# E-PhishGen: Unlocking Novel Research in Phishing Email Detection

arXiv: https://arxiv.org/abs/2509.01791 · HTML: https://mlsanity.com/paper/2509.01791/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 62 references that are in the map.
- First posted on arXiv 1 Sep 2025.

## Builds on (most cited first, 7 of 7)

- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Leveraging Explainable AI for LLM Text Attribution: Differentiating Human-Written and Multiple LLMs-Generated Text](https://mlsanity.com/paper/2501.03212/) (2025)
- [Novel Interpretable and Robust Web-based AI Platform for Phishing Email Detection](https://mlsanity.com/paper/2405.11619/) (2024)
- [Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training](https://mlsanity.com/paper/2409.01378/) (2024)
- [The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations](https://mlsanity.com/paper/2505.12104/) (2025)
- [Smishing Dataset I: Phishing SMS Dataset from Smishtank.com](https://mlsanity.com/paper/2402.18430/) (2024)
- [SecureNet: A Comparative Study of DeBERTa and Large Language Models for Phishing Detection](https://mlsanity.com/paper/2406.06663/) (2024)

## Built on by (most cited first, 4 of 4)

- [The Phish, The Spam, and The Valid: Generating Feature-Rich Emails for Benchmarking LLMs](https://mlsanity.com/paper/2511.21448/) (2025)
- [An LLM Agent-based Framework for Whaling Countermeasures](https://mlsanity.com/paper/2601.14606/) (2026)
- [TraceScope: Interactive URL Triage via Decoupled Checklist Adjudication](https://mlsanity.com/paper/2604.21840/) (2026)
- [From Beats to Breaches:How Offensive AI Infers Sensitive User Information from Playlists](https://mlsanity.com/paper/2605.04724/) (2026)

## Abstract (arXiv)

Every day, our inboxes are flooded with unsolicited emails, ranging between annoying spam to more subtle phishing scams. Unfortunately, despite abundant prior efforts proposing solutions achieving near-perfect accuracy, the reality is that countering malicious emails still remains an unsolved dilemma. This "open problem" paper carries out a critical assessment of scientific works in the context of phishing email detection. First, we focus on the benchmark datasets that have been used to assess the methods proposed in research. We find that most prior work relied on datasets containing emails that -- we argue -- are not representative of current trends, and mostly encompass the English language. Based on this finding, we then re-implement and re-assess a variety of detection methods reliant on machine learning (ML), including large-language models (LLM), and release all of our codebase -- an (unfortunately) uncommon practice in related research. We show that most such methods achieve near-perfect performance when trained and tested on the same dataset -- a result which intrinsically hinders development (how can future research outperform methods that are already near perfect?). To foster the creation of "more challenging benchmarks" that reflect current phishing trends, we propose E-PhishGEN, an LLM-based (and privacy-savvy) framework to generate novel phishing-email datasets. We use our E-PhishGEN to create E-PhishLLM, a novel phishing-email detection dataset containing 16616 emails in three languages. We use E-PhishLLM to test the detectors we considered, showing a much lower performance than that achieved on existing benchmarks -- indicating a larger room for improvement. We also validate the quality of E-PhishLLM with a user study (n=30). To sum up, we show that phishing email detection is still an open problem -- and provide the means to tackle such a problem by future research.