# AURA: Adaptive Uncertainty-Routed Analysis for Email Threat Detection

arXiv: https://arxiv.org/abs/2609.19873 · HTML: https://mlsanity.com/paper/2609.19873/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 45 references that are in the map.
- First posted on arXiv 17 Sep 2026.

## Builds on (most cited first, 13 of 13)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter](https://mlsanity.com/paper/1910.01108/) (2019)
- [ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection](https://mlsanity.com/paper/2402.18093/) (2024)
- [URLTran: Improving Phishing URL Detection Using Transformers](https://mlsanity.com/paper/2106.05256/) (2021)
- [Next-Generation Phishing: How LLM Agents Empower Cyber Attackers](https://mlsanity.com/paper/2411.13874/) (2024)
- [CATBERT: Context-Aware Tiny BERT for Detecting Social Engineering Emails](https://mlsanity.com/paper/2010.03484/) (2020)
- [Reliability and Robustness analysis of Machine Learning based Phishing URL Detectors](https://mlsanity.com/paper/2005.08454/) (2020)
- [The Phish, The Spam, and The Valid: Generating Feature-Rich Emails for Benchmarking LLMs](https://mlsanity.com/paper/2511.21448/) (2025)
- [Zero-Shot Spam Email Classification Using Pre-trained Large Language Models](https://mlsanity.com/paper/2405.15936/) (2024)
- [PhreshPhish: A Real-World, High-Quality, Large-Scale Phishing Website Dataset and Benchmark](https://mlsanity.com/paper/2507.10854/) (2025)
- [A Late Multi-Modal Fusion Model for Detecting Hybrid Spam E-mail](https://mlsanity.com/paper/2210.14616/) (2022)

## Abstract (arXiv)

Email spam and phishing attacks remain a critical security threat. Adversaries increasingly exploit large language models to craft contextually convincing malicious messages, and existing spam detection systems often struggle to keep pace. Generalization across diverse and evolving attack scenarios is limited, which reduces effectiveness once these systems are deployed in practice. This paper introduces Adaptive Uncertainty-Routed Analysis (AURA), a multimodal email threat detection system that analyzes both the content of an email and its embedded URLs. AURA is built around two layers: the first quantifies prediction uncertainty from a URL classifier, and only ambiguous messages are escalated to a fine-tuned transformer encoder for semantic analysis. The system is evaluated on eight heterogeneous training corpora together with two held-out real-world corpora spanning a decade of adversarial campaigns. AURA reaches a macro F1-score of 0.9858 in-distribution, and on NazPhish-Eval and GuenterTrap-Eval it maintains 0.9502 and 0.9436, respectively, which is evidence of robust generalization under genuine distribution shift.