eugenioderodev/fishstop-bert

FishSTOP DistilBERT

Binary content classifier for legitimate vs malicious (phishing or spam) email, used as one signal in FishSTOP. It does not inspect SPF, DKIM, DMARC, sender reputation, links or attachments and must not be used as a standalone verdict.

• Base model: distilbert/distilbert-base-multilingual-cased
• Labels: 0=LEGITIMATE, 1=MALICIOUS (phishing, scam or spam)
• Input: normalized email subject plus body
• Long emails: up to 8 evenly spaced overlapping 512-token windows, stride 128, maximum malicious-margin aggregation
• Calibration: temperature scaling on the validation split
• Test F1: 0.9811
• Test precision: 0.9852
• Test recall: 0.9770
• Test selective coverage: 1.0000

The reported probability is meaningful only for data sufficiently similar to the validation distribution. Performance must be rechecked on recent, external and multilingual email sets.