US23-Heiding-Devicing-and-Detecting-Phishing-wp.pdf

This paper reports a controlled experiment comparing phishing emails created by LLMs (GPT-4), a human-designed V-Triad model, a combined LLM+V-Triad approach, and a control set; it measures click-through rates (n=112) showing much higher success for V-Triad emails (≈65–79%) versus GPT-only (≈30–45%) and demonstrates that LLMs can both generate convincing phishing and assist in detecting phishing under some prompts, concluding that LLMs lower the bar for scalable, high-quality phishing while also offering potential detection/mitigation utility.