An AI spam filter inside your mailbox, trained only by you

The spam filter in a Nisdos Mail mailbox is a machine-learning classifier that lives inside the mailbox itself, encrypted with the same key as your messages, and it learns from exactly one source: the mail you mark as spam and the mail you mark as not spam. Nothing else trains it. No shared corpus, no cross-account signals, no profile of you sitting in a database somewhere with a retention policy attached.

We shipped it in July 2026 with a status page attached, because a filter that makes decisions about your mail owes you an explanation of how it made them.

How do AI spam filters normally work?

On the provider’s servers, over everyone’s mail at once. Gmail’s filter is the reference implementation of that approach: a model trained continuously across an enormous corpus of messages, which is why it is very good and why it improves for you when a stranger in another country reports a campaign. The mail is the training data, and the machinery has to read it to work.

That is honest engineering with a real cost. The catch rate comes from centralisation, so the filter cannot be moved into your mailbox without giving up the thing that makes it strong. You also cannot inspect it, correct it in any durable way, or take it with you.

What does a per-mailbox filter do differently?

It trades the global corpus for your own judgement, and it keeps the model where your mail is. The classifier is a naive-Bayes text model — well-understood statistics, small enough to sit beside your mailbox state — over tokens taken from the subject and the visible body text, plus a few structural hints such as the sender’s domain and whether a message has an attachment.

The model is stored as one data-plane object written through the same encryption seam as your messages, so it inherits your mailbox’s custody tier. Under device custody the server cannot read it at all. It is also fully rebuildable from your labelled mail, which means losing it is an inconvenience rather than data loss.

The trade is worth naming plainly: a personal model starts from nothing and knows only what you taught it, so it will never match Gmail’s cold-start catch rate on a brand-new mailbox. What it does instead is learn your notion of unwanted, which a global model structurally cannot. The recruiter blast one person files instantly is mail somebody else waits for.

How does it learn what you consider spam?

From two clicks. “Mark as spam” teaches it spam, “Not spam” teaches it wanted mail, and reversing a label untrains the earlier lesson. Marking is idempotent — the model records which messages taught it, so retraining the same mail twice does not double its weight.

It never learns from its own verdicts. Auto-learning from a threshold sounds efficient and quietly reinforces its own mistakes; one bad call becomes a bias. Explicit human actions only.

There is also a cold-start gate: the classifier scores nothing until it has 20 marked-spam and 20 marked-wanted examples. Below that, delivery behaves exactly as it did before the feature existed. The product’s own wording for this is the plainest version: it needs 20 of each before it starts scoring, so that a couple of clicks can never mislabel your inbox.

Once it is active, its opinion enters as a weighted signal rather than a separate verdict. High confidence — 95 percent or more likely spam — carries weight 4, which flags a message as suspicious on its own and files it to Spam alongside any second signal, first contact from a stranger being the usual one. Moderate confidence carries weight 2, sharpening whatever else fired. The thresholds are fixed: 3 warns, 5 files.

What else is checking your mail?

Three layers around the classifier, all folding into the same score with the same explainable reason codes.

Content heuristics look for evasion rather than topic: HTML text hidden from the reader by zero font sizes, off-screen positioning or background-coloured type, subject lines that spell ASCII words with mixed-script homoglyphs, bodies that are essentially one image with no readable text, links laundered through URL shorteners. These are individually weak and deliberately soft-weighted; they exist to stack.

Reputation checks are the operator’s call and off by default: an IP blocklist at the receiving edge, a link-domain blocklist, and a check for sender domains registered in the last 30 days. Off means off — unset configuration produces zero DNS queries. When enabled, these lookups do reveal the sender’s address to the blocklist operator, which is exactly why they are opt-in rather than a default.

Bulk fingerprinting counts fan-out without any external service. The backend normalises a message body, hashes it, and keeps a one-hour in-memory window of which fingerprints hit how many distinct mailboxes; past five, later copies pick up a bulk signal. Nothing is persisted, a restart clears it, and subscribed mailing lists are exempt because a popular list legitimately sends identical bodies to many people.

Above all of it, your allowlist wins. An allowed sender’s spam-side signals are vetoed outright. Fraud signals survive the veto — a failed DMARC check or a spoofed display name still stands — because otherwise allowlisting your bank would be a licence for anyone to impersonate it. Blocking a sender produces a decisive reason code instead of a silent overlay, so the banner can tell you that you blocked this sender rather than leaving you to guess.

Can you watch what it learned?

Yes, and that page is the part I would show anyone sceptical about the word AI here. Settings then Spam — reached from the Spam folder’s own context menu, since the folder is where you argue with the filter — reports the model explaining itself: training counts against the gate, vocabulary size and which way it leans, the tokens pulling hardest towards spam with the exact odds the classifier sums, how much mail it examined and filed, why each message currently in Spam is there in the same sentences the reader’s warning banner uses, and a 30-day arrival chart. Thirty days because that is as far back as the Spam folder itself remembers, so the window cannot imply data that was already swept.

Two invariants hold that page together. Nothing about your mail is stored or profiled to produce it: no counters, no analytics rows, no cache — opening the page is what computes it, from your own index and model. And it never presents a partial count as a total; past a row cap it says which slice it counted.

A filter you can read is a filter you can correct. That is most of the argument for keeping it in the mailbox.