Naive Bayes model

Training emails—
Vocabulary size |V|—
P(phishing) prior—

Add training example

Stream control

Last classified email

Verdict—
P(phishing | words)—
log P(phish) − log P(legit)—
Tokens scored—
—
Multinomial Naive Bayes: for class c, log P(c|email) ∝ log P(c) + Σ log P(word|c). Each P(word|c) uses Laplace (add-α) smoothing: (count(word,c)+α) / (total words in c + α·|V|). Log-probabilities are summed (never multiplied) to avoid floating-point underflow, then the two class log-scores are converted to a genuine posterior via a numerically-stable softmax normalisation. Bars show each token's log-likelihood ratio log P(word|phishing) − log P(word|legit): red pushes toward phishing, green toward legit. Words never seen in training are skipped (no evidence either way).