So, thanks everyone for coming. I hope you can hear me.
Okay, I'll try to, but my name is Selwood and I'm the author of our Spondy and I've spent quite
a significant part of my professional career walking with email spam.
In this presentation, I will talk mostly about using of LLM for spam detection as was announced.
So, it's mostly a kind of experimental feature. I'm not quite sure that it will be suitable for everyone,
but it might be interesting as an experiment and interesting in terms of possibilities.
But I would like to start my presentation from this slide.
Because when I walked in central of London, there is a very ancient medieval cemetery in London.
And I walked through it quite a lot of times and I've seen this tomb.
And this is tomb of Thomas Baes.
And I'd like to say that without Baes, we would have no kind of proper content on this poem.
And that was the first ability to filter emails based on their content.
And that's why I think that this mathematician was very important for all development of machine learning of statistics
and stuff like that. And in particular, in email, that was the first example of their content filtering.
So, many of you may be heard about the article of Paul Graham, about the note of spam.
And he mentioned that Baes is an ancient.
So, Baes' engine is actually one of the examples of supervised learning.
So, he needs to train it and without training it's useless.
But the main advantage of Baes and why I like Baes for content filtering is that it can easily adopt for new content.
So, the idea is quite simple and I will talk about it soon because I want to explain how it works in nutshell,
because it might be useful to understand why I was interested in L.M.
Baes is really very fast. So, I would say that it's one of the fastest methods to kind of do classification.
And apparently it's very cost effective. So, you can just store your database, query it, and you have completely nothing to do some sort of computational work.
So, let me explain very quickly about how it works.
Maybe, in example, first from the, but let's imagine that we have like three samples.
And in each sample we have like maybe other tokens, but we have something like Best Vagra, Best Beesius, Best Efforts, Best Beesius, and again Best Beesius,
because Best Beesius is one of the common modes that is met in L.
Then we kind of try to train that, and each tokens combination, which was combination, like two modes is one token.
In other ways, and engines, there are sometimes one mode, sometimes more than one mode, but basically there is no significant difference.
And then what you do is actually you count number of these tokens that were met in spam and ham.
That's it. So, the whole your base and database is actually some representation of tokens and the counts, nothing else.
So, as I've said, it's very simple.
And if you want to calculate something like, we have another like fourth email with Best Beesius.
So, how can we detect what's token is it?
So, the formal is quite simple. So, we basically just summarize weights and divided by number of loans,
because the more loans we have, the less relative weight we have.
So, basically for Best Beesius, we again have weight of normalised weight for one and one for ham and spam.
So, basically what does it mean? It means that this token is neutral.
So, we can't say if it's ham and spam, but the combination of tokens is very important.
So, after all, we get some sort of number for spam and number for ham.
And then you can apply something like bison probability, versky square distribution.
So, there are lots of statistical methods about how to get from counts from frequencies to probabilities.
And that's it. So, the method is very simple.
And the database is very simple as well. So, it just stored a number of equivalences and nothing else.
But as you see, the bison classifier doesn't actually know about the context anything.
So, for example, it just operates with tokens, nothing else.
And that's a bit problematic. So, I'll explain all problems that I personally had with bias.
So, the first problem is that bias is very good for your personal email.
Why? Because, for example, you have some sort of ham that you receive from your trusted kind of friends, relatives, colleagues, mailing lists,
maybe some social networks internet.
But that's the variety of ham is actually quite low for each individual person.
And that's actually very good for bias because basically you have your own topics.
So, for example, I have my own interests and my own databases quite different from other databases.
But for me, it's good. So, personal biases are really very effective and straightforward approach.
But it doesn't understand emails. So, for example, how can I distinguish fishing email from PayPal from the real PayPal?
Because their content will be very similar, but with some distinctive capabilities that won't be visible for bias in the vast majority of the cases.
But we are trying to avoid this issue by adding not only content, as I have shown in the examples like words and text.
Also, some sort of meta tokens like number of attachments, the order of headers, a number of received headers and so on and so forth.
And these are all features that might be useful to distinguish spam and not spam.
As I've said, the fishing is not so good.
And another problem of bias engine that I've seen loads of complaints about bias in many scenarios.
But the problem is that bias requires learning.
And if you stop learning, then it stops kind of being actual.
And you need also to expire all tokens because basically how it's useful to store tokens for spam messages like from the previous year.
It doesn't make any sense.
And another big problem for example, for large installations is that your bias and engine for different people like from HR department.
And let's say engineering their bias and that the bias should be completely different.
And what is spam for engineers will be very useful emails for let's say HR marketing department.
And this is one of the biggest issues to use bias in many scenarios.
Another problem is languages.
So multilingual emails are kind of like a big problem because you can have loads of emails in let's say English like you have some sort of company.
And all Chinese emails are usually spam.
But then you hire some person who is modeling which is Chinese.
And his messages and his correspondence will be automatically detected as spam just because bias and engine is kind of skewed towards spam for this language.
And this is also a problem.
Okay, so what I was trying to solve with the languages model.
So when they were announced, I first tried to test chat GPT to detect some of emails.
And I was quite impressed with it quality at the first time.
And that's why I decided to do some sort of experiments and they are quite simple.
So one big advantage of a large language models is that they are kind of unsupervised learning.
So you don't need to train it.
You just need to get model with all knowledge.
So many models are now open source with all weights.
You can run it on your own even this laptop, not this I think.
And you don't need to train them explicitly for your content.
Another advantage that I found that a large language models, especially with many parameters, are very good to work with multiple languages.
And that was quite impressive because I don't understand what this message means, but large model knows that.
And surprisingly they were quite efficient for fishing.
So at the first time I was very skeptical about their abilities to find fishing, but they were definitely better than bias.
And another thing that these models can really be useful for not only binary classification, but providing other services I will explain with it later.
So I will little bit explain how we send data to large language model because you can't actually send the email as is because it will be just inefficient.
So first of all we get some meaningful part.
So if it's multi-part, we have StrayMail, if it's just steps to each track text.
If we have some large StrayMail attachment and relatively small text parts, we use this attachment.
So there is some sort of heuristics about how to find the content and message because that's not very obvious in some cases.
And also add some additional data like from name, subject, euro and email domains.
And I'm thinking about adding more metadata such as HTML structure because it might be very useful for model to get more input.
Because when I added like subject, the quality of filtering improved by like 10% as far as I remember.
And that was quite impressive. So adding more data is useful there.
And then I've written a simple utility that gets to folders with Hammond Spum.
Then shuffle, mix them and get some sort of part of it is used for training.
And pass a view for testing or cross validation.
But in terms of unsupervised learning, we don't need training at all.
So we just use this cross validation or test set and exclude training step completely.
So for example, that word results for bias.
This is published in the internet. So you can check it in the side.
And actually there results are quite good.
But this corpus, it's very simple because this experiment was with the corpus where spam messages were quite similar.
There were quite a lot of duplicates for both spam and ham.
So I've used like complaints for spam and complaints for positive, actually, for this.
So this corpus is quite good example of what you can see in a typical company.
So it's not like a personal email, but some large company with lots of emails, lots of spam.
But the spam is quite similar, that's important.
So as you can see, the results are quite decent.
But as I've said, the result for this training might be different for tomorrow's one.
This was a model from, that was at the moment the most advanced model GPT for all.
It was quite expensive. And again, the results are a bit lower than bias, but you don't need training.
And there was some strange thing, and actually it was quite common for all other experiments.
There are more false positives than false negatives.
So for some good messages, LN decides that it's likely spam.
I think it's quite bad. So for example, if you compare with bias, it has less false positives than false negatives.
And that's quite interesting thing.
But the time was completely awful comparing to bias.
So it's like 12 seconds for the whole corpus.
And like 300 seconds for a limit, only 90 percent of course you fight.
Okay, so I don't quite a lot of results.
So you can probably check slides after this talk. I'm not going to concentrate on this.
But what you can see that the LAPS time is kind of fluctuating.
I'll stop on it a bit late, but actually the problem is that it's slightly unpredictable.
But overall numbers are quite good.
Again, false positives are prevailing mostly on false negatives in the vast majority of the cases.
And actually there is no significant difference between cheap models and expensive models.
I've also tried my own laptop like Mac.
There are small Lama 3 billion parameters on the GPU of Mac, so without any acceleration, without anything.
And that results will completely rubbish to those.
And I was actually quite surprised that in many cases it tried to do completely different things like
I've asked to classify the spam or not and try to translate it, for example.
So I don't know.
But again, that might be fixed and I will discuss it a little later.
But just small models are not very good actually in sparmclicifying.
They are quite attractive because you can run it and come only to hardware, you don't need anything.
But there results are not too impressive.
Right.
So in any cases, Lama is much, much slower than by real it.
It's not something that you can use for like a thousand messages per second, unless you are very rich and have a cluster of GPUs, but probably it's.
Also, it's not a silver ballet, so it can be done mistakes.
And from my personal opinion, these mistakes are very common and they are like maybe human-like.
So if I ask somebody from this room to do this classification manually, I think nobody can do it a bit hundred percent accuracy.
Because sometimes it's very difficult to distinguish spam and spam emails, especially if you have no previous context sort of.
So for example, if I can provide like full thread of messages to LLM and probably I can do it at some extent, it's very easy to reduce false positives for like replies and stuff like that.
But on the other hand, if you know that this message is reply from mailing list, we don't need to kind of filter it because we already know that it was replied.
So the majority of errors will surprisingly own exotic language such as Arabic language, I don't know what was that spam from because that was just like completely unknown to me message.
Some messages in Chinese, so I really don't understand why they were not classified as spam because I can't receive message in Chinese because I don't know the language.
And again, this is because models don't know the context.
Also surprisingly, lots of my technical discussions about spam filtering will classify the spam, but probably.
And one of the main problems is that really caused money and they are very, very greedy in terms of resources.
So I was thinking that mining of group the currency is bad for environment, it's like using of wasting of energy.
But I think that spam filtering using LLM is even worse.
So they are really quite greedy.
And one of the biggest issues with LLM is really uncertainty.
It provides unstable results. So for example, especially lower hyperparameters models are very bad in terms of stability.
So from one invocation to another invocation, the result might be completely different.
Yes. Also, if you use some sort of cloud sources, then it might have unstable latency.
So for example, when there was a big hype about deep seek model, I couldn't use deep seek model as this.
I had to use distilled model of train it on deep seek.
But the latency can vary. So for example, in night, your latency can be one second, like big time it can be ten seconds.
And it's completely unusable in many cases.
And also quite interesting that many models, especially again, with lower number of hyperparameters, can output some crepence that of Gson.
In spite of the fact that you explicitly ask to get Gson with specific attributes.
Then another problem is privacy. So of course, your messages are scanned by some blackbooks engine.
And even worse, your messages can be used to train these blackbooks.
And apparently they can leak sensitive data.
Just after that experiment, I've created a sort of anonymizer that tries to remove personal stuff.
Just to try this experiment to do that.
But after all, I even added some sort of GPT anonymizer.
So I've asked one GPT and tried locally to anonymize message there.
So yeah, that's crazy, it is.
Also, I tried to do some sort of consensus model.
So instead of getting some expensive model with many parameters, I've tried to use multiple models.
I think that was four models.
Or one mini hi-coup.
Oh, sorry.
And deep-s, no, deep-sick.
Anyway, so these are results from consensus of three models.
And in case if some model is bad in terms of hallucinations or Gson reply or whatever,
the consensus is usually good.
So yes, the percentage of classified is much higher than for each individual model.
And the other results are again slightly better, but nothing again.
Very good.
One thing is actually training bias.
And that was another corporal, actually.
And in this case, as you see, the number of good specifications of spammer is very bad.
Because the spammer is really high variety.
And bias is not so good in this.
So this was the corporal of my personal emails for some years.
And spam is really completely different.
There are no duplicates, nothing.
And this corporal is quite good in terms of representation.
But it definitely shows the problem of bias that it's not good in terms of high
cardinality of hyperrides input.
Yes.
But again, it's very fast.
And it's quite good for learning for using of spam.
And actually, if you train bias by LM's, you can set a separate instance,
where you can mirror some portion of traffic, classify it with LM and train bias,
and you get good from both worlds.
Also, I have quite a few, quite a little time by.
This one was also quite interesting.
So in many cases, it's very difficult to explain a user why this message was classified as spammer ham.
In this thing with LM, you can actually add some sort of reasoning.
And this reasoning is really very good.
And it's very good in terms of human reliability.
So you can actually tell what this message is.
And why it was classified as spam.
So for example, this is my recent fishing from yesterday.
I received this message in in train.
And I immediately asked GPT about why is it bad.
Again, that's quite decent explanation about fishing.
So quite a good tool.
Okay.
I don't have any time.
So let's go to questions.
Thank you.
So very quick answer.
And please try to repeat the question.
I'm going to say that.
Are you?
What do you think that the future of this thing is,
AI actually in the lens are actually going to be future of anti-spend or
are they going to be the future of actually spent creation?
Well, that's a very good question.
So is it a good for spam creation?
I think it's a very good for spam creation.
Especially there were a good in terms of creativity spam.
So that's quite a boring thing.
And I think I've heard some talks about that even.
Some other conferences.
Yes, I think this tool can be used for both of things as usually.
It can be used for good and for bad.
Can you see in our spending what the future of our spending
depending itself from the coming way of AI spam?
As usually there are multiple criteria.
So if you decide spam harm based on content only,
I think that's not enough.
But if you are at here like IP addresses,
like reputation, like DMARG,
the team and all good stuff that will use in the past.
And if you combine that with kind of analysis,
and if you combine that with some meta data like,
you know, number of messages structure,
because actually elements are very good in finding content
that is generated by elements.
So that's also quite a use case.
So if you use some sort of traditional methods and
content based on the analysis,
you can actually try to do something better.
I think, yes.
There you go ahead.
If you use supervised learning to modify the thoughts
about learning of elements.
So I've planted it into the future walk and stuff like that.
But the idea is really to train low parameters LM,
with high parameters LM.
That's also possible.
So you can't train not only bias, but another model.
You can also improve the prompt as you've suggested.
And actually I've tried to do it.
But I've not found any significant differences in that.
Because the prompt is not so important in terms of,
you know, detection because the prompt is simple.
So you have a message and you need to detect spam harm.
And the only thing that was useful was adding actually reasoning.
So in theory, adding reasoning should not affect the probabilities and the accuracy
and stuff like that.
But surprisingly adding just the reason was beneficial for the raw results.
But it wasn't suggested by LM.
It was like my idea.
So one final question, let's take a look at the results.
In my words, I can only experiment such as this.
If there's only one thing I can do about LM,
I'll ask it to raise the following email on the state.
I'm seeing the spam to find it.
And the results were quite spectacular.
And it already included the reasoning without me even.
So that was 3 billion, right?
Yes. So that was 3 billion model.
And my contract question is what language he used?
The email is right.
And English.
So that's the biggest difference because I've tried multiple languages.
In English, the results were quite decent.
In other languages, nothing good.
And I think that's the main disadvantage of low parameters models
that they actually don't have multiple languages
at the same level as larger models.
So yes, I understand, and actually I've tried local models
and I've tried to do them, but as I've said,
I've decided not to continue just because of multiple English support.
All right.
Thank you very much.