An Explainable and Adversarially Robust Multimodal Deep Learning–LLM Framework for Arabic Web Phishing Detection

Abstract

Arabic-language phishing websites are under-served by detectors built for English content and a single input modality. We present a multimodal deep learning–large language model (LLM) framework for Arabic web phishing detection and evaluate its URL/domain branch and a URL-level LLM stage. The corpus is a frozen public-source set of 9,129 Arabic-targeted URLs (2,554 phishing; 7,884 registered domains); template-level de-duplication and campaign clustering keep every registered domain and phishing template within one split. We test unseen-country generalisation, a five-edit evasion suite with and without adversarial training, SHAP faithfulness, and a zero-shot hosted LLM (clean comparison, four-way comparison and prompt-injection test). From the hostname alone, a character CNN with 36 handcrafted features reaches F1 = 0.697 (95% CI 0.665–0.724) and AUC 0.860; adding the path gives F1 = 0.944, partly a path-length artefact. F1 falls to 0.35–0.55 on an unseen country, and at 1% prevalence the model would raise about 802 false alerts per 10,000 pages. Adversarial training raised phishing recall at the worst edit budget from 0.18 to 0.63 without loss of clean F1. Removing the three top SHAP features lowered the phishing score 3.9 times more than removing random features. The LLM gave no clean-data benefit on 1,371 test URLs (baseline F1 0.724; LLM-enhanced 0.695; gain interval -0.058 to -0.001). Under evasion it raised recall from 0.13 to 0.31 at doubled false alerts, whereas adversarial training raised it to 0.59. Arabic, English, mixed and obfuscated injection payloads did not significantly reduce LLM detection. Adversarial training, not the LLM, gave the main robustness gain. Only the URL branch and a URL-level LLM stage were evaluated; the text, DOM and visual branches are specified but untested.