# PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT

arXiv: https://arxiv.org/abs/2408.05667 · HTML: https://mlsanity.com/paper/2408.05667/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 118 references that are in the map.
- First posted on arXiv 11 Aug 2024.

## Builds on (most cited first, 26 of 26)

- [Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer](https://mlsanity.com/paper/1910.10683/) (2019)
- [LLaMA: Open and Efficient Foundation Language Models](https://mlsanity.com/paper/2302.13971/) (2023)
- [DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter](https://mlsanity.com/paper/1910.01108/) (2019)
- [DeBERTa: Decoding-enhanced BERT with Disentangled Attention](https://mlsanity.com/paper/2006.03654/) (2020)
- [BLOOM: A 176B-Parameter Open-Access Multilingual Language Model](https://mlsanity.com/paper/2211.05100/) (2022)
- [TinyBERT: Distilling BERT for Natural Language Understanding](https://mlsanity.com/paper/1909.10351/) (2019)
- [Language-agnostic BERT Sentence Embedding](https://mlsanity.com/paper/2007.01852/) (2020)
- [MobileBERT: a Compact Task-Agnostic BERT for Resource-Limited Devices](https://mlsanity.com/paper/2004.02984/) (2020)
- [Learning Word Vectors for 157 Languages](https://mlsanity.com/paper/1802.06893/) (2018)
- [Semantics-aware BERT for Language Understanding](https://mlsanity.com/paper/1909.02209/) (2019)
- [Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2106.09380/) (2021)
- [URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection](https://mlsanity.com/paper/1802.03162/) (2018)
- [An Empirical Study on the Usage of BERT Models for Code Completion](https://mlsanity.com/paper/2103.07115/) (2021)
- [Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features](https://mlsanity.com/paper/1708.08327/) (2017)
- [Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models](https://mlsanity.com/paper/2308.12287/) (2023)
- [DeltaPhish: Detecting Phishing Webpages in Compromised Websites](https://mlsanity.com/paper/1707.00317/) (2017)
- [Detecting Phishing Sites Using ChatGPT](https://mlsanity.com/paper/2306.05816/) (2023)
- [PhishSim: Aiding Phishing Website Detection with a Feature-Free Tool](https://mlsanity.com/paper/2207.10801/) (2022)
- [Defending against Phishing Attacks: Taxonomy of Methods, Current Issues and Future Directions](https://mlsanity.com/paper/1705.09819/) (2017)
- [WAF-A-MoLE: Evading Web Application Firewalls through Adversarial Machine Learning](https://mlsanity.com/paper/2001.01952/) (2020)
- ["Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages](https://mlsanity.com/paper/2404.02832/) (2024)
- [Understanding Toxicity Triggers on Reddit in the Context of Singapore](https://mlsanity.com/paper/2204.08806/) (2022)
- [Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors](https://mlsanity.com/paper/2310.03166/) (2023)
- ["Do Users fall for Real Adversarial Phishing?" Investigating the Human response to Evasive Webpages](https://mlsanity.com/paper/2311.16383/) (2023)
- [Evaluating the effectiveness of Phishing Reports on Twitter](https://mlsanity.com/paper/2111.07201/) (2021)
- [A Large-Scale Analysis of Phishing Websites Hosted on Free Web Hosting Domains](https://mlsanity.com/paper/2212.02563/) (2022)

## Built on by (most cited first, 3 of 3)

- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants](https://mlsanity.com/paper/2507.15393/) (2025)
- [Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC](https://mlsanity.com/paper/2508.02001/) (2025)

## Abstract (arXiv)

In this paper, we introduce PhishLang, the first fully client-side anti-phishing framework built on a lightweight ensemble framework that utilizes advanced language models to analyze the contextual features of a website's source code and URL. Unlike traditional heuristic or machine learning approaches that rely on static features and struggle to adapt to evolving threats, or deep learning models that are computationally intensive, our approach utilizes MobileBERT, a fast and memory-efficient variant of the BERT architecture, to capture nuanced features indicative of phishing attacks. To further enhance detection accuracy, PhishLang employs a multi-modal ensemble approach, combining both the URL and Source detection models. This architecture ensures robustness by allowing one model to compensate for scenarios where the other may fail, or if both models provide ambiguous inferences. As a result, PhishLang excels at detecting both regular and evasive phishing threats, including zero-day attacks, outperforming popular anti-phishing tools, while operating without relying on external blocklists and safeguarding user privacy by ensuring that browser history remains entirely local and unshared. We release PhishLang as a Chromium browser extension and also open-source the framework to aid the research community.