Modelpublic

Davv4/phishing-qwen3.5-2b-gguf

sourceHugging Faceapache-2.0updated 4mo agoView on Hugging Face

0likes98downloads

Model Card

Phishing Email Detector — Qwen3.5-2B GGUF

GGUF version of Davv4/phishing-qwen3.5-2b, a fine-tuned Qwen/Qwen3.5-2B model for email phishing detection. This version is optimized for use with Ollama — no Python ML dependencies required.

Input Format

The model expects a plain text email in the following format:

Sender: <sender email address>
Receiver: <receiver email address>
Date: <email date>
Subject: <email subject>
Body: <email body text>

Example input:

Sender: security@netf1ix-account-alert.com
Receiver: kevin.walsh@hotmail.com
Date: Sun, 01 Jun 2025 22:10:05 +0000
Subject: Netflix: Payment declined - Update your billing information
Body: Dear Kevin, We were unable to process your most recent payment and
your Netflix membership is at risk of cancellation. Update billing:
http://netf1ix-account-alert.com/billing-update. Act within 48 hours.

Output Format

The model responds with a structured JSON object:

json

{
  "is_phishing": true,
  "confidence_score": 0.98,
  "threat_type": "Credential Harvesting / Financial Fraud",
  "risk_level": "CRITICAL",
  "reasoning": "The sender domain 'netf1ix-account-alert.com' replaces the letter 'l' with '1' to impersonate Netflix..."
}

Field	Type	Description
`is_phishing`	`boolean`	`true` if phishing, `false` if legitimate
`confidence_score`	`float` (0.0–1.0)	Model's confidence in its verdict
`threat_type`	`string` or `null`	Category of threat, or `null` if legitimate
`risk_level`	`string`	One of `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`
`reasoning`	`string`	Human-readable explanation of the verdict

Quick Start with Ollama

Step 1 — Install Ollama

Download and install Ollama from https://ollama.com.

Step 2 — Download the GGUF file

bash

hf download Davv4/phishing-qwen3.5-2b-gguf phishing-qwen3.5-2b.gguf

Step 3 — Create a Modelfile

Create a file named Modelfile with the following content:

FROM /path/to/phishing-qwen3.5-2b.gguf

SYSTEM """You are an email security analyst. Analyze the provided email and determine if it is a phishing attempt. Respond ONLY with a valid JSON object using this exact schema: {"is_phishing": boolean, "confidence_score": number (0.0-1.0), "threat_type": "string or null", "risk_level": "LOW|MEDIUM|HIGH|CRITICAL", "reasoning": "string"}"""

PARAMETER temperature 0.1
PARAMETER num_predict 512

Replace /path/to/phishing-qwen3.5-2b.gguf with the actual path where you saved the file.

Step 4 — Load into Ollama

bash

ollama create phishing-detector -f Modelfile

Step 5 — Run it

bash

ollama run phishing-detector

Once loaded, you can call it from any directory — no need to stay in the Modelfile folder.

Use in Python

python

import json
import requests

def analyze_email(email_text: str) -> dict:
    response = requests.post(
        "http://localhost:11434/api/generate",
        json={
            "model": "phishing-detector",
            "prompt": email_text,
            "stream": False
        }
    )

    raw = response.json()["response"]

    try:
        result = json.loads(raw.strip())
    except json.JSONDecodeError:
        result = {"error": "Failed to parse model output", "raw": raw}

    return result


# Example usage
email = """Sender: security@netf1ix-account-alert.com
Receiver: kevin.walsh@hotmail.com
Date: Sun, 01 Jun 2025 22:10:05 +0000
Subject: Netflix: Payment declined - Update your billing information
Body: Dear Kevin, We were unable to process your payment.
Update billing: http://netf1ix-account-alert.com/billing-update. Act within 48 hours."""

result = analyze_email(email)
print(json.dumps(result, indent=2))

Expected output:

json

{
  "is_phishing": true,
  "confidence_score": 0.98,
  "threat_type": "Credential Harvesting / Financial Fraud",
  "risk_level": "CRITICAL",
  "reasoning": "The sender domain 'netf1ix-account-alert.com' replaces the letter 'l' with '1' to impersonate Netflix. The link routes to a fraudulent domain rather than netflix.com. Loss aversion and urgency tactics are used to pressure the victim."
}

Related Model

Looking for the HuggingFace Transformers version? See Davv4/phishing-qwen3.5-2b.

Training Details

Property	Value
Base model	Qwen/Qwen3.5-2B
Fine-tuning method	LoRA (rank 8, alpha 16)
Training framework	LLaMA Factory
Training epochs	10
Learning rate	3e-4
Task	Supervised Fine-Tuning (SFT)

Limitations

—Trained on a relatively small dataset — best used as a supplementary tool, not a sole decision-maker.
—May not generalize well to highly novel phishing techniques not represented in training data.
—Output is always in English regardless of the input email language.
—Always validate the JSON output programmatically as the model may occasionally produce malformed responses.

License

This model inherits the Apache 2.0 license from the base Qwen3.5-2B model.