Brand protection capstone
NLP Phishing Detection
Safe or Caution, right in the inbox.
A capstone system that turns an open email into a security signal: clean the text, route it through fine-tuned classifiers or LLM adapters, and badge the verdict directly in Gmail.
Live verdict
Safe
Model option
local · distilbert-base-uncased_fine_tuned · badge injected by the Chrome content script
The detector is a model bench and production path in one repo: DistilBERT and RoBERTa fine-tunes, OpenAI and Claude adapters, an Ollama route, W&B-backed evaluation, and a Flask API that preloads every model before serving requests.
The companion Chrome extension watches for the currently opened Gmail message, extracts the email body, sends it to the deployed detector, and renders the answer beside the message toolbar.
5
01Inference Backends
local · roberta · openai · claude · ollama
2
02Fine-Tuned HF Models
DistilBERT and RoBERTa checkpoints
3.75M
03Processed CSV Rows
train and test splits across four datasets
MV3
04Chrome Extension Surface
the verdict badge lands beside the open Gmail message
Text preprocessing and classification.
Every path starts by simplifying the raw message: URLs and punctuation are stripped, casing is normalized, and the result is fed into a sequence classifier or model adapter with a strict phishing/safe output contract.
no-reply@robinhood.com
Important information about your application
Hi Tawfiq, thank you for taking the time to apply. We wanted to let you know that we are no longer accepting applications for the New Grad, Toronto position.
Preprocessed
hi tawfiq thank you for taking the time to apply we wanted to let you know that we are no longer accepting applications for the new grad toronto positionVerdict
Safe
98.4% confidence
The architecture is intentionally direct: browser content script, text cleaning, model selection, preloaded Flask backend, JSON result, and a badge inserted back into Gmail.
Gmail DOM
Open message surface
Content script
Reads .a3s and selectedModel
HTTPS request
email_text + model_option
Flask API
Preloaded inference workers
Preprocess
URL strip + lowercase normalize
Model router
local · roberta · openai · claude · ollama
HF models
DistilBERT / RoBERTa logits
LLM adapters
OpenAI model, Claude, Ollama
Inbox badge
Safe or Caution JSON verdict
Inference options implemented in the detector.
Local DistilBERT
Default on-device-style classifier, loaded from the fine-tuned model folder.
RoBERTa
A second transformer path for sequence classification and comparison.
OpenAI model
Fine-tuned OpenAI adapter with the same phishing/safe response contract.
Claude
Prompted classifier path for Anthropic evaluation and fallback testing.
Ollama
Local LLM route that can run llama3 or another installed model from the CLI.
Containerized service and browser integration.
The final system ran as a containerized service on a Hetzner VPS, behind Nginx and SSL so the Chrome extension could call it from a normal browser session.
Flask API
Models are preloaded at startup, then served through GET /detect_phishing.
Nginx + SSL
g30.xyz sat in front of the detector with a Let's Encrypt certificate.
Chrome extension
The browser surface reads the open email, calls the API, and injects the result.