A good spam filter works so quietly that you forget it exists. Every day it decides whether each email belongs in your inbox or the junk folder. This is a classic machine-learning problem: text classification. Understanding how it works shows many of the ideas used in language processing generally.
The task
Given an email, predict one of two labels: spam or ham (legitimate). The model learns from a collection of emails already labelled by humans or by user actions, such as clicking "report spam".
Why rules alone fail
Early filters used rules like "block messages containing 'lottery winner'". Spammers simply wrote "l0ttery w1nner". Rules are also hard to maintain. Learning-based filters pick up many weak signals at once and adapt when you retrain them with new examples.
Turning text into numbers
Models need numeric input. The common first step is a bag-of-words representation: count how often each word appears, ignoring order. More refined is TF-IDF, which gives higher weight to words that are frequent in a message but rare in the whole collection, such as "claim" or "prize" in spam.
Useful additional features include:
- Presence of links, especially mismatched link text and destination
- Number of exclamation marks and capital letters
- Sender domain age and authentication results (SPF, DKIM and DMARC)
- Attachments and file types
- Time and volume patterns of sending
- Whether the recipient has corresponded with the sender before
Naive Bayes: the classic spam model
Naive Bayes estimates the probability that an email is spam given the words in it, using Bayes' theorem. It assumes words are independent given the class, which is not true in language but works surprisingly well for text. It is fast, needs little data and handles many features.
Intuitively, it multiplies together how typical each word is of spam versus ham. Words like "free" and "winner" push the score toward spam; words like "meeting" and "invoice" from known contacts push it toward ham.
Other models
- Logistic regression and support vector machines often give strong results on TF-IDF features.
- Gradient boosting can combine text scores with metadata features.
- Neural networks and transformers capture context and are used by large providers, especially against sophisticated phishing.
Build a small spam classifier
This example uses scikit-learn with a tiny dataset to show the full pipeline. A real project would use thousands of emails.
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.naive_bayes import MultinomialNB
from sklearn.pipeline import make_pipeline
from sklearn.model_selection import train_test_split
from sklearn.metrics import classification_report
texts = [
"Congratulations you won a free prize claim now",
"Win cash instantly click this link",
"Cheap loans approved no documents needed",
"Limited offer free gift card just for you",
"Meeting moved to 3 pm tomorrow",
"Please find the invoice attached for March",
"Can you review my report before Friday",
"Lunch with the team on Thursday?",
"Exclusive deal buy now and get a free bonus",
"Minutes of the project meeting are attached",
]
labels = ["spam", "spam", "spam", "spam", "ham", "ham", "ham", "ham", "spam", "ham"]
X_train, X_test, y_train, y_test = train_test_split(
texts, labels, test_size=0.3, random_state=3, stratify=labels)
model = make_pipeline(TfidfVectorizer(lowercase=True, stop_words="english"), MultinomialNB())
model.fit(X_train, y_train)
print(classification_report(y_test, model.predict(X_test), zero_division=0))
print(model.predict(["Claim your free reward today", "Agenda for tomorrow's meeting"]))With so little data the metrics are not meaningful, but the structure (vectorise, train, evaluate, predict) is the same in production systems.
Measuring the filter
Accuracy is not enough. Two errors matter very differently:
- False positive: a real email marked as spam. This can be costly, since you might miss a job offer or invoice.
- False negative: spam in the inbox. Annoying and sometimes dangerous (phishing).
Providers tune thresholds to keep false positives extremely low and send uncertain messages to a spam folder instead of deleting them. Metrics include precision, recall, F1 and the confusion matrix.
The arms race
Spammers constantly adapt, using tricks such as:
- Misspellings and special characters to evade word matching
- Images containing text
- Hidden text and random words to confuse statistics ("Bayesian poisoning")
- Compromised legitimate accounts
- Short-lived domains and rapid-changing links
Defenders respond by retraining frequently, using user feedback, sharing threat intelligence and checking sender reputation and authentication.
Privacy and fairness
Email content is private. Providers process it automatically, often under policy and legal limits. Filters can also misclassify messages in minority languages or unusual writing styles, which is why transparent appeal options and the ability to check the junk folder matter.
Protecting yourself
- Do not click links or open attachments from unexpected senders.
- Check the sender's real address, not only the display name.
- Be wary of urgency, threats and requests for money or credentials.
- Enable multi-factor authentication.
- Report spam and phishing so filters learn.
- Occasionally check your spam folder for legitimate messages.
Frequently Asked Questions
Why does some spam still reach my inbox?
New campaigns can look legitimate until enough people report them. Filters trade off between catching spam and avoiding false alarms.
Why do real emails go to spam?
The message may resemble spam in wording, come from a new or poorly configured sender, or lack authentication such as SPF and DKIM.
Is Naive Bayes still used?
Often as part of larger systems or as a fast baseline, alongside more advanced models.
Can I train my own filter?
Yes. With a labelled dataset and a library like scikit-learn you can build one, though large providers have far more data and signals.
Conclusion
Spam filters learn from labelled examples, converting text and metadata into features and predicting spam with models from Naive Bayes to transformers. Because attackers adapt, they must be measured carefully and retrained continuously.