隨著大型語言模型（LLMs）的快速崛起，釣魚郵件攻擊的技術門檻大幅降低，而現有基於預訓練語言模型的偵測系統是否能有效應對 LLM 動態生成的高品質對抗樣本，仍是尚待系統性探索的研究缺口。本研究提出一套三階段對抗式強化學習框架，以 Vicuna-7B-v1.5 為生成骨幹、DeBERTa-v3-base 為判別骨幹，從攻擊者視角系統性揭示現代語意釣魚郵件偵測模型之防禦邊界。 本框架依序包含三個訓練階段：第一，以兩階段漸進式微調策略（Head-only Training 結合 Progressive Unfreezing）訓練 DeBERTa 判別器，搭配溫度縮放（T=1.5）進行事後置信度校準，最終 F1 分數達 96.54%，準確率達 96.91%；第二，以 LoRA-SFT 對 Vicuna-7B 進行領域適應訓練；第三，以 PPO 演算法進行對抗強化學習，以校準後的DeBERTa 輸出機率作為獎勵訊號，並引入 KL 散度約束（target_kl=0.1）防止語言品質退化。 三階段消融實驗結果顯示，逃逸成功率（ASR）由 Base Vicuna 的 35.00% 逐步提升至 SFT 後的 38.67%（+3.67%），再至 PPO 後的 43.67%（+5.00%） 。語意質化分析進一步揭示，PPO 訓練使生成模型習得三項跨情境語義隱寫策略：以技術必要性包裝行動指令、以具名人員與具體日期提升可信度，以及以中性語氣取代威脅性措辭。本研究實驗結果表明，當釣魚意圖被有效嵌入符合正常語言分佈的語境時，基於統計學習的判別器難以有效識別，為未來設計更具韌性的釣魚郵件偵測系統提供了具體的實驗依據。;The rapid advancement of large language models (LLMs) has substantially lowered the technical barrier for phishing attacks， yet it remains an underexplored research gap whether existing pretrained language model-based detection systems can effectively counter high-quality adversarial samples dynamically generated by LLMs. This study proposes a three-stage adversarial reinforcement learning framework that preliminarily evaluates the defensive resilience of static semantic phishing email detection models of modern semantic phishing email detection models from an attacker′s perspective， employing Vicuna-7B-v1.5 as the generative backbone and DeBERTa-v3-base as the discriminative backbone. The framework proceeds through three sequential training stages. First， a DeBERTa discriminator is trained using a two-stage progressive fine-tuning strategy combining Head-only Training with Progressive Unfreezing， supplemented by post-hoc confidence calibration via temperature scaling (T=1.5)， achieving an F1 score of 96.54% and an accuracy of 96.91%. Second， LoRA-SFT domain adaptation is applied to Vicuna-7B. Third， adversarial reinforcement learning is conducted using the Proximal Policy Optimization (PPO) algorithm， with calibrated DeBERTa output probabilities serving as reward signals and KL divergence constraints (target_kl=0.1) incorporated to prevent linguistic quality degradation. Ablation experiments across three stages demonstrate that the Attack Success Rate (ASR) progressively increases from 35.00% (Base Vicuna) to 38.67% after SFT (+3.67%) and further to 43.67% after PPO (+5.00%). Qualitative analysis further reveals that PPO training enables the generative model to acquire three cross-contextual semantic camouflage strategies: framing action requests through technical necessity， enhancing credibility through named personnel and specific dates， and replacing threatening tones with neutral language. The experimental findings indicate that when phishing intent is effectively embedded within language distributions characteristic of legitimate communication， statistics-based discriminators struggle to achieve reliable detection， providing concrete empirical evidence for the design of more resilient phishing email detection systems.
