A second look.
Before you click.
A clearer signal in a crowded inbox. Machine learning that reads the message, weighs the risk, and puts the verdict where you need it.
Your weekly team update
Hi team, here’s the summary from our weekly check-in. Thanks for another great week.
98.4% model confidence
A model signal to support your judgment.
A signal.
Not a guess.
The detector is a model bench and production path in one repo: DistilBERT and RoBERTa fine-tunes, OpenAI and Claude adapters, an Ollama route, W&B-backed evaluation, and a Flask API that preloads every model before serving requests.
The companion Chrome extension watches for the currently opened Gmail message, extracts the email body, sends it to the deployed detector, and renders the answer beside the message toolbar.
5
01Inference Backends
local · roberta · openai · claude · ollama
2
02Fine-Tuned HF Models
DistilBERT and RoBERTa checkpoints
3.75M
03Processed CSV Rows
train and test splits across four datasets
MV3
04Chrome Extension Surface
the verdict badge lands beside the open Gmail message
Read between the lines.
Every path starts by simplifying the raw message: URLs and punctuation are stripped, casing is normalized, and the result is fed into a sequence classifier or model adapter with a strict phishing/safe output contract.
no-reply@robinhood.com
Important information about your application
Hi Tawfiq, thank you for taking the time to apply. We wanted to let you know that we are no longer accepting applications for the New Grad, Toronto position.
Preprocessed
hi tawfiq thank you for taking the time to apply we wanted to let you know that we are no longer accepting applications for the new grad toronto positionVerdict
Safe
98.4% confidence
From message
to meaning.
The architecture is intentionally direct: browser content script, text cleaning, model selection, preloaded Flask backend, JSON result, and a badge inserted back into Gmail.
Gmail DOM
Open message surface
Content script
Reads .a3s and selectedModel
HTTPS request
email_text + model_option
Flask API
Preloaded inference workers
Preprocess
URL strip + lowercase normalize
Model router
local · roberta · openai · claude · ollama
HF models
DistilBERT / RoBERTa logits
LLM adapters
OpenAI model, Claude, Ollama
Inbox badge
Safe or Caution JSON verdict
Different models. One clear verdict.
Local DistilBERT
Default on-device-style classifier, loaded from the fine-tuned model folder.
RoBERTa
A second transformer path for sequence classification and comparison.
OpenAI model
Fine-tuned OpenAI adapter with the same phishing/safe response contract.
Claude
Prompted classifier path for Anthropic evaluation and fallback testing.
Ollama
Local LLM route that can run llama3 or another installed model from the CLI.
Built to leave the notebook.
The final system ran as a containerized service on a Hetzner VPS, behind Nginx and SSL so the Chrome extension could call it from a normal browser session.
Flask API
Models are preloaded at startup, then served through GET /detect_phishing.
Nginx + SSL
g30.xyz sat in front of the detector with a Let's Encrypt certificate.
Chrome extension
The browser surface reads the open email, calls the API, and injects the result.