Unit 12 exercises

Three flaws are clear. First, the random split of time-ordered records lets the model learn from records later than those it is tested on, which is temporal leakage in the sense of Kapoor and Narayanan (2023) and temporal bias in the sense of Pendlebury et al. (2019); any attack family that appears late is seen in training. Second, duplicates are not removed, so identical records can sit on both sides of the split and part of the test measures memorization instead of generalization. Third, accuracy and F1 on a test set with the dataset's own share of attacks say little about deployment, where the base rate is usually far lower (Lesson 1.2); the report needs precision, recall and alerts per day at the deployment base rate and alert budget.

A corrected design deduplicates first, splits by time (for example, the first two weeks for training and the third for testing, with a validation period for the threshold), chooses the threshold on validation data for a stated alert budget, reports precision and recall at that threshold with intervals, reports per-family recall, and compares with a hand-written rule and a logistic regression. "Ready for deployment" would also need a test on the target network's own traffic, since an evaluation on a public dataset alone is a lab-only evaluation, pitfall P9 of Arp et al. (2022).

Choosing hyperparameters and thresholds on the test set is data snooping and biased parameter selection, pitfalls P3 and P5 of Arp et al. (2022). The reported scores are maxima over 20 noisy evaluations, so both are optimistic, and the difference of 0.03 may be produced entirely by the selection, which favors whichever variant's 20 scores happen to vary more. The corrected design selects hyperparameters and thresholds by validation (a time-ordered validation period or grouped cross-validation on the training data), freezes them, evaluates each feature set once on the test period, and repeats over \(k\) seeds with paired differences and the interval \(\bar{m} \pm t_{0.975,\,k-1}\,s/\sqrt{k}\) of Lesson 12.1, where \(\bar{m}\) and \(s\) are the mean and sample standard deviation of the \(k\) per-seed differences and \(t_{0.975,\,k-1}\) is the 97.5% quantile of the \(t\) distribution with \(k - 1\) degrees of freedom.

On the benchmark, the share of records that are detected attacks is \(0.95 \times 0.2 = 0.190\) and the share that are false alarms is \(0.03 \times 0.8 = 0.024\), so precision is

which matches the report. At a base rate of 0.001 the two shares are \(0.95 \times 0.001 = 0.00095\) and \(0.03 \times 0.999 = 0.02997\), and precision becomes

so about 31 alerts in a thousand are real and the rest are false. The report should have stated the benchmark's base rate, reported the true and false positive rates (which do not depend on the base rate), and converted them to precision and alerts per day at a stated deployment base rate. This is the spatial bias of Pendlebury et al. (2019) and the base-rate fallacy, pitfall P8 of Arp et al. (2022).

The flaws compound. Fifty emails give a wide interval; by the Wilson formula of Lesson 10.2, 46 correct out of 50 gives a 95% interval of roughly 0.81 to 0.97. A single run at nonzero temperature measures one draw; repeated runs and prompt variations are needed to see how stable the result is. No baseline was run, so "outperforms traditional filters" is unsupported; a URL reputation check or a simple text classifier evaluated on the same emails is the minimum. A public corpus may be in the model's training data, so emails from after the model's training cutoff are needed to reduce the chance that it recalls them. Accuracy on a corpus whose phishing share is unknown or balanced does not translate to precision in a mailbox. Finally, the evaluation ignores the adversary. Phishing emails are written by attackers, who can include text aimed at the model (indirect prompt injection, Lesson 10.2), so the project should test emails with injected instructions and report how often the verdict changes.

The group is derived from a model feature, so it says nothing about any population whose treatment matters; it partitions the input space where the model's behavior is expected to differ by construction, and any "gap" mostly restates how the feature relates to the label. A fairness audit needs groups defined independently of the model, such as sites, business units, user populations or, where lawful, demographic categories, chosen because the people in them bear the consequences of errors (Lesson 11.2). The true positive rate of a group with no positives is undefined (the denominator \(TP + FN\) is zero), and reporting it as 0 is an error that will be read as a failure to detect. The audit should report "undefined (no attacks in this group in the test period)", the counts behind every rate, and intervals, and should choose a test period or a grouping in which each group contains enough positives to estimate the rate at all.

Reporting the maximum over seeds is selection on noise. The five values sum to 3.66, so the mean is \(\bar{m} = 0.732\). The sample standard deviation is \(s = 0.0421\), and with \(t_{0.975,4} = 2.776\) the 95% interval \(\bar{m} \pm t_{0.975,4}\,s/\sqrt{5}\) has half-width

so the interval is \(0.732 \pm 0.052\). The report should state 0.732 with that interval, mention that one seed reached 0.80, and, if the spread is surprising, investigate why training is unstable (for example, the learning rate or class imbalance) instead of keeping the lucky run.

Publishing a working bypass before the vendor can fix it exposes every customer of the gateway to attackers who read the repository, while defenders cannot patch a product they do not control. Coordinated vulnerability disclosure, as described in the CERT guide (Householder et al., 2017), would report the finding privately through the vendor's security contact, agree on a timeline, and publish after a fix is available or the agreed time has passed, following principles such as reducing harm and avoiding surprise. The author should also check that the trial's terms of use allowed the testing that was done. The project report can still describe the class of weakness and its measured rate; the exact attachment belongs in the report only after the coordinated disclosure.