How AI Spam Filters Work: A Middle School Lesson Plan

A parent gets home from work, opens their email, and finds a week’s worth of school permission slips sitting in the junk folder. The filter had decided that “Click here to confirm your child’s field trip” looked suspicious. Nobody told the filter it was wrong. Nobody told the parent to look. That invisible AI decision — made in milliseconds, never announced — is exactly what your students interact with dozens of times a week, without realizing any AI is involved.

The gap is not that teachers have missed something. The gap is that the AI hiding inside everyday tools was never labeled as AI. This post gives you a clean, device-free lesson that makes the filter visible: how it scores each word, why it still fails, and what phishing can do that bulk spam cannot.

TL;DR: An AI spam filter scans every incoming email and assigns it a spam score. It breaks the message into tokens — words, phrases, formatting signals — then checks each against a probability model trained on millions of labeled spam and legitimate emails. Tokens like “free prize” or ”$$$$” raise the score; “meeting agenda” lowers it. If the total crosses a threshold, the email goes to junk. Modern filters like Gmail’s also verify sender identity and use deep-learning models that read sentence meaning, not just keywords.

How does an AI spam filter actually work?

Every email that hits Gmail’s servers runs through a four-step pipeline before it reaches any inbox. Understanding that pipeline is the conceptual core of the lesson.

Step 1 — Tokenize. The filter breaks the email apart: subject line, body, formatting, sender address. Each piece becomes a token — a unit the model can score. “FREE PRIZE!!!” becomes three tokens. “Re: tomorrow’s meeting” becomes three different tokens.

Step 2 — Score each token. The model uses a probability approach called Naive Bayes classification. Every word carries a “spamicity” score between 0 (always appears in legitimate email) and 1 (always appears in spam). It is called “naive” because the model treats each word as independent — it does not read sentence meaning, just individual word probabilities.

Step 3 — Combine the scores. The filter multiplies (or sums, depending on implementation) the individual token scores into a single message score.

Step 4 — Compare to a threshold. If the message score exceeds the threshold, the email routes to junk. If it falls below, it routes to inbox. The threshold is adjustable — that is why corporate filters are stricter than personal ones.

Here is what that looks like with two real-world-style examples. Note: the spamicity values below are illustrative of how Naive Bayes logic works; they are not a live readout from Gmail’s model.

Token	Email A: “YOU WON!!! Claim your FREE prize $$$“	Email B: “Re: tomorrow’s meeting"
"won”	0.92	—
“FREE”	0.95	—
“prize”	0.88	—
”$$“	0.97	—
“re”	—	0.10
”tomorrow’s”	—	0.08
”meeting”	—	0.05
Verdict	Above threshold → SPAM	Below threshold → INBOX

Modern Gmail does not stop at keyword scoring. It layers in sender-authentication checks (SPF, DKIM, and DMARC records verify that the sending server is actually authorized to send mail from that domain), plus transformer-based deep-learning models that read sentence intent rather than individual words. Gmail’s RETVec model, announced in late 2023, also recognizes character-substitution tricks: it reads “fr33” and “FREE” as the same token. The combined system is why Google reports that Gmail blocks “more than 99.9% of spam, phishing and malware” (Google blog, December 2024).

Why spam still slips through — even at 99.9%

Answer first: because the people writing spam adapt faster than the filter retrains. At 99.9% accuracy, Gmail blocks roughly 10 billion spam messages per day — but at that volume, the remaining 0.1% still means millions of messages reaching inboxes every day.

Three failure modes are worth teaching explicitly.

False positives — the filter junks legitimate mail. When a school district sends a permission slip from a domain with low sender reputation (newly registered, or rarely emailed), the filter may assign a high spam score to a perfectly normal message. Teachers who have ever lost a parent reply in their own junk folder have experienced this firsthand. The filter is not broken; it is reasoning from incomplete evidence.

Adversarial evasion — spammers exploit the model’s assumptions. Because Naive Bayes scores individual tokens, spammers learned to substitute characters: “Viagr4” and “fr33 trial” bypass keyword lists that target “Viagra” and “free trial.” Image-based spam takes evasion further — the spammer bakes the message text into a JPEG so the content filter reads a blank image and assigns a near-zero spam score. The text only appears when a human opens the email. Peer-reviewed work on adversarial attacks against spam classifiers documents these techniques systematically (ResearchGate — Adversarial machine learning for spam filters).

The arms race never ends. Filters train on labeled data collected from yesterday’s spam. Spammers change tactics today. By the time the filter retrains, the technique has already circulated. This cycle — model trains, adversary adapts, model retrains — is a live, never-finished process. Students who understand this stop assuming the junk folder is airtight.

The unplugged lesson: “Be the Spam Filter”

No devices required. A typical class finishes in 45 minutes, including a full debrief. The activity is a printed card-sort that asks students to do exactly what the filter does — and then to break their own rules.

Minute-by-minute pacing:

• 0–5 min — Hook. Project two emails side by side. Ask: “Which is spam, and how do you know?” Students call out their reasoning aloud. Do not confirm yet. The goal is surfacing intuition, not accuracy.
• 5–15 min — Card sort. Each group receives ~12 printed email cards. Students sort them into SPAM and INBOX (in mail filtering, legitimate email is called “ham”). While sorting, they circle the specific tokens — words, formatting choices, sender addresses — that tipped the decision.
• 15–25 min — Class token list. Groups report out. The class builds a shared “spamicity” list on the board and votes on a threshold rule: “If 3 or more trigger tokens appear, it goes to junk.”
• 25–35 min — Spammer round. Each group rewrites one of the clearly-spam cards, trying to sneak it past the class’s own threshold rule. They cannot change what the email offers — only how it is written. This is adversarial evasion by doing, and it lands harder than any explanation.
• 35–45 min — Debrief. Which rewrites got through? Which real-looking legitimate cards got wrongly junked (false positive)? What would the filter have to learn to catch the new versions? Why must it keep retraining?

A ready-made printed card set with all 12 email cards, a student sorting sheet, and the debrief discussion guide is available in the Unplugged AI Activities — 10 No-Tech Lessons (Card Sort, Role-Play, Grades 6-7-8) pack. The Advanced Unplugged AI Simulation — 80 Cards, Confusion Matrix, Bias (Grades 6-8) extends the debrief with a printed confusion matrix that makes false positives and false negatives visible as a class data set — the 35–45 minute debrief gets a lot richer when students can see the full 2×2.

Spam, phishing, and why the filter is not enough

Here is the crucial distinction, stated plainly: spam is bulk junk designed to land in as many inboxes as possible; phishing is targeted deception designed to pass the filter and then fool a specific human being.

A phishing email does not want to trigger the spam filter. It deliberately avoids high-spamicity tokens — no “FREE,” no all-caps, no excessive punctuation. It spoofs a trusted sender address (your school’s IT department, a recognizable bank, a parent organization). It looks, at the token level, exactly like legitimate email. Naive Bayes scores it low. It lands in the inbox.

That is why phishing requires human judgment the filter cannot substitute for. The FBI’s Internet Crime Complaint Center (IC3) recorded over 193,000 phishing complaints in the United States in 2024 — the single most-reported cybercrime category (FBI IC3 Annual Report — press release). The volume makes clear that a functioning spam filter does not solve the phishing problem; it just handles the lower-sophistication bulk traffic.

Teaching students to recognize a phishing attempt that already cleared the filter — a mismatched sender domain, an unexpected urgency claim, a link that does not go where it claims — is a digital citizenship skill, not a tech skill. It requires reading critically, not clicking reflexively. That is exactly the same muscle the AI fake news lesson for middle school targets from the misinformation angle. And the identity-forgery version of this problem is the subject of the facial recognition lesson plan for middle school, where students explore how a person can be faked at the input layer, not the filter layer.

What standards does this lesson hit?

Every step of the card-sort maps to at least one anchor standard. The table below shows the connection.

Activity step	Standard	Code
Tokenize/score/threshold pipeline (Steps 1–4)	AI4K12 — Machines learn from data	Big Idea #3 (Learning)
Phishing / false-positive debrief	AI4K12 — AI affects society	Big Idea #5 (Societal Impact)
Card-sort investigation	ISTE Knowledge Constructor — explore real-world issues	ISTE 1.3.d
Spotting phishing that cleared the filter	ISTE Knowledge Constructor — evaluate accuracy, credibility, relevance	ISTE 1.3.b
Digital citizenship / phishing tie-in	ISTE Digital Citizen — safe, legal, ethical online behavior	ISTE 1.2.b
Class threshold-building and debrief discussion	CCSS.ELA-LITERACY — collaborative discussion	CCSS.ELA-LITERACY.SL.7.1
Evaluating email cards for credibility signals	CCSS.ELA-LITERACY — gather info, assess credibility	CCSS.ELA-LITERACY.W.7.8

Standards sources: ISTE Student Standards (ISTE is a registered trademark of the International Society for Technology in Education; these resources are not affiliated with or endorsed by ISTE). AI4K12 Big Ideas: ai4k12.org.

Two standards deserve a second look. CCSS.ELA-LITERACY.W.7.8 asks students to “gather relevant information from multiple sources; assess the credibility and accuracy of each source.” Reading an email card and circling the credibility signals — mismatched sender, urgency language, suspicious link text — is that skill applied to a new text type. And ISTE 1.3.d (build knowledge by “exploring real-world issues and pursuing an inquiry-based strategy”) is exactly what the Spammer Round does: students investigate their own rule by trying to break it.

Get the printed materials for this lesson

Not having a computer science background is not the barrier here. The spam filter lesson works precisely because it needs no code, no devices, and no prior AI knowledge from the teacher. The point is students seeing the machine’s decision process, not running it on a computer. The AI literacy gap — the one that put the permission slip in the junk folder — closes when students understand what the filter is actually doing. That understanding does not require a CS degree to teach.

Three starting points matched to where your class is this week:

1. Entry-level, no-device card-sort — Unplugged AI Activities — 10 No-Tech Lessons (Card Sort, Role-Play, Grades 6-7-8). Includes the spam-filter card-sort and nine additional no-tech AI lessons. PDF, print-and-go.
2. Extended simulation with confusion matrix — Advanced Unplugged AI Simulation — 80 Cards, Confusion Matrix, Bias (Grades 6-8). The 80-card set supports a full false-positive / false-negative debrief and introduces the confusion matrix as a class artifact.
3. Conceptual depth — How AI Works MEGA — 16 Machine Learning and AI Concept Lessons (Grades 6-12). Covers the full AI concept landscape — from probability scoring to deep learning to societal impact — for teachers building a multi-week unit. Browse the full catalog at /shop.

The permission slip was not in junk because anyone failed. It was in junk because an AI made a call nobody announced. Helping students see that call — name it, interrogate it, understand when it fails — is the lesson. You have everything you need to teach it without writing a single line of code.

This post was drafted with AI assistance and human-finalized.