Explainable Artificial Intelligence for Phishing Detection: A Review of Techniques, Challenges, and Future Directions

Machine learning and deep learning have expanded phishing detection beyond static blacklists and manually specified rules. However, predictive performance alone does not provide the transparency and assurance required for cybersecurity decisions. XAI methods such as LIME and SHAP can help analysts inspect model predictions, identify influential features, and communicate evidence. Their use must nevertheless be accompanied by validation: explanations can be unstable, sensitive to sampling or background data, and unreliable under dataset shift or adversarial manipulation. The literature reviewed here indicates that SHAP and LIME are prominent approaches but serve different explanatory purposes. Cross-dataset evaluation is necessary to assess generalization, while adversarial testing should examine both classification degradation and explanation drift. Future phishing detectors should report predictive metrics alongside explanation fidelity, stability, robustness, human usefulness, and computational cost. They should distinguish model attribution from causal evidence and external threat intelligence. The most promising direction is an evaluation-driven, human-centred framework that treats explanations as part of the security system rather than decorative output. Such a framework should combine temporally aware and cross-dataset testing, realistic attacker models, audience-specific explanation interfaces, and transparent uncertainty reporting. These steps can help move explainable phishing detection from visually interpretable prototypes toward dependable tools for security analysts and end users.

[1] A. Safi and S. Singh, “A systematic literature review on phishing website detection techniques,” Journal of King Saud University – Computer and Information Sciences, vol. 35, no. 2, pp. 590–611, 2023, doi: 10.1016/j.jksuci.2023.01.004. [2] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning based phishing detection from URLs,” Expert Systems with Applications, vol. 117, pp. 345–357, 2019, doi: 10.1016/j.eswa.2018.09.029. [3] I. Fette, N. Sadeh, and A. Tomasic, “Learning to detect phishing emails,” in Proceedings of the 16th International Conference on World Wide Web (WWW ’07), 2007, pp. 649–656, doi: 10.1145/1242572.1242660. [4] R. Basnet, S. Mukkamala, and A. H. Sung, “Detection of phishing attacks: A machine learning approach,” in Studies in Fuzziness and Soft Computing, 2008, doi: 10.1007/978-3-540-77465-5_19. [5] M. T. Ribeiro, S. Singh, and C. Guestrin, “‘Why should I trust you?’: Explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, pp. 1135–1144, doi: 10.1145/2939672.2939778. [6] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems, vol. 30, 2017, pp. 4765–4774. Available: https://arxiv.org/abs/1705.07874. [7] F. Doshi-Velez and B. Kim, “Towards a rigorous science of interpretable machine learning,” arXiv:1702.08608, 2017. [8] T. Miller, “Explanation in artificial intelligence: Insights from the social sciences,” Artificial Intelligence, vol. 267, pp. 1–38, 2019, doi: 10.1016/j.artint.2018.07.007. [9] F. Charmet et al., “Explainable artificial intelligence for cybersecurity: A literature survey,” Annals of Telecommunications, vol. 77, pp. 789–812, 2022, doi: 10.1007/s12243-022-00926-7. [10] N. S. Thalpage and E. Jayarathne, “Explainable AI approaches for detecting and mitigating phishing attacks: A review,” Journal of Digital Science, vol. 7, no. 2, 2025, doi: 10.33847/2686-8296.7.2_4.