Small Language Models for Phishing Website Detection: Cost, Performance, and Privacy Trade-Offs (arXiv, Nov 2025)

Overview

| Field | Content | |------|------| | Title | Small Language Models for Phishing Website Detection: Cost, Performance, and Privacy Trade-Offs | | Authors | Georg Goldenits, Philip Koenig, Sebastian Raubitzek, Andreas Ekelhart | | Published | November 2025 (arXiv) | | Link | https://arxiv.org/abs/2511.15434 | | Type | Academic paper | | Category | Document understanding |

One-Line Summary

The paper studies how small language models (SLMs) can be applied to phishing website detection, with a focus on the trade-offs between inference cost, detection performance, and data privacy.

Background and Motivation

Phishing website detection is a core cybersecurity task where systems must classify URLs and page content quickly, accurately, and at high volume. Conventional machine-learning pipelines rely on hand-crafted features (URL structure, domain age, page characteristics), while large language models (LLMs) offer stronger semantic understanding of page text — but at the cost of:

• High inference cost: per-query token pricing and GPU requirements make LLM-based detection expensive at scale.
• Privacy risks: sending potentially sensitive URLs and page content to third-party cloud APIs may leak user browsing behavior or enterprise data.
• Latency constraints: real-time protection requires fast decisions.

Small language models, deployable locally and cheaply, are positioned as a middle ground. The paper systematically examines what is gained and lost along the cost–performance–privacy triangle when moving detection workloads to compact models.

Key Themes

• Task formulation: treating phishing detection as a text-understanding problem suited to language models, rather than purely a feature-engineering problem.
• Cost analysis: evaluating the computational and financial cost of small models relative to large LLMs and classical baselines.
• Performance evaluation: comparing detection accuracy of SLMs against established approaches.
• Privacy considerations: arguing for local deployment to avoid exposing browsing and organizational data to external services.

Notes on This Summary

This post is based on the paper's public metadata and abstract. Specific benchmark numbers, datasets, and model configurations are not reproduced here; readers should consult the full PDF at https://arxiv.org/abs/2511.15434 before citing quantitative results.

Related Entries

• LongDA: Benchmarking LLM Agents for Long-Document Data Analysis
• Qwen2.5-VL Technical Report (Document Understanding and OCR)
• SmolDocling: An Ultra-Compact Vision-Language Model
• ColPali: Efficient Document Retrieval with Vision Language Models

Takeaways

1. Efficient models matter for security: small, locally deployed language models can make LLM-style semantic analysis viable for real-time, privacy-sensitive applications. 2. Trade-offs must be measured: cost, accuracy, and privacy should be evaluated jointly, not in isolation. 3. Verify against the source: as with any paper summary, quantitative claims should be checked against the original publication.