phishing-qwen3.5-2b-gguf

Phishing Email Detector — Qwen3.5-2B GGUF

GGUF version of Davv4/phishing-qwen3.5-2b, a fine-tuned Qwen/Qwen3.5-2B model for email phishing detection. This version is optimized for use with Ollama — no Python ML dependencies required.

---

Input Format

The model expects a plain text email in the following format:

Sender: <sender email address>
Receiver: <receiver email address>
Date: <email date>
Subject: <email subject>
Body: <email body text>

Example input:

Sender: [email protected]
Receiver: [email protected]
Date: Sun, 01 Jun 2025 22:10:05 +0000
Subject: Netflix: Payment declined - Update your billing information
Body: Dear Kevin, We were unable to process your most recent payment and
your Netflix membership is at risk of cancellation. Update billing:
http://netf1ix-account-alert.com/billing-update. Act within 48 hours.

---

Output Format

The model responds with a structured JSON object:

{
  "is_phishing": true,
  "confidence_score": 0.98,
  "threat_type": "Credential Harvesting / Financial Fraud",
  "risk_level": "CRITICAL",
  "reasoning": "The sender domain 'netf1ix-account-alert.com' replaces the letter 'l' with '1' to impersonate Netflix..."
}

---

Quick Start with Ollama

Step 1 — Install Ollama

Download and install Ollama from https://ollama.com.

Step 2 — Download the GGUF file

hf download Davv4/phishing-qwen3.5-2b-gguf phishing-qwen3.5-2b.gguf

Step 3 — Create a Modelfile

Create a file named Modelfile with the following content:

FROM /path/to/phishing-qwen3.5-2b.gguf

SYSTEM """You are an email security analyst. Analyze the provided email and determine if it is a phishing attempt. Respond ONLY with a valid JSON object using this exact schema: {"is_phishing": boolean, "confidence_score": number (0.0-1.0), "threat_type": "string or null", "risk_level": "LOW|MEDIUM|HIGH|CRITICAL", "reasoning": "string"}"""

PARAMETER temperature 0.1
PARAMETER num_predict 512

Replace /path/to/phishing-qwen3.5-2b.gguf with the actual path where you saved the file.

Step 4 — Load into Ollama

ollama create phishing-detector -f Modelfile

Step 5 — Run it

ollama run phishing-detector

Once loaded, you can call it from any directory — no need to stay in the Modelfile folder.

---

Use in Python

import json
import requests

def analyze_email(email_text: str) -> dict:
    response = requests.post(
        "http://localhost:11434/api/generate",
        json={
            "model": "phishing-detector",
            "prompt": email_text,
            "stream": False
        }
    )

    raw = response.json()["response"]

    try:
        result = json.loads(raw.strip())
    except json.JSONDecodeError:
        result = {"error": "Failed to parse model output", "raw": raw}

    return result


# Example usage
email = """Sender: [email protected]
Receiver: [email protected]
Date: Sun, 01 Jun 2025 22:10:05 +0000
Subject: Netflix: Payment declined - Update your billing information
Body: Dear Kevin, We were unable to process your payment.
Update billing: http://netf1ix-account-alert.com/billing-update. Act within 48 hours."""

result = analyze_email(email)
print(json.dumps(result, indent=2))

Expected output:

{
  "is_phishing": true,
  "confidence_score": 0.98,
  "threat_type": "Credential Harvesting / Financial Fraud",
  "risk_level": "CRITICAL",
  "reasoning": "The sender domain 'netf1ix-account-alert.com' replaces the letter 'l' with '1' to impersonate Netflix. The link routes to a fraudulent domain rather than netflix.com. Loss aversion and urgency tactics are used to pressure the victim."
}

---

Related Model

Looking for the HuggingFace Transformers version? See Davv4/phishing-qwen3.5-2b.

---

Training Details

---

Limitations

• Trained on a relatively small dataset — best used as a supplementary tool, not a sole decision-maker.
• May not generalize well to highly novel phishing techniques not represented in training data.
• Output is always in English regardless of the input email language.
• Always validate the JSON output programmatically as the model may occasionally produce malformed responses.

---

License

This model inherits the Apache 2.0 license from the base Qwen3.5-2B model.