What is AI and Machine Learning?
Follow an email detector from examples to predictions, and learn why testing matters.
Learning from examples
Suppose you want to find suspicious emails. One approach is to write a rule: “Flag a message if its sender is on this blocked list.” Another approach is to train a model using examples of both suspicious and ordinary messages. Real services may combine rules and models.
An algorithm is a method or sequence of steps. A learning algorithm builds or adjusts a model. The resulting model uses what it learned when a new message arrives. Do not confuse the method used to learn with the model produced by learning.
Features and labels
A feature is information supplied to the model. A label is the answer attached to an example during supervised learning.
| Example information | Role in our imaginary detector |
|---|---|
| Number of links in a message | Feature |
| Whether sender and reply address differ | Feature |
| Text asking the reader to act urgently | Possible feature |
| A reviewer’s “phishing” or “ordinary” decision | Label |
These are teaching examples, not a reliable detection recipe. A real work email can be urgent. A phishing email can be calm. The model needs useful combinations of evidence rather than a single magic clue.
Google’s supervised learning introduction explains the relationship between features, labels, and predictions.
Training and inference are different
Training changes the model using examples and a learning objective. Inference applies an existing model to an input. Reading a new email usually belongs to inference; it does not automatically mean the model retrains itself.
Open the diagram for a larger view.
During training, feedback changes the model. During normal inference, the model’s learned values usually stay fixed.
Give the model a fair test
A training set helps the model learn. A validation set helps the developer choose between versions. A test set gives a final check using examples kept separate from that development work.
Imagine studying ten questions and then taking an exam containing those exact questions. A high score would not prove you can solve unfamiliar problems. Repeated or closely related examples across the sets can similarly exaggerate a model’s results.
Overfitting means a model fits its training examples too closely and performs poorly on new examples. Generalisation means the learned patterns also work on relevant examples it has not seen. See Google’s guide to separating datasets.
Accuracy can hide a serious failure
Suppose 990 out of 1,000 messages are ordinary. A detector that calls everything ordinary gets 99% accuracy. It also misses all ten attacks.
A false positive is an ordinary message flagged as dangerous. A false negative is a dangerous message missed by the detector. Precision asks how many flagged messages really are attacks. Recall asks how many actual attacks were found. Different mistakes create different costs for users and defenders.
The numbers above are an original teaching example. Google’s classification metrics lesson explains the measures behind it.
Check your understanding
A model scores very well on old emails but misses a new phishing style. What might explain the gap?
The old examples may not represent the new messages. The model could have learned patterns that no longer help. Check the data and missed cases, then update and evaluate the system using suitable separate examples.