LLM-Augmented Machine Learning for Phishing Email Detection: Enhancing Classification, Explainability, and Multilingual Support

Abstract

Nowadays, email is the primary communication channel and a major vector for phishing attacks exploiting urgency, authority, and trust, a threat amplified by large language models that enable low-cost, persuasive, and multilingual phishing. Traditional machine learning approaches are increasingly insufficient due to evolving attack strategies, limited non-English datasets, and poor explainability, while standalone LLM solutions remain too costly for large-scale deployment. This paper proposes a selective hybrid framework that combines machine learning with LLMs in a cost-aware architecture. LLMs are used selectively to correct ML errors, translate non-English emails for a single English-trained classifier, and generate human-readable explanations of model decisions. GPT-4, Claude, and DeepSeek are evaluated across these tasks, and results show improved robustness, multilingual coverage, and explainability with manageable computational overhead, with each model demonstrating task-specific strengths.