Doppel AI Defense System: Automating Threat Detection with GPT-5 and o4-mini

Doppel has launched an AI-powered defense system that leverages OpenAI's GPT-5 and o4-mini models to autonomously detect, classify, and remove deepfakes and impersonation sites. This system addresses the scale of generative AI-driven threats by reducing analyst workloads by 80%, tripling threat-handling capacity, and cutting response times from hours to minutes.

Automated Threat Detection and Response

Doppel's system replaces traditional manual review processes with an LLM-driven pipeline that can combat attacks at internet scale. Because attackers can now generate infinite variants of phishing kits and spoofed domains almost instantly, Doppel uses AI to automate decision-making to act within the narrow window before damage occurs.

The LLM-Driven Detection Pipeline

Doppel utilizes a multi-stage orchestration of OpenAI models to process millions of daily signals:

  • Signal Filtering: OpenAI o4-mini is used alongside heuristics to filter noise and extract structured features from millions of domains, URLs, and accounts.
  • Parallel Threat Confirmation: Multiple GPT-5 prompts analyze signals for brand misuse, social engineering patterns, and impersonation risk.
  • Threat Classification: An RFT-tuned version of o4-mini synthesizes these confirmations to label threats as malicious, benign, or ambiguous.
  • Final Verification: A second GPT-5 pass validates the decision and generates a natural-language justification.
  • Human Review: Low-confidence or conflicting results are routed to human analysts, whose decisions are then fed back into the system to improve future accuracy.

Improving Consistency via Reinforcement Fine-Tuning (RFT)

To solve the problem of inconsistent judgments on ambiguous threats, Doppel implemented Reinforcement Fine-Tuning (RFT). By using analyst data as a feedback source, each classification decision became a graded example that trained the model to replicate expert human judgment.

Working with OpenAI's applied engineering team, Doppel developed grader functions that rewarded models for both accuracy and the quality of their reasoning. This process ensures that the automated system remains consistent and reliable even when facing complex edge cases.

Operational Transparency and Trust

Automation is paired with transparency to ensure organizational trust. Every automated takedown now includes an AI-generated justification explaining the specific reasoning behind the removal. This provides customers with immediate insight into why an action was taken, a task that previously required manual analyst intervention.

Performance Metrics

The implementation of the GPT-5 and o4-mini pipeline has resulted in the following operational gains:

  • Analyst Workload: Reduced by 80%.
  • Response Time: Decreased from hours to minutes.
  • Threat Capacity: Tripled.
  • Automation Rate: Most threats are now classified automatically.

Future Roadmap

Having automated the handling of phishing and impersonation domains, Doppel is expanding this framework to other high-variance channels, including social media and paid advertisements. Future technical milestones include scaling the RFT dataset by an order of magnitude, experimenting with new grading strategies, and utilizing GPT-5 for upstream feature extraction to consolidate pipeline stages.

Sources