Small Language Models for Phishing Website Detection: Cost, Performance, and Privacy Trade-Offs

2025/11/19 by Goldenits, Georg, Koenig, Philip, Raubitzek, Sebastian +1
Computer Science · Social Sciences · #Advanced Malware Detection Techniques #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Misinformation and Its Impacts #Spam and Phishing Detection

paper · doi:10.48550/arxiv.2511.15434

openalex publication_date 2025/11/19 · openalex created_date 2025/11/23 · openalex updated_date 2026/07/28

Abstract

Phishing websites pose a major cybersecurity threat, exploiting unsuspecting users and causing significant financial and organisational harm. Traditional machine learning approaches for phishing detection often require extensive feature engineering, continuous retraining, and costly infrastructure maintenance. At the same time, proprietary large language models (LLMs) have demonstrated strong performance in phishing-related classification tasks, but their operational costs and reliance on external providers limit their practical adoption in many business environments. This paper investigates the feasibility of small language models (SLMs) for detecting phishing websites using only their raw HTML code. A key advantage of these models is that they can be deployed on local infrastructure, providing organisations with greater control over data and operations. We systematically evaluate 15 commonly used Small Language Models (SLMs), ranging from 1 billion to 70 billion parameters, benchmarking their classification accuracy, computational requirements, and cost-efficiency. Our results highlight the trade-offs between detection performance and resource consumption, demonstrating that while SLMs underperform compared to state-of-the-art proprietary LLMs, they can still provide a viable and scalable alternative to external LLM services. By presenting a comparative analysis of costs and benefits, this work lays the foundation for future research on the adaptation, fine-tuning, and deployment of SLMs in phishing detection systems, aiming to balance security effectiveness and economic practicality.

Citations

• Characterizing Phishing Pages by JavaScript Capabilities
• PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites
• PhishDebate: An LLM-Based Multi-Agent Framework for Phishing Website Detection
• Multimodal Large Language Models for Phishing Webpage Detection and Identification
• From ML to LLM: Evaluating the Robustness of Phishing Webpage Detection Models against Adversarial Attacks
• Challenges in Deploying Long-Context Transformers: A Theoretical Peak Performance Analysis
• ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection
• On The Computational Complexity of Self-Attention
• Towards Web Phishing Detection Limitations and Mitigation
• Conv-Linformer: Boosting Linformer's Performance with Convolution in Small-Scale Settings
• High Accuracy Phishing Detection Based on Convolutional Neural Networks
• Attention Is All You Need

Related

• How Can We Effectively Use LLMs for Phishing Detection?: Evaluating the Effectiveness of Large Language Model-based Phishing Detection Models
• CLASP: Cost-Optimized LLM-based Agentic System for Phishing Detection
• Phishing Detection in the Gen-AI Era: Quantized LLMs vs Classical Models
• Improving Phishing Email Detection Performance of Small Large Language Models
• Multimodal Large Language Models for Phishing Webpage Detection and Identification