PaperlayerView exact revision on arXiv

Source-linked AI summary

Assessing AI-Generated vs. Human-Authored Spear Phishing SMS Attacks: An Empirical Study

Jerson Francia, Derek Hansen, Benjamin Schooley, Matthew Taylor, Shydra Valynn Murray, Rebekah Cornelius, Greg Snow

arXiv:2406.13049v3cs.CYcs.AI

TL;DR

Evidence remains limited on whether simple-prompt AI messages are as convincing as human-authored spear-phishing SMS messages tailored to the same targets. This 25-target pilot used TRAPD to compare GPT-4 and novice student messages; the intended-click difference was uncertain, while job-related messages elicited higher intended-click odds than hobby- or social-media-related messages.

  • Problem

    Evidence is limited on comparing GPT-4-generated and human-authored spear-phishing messages tailored to the same targets, particularly in SMS, and on source judgments and textual signals.

    Source: §1 · p. 2, §2.2 · p. 5

  • Method

    A 25-target pilot used TRAPD to compare GPT-4 messages with time-constrained novice student messages tailored to the same targets.

    Source: §1 · p. 2, §4 · p. 5

  • Results

    Job-related messages were placed above intended-click thresholds 38% of the time, versus 19% for hobby and 17% for social-media messages, with significantly higher adjusted intended-click odds for job messages.

    Source: §9 · p. 29

  • Takeaways & Limitations

    TRAPD supports controlled comparisons and participant-reasoning analysis, but does not estimate real-world click-through rates.

    Source: §4 · p. 5

    TRAPD is proposed rather than validated; reliability, evaluator agreement, order effects, and validity against live behavior remain untested.

    Source: §7.3 · p. 26

Abstract

from arXiv · show

Personalized phishing is difficult to defend against because messages can be tailored to a target's work, interests, and social context. Large language models may make such tailoring faster and easier, but it remains unclear whether messages produced from simple prompts are more convincing than those written by people. This 25-target pilot study compared personalized smishing messages generated by GPT-4 with messages written by novice student authors working under time constraints. Using the proposed Threshold Ranking Approach for Personalized Deception (TRAPD), participants ranked 12 messages written for them, indicated the point at which they would intend to click, explained their reasoning, and judged whether each message was authored by GPT-4 or a human. GPT-4-generated messages elicited an intention to click more often than student-authored messages (28% versus 21%), although the difference was uncertain. More broadly, our findings suggest that a simple prompt can produce personalized messages that participants found comparably convincing within the uncertainty of this pilot study. Job-related messages were significantly more likely to elicit an intention to click than hobby- or social-media-related messages. When asked whether a message was written by a human or generated by AI, participants identified the source no more accurately than chance, although the two study-specific message sets remained computationally distinguishable based on their text. Together, these findings suggest that accessible AI-assisted personalization may increase the practical scale of social-engineering threats, while also demonstrating both the value and current limitations of TRAPD for controlled and ethical comparison.

1. Introduction

Personalized spear phishing can make deceptive messages more credible, while AI may reduce the effort needed to create targeted content. This pilot compares GPT-4 and novice student-authored smishing messages for the same targets and examines convincingness, source judgments, and textual signals.

1. Introduction

  • Spear phishing uses victim or organizational context to make deceptive messages more credible, and matching a victim’s expectations can make an attack more likely to succeed.AI models may automate parts of targeted-content creation at lower marginal cost.Source: §1 · p. 2
  • AI-generated phishing can combine personalization with speed and scale, whereas crafting targeted messages traditionally required substantial research and effort.The paper also notes that commercial LLMs can generate convincing phishing content without jailbreaking.Source: §1 · p. 2
  • The study addresses limited evidence comparing GPT-4-generated and human-authored spear phishing tailored to the same individuals, especially in SMS, and whether targets can identify the source or text-based signals.It also examines the cues targets use when judging authorship.Source: §1 · p. 2
  • The 25-target pilot compares GPT-4 messages from a simple shared prompt with time-constrained novice student messages, using TRAPD to assess responses and source attribution.“Human-authored” refers specifically to the screened novice-student condition, not professional social engineers or human authors generally.Source: §1 · p. 2
  • The paper’s contributions include identifying convincingness and suspicion cues, testing computational distinguishability on unseen targets, and documenting TRAPD’s feasibility and limitations.The comparison is framed as relevant to assumptions about stylistic differences between human- and AI-authored malicious messages.Source: §1 · pp. 2–3

2. Review of the Related Literature

The literature describes phishing’s spread across channels and the growing capability of AI to generate targeted content, but direct evidence comparing AI- and human-authored personalized SMS messages remains limited. Prior studies and detector findings motivate this comparison while also bounding what computational attribution can establish.

2.1. Evolution of Phishing Techniques

  • Phishing expanded from email into targeted, multi-channel attacks, while social media can supply information for more personalized scams.SMS exploits mobile messaging’s ubiquity and immediacy; attackers may use urgency, fear, or impersonation.Source: §2.1 · p. 3

2.2. AI-Enabled Phishing

  • Prior AI-phishing studies demonstrated automated targeted content and decision-making, but did not directly compare current AI and human messages aimed at the same individuals.Earlier work reported a 30-66% success rate in its own experimental context [15].Source: §2.2 · p. 4
  • Research on email finds that LLM-generated messages can match human-authored phishing in some settings, leaving open whether that pattern holds for personalized SMS to the same targets.Bethany et al. found LLM-generated lateral phishing emails as effective as communications-professional emails [20].Source: §2.2 · pp. 4–5
  • Computational source-attribution results describe tested messages and conditions, since detector-guided paraphrasing can reduce AI-text detector effectiveness [28].The broader gap includes whether targets distinguish sources, which cues they use, and whether message text carries source signals.Source: §2.2 · pp. 4–5

3. Research Questions

The paper asks how participants respond to personalized spear-phishing SMS messages and whether they can identify their source. It also examines message features, judgment criteria, and computational distinguishability.

3. Research Questions

  • The five questions address comparative convincingness, convincing message characteristics, participant source-identification accuracy and criteria, and computational distinguishability of the study messages.The comparison concerns GPT-4-generated and human-authored personalized smishing messages in this pilot.Source: §3 · p. 5

4. Methodology

The study uses a proposed framework to compare personalized deceptive messages under controlled, consent-based conditions rather than deploying live phishing. TRAPD combines within-target rankings and intended-click thresholds with participant explanations and optional source judgments.

4. Methodology

  • TRAPD compares personalized deceptive messages while preserving informed consent and avoiding live deceptive deployment, but it does not measure real-world click behavior.The pilot compares GPT-4-generated and human-authored spear-phishing SMS messages tailored to the same targets and collects qualitative feedback.Source: §4 · p. 5
  • The study analyzes convincingness and source attribution, including whether participants and computational analysis distinguish GPT-4-generated from human-authored messages.Twenty-five targets evaluated the messages after informed consent and institutional review approval.Source: §4 · p. 5

4.1. TRAPD Framework and Study Procedure

  • TRAPD is proposed for ethical comparison of personalized deceptive content and combines quantitative and qualitative evidence about message rankings and participants’ reasoning.The framework could be adapted to other personalized deceptive content, including disinformation or other phishing channels.Source: §4.1 · pp. 5–6
  • TRAPD adapts surveys, laboratory judgment tasks, and personalized phishing simulations for within-target comparisons, trading ecological realism for ethical control and richer explanations.The framework has not been formally evaluated for reliability, evaluator agreement, order effects, or validity against live behavior.Source: §4.1 · p. 6
  • TRAPD recruits targets, generates tailored messages, collects rankings and intended-click thresholds, and gathers explanations and optionally source labels.In this pilot, it linked rankings to participants’ stated click thresholds and captured explanations, but did not estimate real-world click-through rates.Source: §4.1 · p. 6, Figure 1 · p. 7

4.2. Recruiting Targets Who Shared Personal Information

The study recruited targets who shared personal information, then used that information in a shared prompt structure to generate personalized messages from GPT-4 and novice student authors. The resulting message sets were curated and matched across sources, though the original GPT-4 generation run cannot be exactly recreated.

4.2. Recruiting Targets Who Shared Personal Information

  • Of 41 survey completers, 25 returned for the later interview and formed the final target sample; 16 did not complete later activities, yielding a 61% interview completion rate (25/41).Recruitment was not intended to produce a sample representative of the broader population, and findings are limited to the 25 pilot participants.Source: §4.2 · p. 7

4.3. Generating Personalized Deceptive Messages

  • Each target’s messages drew on three common personalization topics—hobbies, workplace, and a recently posted-about possession—using the same prompt structure for both sources.The topics were intended to keep personalization consistent across GPT-4 and human-authored conditions.Source: §4.3 · pp. 7–8

4.3.1. Human Generation

  • Students with phishing-related instruction and practice wrote up to four messages in approximately 15 minutes, under time constraints.The authors were undergraduate cybersecurity or honors students, not professional social engineers.Source: §4.3.1 · p. 8
  • Reviewers retained 246 of 363 student submissions (67.8%) after excluding incomplete, non-click-request, or clearly unusable messages; the screened pool was not representative of expert or attacker writing.Two valid human messages per target/topic combination were randomly selected when enough were available.Source: §4.3.1 · p. 8

4.3.2. GPT-4 Generation

  • GPT-4 outputs were sampled at temperature 0.7 with a 256-token maximum, yielding six messages per target alongside six human messages.Two messages per source were selected for each of the three topics; the exact GPT-4 snapshot and other generation records were not retained, so the original run cannot be recreated exactly.Source: §4.3.2 · p. 8

4.4. Target Interview and Sorting Activity

Participants sorted 12 printed SMS messages by perceived likelihood of prompting a click, marked their intended-click threshold, and explained their judgments. Only afterward did they label messages as AI-generated, a sequence that may have influenced those later labels and explanations.

4.4.1. Threshold Rank Order

  • Participants arranged 12 messages from most to least likely to prompt a click and marked the point above which they would intend to click.The activity’s ordering and threshold marker are illustrated in Figure 3.Source: §4.4.1 · p. 9, Figure 3 · p. 9

4.4.2. Qualitative Assessment

  • Participants explained why messages seemed convincing or suspicious and why they placed particular messages near the top or bottom.They were encouraged to ground their explanations in individual messages before discussing broader criteria.Source: §4.4.2 · p. 9

4.4.3. Source Labeling

  • After the ranking and explanations, participants marked messages they believed were AI-generated and could request disclosure of the actual sources.The source-labeling phase is illustrated in Figure 4.Source: §4.4.3 · p. 9, Figure 4 · p. 10
  • Because participants completed the phases in a fixed order, learning about AI may have influenced later source labels and explanations, but not earlier rankings or intended-click thresholds.The in-person interview and participants’ awareness of being studied may also have encouraged answers they thought researchers expected.Source: §4.4.3 · p. 10

4.5. Convincingness Analytic Track

The analysis used participant- or target-aware comparisons to assess convincingness, topic effects, source judgments, and whether the study’s message sets could be distinguished computationally. Qualitative coding complemented these analyses, while the computational plan included sensitivity checks and exploratory text-pattern analysis.

4.5. Convincingness Analytic Track

  • Intended-click comparisons used a participant-repeated-measures GEE, while within-target rank differences were tested with a sign-flip test.Bootstrap intervals, paired t-tests, and Wilcoxon tests were additional checks; the reporting hierarchy was refined during revision and was not preregistered.Source: §4.5 · p. 10
  • Topic analyses compared intended clicking and within-target ranks across job, hobby, and social-media messages, with Holm adjustment for pairwise contrasts.Demographic and prior-experience analyses were exploratory because the 25-target sample was too small for stable subgroup conclusions; qualitative coding examined reasons for convincingness judgments.Source: §4.5 · p. 10

4.6. Source Attribution Analytic Track

  • Source-label accuracy was assessed across 300 participant judgments with a participant-clustered GEE and compared with the 50% chance expectation.Feature associations with correct judgments were exploratory and cannot establish that a feature caused a judgment; source-attribution themes were coded separately from convincingness themes.Source: §4.6 · p. 11

4.6.1. Computational Source-Attribution Analysis Plan

  • A logistic-regression classifier tested whether embeddings distinguished the 300 study-specific messages using target-grouped five-fold cross-validation.Sensitivity analyses standardized visible text features and, in the strictest condition, paired messages by target/topic and shortened them to equalize lengths; the test does not establish detectability of arbitrary AI text.Source: §4.6.1 · pp. 11–12

4.6.2. PCA and Exploratory Clustering

  • The exploratory text-pattern analysis projected no-link message embeddings onto two principal components and varied clustering settings in a supplementary KMeans analysis.The analysis explored whether messages formed groups with similar text patterns.Source: §4.6.2 · p. 12

4.7. Implementation and Reproducibility Details

The available participant-level data supported reproduction of reported analyses and sensitivity checks, but missing generation records prevent exact recreation of the original GPT-4 run. The planned repository excludes privacy-sensitive and dual-use materials.

4.7. Implementation and Reproducibility Details

  • Available participant-level data were sufficient to reproduce reported results and requested sensitivity analyses.The final statistical and computational analyses used Python 3.13.12 and specified package versions, with seed 42 for analyses involving randomness.Source: §4.7 · p. 12
  • The evaluated GPT-4 outputs are available, but the exact model snapshot, API logs, complete environment, and some generation settings were not recorded.Consequently, the original generation run cannot be recreated exactly.Source: §4.7 · p. 12
  • The planned repository will provide analysis code and placeholder-only prompt documentation, but not personalized messages, participant-level data, transcripts, recordings, or embeddings.Those materials are withheld because they contain privacy-sensitive information or could create dual-use risks.Source: §4.7 · p. 12

5. Convincingness Results

GPT-4-generated messages had numerically higher intended-click rates than human-authored messages, but the study did not establish a reliable source difference. Job-related messages elicited more intended clicks than hobby- or social-media-related messages, while participants described multiple cues behind their judgments.

5.1.1. GPT-4 vs. Human Ranking and Intended Click Probability

  • 28.0% of GPT-4-generated messages versus 21.3% of human-authored messages exceeded intended-click thresholds, but the source difference was not statistically reliable.The participant-clustered analysis reported OR = 1.43 (95% CI: 0.88–2.33; p = 0.147); rankings also did not differ reliably. Table 1 summarizes average rank and intended-click rate by topic and source.Source: §5.1.1 · p. 13, Table 1 · p. 13, Figure 5 · p. 13

5.1.2. Topic-Based Ranking and Intended Click Probability

  • 38% of job-related messages exceeded intended-click thresholds, compared with 19% of hobby messages and 17% of social-media-related messages; job-related messages had higher intended-click odds than either topic.The adjusted odds ratios were 2.61 versus hobby messages and 2.99 versus social-media-related messages; rank differences were only descriptive after adjustment.Source: §5.1.2 · pp. 14–15, Figure 7 · p. 15

5.1.3. Demographics and Phishing Experience

  • The 25-target sample was too small for stable demographic or prior-experience subgroup inference, so those exploratory comparisons do not establish that subgroup differences are absent.Source: §5.1.3 · p. 15

5.2.1. Personal Relevance

  • Participants associated accurate, specific personal relevance with credibility, while mismatched, inaccurate, or vague details raised suspicion.Because all messages were personalized, relevance was a prominent theme; 19 of 25 participants discussed it, and responses could describe features as convincing or suspicious.Source: §5.2 · p. 15, §5.2.1 · p. 16

5.2.2. Sender Identity

  • Seven participants described a familiar or plausible sender as convincing, whereas 17 viewed an unfamiliar or inconsistent claimed sender as suspicious.The study messages did not display source phone numbers, so these comments concerned the sender claimed in the message and participants’ expectations.Source: §5.2.2 · pp. 16–17

5.2.3. URLs and Perceived Convincingness

  • Participants treated URL characteristics as legitimacy cues, and SMS seemed appropriate or suspicious depending on whether the channel fit the claimed sender.They considered domains, spelling, protocol, and link shorteners; 10 participants discussed communication medium.Source: §5.2.3 · p. 17, §5.2.4 · pp. 17–18

5.2.5. Messaging Style

  • Message style could support or undermine credibility, while participants differed on whether urgent wording signaled a problem requiring action or pressure to avoid careful evaluation.Six participants said emojis reduced credibility, especially in messages claiming to represent professional organizations.Source: §5.2.5 · p. 18, §5.2.6 · p. 18

5.2.7. Context Inaccuracies

  • Participants treated inaccurate target-specific details as failed personalization and viewed realistic, context-appropriate rewards as more credible than implausibly generous ones.Seven participants discussed inaccuracies; seven described realistic rewards as increasing credibility, while six described rewards that seemed too good to be true as suspicious.Source: §5.2.7 · p. 19, §5.2.8 · p. 19

6. Source Attribution Results

Participants could not reliably identify whether messages were AI-generated or human-authored, while computational analysis distinguished these study-specific message sets even after strict text controls. Participants described multiple perceived authorship cues, but these were not validated indicators.

Identifying Message Origin

  • Participants correctly identified 156 of 300 message sources (52.0%), with accuracy not statistically distinguishable from the 50% chance level.The 95% confidence interval was 44.6%–59.3% (p = 0.597).Source: Identifying Message Origin · p. 19, Table 3 · p. 20

6.2. Human Criteria for Judging Message Source

  • Targets reported style (40%, 10/25), personalization (32%, 8/25), and word choice (24%, 6/25) as cues when judging messages as AI- or human-authored.AI-associated cues included formal or generic style, lack of personalization, and buzzwords or marketing-like wording; casual slang was associated with human authorship.Source: §6.2.1 · p. 21, §6.2.2 · p. 21, §6.2.3 · pp. 21–22
  • Grammar and spelling cues cut both ways: participants associated near-perfect language with AI and errors or texting language with human authorship.Six participants mentioned grammar or spelling; several also viewed emoji use as an AI cue, while others treated emojis as human-like because they were unsure AI could use them.Source: §6.2.5 · p. 22, §6.2.6 · p. 22
  • Four participants used message length as a source cue, and AI messages averaged 337.8 characters versus 237.9 for human-authored messages.Only two participants mentioned URLs; most human authors used placeholders that were replaced with shortened links, while only one AI message had a placeholder.Source: §6.2.7 · pp. 22–23, §6.2.8 · p. 23

6.3. Computational Source Attribution

  • After surface features and message length were jointly standardized, the classifier achieved 88.7% balanced accuracy and 0.954 ROC AUC on messages from unseen targets.ROC AUC ranged from 0.929 to 0.970 across the five unseen-target groups; this does not establish that the differences are inherent to AI writing or generalize beyond these message sets.Source: §6.3 · p. 23, Table 5 · p. 23

Descriptive PCA and Exploratory Clustering

  • The exploratory PCA showed only a limited two-dimensional view, and the selected 13-cluster solution was not used to support conclusions about message source.The first two components explained 11.95% of embedding variation; the cluster solution was not uniquely supported and its selection considered source separation.Source: Descriptive PCA and Exploratory… · pp. 23–24, Figure 8 · p. 24

7. Discussion

This discussion interprets a 25-target pilot comparing personalized GPT-4 and novice-human smishing messages, participant source judgments, and computational attribution. It emphasizes uncertain message-level comparisons, scope limits, TRAPD’s controlled but unvalidated role, and defensive and ethical implications.

7.1. Convincingness of GPT-4- and Human-Authored Messages

  • GPT-4 messages crossed participants’ intended-click thresholds 28.0% of the time versus 21.3% for human-authored messages, but the uncertain difference establishes neither superiority nor equivalence.The estimated difference was 6.7 percentage points, with a confidence interval spanning 2.9 points favoring human messages to 16.3 points favoring GPT-4 messages.Source: §7.1 · pp. 24–25
  • Job-related messages crossed intended-click thresholds more often than hobby or social-media messages, and their intended-click odds were reliably higher than both topics.The respective threshold rates were 38%, 19%, and 17%; the study measured intended rather than observed clicking, so the difference should not be generalized directly to real-world behavior.Source: §7.1 · p. 25

7.2. Source Attribution by Participants and Models

  • Participants identified source at chance-level accuracy despite describing cues, while computational analysis distinguished the study’s message sets after surface features and length were standardized.Personal relevance could increase credibility or suspicion depending on whether details fit targets’ actual relationships, responsibilities, and expectations.Source: §7.2 · p. 25, §7.1 · p. 25

7.3. The Proposed TRAPD Evaluation Framework

  • TRAPD enables controlled within-target comparison, ranking, intended-click thresholds, and explanations while preserving informed consent, but sacrifices field realism and remains unvalidated.The study did not test repeatability, evaluator agreement, order effects, or whether intended-click thresholds correspond to live clicks.Source: §7.3 · p. 26

7.4. Implications of AI-Enabled Spear Phishing

  • The study’s combination of comparable perceived message quality, low-cost prompting, and chance-level human source identification raises concern about the practical scale of personalized phishing.The computational distinction applies to this study’s texts, not a general detector; the authors note it may not extend to other models, prompts, authors, workflows, or revised text.Source: §7.2 · p. 25, §7.4 · pp. 26–27

7.5. Dual-Use Considerations

  • Personalized-deception procedures could be misused to improve deceptive messages or automate targeting, so automated studies require authorization, consent, data minimization, access controls, and content review.The paper restricts sharing of personalized data, embeddings, and operational generation materials.Source: §7.5 · p. 27

7.6. Mitigation and Countermeasure Implications

  • Defensive training should emphasize verifying sender, channel, request, and URL rather than guessing authorship, and use realistic workplace scenarios without treating personalization as proof of legitimacy.The reported awareness effect was an unsolicited qualitative observation, not a measured training outcome; verification-focused training remains a question for future research.Source: §7.6 · p. 27

8. Limitations

The study’s controlled design constrains what its findings establish: measures were hypothetical, the sample and human comparison were narrow, and several analyses and generation procedures have unresolved validation or reproducibility limits.

8.1. Measurement and TRAPD Validity

  • TRAPD measured intended clicks on printed messages, not live SMS behavior, and its reliability and prediction of real-world clicking remain untested.Participants saw no sender number, delivery timing, device context, distractions, or functional links.Source: §8.1 · pp. 27–28

8.2. Sample and Statistical Precision

  • The 25-target sample was not representative, and its wide source-difference interval establishes neither superiority nor equivalence between conditions.The study was also too small to rule out demographic or prior-experience differences.Source: §8.2 · p. 28

8.3. Human Comparison Condition

  • The human comparison comprised screened messages from time-constrained novice students, so the findings do not generalize to AI versus humans overall.Using the same prompt improved consistency but did not make the human and GPT-4 generation processes equivalent.Source: §8.3 · p. 28

8.4. GPT-4 Generation Reproducibility

  • The original GPT-4 generation run cannot be recreated exactly because the model snapshot, API logs, complete software environment, and some settings were not recorded.The available outputs cover all 150 evaluated messages, but do not resolve those missing records.Source: §8.4 · p. 28

8.5. Qualitative Coding

  • Qualitative themes reflect consensus review after one primary coder per transcript, without full independent double-coding or a formal agreement statistic.The explanations therefore support descriptive interpretation, not a quantified estimate of coding consistency.Source: §8.5 · p. 28

8.6. Interview Sequence and Response Effects

  • Disclosure of AI’s inclusion came after ranking and click-threshold judgments, but may have shaped later source labels and explanations.Equal numbers of messages from each source and interview awareness may also have affected responses.Source: §8.6 · p. 29

8.7. Computational Scope and Data Availability

  • Computational attribution was tested on one balanced message set and does not establish performance across other models, prompts, authors, domains, or revised texts.The PCA figure preserves 11.95% of embedding variation; exploratory clustering does not independently validate attribution, and privacy limits reproduction from raw inputs.Source: §8.7 · p. 29

9. Conclusions

In this 25-target pilot, a simple prompt produced GPT-4 messages participants found comparable in convincingness to screened novice-student messages, within the study’s uncertainty. Job-related messages more often crossed intended-click thresholds, while participant source judgments were no better than chance and computational distinction remained specific to this message set.

9. Conclusions

  • GPT-4-generated messages elicited more intended clicks, but the difference was not statistically reliable and establishes neither superiority nor equivalence.The practical finding is that simple-prompt messages were comparable, within pilot uncertainty, to messages from a screened novice-student pool.Source: §9 · p. 29
  • Participants placed 38% of job-related messages above intended-click thresholds, versus 19% of hobby and 17% of social-media messages; adjusted intended-click odds were significantly higher for job messages.Participants weighed relevance, sender identity, URLs, communication medium, style, plausible rewards, and contextual accuracy; misaligned organizations, colleagues, senders, or channels were failed personalization examples.Source: §9 · p. 29
  • Participants identified message source no more accurately than chance, while the study’s two message sets remained computationally distinguishable on unseen targets after obvious surface differences were standardized.This result is limited to the study’s message set, not a general AI detector.Source: §9 · pp. 29–30
  • TRAPD enabled controlled same-target comparisons with informed consent and detailed explanations, but does not measure live clicking and lacks formal reliability or real-world validity testing.The authors recommend larger, more diverse samples and comparisons with authorized laboratory or field methods.Source: §9 · p. 30
  • The authors recommend defenses that assume convincing personalized phishing can be produced with or without AI and teach verification of sender, channel, URL, and request.They also call for protecting personalized data and limiting dual-use risk in future research and tools.Source: §9 · pp. 30–31

Abbreviations

The manuscript lists abbreviations used in its text.

Abbreviations

  • AI means artificial intelligence, LLM means large language model, and SMS means short message service.These abbreviations are listed as manuscript terminology.Source: Abbreviations · p. 31
  • TRAPD is the abbreviation for Threshold Ranking Approach for Personalized Deception.The manuscript names TRAPD as its evaluation framework.Source: Abbreviations · p. 31
Loading 2406.13049v3…