Fine-tuned LLMs for phishing detection show a dissociation between self-consistent explanations and classification accuracy, with Llama models scoring high on CC-SHAP but low on phishing detection while Wizard scores the reverse.
An Explainable Transformer-based Model for Phishing Email Detection: A Large Language Model Approach
1 Pith paper cite this work. Polarity classification is still indexing.
abstract
Phishing email is a serious cyber threat that tries to deceive users by sending false emails with the intention of stealing confidential information or causing financial harm. Attackers, often posing as trustworthy entities, exploit technological advancements and sophistication to make detection and prevention of phishing more challenging. Despite extensive academic research, phishing detection remains an ongoing and formidable challenge in the cybersecurity landscape. Large Language Models (LLMs) and Masked Language Models (MLMs) possess immense potential to offer innovative solutions to address long-standing challenges. In this research paper, we present an optimized, fine-tuned transformer-based DistilBERT model designed for the detection of phishing emails. In the detection process, we work with a phishing email dataset and utilize the preprocessing techniques to clean and solve the imbalance class issues. Through our experiments, we found that our model effectively achieves high accuracy, demonstrating its capability to perform well. Finally, we demonstrate our fine-tuned model using Explainable-AI (XAI) techniques such as Local Interpretable Model-Agnostic Explanations (LIME) and Transformer Interpret to explain how our model makes predictions in the context of text classification for phishing emails.
citation-role summary
citation-polarity summary
fields
cs.CR 1years
2025 1verdicts
CONDITIONAL 1roles
background 1polarities
background 1representative citing papers
citing papers explorer
-
Evaluating Large Language Models for Phishing Detection, Self-Consistency, Faithfulness, and Explainability
Fine-tuned LLMs for phishing detection show a dissociation between self-consistent explanations and classification accuracy, with Llama models scoring high on CC-SHAP but low on phishing detection while Wizard scores the reverse.