-
-
The SecondLook workspace: inspect a message before clicking, paying or sharing a code.
-
A synthetic scholarship request with payment, deadline and confidentiality cues.
-
Scholarship evidence: observable requests alongside transparent model contributions.
-
A synthetic delivery message with payment pressure and an unusual URL.
-
Delivery evidence: links remain plain text and are never opened by SecondLook.
-
A synthetic account-support request for a password and verification code.
-
Account evidence and a plan to verify through a contact you already trust.
-
An ordinary study-group message for comparison with suspicious requests.
-
Fewer cues do not prove safety or verify the identity of the sender.
-
Short or unfamiliar text suppresses the model score and explains its limits.
-
The verification guide: pause, find a trusted channel and confirm the exact request.
-
Model transparency: historical SMS evaluation, feature explanations and limitations.
-
Architecture: trained TF-IDF model, local browser inference and independent request cues.
-
Evidence and practical next steps are shown together for a clearer decision.
-
The responsive mobile workflow, presented from an actual narrow-screen app capture.
Source
Try SecondLook · Public source
Inspiration
A scholarship offer. A missed delivery. A message that looks like it came from university support. Students receive requests like these in the same inbox as legitimate opportunities. The hard part is deciding what to do before clicking, paying, or sharing a code.
SecondLook adds a pause between a convincing message and a consequential action. It directly addresses ForgeHacks’ AI + Cybersecurity prompt: helping people recognize and verify scams, impersonation, and fraud enabled by modern technology.
What it does
Paste an English message, read the observable cues, inspect the trained model’s evidence, and follow an independent verification plan. Payment requests, urgency, access-code requests, secrecy, and unverified link structure are explained in plain language. Links in the message are displayed as text and never opened.
The target users are students and everyday readers who want a quick, private way to understand a suspicious request. No login, message upload, or paid AI subscription is needed. Messages remain in memory in the browser and are cleared on reload. Ordinary static-host access logs still apply.
How we built it
The AI is a trained classifier, not a chatbot wrapper. A reproducible Python pipeline normalizes and deduplicates the licensed UCI SMS Spam Collection before a stratified 80/20 split. TF-IDF word unigrams and bigrams feed a logistic regression model. Its 9,819 learned features and parameters are exported to a static JSON artifact.
A JavaScript engine performs the same inference on the user's device. It exposes the positive feature contributions behind the spam-pattern score. Independent deterministic request cues and URL-structure checks run beside the model. The interface combines this evidence into a verification workflow without declaring a message safe or authentic.
The frontend uses semantic HTML, CSS, and JavaScript. Vercel serves static files; there is no inference backend, remote model API, account database, or embedded secret. Documentation includes the architecture, dataset attribution, security boundaries, evaluation, and runnable tests.
Technical validation
On 1,026 held-out historical SMS messages, the classifier achieved 97.17% spam precision, 81.75% spam recall, and 88.79% F1 at threshold 0.5. The confusion matrix includes 3 false positives and 23 false negatives. Every held-out JavaScript probability matches Python within 1e-10.
Browser checks cover the main examples, empty input, clear, unsupported text, injected markup, responsive layout, and console errors. Four tested interface states had no automated WCAG 2.0/2.1 AA violations. This is evidence of targeted testing, not accessibility certification or an independent penetration test.
Challenges we ran into
A spam dataset is not a fraud dataset. Its old language and SMS format are not representative of modern AI impersonation. We kept that distinction visible rather than presenting a confident “scam probability.” Short, unfamiliar, and detected non-English messages suppress the model score and explain the limitation.
We also had to preserve numerical parity across Python and JavaScript, prevent copied content from becoming executable HTML, and keep old results from remaining visible after a message changes. Request cues can also appear in legitimate messages; their presence is explained as a reason to verify, not proof of wrongdoing.
Accomplishments and learning
We shipped a real local AI model, reproducible evaluation, transparent evidence, a practical verification guide, and an accessible responsive interface. The key lesson was that responsible uncertainty is part of product design. A user needs a next step more than an impressive-looking score.
Real-world impact
SecondLook can help readers slow down and check a request through a known contact or official app. That is the intended benefit; we have not conducted a user study, measured prevented fraud, or established accuracy on current phishing. It cannot verify identity, inspect a linked website, or detect whether text was generated by AI.
Team and responsibilities
Adeel Falak Sher: assigned product direction, frontend experience, user flow, and presentation responsibilities.
Rauf Khalid: assigned ML evaluation, security review, and demo verification responsibilities.
Implementation and documentation were AI-assisted. These assigned roles do not assert independently verified past contributions.
What's next
Test with consenting students, evaluate modern independently labeled scam messages, group near-duplicate templates before splitting, measure false-alarm rates, and support additional languages. Keep the privacy-first runtime and avoid turning uncertainty into a false safety guarantee.
Track and built with
AI + Cybersecurity
Python, scikit-learn, NumPy, TF-IDF, logistic regression, NLP, JavaScript, HTML5, CSS3, Vercel, Playwright, axe-core, HyperFrames.
Dataset: Almeida & Hidalgo (2011), UCI SMS Spam Collection, DOI 10.24432/C5CC84, CC BY 4.0.
Log in or sign up for Devpost to join the conversation.