EPS
← All batches·2605.17201

Filter-then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks

topic: current_projecttop score: 100released: 2026-05-19first surfaced: 2026-05-19arXivPDFlinked_to_results2026-05-19

Authors: Barsat Khadka, Prasant Koirala, Kshitiz Neupane et al.

arXiv · PDF

Summary

arXiv:2605. 17201v1 Announce Type: new Abstract: Social engineering attacks exploit human trust rather than software vulnerabilities, making them difficult to detect using conventional filters.

Relevance

Read next because Filter-then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks overlaps with clean result "LoRA persona trained on alone emits at 23.5% when a co-trained partner learns ..., vs 0% control on Qwen2.5-7B-Instruct (MODERATE confidence)", clean result "Leakage rate is a usable signal for recovering trigger-shaped phrases on Gaperon-1125-1B without knowing the hidden trigger itself (MODERATE confidence)", clean result "Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT (LOW confidence)". Matching terms: text, soft, rate, stage, model. Source: arxiv cs.CR (Cryptography and Security).

Abstract

arXiv:2605.17201v1 Announce Type: new Abstract: Social engineering attacks exploit human trust rather than software vulnerabilities, making them difficult to detect using conventional filters. We propose a two-stage filter-then-verify framework combining inductive Graph Neural Networks (GNNs) for structural anomaly detection with a co-attention ModernBERT model for content verification. The GNN identifies anomalous sender-receiver patterns, while BERT analyzes message context to reduce false positives. Using the Enron dataset augmented with realistic synthetic campaigns, we show that the framework achieves 86% recall in structural filtering and over 92% precision after BERT refinement, effectively detecting both external attacks and insider threats. Our results demonstrate that combining structural and content analysis allows practical, scalable detection of multi-stage social engineering attacks in email networks.