Phishing detectors are typically calibrated on public datasets because privacy rules make it difficult for organizations to collect and label their own legitimate email. According to the paper, this reliance on public corpora breaks the false-positive budget of trained detectors: the calibration no longer matches the organization's actual mail distribution, leading to more false alarms than intended.
The authors propose CyberCane, a neuro-symbolic retrieval framework that is explicitly privacy-bounded. The framework appears to combine neural and symbolic retrieval techniques to adapt phishing detection without requiring access to sensitive labeled data. By bounding privacy, CyberCane aims to keep false positives within acceptable limits even when the target distribution shifts away from the public corpus used for initial calibration.
The abstract is brief, but the core contribution is a way to reconcile privacy constraints with the need for detector calibration. Rather than collecting private labels, CyberCane retrieves relevant information in a privacy-aware manner, offering a potential path for organizations to maintain accurate phishing detection under real-world distribution shift.