positive rate of 0.451% and false negative rate of 0.899%), we present representative example in T Our analysis reveals that the model identified potential phishing elements within the email, despite the misclassification. Notably, the predicted label and sentence still offer valuable insights, enabling users to take proactive measures to enhance security.
Human evaluation We conduct human evaluation to investigate the usefulness of our AI2TALE method in identifying the most important and phishing-relate information (e.g.. sen- tences) in phishing emails to help provide useful and concise explanations about the phishing of the corresponding email data. In particular, we evaluate whether the most important (top-1) selected sentence in each phishing email by our proposed AI2TALE method is perceived convincing in- formation for email users. To do that, we asked participants to evaluate the selected sentences of 10 different phishing emails (randomly chosen from the testing set) in terms of whether the sentence selected in each email is important to influence and persuade users to follow the instructions in the emails (refer to the appendix, Section [1 for an example). Note that, in this human evaluation, we implemented careful study design protocols to minimize potential priming. Particularly, to ensure objectivity in the results, no information was provided about the source of the selected sentences.
There were 25 university students and staff (i.c., lecturers, professors, engineers, research scientists, and research fellows, representing diverse professional back- grounds, education levels, career stages, and age groups) participating in our sur- vey. All participants reported using email for work and study, and have both ex- perienced and heard about phishing at- tacks. Based on the responses, in sum- mary, as depicted in Figure 81% of par- ticipants selected either "Agree" (55%) or "Strongly Agree" (26%) when asked if they believe the selected sentences af- fect users' decision to follow the instruc- tions in the survey phishing emails (note that in each phishing email, we use the top-1 selected sentence obtain from method). In contrast, 10% of participants chose "Neutral", while 9% chose "Dis- agree" and "Strongly Disagree".
Disagree and Strongly Disagree
9%
Neutral
Agree Strongly Agree
Human evaluation on the importance of the top-1 selected information (i.e., a sentence) from each email (by our AI2TALE method) in affecting and per- suading users to follow the instructions from the email. We evaluate the selected sentences of 10 different phish- ing emails (randomly chosen from the testing set).
Figure 2:
The human evaluations demonstrate the effectiveness of our method in successfully identifying the critical phishing information (reflecting the way attackers use it to deceitfully persuade users). The selected information provides a useful and concise explanation of the vulnerability prediction of the email, especially for the phishing one, to users. essence, our approach enhances the explainability (transparency) of phishing detection, addressing and improving the overall clarity of the prediction process.
5 CONCLUSION
In this paper, we have successfully proposed an innovative deep learning- bearning-based based method derived from an information information-theorttic perspective and information bottleneck theory for solving the phishing at- tack localization problem where automated Al-based techniques have not yet been well studied. Our AI2TALE method works effectively in weakly supervised setting, providing practical solution that not only accurately predicts the vulnerability of the email data but also has the capability to automatically identify the most important and phishing-relevant information in each phishing email. The selected information provides useful and concise explanations about the vulnerability of the associated phishing email data. In addition. attack localization. The rigorous and comprehensive experiments on seven real- real-world diverse email datasets show the superiority of proposed A AI2TALE method over the of-e-ooftheear baselines.
also introduce appropriate measures for phishing
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Martín Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, Manjunath Kudlur, Josh Levenberg, Rajat Monga, Sherry Moore, Derek G. Murray, Benoit Steiner, Paul Tucker, Vijay Vasudevan, Pete Warden, Martin Wicke, Yuan Yu, and Xiaoqiang Zheng. Tensorflow: A system for large- scale machine learning. In 12th USENIX Symposium on Operating Systems Design and Imple- mentation (OSDI 16), pp. 265-283 2016.
Sahar Abdelnabi, Katharina Krombholz, and Mario Fritz. Visualphishnet: Zero-day phishing web- site detection by visual similarity. In Proceedings of the 2020 ACM SIGSAC Conference Computer and Communications Security, pp. 1681-1698, 2020.
Nurul Akbar. Analysing persuasion principles in phishing emails. PhD thesis, 2014.
Mohammad Nazmul Alam, Dhiman Sarma, Farzana Firoz Lima, Ishita Saha, Rubaiath-E Ulfath, and Sohrab Hossain. Phishing attacks detection using machine learning approach. In 2020 Third International Conference on Smart Systems and Inventive Technology (ICSS/T), pp- 1173-1179, 2020.
Anti Anti-Phishing Working Group. Phishing trends reports, 2022. URL sttps://apwg...
t trendsreports:
Sultan Asiri, Yang Xiao, Saleh Alzahrani, and Tieshan Li. Phishingrtds: A real-time detection system for phishing attacks using a deep learning model. In Computers and Security, 2024.
Seojin Bang, Pengtao Xie, Heewook Lee, Wei Wu, and Eric Xing. Explaining a black-box using deep variational information bottleneck approach. The AAAI Conference on Artificial Intelligence (AAAI), 2021.
Abdul Basit, Maham Zafar, Xuan Liu, Abdul Rehman Javed, Zunera Jalil, and Kashif Kifayat. A comprehensive survey of ai-enabled phishing attacks detection techniques. In Telecommunication Systems, 2020.
2020.
Ahmed Bensaoud, Jugal Kalita, and Mahmoud Bensaoud. A survey of malware detection using deep learning. In Machine Learning with Applications, 2024.
Mareus Butavicius, Kathryn Parsons, Malcolm Pattinson, and Agata McCormac. Breaching the human firewall: Social engineering in phishing and spear-phishing emails. The Australasian Conference on Information Systems (ACIS), 2015.
Rich Caruana, Yin Lou, Johannes Gehrke, Paul Koch, Marc Sturm, and Noemie Elhadad. Intel- ligible models for healthcare: Predicting pneumonia risk and hospital 30-day readmission. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1721-1730, 2015.
Jianbo Chen, Le Song, Martin J. Wainwright, and Michael I. Jordan. Learning to explain: An Enformation-theoretii perspective on model interpretation. International Conference on Machine Learning (ICML), 2018
Li Chen, Penghao Wu, Kashyap Chitta, Bernhard Jaeger, Andreas Geiger, and Hongyang Li. End- to-end autonomous driving: Challenges and frontiers. CoRR, abs/2306.1699 16927, 2023a.
Wentao Chen, Fuzhou Wang. and Matthew Edwards. Active countermeasures for email fraud. CORR, abs/2210. 2023b.
Changkyu Choi, Shujian Yu, Michael Kampffmeyer, Arnt-Børre Salberg, Nils Olav Handegard, and Robert Jenssen. Dib-x: Formulating explainability principles for a self-explainable model through information theoretic learning. In IEEE International Conference on Acoustics, Speech and Signal Processing, 2024.
Anargyros Chrysanthou, Yorgos Pantis, and Constantinos Patsakis. The anatomy of deception: Measuring technical and human factors of a large-scale phishing campaign. In Computers and Security, 2024.
11

---

Published as a conference paper at ICLR 2025
R Cialdini. Influence. The Psychology of Persuasion, 1984.
Thomas M. Cover and Joy A. Thomas. Elements of information theory. In John Wiley and Sons, Inc., 2006.
Avisha Das, Shahryar Baki, Ayman EI Aassal, Rakesh M. Verma, and Arthur Dunbar. SOK: A comprehensive reexamination of phishing research from the security perspective. CoRR, 0ts//911..0055.. 2019.
Jacob Devlin, Ming-Wai Wei Chang, Kenton Lee, and Kristina Toutanova. BERT; Pre-training of deep bidirectional transformers for language understanding. In Association for Computational Linguis 2019. 2019.
Federal Bureau of Investigation, Fbi internet crime report 2022, 2022. URL httpt:ttss/wwwt www/
Ana Ferreira, Lynne Coventry, and Gabriele Lenzini. Principles of persuasion in social engineering and their use in phishing. In Lecture Notes in Computer Science, 2015.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In International Conference Machine Learning, pp. 1050-1059, 2016.
Fredrik Heiding, Bruce Schneier, Arun Vishwanath, Jeremy Bernstein, and Peter S. Park. Devising and detecting phishing emails using large language models. IEEE Access, 2024.
Amber Van Der Heijden and Luca Allodi. Cognitive triaging of phishing attacks. The Proceedings of the 28th USENIX Security Symposium, 2019.
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax. CoRR, abs/161 1.01 2016.
Neil Jethani, Mukund Sudarshan, Yindalon Aphinyanaphongs, and Rajesh Ranganath. Have we learned to explain?: How interpretability methods can learn to encode predictions in their inter- pretations. In International Conference on Artificial Intelligence and Statistics, pp. 1459-1467. PMLR, 2021.
Diederik P. Kingma and Jimmy Ba. abs/1412.66 411.69900,, 2014.
Adam: A method for stochastic optimization. CoRR,
Hung Le, Quang Pham, Doyen Sahoo, and Steven C. H. Hoi. Urinet: Learning URL representation with deep learning for malicious URL detection. CoRR,
2018.
Yukun Li, Zhenguo Yang, Xu Chen, Huaping Yuan, and Wenyin Liu. A stacking model using url and html features for phishing webpage detection. Future Generation Computer Systems, 94: 27-39, 2019.
Zhen Li, Deqing Zou, Shouhuai Xu, Xinyu Ou, Hai Jin, Sujuan Wang, Zhijun Deng, and Yuyi Zhong- Vuldeepecker: A deep learning-based based system for vulnerability detection. CoRR, abs/1801.01681, 2018
Yun Lin, Ruofan Liu, Dinil Mon Divakaran, Jun Yang Ng, Qing Zhou Chan, Yiwen Lu, Yuxuan Si, Fan Zhang, and Jin Song Dong. Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages. In USENIX Security Symposium, pp. 3793-3810, 2021.
Ruofan Liu, Yun Lin, Xianglin Yang, Siang Hwee Ng. Dinil Mon Divakaran, and Jin Song Dong. In- ferring phishing intention via webpage appearance and dynamics: A deep vision based approach. In 31st USENIX Security Symposium (USENIX Security 22), pp. 1633-1650, Boston, MA, 2022.
USENIX Association. ISBN 978-1-939133-31-2
Scott M Lundberg and Su-In Lee. A unified approach interpreting model predictions. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Gameett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Associates,
12

---

Published as a conference paper at ICLR 2025
Chris J. Maddison, Andriy Mnih, and Yee W. Teh. The concrete distribution: A continuous relax- ation of discrete random variables. CoRR, abs/1611.00712, 2016.
Carlos Guestrin Marco T. Ribeiro, Sameer Singh. Why should trust you?: Explaining the predic- tions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1135-1144, ACM, 2016.
Noga Zaslavsky Naftali Tishby. Deep learning and the information bottleneck principle. In 2015 IEEE Information Theory Workshop (ITW), pp- 1-5. IEEE, 2015.
Bilal Naqvi, Kseniia Perova, Ali Farooq, Imran Makhdoom, Shola Oyedeji, and Jari Porras. Miti- gation strategies against the phishing attacks: A systematic literature review. In Computers and Security, 2023.
Van Nguyen, Trung Le, Olivier De Vel, Paul Montague, John Grundy, and Dinh Phung. Information- theoretic source code vulnerability highlighting. International Joint Conference Neural Net- works (JJCNN), 2021.
Van Nguyen, Trung Le. Chakkrit Tantithamthavom, John Grundy, and Dinh Phung. Deep domain adaptation with max-margin principle for cross-project imbalanced software vulnerability detec- tion. In ACM Transactions Software Engineering and Methodology, 2024.
Van-Anh Nguyen, Dai Quoe Nguyen, Van Nguyen, Trung Le, Quan Hung Tran, and Dinh Q. Phung. Regvd: Revisiting graph neural networks for vulnerability detection. The ACM/IEEE 44th Inter- national Conference Software Engineering: Companion Proceedings, 2022.
OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, and et al. Gpt-4 technical report, 2024. URL https: 7 //arxiv.org//a/a wttp.oor///b//333.ee
Kathryn Parsons, Agata McCormac, Malcolm Pattinson, Marcus Butavicius, and Cate Jerram, The design of phishing studies: Challenges for researchers. Computers and Security, 2015.
Debleena Paul, Gaurav Sanap, Snehal Shenoy, Dnyaneshwar Kalyane, Kiran Kalia, and Rakesh K. Tekade. Artificial intelligence in drug discovery and development. In Drug Discovery Today, 2021.
Wei Qian, Chenxu Zhao, Yangyi Li, Fenglong Ma, Chao Zhang, and Mengdi Huai. Towards mod- eling uncertainties of self-explaining neural networks via conformal prediction. In The Thirty- Eighth AAAI Conference on Artificial Intelligence, 2024.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog. 1(8):9, 2019.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. In Journal of Machine Learning Research, 2020.
Venkatesh Ramanathan and Harry Wechsler. Phishing detection and impersonated entity discovery using conditional random field and latent dirichlet allocation. In Computers and Security, 2013.
Routhu Srinivasa Rao and Alwyn Roshan Pais. Detection of phishing websites using an efficient feature-based machine learning framework. Neural Computing and Applications, 31:3851-3873, 2019.
Marco Túlio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should I trust you?": Explaining the predictions of any classifier. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016.
Michael L. Rich. Machine learning, automated suspicion algorithms, and the fourth amendment.
University of Pennsylvania Law Review, pp. 871-929, 2016.
Ozgur Koray Sahingoz, Ebubekir Buber, Onder Demir, and Banu Diri. Machine learning- bbased phishing detection from urls. Expert Systems with Applications, 11::345-37, 2019.
13

---

Published as a conference paper at ICLR 2025
Fatima Salahdine, Zakaria El Mrabet, and Naima Kaabouch. Phishing attacks detection machine learning-basee approach. In 2021 IEEE 12th Annual Ubiquitous Computing. Electronics and Mobile Communication Conference (UEMCON), 2021.
Claude Elwood Shannon. The mathematical theory of communication. In Warren Weaver University of Illinois Press, Urbana, 1998.
Noam Slonim and Naftali Tishby. Agglomerative information bottleneck. In Advances in Neural Information Processing Systems, pp. 617-623, 2000.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, llya Sutskever, and Ruslan Salakhutdinov. Dropout: A simple way to prevent neural networks from overfitting Journal of Machine Learning Research, 15:1929-1958, 2014.
TensorFlowAPI.
Relaxedbemnouli. 2023. http::///www..ttteotfff org/
probability/aple docs wttp://ttto/ccceeccoctoo eistributions/ htw.r//tttooos/eeeeeeeeeeeeeeoee Rew.s//eeaaaeeeeeell111111
Naftali Tishby, Fernando C. Pereira, and William Bialek. The information bottleneck method. arXiv preprint physics/0004057, 2000.
Ishant Tyagi, Jatin Shad, Shubham Sharma, Siddharth Gaur, and Gagandeep Kaur. A novel machine learning approach to detect phishing websites. In 2018 5th International Conference on Signal Processing and Integrated Networks (SPIN), pp. 425-430. IEEE, 2018.
Amber Van Der Heijden and Luca Allodi. Cognitive triaging of phishing attacks. In USENIX Security Symposium, pp. 1309-1326, 2019.
Vy Vo, Trung Le, Van Nguyen, He Zhao, Edwin V. Bonilla, Gholamreza Haffari, and Dinh Phung. Feature-based learning for diverse and privacy-preserving counterfactual explanations. In The 29th ACM SIGKDD Conference Knowledge Discovery and Data Mining, 2023a.
Vy Vo, Van Nguyen, Trung Le, Quan Hung Tran, Reza Haf, Seyit Camtepe, and Dinh Phung. An additive instance-wise approach to multi-class model interpretation. The International Conference Learning Representations (ICLR), 2023b.
Xi Xiao, Dianyan Zhang, Guangwu Hu, Yong Jiang, and Shutao Xia. Cnn-mhsa: A convolutional neural network and multi-head self-attention combined approach for detecting phishing websites. Neural Networks, 125:303-312 2020.
Peng Yang, Guangzhen Zhao, and Peng Zeng. Phishing website detection based on multidimen- sional features driven by deep learning. IEEE Access. 7:15196- 2019.
Rundong Yang, Kangfeng Zheng, Bin Wu, Chunhua Wu, and Xiujuan Wang. Phishing website detection based on deep convolutional neural network and random forest ensemble learning. Sen- sors, (282)) 2021.
Jinsung Yoon, James Jordon, and Mihaela van der Schaar. Instance-wise variable selection using neural networks. The International Conference on Learning Representations (ICLR), 2019.
Ammara Zamir, Hikmat Ullah Khan, Tassawar lqbal, Nazish Yousaf, Farah Aslam, Almas Anjum, and Maryam Hamdani. Phishing web site detection using diverse machine learning algorithms. The Electronic Library, 80, 2020.
14

---

Published as a conference paper at ICLR 2025
6 APPENDIX
6.1 REPARAMETERIZZTTION FOR CONTINUOUS OPTIMIZATION
Recall that the selected sentences X are constructed by X z C X where z MultiBernoulli(p) with p is the output of the selection process ( parameterised by neural network w(., a).
To make this computational process (i.e., the process consists of sampling operations from Multi- Bernuull distribution) continuous and differentiable during training, we apply the temperature- dependent Guftel-Softmax trick (Jang et al. 2016 Maddison et al.) (2066) for relaxing each Bernoulli variable zạ. We sample 2; (X;a)= ~ Concrete(w:(X:0))
w (X;a)):
e + +a,/T} 24 (X;a)= exp((logw: - -a://)) + expl (1 w1- + b,)/T}
where we denote ii aX; as wi while is a temperature parameter (i.e., that allows us to control how closely continuous representation from Gumbel-Softmax distribution approxi- mates this from the corresponding discrete representation from a discrete distribution (e.g., the Bernoulli distribution)), random noises o; and b; independently drawn from Gumbel distribution G = log(- lo with u ~ Uniform (0, 1).
6.2 DATA PROCESSING AND EMBEDDING
We observed that most of the email data from the studied datasets (i.e., IWSPA-AF Nazario Phish- ing Corpus
4 Fraud email Cam- bridge and Enron Emails? are stored in the form of webpages on public websites. We preprocessed the datasets before using them for the training and testing processes such as removing non-ASCII characters. We also removed duplicated emails in the used datasets as well as similar emails (when they are in the same label category, i.e., phishing or benign). In the end, we utilized around 40,000 email data samples, where half of them are phishing, from the datasets to conduct our comprehensive and rigorous experiments. Note that the email data samples used in our experiments cover wide spectrum of writing styles, tones, and structures (e.g., subject, content, html links, and signature) commonly encountered in email communications (e.g.. formal business correspondences, informal personal messages, transactional emails (e.g., order confirmations or account notifications), market- ing emails promoting products or services, and automated responses to specific actions events).
2 Miller Smiles Phishing Emai Phish Bowl Cornell University"
We further preprocessed the datasets before injecting them into deep neural networks of our A12TALE method and baselines. In the context of our paper, we viewed each email as sequence of sentences and aim to learn and identify the most important sentence in each email contributing to the email's vulnerability label (phishing benign). We embedded sentences of each email into vec- tors. For instance, consider the following sentence "Your account has been suspended." ",, to embed this sentence, we tokenized it to a sequence of tokens including "your", "account". "has". "been" ", "suspended", and using the common Natural Language Toolkit (NLTK). We then used a 150- dimensional token Embedding layer followed by Dropout layer with a dropped fixed probability p 0.2, 1D convolutional layer with the filter size 150 and kernel size 3, and ID max pooling layer to encode each sentence. Finally, mini-batch of emails in which each email consisting of encoded sentences was fed to proposed AI2TALE method and the baselines.
In our paper, the length of each email is padded or truncated with L = 100 sentences (i.e., we base on the quantile values of the emails' length of the used datasets to decide the length of each email). We observe that almost all important information relevant to the phishing vulnerability lies in the lies in some very first sentences.
100 first sentences
http:://mnnkey.rrr//00///////
http://ww..allerrmmeee..........
A private dataset
https:
htt::///wwwcc www. wtt.:s.cscc..ccceeee www..edd/eenroon
15

---

Published as a conference paper at ICLR 2025
6.3 MEASURES
For the Sepnitive-TruePPsittti metric, to measure the top-1 selected sentence obtained from each method reflects the human cognitive principles (triggers) used in each phishing email, particularly based on the keywords and phrases often used in each cognitive principle. To obtain the keywords and phrases, for each cognitive principle, first base its definition (descriptions) pioneered in the well-known work (Cialdini] 1984) (widely cited and used in phishing-related stud- ies (Akbar 2014, BButviiiius et al.) 2015 Ferreira al. 2013 Heijden & Allodi 2019)). We then use Ch (OpenAl et al., 2024) to obtain all the possible keywords and phrases related to each cogmitive prineiple's 's defimition (descriptions). For example, to the Scarcity principle, some of the related keywords and phrases can be relevant to Time-sensitive language (e.g., "Act now" or "Ex- pires soon"), Limited availability (e.g., "Only few left"), and Threats of consequences (e.g.. "Will be deleted" or "Will lose access"). By relying on the definition (descriptions) of each cognitive principle with the help of ChatGPT in finding all the possible and main keywords and phrases, re- lated to the definition (descriptions) of each cognitive principle, used in the Cognitive-True-Poiiiee measure, we ensure this process reliable and objective.
6.4 BASELINE METHODS
The baselines of our method are recent, popular, and state-of-the-ar interpretable machine learning approaches falling into the category of intrinsic interpretable models including L2X (Chen et al. 2018). INVASE Yoon al., 2019), ICVH (Nguyen et al.] [02I]. VIBI (Bang et al., [202]] and AIM Vo et al. 2023b) that we apply to solve the email phishing attack localization problem. As mentioned in Section 2
intrinsic interpretable machine learning techniques, a.k.a. self-explanatory models, strongly suitable for phishing attack localization because they not only make predic- tions themselves but also identify the most important features of the data obtained from the model explain the model's predictive decision.
We briefly summarize the baselines as follows:
L.2X (Chen al. 2018). An efficient instance-wise feature selection method leverages mutual information for model interpretation. 1.2X aims to extract subset of features that are most informative for each given example and the associated model prediction response.
INVASE Yoon et al. 2019). Another effective approach for instance-wise feature selec- tion. INVASE consists of three neural networks including a selector network, a predictor network, and baseline network which used to train the selector network using the actor-critic methodology.
ICVH (Nguyen et al. (021). One of the first interpretable deep learning- based methods ap- plied for source code vulnerability localization. ICVH is based on mutual information and a multi-Bernoully distribution selection process for selecting vulnerability-reeeee source code statements.
VIBI (Bang et al. 202 VIBI is system-agnostic method providing a brief and compre- hensive explanation by adopting an information -hhooretic principle, the information bottle- neck principle, as a criterion for finding such explanations.
AIM (Vo et al. 2023b). A recent innovative additive instance-wiss framework for model in- terpretation. AIM integrates both feature attribution (producing relative importance scores to each feature) and feature selection (directly identifying the subset of features most rel- evant to the model behavior being explained) into an effective framework for multi-class model interpretation.
worth noting that our proposed AI2TALE method and the baselines can work on the weakly supervised setting where during the training process, only utilize the vulnerability label of the data, without requiring the ground truth of phishing information in the data for the task of phishing attack localization.
16

---

Published as a conference paper at ICLR 2025
6.5 MODEL'S CONFIGURATION
For the 1.2X (Chen al. 2018). ICVH (Nguyen et al.
2021 VIBI (Bang et al. 2021 and AIM
(Vo et al. (023b) methods, they were proposed to explain the output of black-box learning models. To use these methods for phishing attack localization, we keep their principles and train the models to directly approximate p ()) using p p((]X) where X consists of the selected sentences while Y is ground truth label of the data X instead of the output from the black-box model.
Note that the L2X, ICVH, VIBI, and AIM methods were also proposed to work with sequential text data. For these methods, we follow the structures outlined in the corresponding original papers for the architecture of the selection network that obtains X, as well as the classifier working on X to mimic p(Y]))) using the same suggested value ranges for hyper- syper-parameters. For the INVASE method, originally designed for tabular data, we adapt it to be applicable to sequential text data by retaining its principles and using the same data embedding technique (also used in our method and other baselines) and the selection network architecture as in our A12TALE method.
We implemented our AI2TALE method in Python using Tensorflow (Abadi et al. 2016). The trade-off parameter À is in {10-1, 10-2 10-3} while is in 210-1,2 x 10 x 10 "J. For the networks w (+:a) and f (): we used deep feed-forward neural networks having three and two hidden layers with the size of each hidden layer in {100, 300). respectively. The dense hidden layers are followed by a ReLU function as nonlinearity and Dropout (Srivastava et al. 2014) with retained fixed probability p 0.8 regularization. The last dense layer of the network w (::) for learning a discrete distribution is followed by a sigmoid function while the last dense layer of the network f (:: (8) is followed by softmax function for predicting. The temperature for the Gumbel softmax distribution is in {0.5, 1.03. Note that we utilized the commonly used values for these hyper-pane parameters.
For our AI2TALE method and baselines, we employed the Adam optimizer (Kingma & Ba 2014) with an initial learning rate of 10-3, while the mini-batch size 128. We split the data set into three random partitions. The first partition contains 80% for training. the second partition contains 10% for validation and the last partition contains 10% for testing. We used 10 epochs for the training process. We additionally applied gradient clipping regularization to prevent over-fitting. For each method, we ran the corresponding model several times and reported the averaged Label-Accuracy and Cognitive-Trrus True-PPsitive measures.
We ran our experiments on a 13th Gen Intel(R) Core(TM) i9- 10-0390 having 24 CPU Cores at 3.00 GHz with 32GB RAM, integrated Gigabyte RTX 4090 Gaming OC 24GB.
6.6 ADDITIONAL QUANTITATIVE RESULTS
Model Performance on F1-Score, False Positives, and False Negatives In our study, via the Label-Accuracy metric, aim measure whether the selected sentences obtained from each model are truly important and help accurately predict the associated emails' vulnerability label (i.e., phish- ing or benign). The underlying intuition is that the most pivotal sentences significantly influence the vulnerability of emails, particularly phishing ones. Specifically, in the experiments, for cach email, we focus on evaluating the most important (top-1) selected sentence (i.e., aiming to provide the most highly qualified and concise explanation of the vulnerability of email data to users) from each model to determine its efficacy in predicting the email's 's vulnerability label, without considering all of its sentences. The higher the value of the Label-Accuracy measure, the better the performance in selecting the most crucial and label-relevant information from the data.
To examine our experiments further on this aspect, we calculated the F1-score for our AI2TALE method and baselines. Specifically, we computed the F1-score in two scenarios: (i) exclusively the testing phishing emails, and (ii) both the testing phishing and benign emails. The results for our AI2TALE method and the baselines (i.c., AIM, VIBI, L2X, ICVH, and IN- VASE) in scenarios (i) and (ii) are shown in Table 3 In this table, we also compared the false positive rate and the false negative rate for our AI2TALE method and the baselines.
In summary, the Fi-score results for our AI2TALE method and baselines closely align with those obtained using the accuracy measure (i.c., Label-Accuracy). Notably, our AI2TALE method ex- hibits consistent effectiveness and advancement, considerably surpassing the baselines in both sce-
17

---

Published as a conference paper at ICLR 2025
narios (i) and (ii). Additionally, AI2TALE method achieves the best performance in both false positive and false negative rates, further highlighting its superiority over the baselines.
Table 3:
The performance of our AI2TALE method and the baselines for the Fl-score mea- sure on the testing set in two scenarios (i) and (ii). We also present the performance of our A12TALE method and the baselines for the false positive rate (FPR) and false negative rate (FNR)
(the best results in bold).
Methods
F1-score (i)
F F1-score (ii) 1
FPR 4
FNR L
INVASE Yoon et al. 2019
98.313%
98. 29.9
2.353%
1.048%
ICVH (Nguyen et al.
202T
96.732%
96.725%
3.355%
3.195%
L2X (Chen et al. 2018
98.261 %
98.249%
2.253%
1.248%
VIBI [Bang et al. 2021
96.626%
96.649%
2.504%
4.194%
AIM (Vo al. 2023b
98.406%
98.399%
1.853%
1.348%
A12TALE (Ours)
99.324%
99.325% %
0.451
0.899
Data representation learning using transformer-based large language model In our study, we treat each email a sequence of sentences, where each sentence sequence of words (to- kens), and aim to identify the most important sentence contributing to the email's vulnerability label (phishing or benign). For tokenization, we use the Natural Language Toolkit (NITK), a widely adopted tool for natural language processing tasks.
Inspired by the baselines, to encode each sentence, we used a 150-dimensional token Embedding layer followed by Dropout layer with a dropped fixed probability p 0.2, a ID convolutional layer with the filter size 150 and kernel size 3, and a ID max pooling layer. The combination of the Embedding layer, ID convolutional layer, and ID max pooling layer is known to be a lightweight rresource-efficeenn and effective approach for processing text data and learning representations. Notably, the Embedding and 1D convolutional layers are learnable during training. We refer this method as EID.
In addition to the EID method for text data representation learning, another solution is leverage the power and structure of a transformer-based pre-trained large language model (e.g.. BERT (Devlin) al., 2019) T5 (Raffel al., 20200, ), particularly via its encoder component, which is special- ized in data representation learning. In this section, we use the encoder component of the BERT model for the data representation learning part of our AI2TALE method. BERT, which stands for Bidirectional Encoder Representations from Transformers, is relatively lightweight in terms of com- putational resources compared to many other transformer- based L.MMs, like T5. BERT was designed to pre-train deep bidirectional representations from unlabeled text by jointly conditioning on both left and right context in all layers. It has achieved state-of-the-arr results on various natural language processing tasks, including natural language inference, question answering, and classification. We refer to this method as EBERT. Note that in the case of using EBERT, during the training process, the encoder will also be fine-tuned, allowing it to adapt the specific data and task at hand. The outputs from EBERT are the token-level representations of the input, which are then processed to form sentence-level representations. These sentence representations will be passed on the next part of our AI2TALE model. In terms of computing resources for this case, we use a Linux-bart based x86-64 machine (Precision 7865 Tower) with an AMD Ryzen Threadripper PRO 5955WX and two RTX 6000 Ada Generation GPUs, each with 48 GB of VRAM.
The experimental results of our AI2TALE method for the EID and EBERT cases are (99.33% 98. 08.95% 0.451 %, and 0.899%) for Label-Accuracy, Cognitive- True-Positee FPR, and FNR in the EID case, and (97.25% 97.15%, 2.303%, and 3. 3.195% for the same metries in the EBERT case.
In short, the EID method is significantly more lightweight than the EBERT method. Moreover, the performance of our AI2TALE model using EID substantially outperforms that of EBERT. We observed that this discrepancy can be attributed to several potential factors: (i) Domain shift: Dif- ferences between the domain of the pre-training data and the downstream task domain can hinder transferability; (ii) Task complexity: Some downstream tasks may be more complex or have patterns that differ from those of the pre-training objectives. In such cases, the model may not fully adapt to the unique demands of the task; (iii) Lack of task-specific knowledge: While LLMs trained on vast datasets, they may lack specialized knowledge about the nuances of certain tasks. Although fine-tuning can help, it might not be sufficient for highly specialized or domain-specific tasks.
18

---

Published as a conference paper at ICLR 2025
In our future work, we will explore innovative fine-tuning strategies and appropriate modifications to harness the capabilities of LLMs, combined with the principles of our A12TALE method, to tackle the email phishing attack localization challenge, with the goal of identifying optimal solutions.
6.7 ADDITIONAL QUALITATIVE RESULTS
In 4 we expand the qualitative results presented in 2 In particular, to further aid in label explanation, along with the most important (top-1) selected sentence (which provides concise and useful information), we also present the second and third most relevant sentences for each email. It is evident that these selected sentences complement each other in elucidating the predicted label, offering additional insights to help users better understand the phishing attacks.
In Table ]] we further show qualitative experimental results of our A12TALE method on some additional phishing email samples. Via these qualitative results, our method again demonstrates its effectiveness in learning and identifying the most important and phishing-
information (i.e., sentences) phishing emails for providing useful and concise interpretations corresponding to the predicted phishing labels. Analysis of these phishing email samples reveals that the most important (top-1) selected sentences (as well as the second and the third selected sentences) from the model primarily reflect commonly used cognitive triggers related to the principles of scarcity (i.e., creates sense of scarcity and urgency), authority (i.e., creates sense of trust and legitimacy), and consistency (i.e., creates a sense of familiarity and consistency). Additionally, we observe that the most important sentence contributing to a specific phishing email tends to appear in the initial positions of the email to capture the users' attention.
6.8 MODEL SENSITIVITY TO HYPERPARAMETER CHANGES AND THE IMPACT OF INFORMATION BOTTLENECK AND DATA-DISTRIBUTION MECHIANISMS
In this section, we first examine the sensitivity of our AI2TALE method to the hyperparameters used
in the mutual information maximization (i.e., max (X, Y) AI(X, AI(X,X)) described in Eq. (8) In particular, we explore the impact of varying values for the trade-off X {10-1, 10-22 100-3 and {10-1.2 ..2 x 10-1,3 3 x 10-'), which are commonly used in such experiments. The results show that our AI2TALE method exhibits stability with small variances in key performance metrics, including Label-Accuracy (0.0124).
(0.0852), and F1-score (0.0123). Achieving high performance, around 99.33% in both Lccur-Ac and F1-score, and 98.95% in Cognitive- Positive, along with small variances, indicates the robustness of our AI2TALE method.
In our AI2TALE method, although the joint training process mentioned in the main paper via the Eq. ① guided by information theory (through mutual information) brings benefits for selecting the important and phishing-relevan
sentences from phishing emails, we observe two potential limita- tions of this training principle, including obtaining a superset of phishing-relevant encoding the vulnerability label via its selections instead of via truly meaningful information. To tackle these potential issues, propose two innovative training solutions: (i) information bottle- neck theory training term that ensures only important and label-relevant information (i.e., sentences) will be kept and selected, and (ii) data-distribution mechanism that ensures the learnable selection process respecting the data distribution to select the meaningful and label-relevant information. This mechanism also aids in improving the generalization capability of the selection network.
relevant sentences, and
We examine the impact of the information bottleneck theory training term and data-distribution mechanism on the model performance. Without these terms, our model's performance matches the second-highes baseline in Cognitive- Srggittiv-Truu-Posiiiie Sruut-Psiiivee which is ICVH. We observe improvements of approximately 0.5% Label-Aceuracy and 0.8% in False Positive Rate (FPR) compared to the second-highed baseline (AIM). However, there is an increase of about 0.4% in False Nega- tive Rate (FNR) compared to the second-highest baseline (INVASE). When these terms are ap- plied, our AI2TALE method consistently outperforms the baselines, achieving the best performance across all metrics, including Label-Accuracy (99.334 99), Cognitive-Truus True-Position (98.95%) Fl-score (99.33%), False Positive Rate (0.451%), and False Negative Rate (0.899%) by wide margin. In this case, our method shows an improvement of approximately 1.5% to 3.5% in the average of two Cognitive-Truu-Pssittie
key metrics (label-Accuracy and Cognitive- True-Positive) compared to the baselines.
19

---

Published as a conference paper at ICLR 2025
6.9 THREATS TO VALIDITY
Construct validity Key construct validity threats are if the assessments of our AI2TALE method and baselines demonstrate the ability for phishing attack localization. In our paper, we study an important problem of phishing attack localization where we not only aim to automatically learn and identify the most important and meiishing-relevann information (e.g., sentences) in each phishing email but also can detect the vulnerability label Y (i.e., phishing or benign) of the corresponding email based on the crucial selected information. The selected phishing-relevant information (e.g., sentences) helps provide useful and concise explanations about the vulnerability of the phishing email data. To evaluate the performance of our method and baselines, we utilize two main measures including Label-Accuracy and Cognitive- Teaeee-Trru-PPPsiiiii supported by additional measures such as F1-score, False Positive Rate, and False Negative Rate.
Internal validity Key internal validity threats are relevant to the choice of hyperparameter set- tings, such as the optimizer, the learning rate, and the number of layers in deep neural networks. It is worth noting that finding expensive due to a large number of trainable parameters. To train our method, we chose to use the common and default values of hyperparameters, e.g., using Adam optimizer and the learning rate of 10-3. We also report the hyperparameter settings in our released reproducible source code samples to support future replication studies.
of optimal hyperparameter settings of deep neural networks is
External validity Key external validity threats include whether our proposed AI2TALE method can generalize well to different types of phishing email datasets. We mitigate this problem by con- ducting our experiments Phishing Corpus, Miller Smiles Phishing Email, Phish Bowl Cornell University, Fraud emails, Cam- bridge, and Enron Emails.
seven real-world diverse email datasets including IWSPA-AP, Nazario
6.10 PRIVACY CONCERNS AND THE RISK OF MISCLASSIFICATION
Privacy is an important concern in Al and machine learning systems, especially when dealing with sensitive personal data. Training AI models on large datasets carries the risk of inadvertently expos- ing private information. This can occur through direct access to the training data or through model inference, where the model may unintentionally memorize and reveal private details.
Regarding privacy concerns when deploying our AI2TALE method in real-world applications, the operations of our AI2TALE method and its approach to addressing the phishing attack localiza- tion problem are designed to minimize these risks. In particular, the explainable component of our method allows users to understand the reasoning behind flagged phishing attempts by highlight- ing the most important and label-relevant information directly from the data tested along with the predicted label. Importantly, this process does not expose any sensitive data from the training set, minimizing the risk of privacy breaches throughout.
In terms of misclassification issues, when the model produces an incorrect prediction about the vulnerability label (phishing or benign) of the email, experiments seven diverse real- world email datasets show that our AI2TALE method achieves around 99.33% for both Label-Accuss aacel-Accuracy and F1-score, with low False Positive Rate of 0.451 % and low False Negative Rate of 0.899%. This indicates that the rate of misclassifications is minimal. In the case of false positives, the highlighted information from the data still provides users with useful insights, enabling them to take proactive measures to enhance security. For false negatives, the highlighted information also allows users to double-check the flagged content (if they wish), minimizing the likelihood that potential threats are overlooked. In conclusion, the predictions and explanations work together to provide users with interconnected, supportive information. Furthermore, by highlighting the most important and label- relevant information, the model facilitates users in receiving clear, actionable insights.
6.11 EXAMPLE USED IN HUMAN EVALUATION
In the human evaluation, we evaluate whether the most important (top-1) selected sentence in each phishing email by our proposed AI2TALE method is perceived as convincing information for email users. To do that, we asked participants to evaluate the selected sentences of 10 different phishing emails (randomly chosen from the testing set) in terms of whether the sentence selected in each
20

---

Published as a conference paper at ICLR 2025
email is important to influence and persuade users to follow the instructions in the emails. Below, we present an example question.
"Given an email follows, do you think the selected sentence (in bold) affects and persuades users' decision to follow the instructions from the email?
Bulk attention! Your discover account will close soon! Dear member, we have faced lems with your account, so please update the account. If you do not update will be closed. To update your account, just confirm your information. (it only takes minute). It's easy. 1. Click the link below to open a secure browser window. 2. Confirm that you're the owner of the account, and then follow the instructions.
prob-
The participants will then choose one option from the following: Strongly Agree, Agree, Neutral, Disagree, or Strongly Disagree."
6.12 FUTURE WORK
In this study, our paper focuses primarily on addressing the phishing attack localization problem in email phishing, the most common form of phishing. It is worth noting that phishing attacks can also occur through webpages. Several methods have been proposed to detect and infer phishing intention based on webpage appearances (e.g., (Abdelnabi et al. 2020 Liu et al. 2022)). We believe the principles underlying our AI2TALE method can also be extended to detect and localize webpage phishing attacks. The operational nature of our AI2TALE method within (i) a unified framework,
(ii) working directly with webpage data without requiring additional steps to gain extra information (e.g., references to the ground truth of phishing information) beyond the data and its vulnerability label (i.e., phishing benign), well (iii) the way our AI2TALE model can be trained without requiring the ground truth of phishing information in the data can be considered as some of the advantages of our method compared to the relevant methods (e.g.. (Abdelnabi al., 2020 Liu al., 2. Investigating the application of our AI2TALE method to explain webpage phishing attacks could be a focus of our future studies.
6.13 RELATED BACKGROUND
Following, we briefly present the main related background used in our proposed AI2TALE method.
Mutual information Mutual information (MI) is used to measure the dependence between two random variables (Shannon 1998 Cover & Thomas 2006). It captures how much the knowledge of one random variable reduces the uncertainty of the other. In particular, MI quantifies the amount of information obtained about random variable by observing the other random variable. For instance, suppose variable A signifies the outcome of rolling a standard 6-sided die, and variable represents whether the roll yields an even for even, for odd) result. It is evident that information from B offers insights into the value of A, and vice versa. In essence, these random variables exhibit mutual information.
Assume that we have two random variables X and Y drawn from the joint distribution p(z, y) with two corresponding marginal distributions p(x) and p(y). The mutual information between X and Y denoted by T T(X, Y) is the relative entropy between the joint distribution p(z, y) and the product distribution p(x: p(y), and is defined as follows:
I(X,))= = p(x, log p(r,y) y) drdy = p(z)p(z)
where (p(a,, y) v)(pp()))()) the Kullback Leibler divergence measuring the relative entropy (i.c. the difference in information) represented by two distributions, i.c., the product of marginal distributions p(x) (()) of X and Y from their joint distribution p(z, f).
Information bottleneck theory Here, consider the supervised learning context where want to predict corresponding outputs (e.g., labels) {y:)" of given inputs { A deep learning network (DNN) will learn latent representations (i.e., latent features in the latent space that contain
21

---

Published as a conference paper at ICLR 2025
useful information to describe the data) { of the corresponding input data samples {x, ) in terms of enabling good predictions and generalizations.
x
Y
p Pl
Figure 3: An architecture of a simple deep neural network in supervised learning context for the classification problem.
Assume that the whole hidden layer in Figure 3 is denoted by random variable X while the input and output layers are denoted by random variables X and Y respectively. We can describe this hidden layer by two conditional distributions: the encoder p(x|x) and the decoder p(y) p(y/x). This transformation process preserves the information of the input layer X without considering which individual neurons within the hidden layer X encode which features (i.e., neurons) of X. An optimal encoder process of the mutual information between X and the desired output denoted by [(X, Y) can create the most compact encoding (i.e., minimally sufficient statistic) X of the input data X while X still has enough information (i.e., X can capture the important features of X as well as remove the unnecessary parts of X that do not make contributions the prediction of Y) predict Y as accurately as possible.
An information bottleneck (Tishby al., 2000 Naftaii Tishby 2015) is proposed to be computa- tional framework that aims find the most compact encoding X of the input data X. In particular, it is the optimal trade-off between the compression X and the prediction of the desired output Y as described in the following optimization problem:
((xx,))-1(Xx.))
min p( p(yy)) ((()
where specifies the amount of relevant information captured by the encoding process (i.c., the representations X and 1(8,y) Y)).
22

---

Published as a conference paper at ICLR 2025
Table 4: The ground truth and the predicted label based on the most important (top-1) selected sen- tence (in yellow) of each email from our AI2TALE method. The top-1 selected sentence provides concise and useful information. However, to further aid in label explanation, here, we also show the second (in melon) and third (in pink) most relevant sentences.
Truth
Model
Emails
phishing phishing
The email: "Please
online banking records! Dear customer on our servers. policies all natwest bank customers must complete the natwest customer form.
confirm your are
of natwest bank,
running
scheduled maintenance
We want make your money and your personal details safe and secure. Due to security
To complete the form,
please use the link below natwest customer form this should take you directly the natwest customer form. Sincerely, natwest customer service good."
Note: The phishing email poses as legitimate message from natwest bank, requesting confirmation banking records. Its goal to trick individuals into providing personal information under the guise of security. emphusizing the need to verify the authenticity of such communications, Our method successfully figures out the sentence "Please confirm your oaline banking records." representing the key message of the phishing email. It serves to creute urgency and prompt the recipient to take action. suggesting that there is need to verify their record information.
addition, second and third selected sentences, "Due to new security policies, all natwest bank customers must complete the natwest customer form." (in melon) and "We want to make sure your money and your personal details are safe and secure." (in pink), respectively create a sense of urgency and authority. as well as evoke feelings of warmth and security. subily reassuring the recipient and lowering their guard.
phishing
phishing
The email: "Temporaiily suspended. Dear customer, customer advice, please address the following issues. The details that you have entered have not been recognized. For your security, your online service has been temporarily locked, No further attempts will be accepted.
If you provide with the following details, you should able access the service in just a few minutes. Click here to get started legal info privacy security 2005 2010."
Note: This phishing email tries convey the action taken is intended to protect the recipient's 's well being and (ii) a sense of ugency, encouraging the recipient to address the issue promptly to regain access to their online service.
successfully figures out the sentence "For your security, your online service has been temporarily locked," ! representing the key message of the phishing email.
addition, the second and third selected sentences, "If you provide us with the following details, you should be able access the service just a few minutes." (in melon) creates sense of urgency and promises quick resolution, prompting the recipient to act immediately without thinking criticall.. Meunwhile, "Dear customer, customer advice, please address the following issues." (in pink) aims to create an illusion of profes- sionalism and authority, making the recipient feel reassured and more likely to trust the email.
phishing phishing
The email: "Bulk attention! Your discover account will close soon! Dear member, we have faced some problems with your account, please update the account. If you do not update will be closed. update your account, just confirm your information. (it only takes minute). It's easy. 1. Click the link below to open a secure browser window. 2. Confiem that you't re the owner of the account, and then follow the instructions."
Note: The message from the yellow selected sentence ohtained from our method exhibits cognitive triggers commonly associated with phishing attempts used in the phishing email, particular, implies a sense of urgency (concem) via problems with your account while "Dear member" aims to estahlish connection with the recipient and imply that the message comes from a trusted source. The phrase "please update the account" creates a sense of fumiliarity and consistency.
addition, the instruction "just confirm your in information" and the statement "It's easy" (via the second (in melon) and third (in pink) selected sentences) aim to minimize perceived effort, making the recipient more likely comply without hesitation.
benign
phishing
The email:
Lowwe your mortgage payment! Bad credit, no problem! Lower your morigage payment! Bad credit, no problem! Whether your credit is excellent or less than perfect, loanweb has a lender that can help you! Lowest rates on the web! Bad credit? Refinance to get cash! Lower monthly payments! Bad credit? Refinance to consolidate hills! Click here for lower morigage payment! Win a free bread maker! Win free bread makers, toaster ovens, cookware and more get free subscription cooking pleasures magazine get free multi purpose grater test and keep free cooking products get free recipes from world famous chefsplus get a free 90 day membership in the cooking club of america. Home equity loans without perfect credic! Click here for home equity loan! Free applicution! Home equity loans up 125 potential tax deductible interest! Customized, competitive equity lines and loans. Apply now!"
Note: the datasets we utilized, the ground truth label for this email is benign. However, our method predicts phishing due to the detection of potential phishing indicators, such as the use of enticing offers of "lowering mortgage payments" and the presence of "suspicious links" potentially prompting usees to provide personal information and bank account details via the phrase "Click here for lower mortgage payment!" Although the email's ground truth classification was incorrect, deem the predicted label the highlighted sentence from our model valuuble in alerting users to potential phishing attempts.
addition, the second and third selected sentences, "Refinance consolidate bills!" melon) and "Lower your mortgage payment!" (in pink). are designed to appeal to individuals struggling with debt or looking for ways to manage their finances. These phrases create the impression of offering a legitimate and helpful financial product. while also aining immediately grab the recipient's attention.
23

---

Published as a conference paper at ICLR 2025
Table 5: The ground truth and the predicted label based on the most important (top-1) selected sen- tence (in yellow) of each email from our A12TALE method. The top-1 selected sentence provides concise and useful information. However, to further aid in label explanation, here, we also show the second (in melon) and third (in pink) most relevant sentences.
Truth
Model
Emails
phishing phishing
the pri- The email: "Dear paypal customer. Dear paypul customer, this is an official notification from paypal that the service listed below will be deactivated and deleted if not renewed immediately. Previous notifications have been sent to billing contact assigned to this account. mary contact, you must renew the service listed below, or will be deactivated and deleted. Click to renew your paypal account now service paypal security department Expiration may 14, 2010, paypal
dedicated providing you with exceptional service and to ensuring your trust. If you have any questions regarding our services, please check the website or call our customer service. Thank you, sincerely, paypal security department paypal's services terms and conditions upply The infor- mation on this page presented subject to legal page and any other terms and conditions that paypal may impose from time to time. It is subject to change without notification. Microsoft and the microsoft internet explorer are registered trudemurks or trade works of microsoft corporation in the united states and for other countries."
Note that: The yellow selected sentence employs urgent (fear and concern) language by stating that the ser- will "deactivated and deleted renewed immediately". This urgency can create panic and pressure the recipient to act quickly without considering the legitimacy of the message. Furthermore. also attempts establish credibility and authority via "officiul notification from paypal" often used by attackers. The message from the selected sentence starts with the generic address "Dear paypal customer" twice. While legitimate communications would typically use the recipient's 's actual name, phishing emails often lack personalization and use general greetings. In general, the selected sentence consists of almost all key messages from the email. That shows the effectiveness of our proposed A12TALE method identifying the most important phishing-relevant information (sentence) from the email.
addition, the second and third selected sentences, "Click renew your paypal account now, service paypal security department" (in melon) and "Thank you, sincerely, paypal security depurtment paypul's services terms and conditions apply" (in pink). both create urgency, mimic authority, and use vague or formal language to gain trust. The melon sentence pressures the recipient to click a link, while the pink sentence attempts to establish credibility with official-sunding language.
phishing phishing
The email: "Your payment didn't succeed. your ads have been suspended. This message sent from a notification only email address that does not accept incoming email. Please do not reply to this message. If you have any questions, please visit the google ads help center. Hello advertiser, our attempt to charge your credit card for your outstanding google ads account balance was declined Your account is still open. However, your ads have heen suspended. charge your card and receive payment for your account balance, will se activate your ads. Please update your billing information, even if you plan to use the same credit card This will trigger our billing system to try charging your card again. You do not need to contact us to reactivate your account. To update your primary payment information. please follow these steps Log in your account http ad words google com select, 2. Enter your primary payment information. 3. Click "updute" when you have fin- ished. Thank you for advertising with google ads. We look forward to providing you with the most effective advertising available. (c) google ads teum 2008." "
Once we are able to
Note: The yellow selected sentence "Your payment didn't 't succeed, so your ads have been suspended," ex- empliñies key tactics in the phishing email by creating a sense of urgency and alarm, prompting recipients quickly. impersonates legitimate Google Ads communications action to update billing information. aiming to harvest personal and financial details. By conveying authority and legitimacy, the message seeks to distract recipients from potential red flags, increasing the likelihood falling victim.
gain trust and includes a call
In addition. the second and third selected sentences. "Hello advertiser, our attempt to charge your credit card for your outstanding google ads account balance was declined" (in melon) and "Please update your billing information, even if you plan use the legitimate and pressure the recipient into acting without cureful consideration. The melon sentence exploits the fear of an account issue, while the pink sentence suggests specific action ("update billing information",, ), a common phishing tactic to collect sensitive data.
credit card" (in pink), use authoritative language to appear
24


Reviews:
[{"review_id": "AzwjYv0MZS", "reviewer": "Reviewer_PCAG", "summary": "This work addresses the problem of phishing attacks and introduces an information theory-based model called AI2TALE to detect them without requiring ground truth while also providing explainable results. The authors validate this model on seven diverse real-world email datasets, demonstrating that the AI2TALE model achieves state-of-the-art results. The model is also tested with human participants, who found it helpful for detecting phishing attacks.", "questions": "1) In line 271, you mention that $p(\\tilde{x_i}|X)$ is a Gaussian mixture distribution. Why did you choose this distribution? Did you evaluate the effect of this assumption on your results?\n    \n  2) In your algorithm (see line 333), you split an email into sentences based on periods or commas. Have you examined whether this sentence-splitting method impacts your results? There are alternative ways to split text, such as by a specified number of characters.\n    \n  3) Based on the main paper and appendices, it appears you developed a feed-forward neural network (see lines 879–881) for the selection model in your algorithm (see line 339). My understanding is that this neural network creates word embeddings based on the provided texts and then focuses on detecting phishing attacks. Why did you choose this model instead of a more advanced architecture, such as a transformer?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "Overall, this is a well-written and clearly explained work. The motivation and contributions are effectively communicated, as are the details of the algorithm, including the model architecture and data. According to the results presented in the tables, the AI2TALE model achieves state-of-the-art performance in detecting phishing attacks based on two measures—Label-Accuracy and Cognitive-True-Positive—which the authors believe are more appropriate for this task. The model also achieves state-of-the-art results with the well-known F1 score. The results are also validated by humans who found this model helpful. Another strength of this paper is that the results of this information-theory-based model are explainable, a claim that appears valid based on the presented figures. Finally, all code is reproducible and open-source.", "weaknesses": "I have included a few comments regarding the presentation and also have some feedback on the experimental section.\n   \n   A) Presentation Comments\n   \n   A1) In lines 058 to 060, where you mention that early-stage AI approaches are among the most effective solutions for preventing and reducing negative effects, this seems like a strong statement. It would be beneficial to include a citation to support this claim.\n   \n   A2) In line 152, you introduce the term \"AI2TALE\" for the first time as the name of your model. It would be helpful to clarify what this acronym stands for and briefly explain your rationale behind the name selection.\n   \n   A3) In line 330, you refer to your method as “Algorithm 1.” Since this is the only algorithm presented in your paper, it is unnecessary to number it as \"1.\" Consider renaming it simply as “Algorithm” throughout the text.\n   \n   A4) In Section 4.1, “Studied Datasets” (lines 360-371), you list several datasets used in your research. Please add citations and links for each referenced dataset. Additionally, include citations and links in Section 6.2 of the appendices (lines 778-788).\n   \n   A5) In line 404, you mention that readers seeking more details can refer to the appendices. Please specify the exact section or appendix that contains the relevant information.\n\n   A6) In Section 6.2 of the appendices (lines 789-799), this paragraph appears to be more relevant to the following section, 6.3, on data preprocessing and embeddings.\n\n   A7) The link of your code, see line 897, should be in the main paper, such as in the introduction. \n\nA8) As mentioned in the author guidelines (see https://iclr.cc/Conferences/2025/AuthorGuide), you are encouraged to include a Reproducibility Statement at the end of the main text. This statement should detail the efforts made to ensure reproducibility and include any necessary information for those wishing to replicate your results.\n\n   A9) You have referenced a good selection of papers with nice variation; however, I think a few relevant papers are missing. These include \"Feature-based Learning for Diverse and Privacy-Preserving Counterfactual Explanations\" by Vy Vo et al., \"The Anatomy of Deception: Measuring Technical and Human Factors of a Large-Scale Phishing Campaign\" by Anargyros Chrysanthou et al., \"Towards Modeling Uncertainties of Self-Explaining Neural Networks via Conformal Prediction\" by Wei Qian et al., and \"DIB-X: Formulating Explainability Principles for a Self-Explainable Model Through Information Theoretic Learning\" by Changkyu Choi et al. In the related work section of the appendices or the main paper, you could also include additional studies based on information theory that are not necessarily related to phishing attacks.\n   \nB) Experimental Section Comments\n    \n   B1) In Table 1 (line 424), you present the results for each model. Since you used multiple datasets, it would be helpful to show the results for each dataset separately.\n    \n   B2) In Table 2 (line 443), it would be nice to include the second and third sentence top sentences of the model highlighting them with different colors and briefly discussing them.\n    \n   B3) In the human evaluation section (line 493), please include any available statistics on the participants, such as their expertise, gender, education level, etc.\n\n   B4) In Section 6.7 of the appendices (lines 899–960), Table 3 presents results that, in my opinion, are quite significant and provide further support for the strength of your model. It would be better to incorporate the results from Table 3 into Table 1 and remove the \"average\" section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2iIN9YjC0A", "reviewer": "Reviewer_8txw", "summary": "This paper builds a system that identifies both, whether an email text is a phishing attack and which top-1 sentence in the email has the highest contribution to the classification label. The method is based on information theory, which is used by the model to distribute importance weights to features. The paper claims that this is one of the first works in phishing localization and that XAI techniques have not been applied to phishing attacks in the literature. By comparing against 7 open source datasets and 5 popular baseline methods, the method shows an improvement of 1.5-3.5% over baselines.", "questions": "Please see below some questions and comments to improve the manuscript:\n\n- Overall, the terminology used in this paper, e.g., phishing attack localization and phishing vulnerability are atypical for the cybersecurity community. Page 1, para 2 states that AI has been used for malware vulnerability detection. Malware detection and vulnerable code detection are two entirely different sub-domains. Moreover, page 3 states that post-hoc explanations do not offer a comprehensive understanding of the model's internal architecture or workings. Overexaggerated claim. Model-based XAI techniques like integrated gradients do exactly that! Deep models are also called \"self-explanatory\" methods in the manuscript. Again, popular literature dictates that deep learning is inherently a black box and thus cannot be self-explanatory/interpretable. The authors are advised to revise the manuscript and avoid redefining terms that already exist in the domain.\n\n- This work is not the first or the only work that labels an object as phishing and identifies which features led to the classification decisions. Could the authors present a comparative analysis against existing methods, e.g., [1-2], and justify why they were not mentioned in the manuscript? \n\n- Please add references for the datasets mentioned on page 7.\n\n- Please include the definition of the evaluation metrics (especially cognitive true positive) in the main body text (Section 4.2). Without the definition, it is impossible to understand the results. \n\n- The significance of the results in table 1 are hard to interpret because the authors do not provide any information regarding the dataset, e.g., number of phishing emails, sentences per email etc. Moreover, the improvement in the results is marginal (1-3%). Does the proposed approach provide benefits beyond the results in Table 1?\n\n- Please also report false positives and false negatives for each method in table 1. FPs are especially a big problem in cybersecurity tasks.\n\n- Please provide more details regarding the human study. 25 participants don't seem statistically significant for 10 emails, each with 5 options, as estimated by Cochran's formula. Moreover, it is unclear what questions are asked or how they are phrased exactly. For instance, if the participants are always shown the top-1 sentence and not given an option of top-3 sentences, this can very likely be interpreted as a rhetorical question, which leads people to respond in the affirmative most of the time. The authors are advised to increase the sample size to a statistically significant level, provide the exact phrasing of questions asked, and include control questions or alternative options (like top-3 sentences) to reduce bias.", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 1, "contribution": 1, "strengths": "It is good to focus on explainable approaches so we can understand what ML models do. The method uses information theory approaches, which is indeed an innovative angle.", "weaknesses": "Firstly, the claim that this is one of the only works for interpretable phishing localization might be inflated. There is plenty of work in the domain of phishing attack detection that builds ML models and applies XAI techniques to understand why something was labelled as a phishing attempt, see e.g., [1-2] as just two random examples. These techniques even go beyond text and also tag why images or URLs were considered phishing. Thus, the novelty of this approach is severely lacking. Please provide a more detailed comparison of the proposed approach to existing XAI techniques in phishing detection, highlighting specific differences in methodology or capabilities.\n\nSecond, one of the most popular explanation techniques for text, especially for deep nets is the attention mechanism. The proposed approach seems to somewhat achieve a similar goal by learning one model that both classifies text as phishing and also discovers features (sentences) that led to the classification decision. Yet, the paper makes no mention of this popular technique, nor do they compare with it in terms of fidelity, speed, correctness, etc. Thus, there is insufficient comparison with existing methods. The authors are advised to include a comparison with attention-based methods, evaluating aspects like fidelity, speed, and correctness. \n\nThird, the writing can substantially be improved. There are several typos that hinder comprehension. A non-exhaustive list: page 2, second last para -> which information causes. page 4, first sentence -> given an email. page 5, line 255 -> we encourage. \n\n\n[1] Chai, Yidong, et al. \"An explainable multi-modal hierarchical attention model for developing phishing threat intelligence.\" IEEE Transactions on Dependable and Secure Computing 19.2 (2021): 790-803.\n[2] Lin, Yun, et al. \"Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages.\" 30th USENIX Security Symposium (USENIX Security 21). 2021.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YoZFnvtK5y", "reviewer": "Reviewer_YZX3", "summary": "This paper presents a novel approach to phishing attack localization using deep learning and information theory principles. The method aims to classify emails as phishing or benign and explain these classifications by identifying the most relevant information within the emails. In short, phishing attack localization aims to customize phishing attacks to align with a target region or group's specific cultural, linguistic, and contextual characteristics. The paper examines how localized phishing tactics, such as using native language, regional events, or imitating local institutions, enhance the effectiveness of phishing campaigns by increasing their credibility. The study compares localized versus generic phishing attacks and highlights key factors that improve success rates. It also discusses the growing role of AI in automating localization efforts, presenting a challenge for organizations to develop stronger, region-specific defense mechanisms to counter these advanced attacks. The authors have conducted extensive experiments on multiple datasets to demonstrate the efficacy of their approach. Overall, it’s an interesting paper with a sound contribution.", "questions": "- The paper compares the proposed method with state-of-the-art AI-based approaches. Did you consider including a more elaborate discussion of how traditional (non-AI) phishing detection methods, such as URL filtering and white and blacklisting IPs, sandboxing, etc.,  can be complemented by or replace improvements offered by AI2TALE?\n- Can you elaborate on what defense mechanisms organizations should prioritize to counter the increasingly sophisticated, region-specific threats posed by localizaion?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Strengths:\n- Original Contribution: The proposed method (enhances explainability) is a significant improvement in phishing defense and a good use of AI.\n- The use of information theory and the mutual information training principle to select relevant features is well-founded. The introduction of a selection network that utilizes latent variables to identify important sentences is also good.\n- The authors provide thorough evaluations across seven diverse datasets. The comparative performance metrics (Label-Accuracy and Cognitive-True-Positive) are appropriate and lend credibility to their claims of improved performance over baseline models.\n- The paper is well-organized, with clear sectioning and logical flow. The introduction succinctly frames the problem and the proposed solution, making it accessible even to readers less familiar with the technical intricacies.\n- The use of human evaluations to assess the interpretability of the selected sentences enhances the practical relevance of the findings.", "weaknesses": "Weaknesses:\n- It could be good to add a more elaborate discussion of the ethical implications of deploying this AI-based system in real-world applications, particularly concerning privacy concerns and the risk of misclassification.\n- The authors acknowledge potential limitations regarding selecting non-relevant sentences. A more thorough discussion of these limitations and how they might affect real-world applications would be good. For example, the risk of misclassification and potential consequences of user confusion arising from irrelevant explanations.\n- The paper mentions the introduction of hyperparameters in the mutual information maximization and data-distribution mechanisms. It would be good to elaborate on the model’s sensitivity to these hyperparameters and their impact on the performance. It would also be beneficial for the authors to discuss how the introduced hyperparameters are likely to generalize to different contexts and model types. Understanding whether these hyperparameters remain effective across various datasets or when applied to different phishing detection frameworks.\n- The results section could benefit from more visualizations (figures or tables) to make the results more digestible and better illustrate the performance improvements.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)