Evade a frozen phishing detector

Course · Part 4 · Part 4 exercises · Notebook · Example bank

Self-study after Part 4 · slides 10–12 (notebook lesson 4). Core comparison: steps 1–2; the additional cases and threshold changes in steps 3–4 are further practice. An attacker may change what a deployed detector sees without altering its weights. We explore the feature-space mechanism before making claims about actual email manipulation.

Teaching steps: predict, do, observe, explain

1. Select Storage full, threshold 0.50. Record original score and weights. Predict what lowering credential pressure will do.

2. Lower only that clue; follow the moving probe. Weights stay frozen. Restore supplied clues before trying another case.

3. Compare Trusted site, compromised page with Approved portal move. Explain why similar clues can mislead in opposite directions.

4. Move the threshold: routing regions change, scores do not. A feature edit is not proof of a real email transformation.

The in-demo step controls move between instructions. They never perform the next experiment for you. Record one observation before moving on.

Predict, try, explain

1. Choose Storage full. Keep threshold 0.50. Record original score and the two trained weights. Lower only credential pressure, predict the score, then compare.

2. Choose Trusted site, compromised page. The authored message is malicious although its clues look ordinary. Compare with Approved portal move, which is legitimate although its clues look suspicious.

3. Restore supplied clues. Move the threshold while keeping features and weights fixed. Explain what an evasion experiment establishes and what a real attacker would still need to achieve.

Record: I changed ___. I predicted ___. I observed ___. This does not establish ___.

More experiments

Find a feature vector below threshold; minimise the edit you make; investigate a false alarm; compare the same vector at two thresholds. Do not call a slider edit a demonstrated attack against a real extractor.

What this example establishes

Inference evaluates a different input with the same learned function. Threshold tuning changes routing. Neither fixes missing compromise or authorisation evidence.

Explain it to your partner

Question: A score falls after changing a feature. What is still missing before claiming a real phishing attack?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: A practical evasion claim needs a feasible message edit that produces those features and preserves the malicious purpose.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.