Build a phishing detector

Course · Part 2 · Part 2 exercises · Practice notebook

Predict the score of a suspicious payroll message, train the weights, then find a mistake the model cannot explain with its two features.

Core route. Set threshold 0.50 and evaluation Six validation messages, Reset model, then Train 500 updates once. Reset model retains your threshold/probe, so check these settings explicitly. Inspect V5. Switch evaluation to Four new-campaign messages and inspect S1/S3 without training again. Save one mistake you can explain. The S1 mismatch edit is further practice; the later lecture transfer uses the separate image learner. Weights and threshold experiments are optional.

Teaching steps: predict, do, observe, explain

1. Use Model view, threshold 0.50 and Six validation messages. Reset model. Predict why every initial score is 0.50.

2. Press Train 500 updates once. Watch weights and loss change. Inspect V5: which recorded label makes this a false alarm?

3. Choose Four new-campaign messages, then S1 and S3. Do not train again. Explain one miss and one false alarm.

4. On S1, keep threshold 0.50 and raise only mismatch to 0.90. Predict first; restore S1 by selecting S3, then S1.

5. Choose Images. Compare the identical login crops, then reveal addresses. What evidence did the cropped picture leave out?

The in-demo step controls move between instructions. They never perform the next experiment for you. Record one observation before moving on.

Try it with a partner

1. Reset the model. Every score starts at 0.50. Predict which weight should increase.
2. Click Train 500 updates once. Compare loss, weights, false alarms and missed phishing.
3. Inspect V5, then switch evaluation to the new campaign and inspect S1 and S3. Keep weights and threshold fixed for the core run. For optional further practice, change only S1 mismatch to 0.90 and explain the effect. Manual weights and threshold edits are optional.

Explain what you observed

Write: “I changed ___. I predicted ___. I observed ___. The missing evidence is ___.” Swap operator and observer for a second attempt.

The model receives two supplied feature values. It does not parse the email text. All messages and labels are supplied. Evaluation sets are development examples, not an untouched final test.

If the experiment is unavailable

On paper, calculate z = 2 × 0.8 + 2 × 0.7 − 2 = 1.0. Its sigmoid score is about 0.73. Compare thresholds 0.50 and 0.80.

Explain it to your partner

Question: A legitimate portal move is escalated. Which two numbers did the model actually see?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: The model received supplied mismatch and pressure values. It did not read the message or an approval record.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.