lurescope 0.7.1

Most fraud-scoring demos stop at "is this phishing? — 94%." That number is the easy part, and it hides the two questions that actually decide whether a detector survives production: does it still fire when an attacker perturbs the message, and can a defense you'd actually deploy get the catch back? LureScope answers all three. Paste a message, get a fraud score, apply an attack a real fraudster would run (homoglyph, leet, paraphrase), then flip on input normalization and see whether the detector recovers — or whether the attack was never typographic to begin with.

Deployment thresholds now carry inspectable evidence. LureScope accepts LureBench schema-v2 policies with finite-sample FPR control, independently recomputes their exact statistics, and exposes assurance and limitations at GET /policy. See risk-controlled policy deployment.

Inbox to evidence in one command

Point LureScope at a folder of user-reported emails. It creates a private case directory with one LureProof per message, a privacy-minimized JSONL manifest, and an aggregate routing summary:

lurescope inbox ./reported-emails --recursive --out ./lurescope-cases

# Offline transforms—these commands never contact Splunk, Microsoft, or a webhook
lurescope export ./lurescope-cases/manifest.jsonl \
  --format splunk-hec --out ./lurescope-cases/splunk-hec.jsonl
lurescope export ./lurescope-cases/manifest.jsonl \
  --format sentinel --out ./lurescope-cases/sentinel.json

The shareable outputs contain random case IDs, scores, routing actions, evidence codes, resilience counts, and proof digests. They do not contain source paths, subjects, bodies, addresses, message IDs, URL values, or attachment names. Files are created private and existing output directories are never overwritten. Add --signing-key issuer.pem to authenticate every case as a DSSE envelope. See the complete Inbox-to-LureProof workflow and SIEM mappings.

LureProof: a portable resilience passport

Screenshots are difficult to authenticate, vendor reports are difficult to compare, and forwarding a suspicious email exposes its content. LureProof packages the useful middle: what a named control decided at a named threshold, whether four adversarial edits evaded it, and whether normalization recovered the catch—with no raw body, subject, addresses, URLs, attachment names, or transformed lure text.

# Unsigned evidence: strict and portable, but explicitly unauthenticated
lurescope proof examples/suspicious-invoice.eml -o suspicious.lureproof.json
lurescope verify suspicious.lureproof.json

# Authenticated evidence: in-toto Statement + standard DSSE envelope
lurescope keygen --private-out issuer.pem --public-out issuer.pub.pem
lurescope proof examples/suspicious-invoice.eml --signing-key issuer.pem \
  --issuer "Example SOC" --nonce "verifier-challenge-123" \
  -o suspicious.lureproof.dsse.json
lurescope verify suspicious.lureproof.dsse.json \
  --public-key issuer.pub.pem --require-signature

Prefer the browser? Run lurescope, open http://127.0.0.1:8000, choose a saved .eml, review the triage result, and select Download salted LureProof. The API-backed web lab creates an unsigned, strict proof through POST /proof/email; signing remains an explicit offline CLI step.

The default uses a fresh salted subject commitment, preventing direct hash-based matching between proofs; raw SHA-256 correlation is opt-in. Other fields can still act as a fingerprint, so this is not an anonymity claim. Signed proofs bind the exact payload and media type to an externally trusted P-256 key. They can travel with a SOC ticket, control-validation report, procurement exercise, or cross-organization drill without carrying live lure content. Read the format, privacy boundary, standards landscape, and public-interest use cases.

Triage the artifact people actually receive

LureScope now accepts raw .eml files—not just copied text. It safely extracts visible message content and reports model evidence alongside deterministic email context: Reply-To mismatch, explicit SPF/DKIM/DMARC failures, punycode and IP-address links, and risky attachment filename extensions.

# Human-readable result; everything runs locally by default
lurescope triage examples/suspicious-invoice.eml

# Help-desk queue → one structured JSON event per message
lurescope triage ./reported-emails --recursive --json > triage-results.jsonl

# Full case bundle → minimized manifest + one LureProof per message
lurescope inbox ./reported-emails --recursive --out ./lurescope-cases

The API-backed browser lab served by lurescope has a Choose .eml file workflow, and integrations can call POST /triage/email. LureScope never visits extracted links or opens attachment contents. See real-world workflows and safety boundaries.

Why this exists

A detector's clean-data accuracy is not its deployment accuracy, and the gap has structure worth seeing. LureScope makes it interactive across three moves:

1. The score. tfidf-logreg (the bundled trained baseline) catches a phishing lure at 90%; heuristic-v0 (keyword rules) catches it at 69%.

2. The evasion. A single homoglyph substitution (vеrifу with a Cyrillic е) drops the keyword detector from 69% to 17% — the message walks straight through. The trained model degrades more gracefully.

3. The defense. Turn on normalize and the attacked text is folded back to ASCII before scoring; the keyword detector jumps back to 69% and the catch is recovered. But run the same defense against an llm-paraphrase and nothing changes — that attack rewrote the meaning, not the spelling, and normalization can't reach it.

That last contrast is the point. Character obfuscation is a solved problem for any detector that normalizes its input; the residual robustness gap is semantic. LureScope lets a security team see exactly which of their detectors have which kind of hole, on their own message, in ten seconds.

Robustness scorecard

A single message is an anecdote; a rate over a corpus is a claim. Running both always-on detectors against every character attack on the 819 fraud lures in LureBench's core/test set gives the evasion rate — of the lures a detector caught clean, the fraction that slip below threshold after the attack — before and after the normalize defense:

Read the pattern, not the cells. Normalization drives the homoglyph and zero-width columns to 0% for both detectors because it reverses them losslessly; leet leaves a small residue (the 1=i/l ambiguity); whitespace is untouched because re-joining split words would corrupt real text. The typographic gap closes, the semantic one does not. Full table in SCORECARD.md, background in the writeup; regenerate on any corpus with:

python scripts/robustness_scorecard.py --data <corpus.jsonl> --out-md SCORECARD.md --out-png docs/assets/scorecard.png

Cross-model: do LLM detectors survive?

The scorecard above uses two token detectors. The natural next question is whether an LLM-as-classifier — which reads meaning rather than tokens — survives the same attacks, and whether the semantic paraphrase is the attack that finally bites. Running the llm-judge detector across five models (via one OpenRouter key) over 120 fraud lures answers it:

Three findings. First, the strong LLM judges are essentially immune to character attacks (0–5% evasion for the two strongest, where the keyword detector hits 100%): they read the meaning straight through the homoglyphs. Second, their clean recall here is below tfidf's 97% — but that turned out to be mostly a threshold artifact, not a capability gap (see the corrections below). Third, paraphrase is the attack that most erodes every judge: it is the worst column for four of the five, and the weakest judge (qwen-2.5-7b) is the most evadable at 29%.

Corrections. Two published claims in this section have been revised; both are recorded in full in LLM_SCORECARD.md. In summary: (2026-07-30) the table's stated 120-lure sample was really 73 distinct records, because colliding record ids in the upstream corpus caused this script to overwrite records; judge recall was understated by 4–10 points and deepseek-v4-flash paraphrase evasion moved from 27% to 16%. (2026-07-26). This section originally read the judges' low clean recall as "immunity paid for in recall." Re-measured over the full 2,056-record core/test set with threshold-free metrics, the judges post an AUC of 0.89–0.94 — they rank fraud above benign well, they are just badly calibrated at the 0.50 cut. Dropping deepseek-v4-flash to a 0.10 threshold lifts recall from 0.750 to 0.856 at a 2.5% false-positive rate. The character-attack immunity and the paraphrase weakness both stand; the recall trade-off does not. Details in LLM_SCORECARD.md, full leaderboard in LureBench.

Serve a risk-controlled decision policy

LureBench can now require finite-sample evidence—not merely an observed validation FPR—before exporting a threshold:

lurebench calibrate -d validation.jsonl -m tfidf-logreg \
  --model-path models/tfidf-logreg-fraud.joblib \
  --objective risk_controlled_fpr --target-fpr 0.01 \
  --confidence 0.95 -o policies/tfidf-1pct-fpr-95.json
lurescope policy policies/tfidf-1pct-fpr-95.json
export LURESCOPE_POLICY_PATH=/absolute/path/to/policies/tfidf-1pct-fpr-95.json
uvicorn lurescope.app:app

When /score omits threshold, LureScope applies a configured policy whose detector matches the request. The response includes policy_id and threshold_source=validated_policy. An explicit request threshold remains a supported override and is identified as threshold_source=request; with no matching policy, the backward-compatible 0.5 default remains. GET /policy reports whether the configured artifact is finite-sample risk-controlled, empirical-only, or absent, along with its assumptions. Details in the deployment guide.

Full table and caveats in LLM_SCORECARD.md; reproduce with your own key and model list:

export OPENROUTER_API_KEY=...
python scripts/llm_scorecard.py --data <corpus.jsonl> --limit 120 \
  --out-md LLM_SCORECARD.md --out-png docs/assets/llm_scorecard.png

The detectors that matter

The headline comparison above is toy-vs-toy on purpose (it runs with zero keys, including fully in-browser). The more useful question is whether the detectors a team actually deploys survive the same attacks — so LureScope exposes LureBench's real detectors too:

The gated detectors are advertised in /capabilities with their requirement spelled out; request one without its key or weights and you get a clean 400 telling you what's missing, never a 500.

Why this matters: in LureBench, Llama Guard scores a 0% true-positive rate on AI-generated romance-baiting lures even while catching tax and e-commerce scams — a content-safety model a company might trust to gate fraud is blind to a whole typology. LureScope is where you probe that failure on a single message instead of reading it off a leaderboard. (See LureBench for the corpus-level numbers.)

Quickstart

python3 -m venv .venv
source .venv/bin/activate
python -m pip install lurescope
lurescope

For a contributor checkout, clone the repository and install the development extras with python -m pip install -e ".[dev]".

Keep that terminal running, then open the full local web lab. The local HTML page is API-backed, so opening lurescope/static/index.html directly with a file:// URL will display the interface but its scoring, triage, and proof actions will not work. Alternatively, use the public browser-only demo without installing anything.

You can also call the local API directly:

# Score a message
curl -s localhost:8000/score -H 'content-type: application/json' \
  -d '{"text":"Verify your account within 24 hours or it will be suspended."}'
# -> {"fraud_probability":0.90,"label":"fraud","signals":["your","account","within","hours"], ...}

# Attack it, then defend it in one call: does the detector recover after normalization?
curl -s localhost:8000/attack -H 'content-type: application/json' \
  -d '{"text":"Verify your account within 24 hours or it will be suspended.",
       "attack":"homoglyph","detector":"heuristic-v0","defense":"normalize"}'
# -> {"clean_probability":0.69,"attacked_probability":0.17,"evaded":true,
#     "defended_probability":0.69,"defense_recovered":true,"defended_evaded":false, ...}

Run it in a hardened local container instead:

docker pull ghcr.io/immu4989/lurescope:0.7.1
docker run --name lurescope-local --restart unless-stopped \
  --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --cap-drop ALL --security-opt no-new-privileges:true \
  -p 127.0.0.1:8000:8000 \
  -e LURESCOPE_LLM_ENGINE=openrouter -e OPENROUTER_API_KEY \
  ghcr.io/immu4989/lurescope:0.7.1

The public image supports linux/amd64 and linux/arm64 and carries SBOM and provenance attestations. Its runtime is non-root, contains no Git or compiler toolchain, carries a Docker health check, and pins the exact LureBench source used by its policy verifier. To build it yourself, replace the pull with docker build -t lurescope . and use lurescope as the final run argument. Keep key-backed deployments on localhost unless an authenticating, rate-limiting gateway is in front; otherwise public callers can spend your provider credits.

For an internet-facing deployment, enable LureScope's fail-closed public mode. It requires a bearer key, rate-limits each credential, defaults to local detectors, blocks arbitrary provider/model selection, and keeps provider use at a zero-call budget until explicitly enabled. Follow the public deployment guardrails and inspect the active posture at GET /security.

API

Interactive OpenAPI docs are served at /docs.

Attacks: four instant, dependency-free character attacks (homoglyph, leet, zero-width, whitespace) and two LLM-driven attacks (llm-paraphrase, llm-keyword-evasion). The LLM attacks use any OpenAI-compatible provider by name with your own key — set LURESCOPE_LLM_ENGINE (e.g. deepseek) and that provider's API key in the environment. They never call api.openai.com or api.anthropic.com.

Defenses: none (default) and normalize. Normalization strips invisible format characters, folds confusable Cyrillic/Greek letters back to Latin, and undoes in-word leet — reversing the homoglyph and zero-width attacks losslessly and leet for the most part. It deliberately does not try to re-join word-splitting (whitespace) or undo a paraphrase, because those can't be reversed without corrupting legitimate text. The defense_recovered flag tells you when normalization turned an evasion back into a catch; defended_evaded tells you when the attack slipped through even the defense.

Live demo (runs in your browser)

The Hugging Face Space is a zero-backend build of the same demo: it exports the trained model to JSON (space/model.json) and runs both always-on detectors and all four character attacks entirely client-side — no server, nothing leaves the page. The in-browser scoring replicates scikit-learn's TfidfVectorizer transform and is verified to match the Python service to four decimals. Regenerate the exported model with python scripts/export_static_model.py. (The key-gated detectors and the LLM-based attacks need a backend, so they live only in the API above.)

How it relates to LureBench

LureScope reuses LureBench's detectors and attacks directly (it installs lurebench as a dependency), so the served model and the benchmarked model are the same code — they cannot drift. LureBench is where you measure detectors across a corpus; LureScope is where you serve one, probe it on a single message, and stress it against attacks and defenses interactively.

Responsible use

This is a defensive research tool. It scores text you supply and demonstrates evasion against your own detectors; it does not generate deliverable lures, personalize to real targets, or embed working links or payment rails. See LureBench's DATA.md for the data and generation ethics that underpin the bundled model.

Contributing

Contributions are welcome, especially new defenses and corrections to published numbers. See CONTRIBUTING.md for the development setup and the parity bar for the browser build, CODE_OF_CONDUCT.md for community expectations, and SECURITY.md for what counts as a vulnerability here (the attacks working is not one). Release history is in CHANGELOG.md.

Citing

If you use LureScope in your work, see CITATION.cff. Archived releases carry a DOI: cite the concept DOI 10.5281/zenodo.21631787, which always resolves to the latest version.

License

Apache-2.0.