# Prompted Contextual Vectors for Spear-Phishing Detection

arXiv: https://arxiv.org/abs/2402.08309 · HTML: https://mlsanity.com/paper/2402.08309/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 87 references that are in the map.
- First posted on arXiv 13 Feb 2024.

## Builds on (most cited first, 15 of 15)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks](https://mlsanity.com/paper/1908.10084/) (2019)
- [DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter](https://mlsanity.com/paper/1910.01108/) (2019)
- [HuggingFace's Transformers: State-of-the-art Natural Language Processing](https://mlsanity.com/paper/1910.03771/) (2019)
- [A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly](https://mlsanity.com/paper/2312.02003/) (2023)
- [Characterizing Concept Drift](https://mlsanity.com/paper/1511.03816/) (2015)
- [Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift](https://mlsanity.com/paper/2010.03856/) (2020)
- [Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models](https://mlsanity.com/paper/2308.12287/) (2023)
- [SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective](https://mlsanity.com/paper/1911.00953/) (2019)
- [CHiLL: Zero-shot Custom Interpretable Feature Extraction from Clinical Notes with Large Language Models](https://mlsanity.com/paper/2302.12343/) (2023)
- [Cheap-fake Detection with LLM using Prompt Engineering](https://mlsanity.com/paper/2306.02776/) (2023)
- [Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails](https://mlsanity.com/paper/1606.00887/) (2016)
- [RAIDER: Reinforcement-aided Spear Phishing Detector](https://mlsanity.com/paper/2105.07582/) (2021)
- [That Ain't You: Detecting Spearphishing Emails Before They Are Sent](https://mlsanity.com/paper/1410.6629/) (2014)

## Built on by (most cited first, 5 of 5)

- [When LLMs Meet Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2405.03644/) (2024)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [SecureNet: A Comparative Study of DeBERTa and Large Language Models for Phishing Detection](https://mlsanity.com/paper/2406.06663/) (2024)
- [PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants](https://mlsanity.com/paper/2507.15393/) (2025)
- [Assessing Spear-Phishing Website Generation in Large Language Model Coding Agents](https://mlsanity.com/paper/2602.13363/) (2026)

## Abstract (arXiv)

Spear-phishing attacks present a significant security challenge, with large language models (LLMs) escalating the threat by generating convincing emails and facilitating target reconnaissance. To address this, we propose a detection approach based on a novel document vectorization method that utilizes an ensemble of LLMs to create representation vectors. By prompting LLMs to reason and respond to human-crafted questions, we quantify the presence of common persuasion principles in the email's content, producing prompted contextual document vectors for a downstream supervised machine learning model. We evaluate our method using a unique dataset generated by a proprietary system that automates target reconnaissance and spear-phishing email creation. Our method achieves a 91% F1 score in identifying LLM-generated spear-phishing emails, with the training set comprising only traditional phishing and benign emails. Key contributions include a novel document vectorization method utilizing LLM reasoning, a publicly available dataset of high-quality spear-phishing emails, and the demonstrated effectiveness of our method in detecting such emails. This methodology can be utilized for various document classification tasks, particularly in adversarial problem domains.