🤖 AI

A Robust and Explainable Transformer-Based Framework for Phishing Email Detection

This paper proposes a robust and explainable phishing email detection framework that combines adversarial training on a DistilBERT model with integrated XAI methods and a Flan-T5 generator to produce accurate, resilient, and transparent, evidence-based explanations.

Original authors: Sajad U P

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sajad U P

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your email inbox is a busy airport, and every message is a passenger trying to board a flight. Most passengers are friendly locals (legitimate emails), but some are impostors wearing disguises, trying to sneak in and steal your luggage (phishing emails).

For years, the security guards at this airport (traditional spam filters) used a simple checklist: "If the passenger says 'free money,' stop them." But the impostors got smart. They started changing their clothes, swapping letters in their names (like writing "G00gle" instead of "Google"), or whispering their lies in a way that sounded normal. The old guards couldn't tell the difference.

This paper introduces a new, super-smart security system built on three main ideas: a smarter guard, a tougher training camp, and a friendly guide to explain the decision.

1. The Smarter Guard: DistilBERT

The paper uses a model called DistilBERT. Think of this as a highly educated security guard who has read millions of books and understands the context of a sentence, not just the words.

The Problem: While this guard is very smart, it's also a bit of a "black box." You can't ask it why it stopped someone; it just says, "No." Also, if an impostor changes just one letter in their name, the guard might get confused and let them through.
The Solution: The researchers kept this smart guard but gave it a special training regimen to make it tougher and more transparent.

2. The Tougher Training Camp: Adversarial Training

To make the guard unshakeable, the researchers put it through a "boot camp" designed to break it, so it can learn to survive.

The "FGM" Drill (Embedding Level): Imagine the guard is learning to recognize a face. The trainers take the guard's mental image of a face and slightly blur or distort it (mathematically) to see if the guard still recognizes the person. This is called FGM. It teaches the guard to focus on the essence of the person, not just the perfect lighting.
The "Character Noise" Drill (Surface Level): Then, they take the actual text of the emails and start messing with it. They swap an "o" for a "0," delete a letter, or add a random character. This simulates the real-world tricks scammers use.
The Result: By training on these "broken" and "distorted" emails, the guard learns to ignore the noise. Even if a scammer writes "Acc0unt" instead of "Account," the guard knows it's still a suspicious account. The paper shows that while a normal guard's accuracy drops from 98% to 54% when faced with these tricks, this trained guard stays strong at 93%.

3. The Friendly Guide: Explainable AI (XAI)

Even if the guard is perfect, you still need to know why they stopped someone. If a guard just yells "Stop!" without a reason, you might get angry or confused.

The Problem: Usually, AI models just give a "Yes/No" answer.
The Solution: The researchers added a "Friendly Guide" (using a tool called Flan-T5).
- First, the system uses three different "detective tools" (called LIME, SHAP, and IG) to highlight exactly which words made the guard suspicious. Did the email say "Urgent"? Did it ask for your password?
- Then, the Friendly Guide takes those highlighted words and writes a simple, plain-English sentence for you.
- Example: Instead of a confusing code, the system tells you: "This email was flagged as a scam because it uses urgent language like 'immediate action' and asks you to click a link to reset your password."

How It All Works Together

The paper describes a pipeline that looks like this:

Input: An email arrives.
The Guard: The DistilBERT model reads it. Because of its special training, it isn't fooled by typos or weird symbols.
The Detectives: If the guard is suspicious, the detective tools (LIME, SHAP, IG) point out the specific words that triggered the alarm.
The Guide: The Friendly Guide translates those technical points into a short, human-readable story explaining the risk.

What the Paper Found

It's Tougher: The new system didn't just get better at spotting scams; it got much better at spotting tricky scams that try to hide by changing letters.
It's Clearer: When the system makes a mistake (like flagging a real urgent email as a scam), the explanation helps you understand why it happened (e.g., "It thought the word 'urgent' was a scam tactic"). This helps users trust the system more.
It's Fast: Because they used "DistilBERT" (a lighter, faster version of the big AI models), this system can run quickly without needing a supercomputer.

The Bottom Line

This paper presents a security system that is stronger against tricks, faster to run, and honest about its reasoning. It bridges the gap between a powerful computer brain and a human user who just wants to know, "Is this email safe?" without needing a degree in computer science.

Technical Summary: A Robust and Explainable Transformer-Based Framework for Phishing Email Detection

Problem Statement
Phishing attacks remain a persistent and sophisticated cyber threat, increasingly leveraging AI to mimic trusted sources and exploit human vulnerabilities. While Transformer-based models (e.g., BERT, DistilBERT) have demonstrated superior performance in capturing contextual linguistic patterns for phishing detection, they suffer from two critical limitations: a lack of interpretability (operating as "black boxes") and vulnerability to adversarial perturbations. Recent adversarial attacks, including minor character-level modifications and embedding-level manipulations, can easily bypass standard detection mechanisms. Furthermore, existing research often addresses robustness and explainability in isolation, leaving a gap between model reliability and user trust.

Methodology
The paper proposes a unified, lightweight, end-to-end framework centered on DistilBERT (a distilled, efficient variant of BERT) to address these challenges through three integrated components:

Hybrid Robustness Training:
To enhance resilience against both embedding-level and surface-level attacks, the authors employ a dual-strategy training approach:
- Embedding-Level Adversarial Training: Utilizing the Fast Gradient Method (FGM), the model is trained with gradient-based perturbations applied directly to token embeddings. This smooths the decision boundary in the continuous embedding space.
- Character-Level Noise Augmentation: Stochastic perturbations (insertion, deletion, and substitution of characters, including visually similar replacements like 'o'→'0') are applied to 30% of training samples prior to tokenization. This simulates real-world evasion tactics and forces the model to learn robust subword and contextual representations.
- Optimization: The model minimizes a composite loss function ( $L_{total} = L_{clean} + \lambda L_{adv}$ ) where $\lambda=0.5$ , balancing standard classification accuracy with adversarial resilience.
Explainable AI (XAI) Integration:
To improve transparency, the framework integrates three local attribution methods: LIME (Local Interpretable Model-agnostic Explanations), SHAP (SHapley Additive exPlanations), and IG (Integrated Gradients). These methods quantify the importance of specific tokens in the model's decision-making process. The study conducts a comparative evaluation of these methods under input perturbations to assess explanation stability.
Natural Language Explanation Generation:
To bridge the gap between technical feature attributions and user understanding, the framework uses Flan-T5-Small, a lightweight instruction-tuned sequence-to-sequence transformer. LIME-derived top influential tokens, their attribution scores, and the model's prediction confidence are formatted into structured, rule-based prompts. Flan-T5-Small then generates concise, plain-language, evidence-based narratives explaining why an email was flagged as phishing or legitimate.

Key Contributions
The paper outlines four primary contributions:

Enhanced Hybrid Robustness: Demonstrates that combining FGM-based embedding training with character-level noise augmentation significantly improves DistilBERT's resilience to character-level perturbation attacks, offering a computationally efficient alternative to multi-step adversarial defenses.
Comparative XAI Evaluation: Provides a systematic comparison of LIME, SHAP, and IG under realistic input distortions, quantifying the interpretability and qualitative robustness of attribution methods.
Evidence-Grounded Explanations: Establishes a layer that converts technical feature attributions into human-readable narratives using Flan-T5-Small, directly grounding explanations in model evidence rather than static alerts.
End-to-End Framework: Unifies robust training, XAI, and natural language rationalization into a deployable pipeline that addresses the trade-off between model robustness and user trust.

Experimental Results
The framework was evaluated on a public phishing email dataset (approx. 18,650 samples) and validated on a cross-domain dataset (CEAS 08 subset).

Robustness: Under increasing character-level noise (up to 20% corruption), the proposed framework maintained 93.2% accuracy, a drastic improvement over the baseline DistilBERT, which dropped to 54.5%. The hybrid approach reduced the accuracy drop from clean data to 20% noise to only 4.9 percentage points, compared to 43.5 points for the baseline.
Explanation Stability: Qualitative analysis showed that while baseline models exhibited volatile token attributions and polarity reversals under minor text modifications, the proposed framework maintained stable attribution patterns, relying on semantically meaningful indicators rather than fragile surface cues.
User Study: A pilot study with 30 participants using a web-based prototype yielded high scores for Decision Clarity (Mean: 4.34/5) and Information Focus (Mean: 4.22/5), indicating that the generated explanations were perceived as clear and relevant.
Cross-Domain Generalization: On the CEAS dataset, the proposed framework maintained 95.7% accuracy at 20% noise, compared to the baseline's 67.6%, demonstrating strong generalization capabilities.

Significance and Claims
The authors claim that this integrated approach effectively bridges the gap between model reliability and user trust. By simultaneously addressing adversarial robustness and interpretability, the framework advances the state of transparent phishing detection. The paper emphasizes that the proposed method is not merely a detection tool but a decision-support system that enhances transparency, allowing users to understand the rationale behind security alerts. The authors modestly note that while the framework improves resilience to common obfuscation tactics, it does not fully capture optimized adversarial attacks or sophisticated semantic paraphrasing, and future work is needed to address these evolving threats. The study strictly positions its adversarial techniques as defensive measures to enhance system resilience against malicious actors.