Scholarlink

<p>Phishing attacks remain a significant cybersecurity threat, exploiting social engineering techniques to deceive users and steal sensitive information. Traditional phishing detection mechanisms based on machine learning and deep learning often rely on centralized data collection, raising privacy concerns and limiting adaptability to diverse user environments. Recent advancements in large language models (LLMs) have introduced new opportunities for phishing detection by leveraging multimodal data, yet existing approaches primarily depend on commercial LLMs, which increase operational costs and potentially compromise user privacy. To address these challenges, we propose <i>FedPhishLLM</i>, a privacy-preserving and explainable phishing detection framework that integrates federated learning (FL) with fine-tuned multimodal LLMs. Our approach enables decentralized model training, allowing users to collaboratively improve phishing detection without sharing raw data, thereby preserving privacy while maintaining high detection accuracy. <i>FedPhishLLM</i> enhances explainability by providing phishing explanations, including brand identification and intent recognition, fostering user trust and informed decision-making. Experimental results confirm that our framework outperforms all baseline models, achieving up to 95% accuracy, precision, and F1-score with 96% recall. Further analyses validate the rationality of chosen training parameters and prompting strategies, demonstrate the complementary value of multimodal phishing indicators, and highlight the framework’s adaptability to linguistic heterogeneity as well as resilience against adversarial and evasive attacks. To the best of our knowledge, <i>FedPhishLLM</i> is one of the first FL-based multimodal LLM approaches for phishing detection, offering a scalable, privacy-conscious, and explainable security solution practical for real-world deployments.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

FedPhishLLM: A privacy-preserving and explainable phishing detection mechanism using federated learning and LLMs

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年10月14日

查看全文
  • Wenhao Li,
  • Selvakumar Manickam,
  • Yung-Wey Chong

摘要

Phishing attacks remain a significant cybersecurity threat, exploiting social engineering techniques to deceive users and steal sensitive information. Traditional phishing detection mechanisms based on machine learning and deep learning often rely on centralized data collection, raising privacy concerns and limiting adaptability to diverse user environments. Recent advancements in large language models (LLMs) have introduced new opportunities for phishing detection by leveraging multimodal data, yet existing approaches primarily depend on commercial LLMs, which increase operational costs and potentially compromise user privacy. To address these challenges, we propose FedPhishLLM, a privacy-preserving and explainable phishing detection framework that integrates federated learning (FL) with fine-tuned multimodal LLMs. Our approach enables decentralized model training, allowing users to collaboratively improve phishing detection without sharing raw data, thereby preserving privacy while maintaining high detection accuracy. FedPhishLLM enhances explainability by providing phishing explanations, including brand identification and intent recognition, fostering user trust and informed decision-making. Experimental results confirm that our framework outperforms all baseline models, achieving up to 95% accuracy, precision, and F1-score with 96% recall. Further analyses validate the rationality of chosen training parameters and prompting strategies, demonstrate the complementary value of multimodal phishing indicators, and highlight the framework’s adaptability to linguistic heterogeneity as well as resilience against adversarial and evasive attacks. To the best of our knowledge, FedPhishLLM is one of the first FL-based multimodal LLM approaches for phishing detection, offering a scalable, privacy-conscious, and explainable security solution practical for real-world deployments.