PhishTriage: A Local, Fine-Tuned LLM That Hunts for phishing emails
My first AI project based on a local, Fine-Tuned LLM That Hunts Phishing emails and then build a RAG flow to work on live flow of data
So I built PhishTriage, and here’s how it came together.
The toolslinks I used :
https://unsloth.ai/
https://ollama.com/download
https://huggingface.co/
https://colab.research.google.com/
https://www.langflow.org/
https://colab.research.google.com/github/unslothai/unsloth/blob/main/studio/Unsloth_Studio_Colab.ipynb
Get Ankitmalhotra’s stories in your inbox
Join Medium for free to get updates from this writer.
Analysed the agent in Ollama whether an email is malicious or clean:
I have selected T4GPU because fine-tuning needs a GPU, and T4 is the only one Colab gives for free.
- An 8B model in 4-bit takes ~6GB of memory; the T4 has 16GB VRAM — enough for QLoRA fine-tuning with Unsloth
Used Google Colab to host the UnSloth to fine tune the model:
Fine tuned the model on UnSloth using Email security datasets generated using claude, although we can use datasets hosted on HuggingFace, But always verify any datasets from Huggingface since anyone can host it:
Below snapshot shows how the trained model learning looks like:
I have used Qwen3.0–0.6B which is free and dont require any API key and as part of the training the training loss shows how well the model has been trained on a dataset and how gradual is the training loss
Below is an unclean version of dataset used for my model training:
Below snapshot shows the model behaviour for the same prompt between an untrained base model vs trained model. The untrained model classfied the malicious email as clean vs trained model which has classified it has malicious as part of its verdict:
Below snapshot shows how the untrained model hallucinate:
Hosted the model locally on Ollama:
UnSloth model alone gives a bare verdict and score. Ingestion RAG builds a searchable library of 513 past cases and your response playbooks. Triage RAG feeds the model today’s vendors, VIPs and simulation policy, then backs its verdict with matching past cases, deterministic guardrails and the right playbook steps, so the security team updates policy in data instead of retraining.
- Built a RAG pipeline to analyze email related data using uploaded knowledge-base documents.
- The document is first read, split into smaller chunks, and converted into embeddings.
- FAISS stores those embeddings and retrieves the most relevant context when a user asks a question.
- The user query is passed to FAISS, which searches for matching cases and add more context to its verdict.
- The retrieved context is sent to the language model, which generates a clear threat verdict, severity, reason, and recommended action.
- This setup is useful for building a cybersecurity assistant that can support email analysis/triage for capturing phishing
Also you can connect me on Linkedin : https://www.linkedin.com/in/ankit-malhotra-098915a4/
If you found this helpful, please give it a clap,comment or repost where it might benefit others .It helps more people discover & learn from this series.
