# Small Language Models for Phishing Website Detection: Cost, Performance, and Privacy Trade-Offs

arXiv: https://arxiv.org/abs/2511.15434 · HTML: https://mlsanity.com/paper/2511.15434/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 44 references that are in the map.
- First posted on arXiv 19 Nov 2025.

## Builds on (most cited first, 14 of 14)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Linformer: Self-Attention with Linear Complexity](https://mlsanity.com/paper/2006.04768/) (2020)
- [A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly](https://mlsanity.com/paper/2312.02003/) (2023)
- [On The Computational Complexity of Self-Attention](https://mlsanity.com/paper/2209.04881/) (2022)
- [Challenges in Deploying Long-Context Transformers: A Theoretical Peak Performance Analysis](https://mlsanity.com/paper/2405.08944/) (2024)
- [ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection](https://mlsanity.com/paper/2402.18093/) (2024)
- [Scaling Down to Scale Up: A Cost-Benefit Analysis of Replacing OpenAI's LLM with Open Source SLMs in Production](https://mlsanity.com/paper/2312.14972/) (2023)
- [High Accuracy Phishing Detection Based on Convolutional Neural Networks](https://mlsanity.com/paper/2004.03960/) (2020)
- [Multimodal Large Language Models for Phishing Webpage Detection and Identification](https://mlsanity.com/paper/2408.05941/) (2024)
- [From ML to LLM: Evaluating the Robustness of Phishing Webpage Detection Models against Adversarial Attacks](https://mlsanity.com/paper/2407.20361/) (2024)
- [Towards Web Phishing Detection Limitations and Mitigation](https://mlsanity.com/paper/2204.00985/) (2022)
- [PhishDebate: An LLM-Based Multi-Agent Framework for Phishing Website Detection](https://mlsanity.com/paper/2506.15656/) (2025)
- [PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites](https://mlsanity.com/paper/2508.02035/) (2025)
- [Characterizing Phishing Pages by JavaScript Capabilities](https://mlsanity.com/paper/2509.13186/) (2025)

## Built on by (most cited first, 1 of 1)

- [Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks](https://mlsanity.com/paper/2609.12839/) (2026)

## Abstract (arXiv)

Phishing websites pose a major cybersecurity threat, exploiting unsuspecting users and causing significant financial and organisational harm. Traditional machine learning approaches for phishing detection often require extensive feature engineering, continuous retraining, and costly infrastructure maintenance. At the same time, proprietary large language models (LLMs) have demonstrated strong performance in phishing-related classification tasks, but their operational costs and reliance on external providers limit their practical adoption in many business environments. This paper investigates the feasibility of small language models (SLMs) for detecting phishing websites using only their raw HTML code. A key advantage of these models is that they can be deployed on local infrastructure, providing organisations with greater control over data and operations. We systematically evaluate 15 commonly used Small Language Models (SLMs), ranging from 1 billion to 70 billion parameters, benchmarking their classification accuracy, computational requirements, and cost-efficiency. Our results highlight the trade-offs between detection performance and resource consumption, demonstrating that while SLMs underperform compared to state-of-the-art proprietary LLMs, they can still provide a viable and scalable alternative to external LLM services. By presenting a comparative analysis of costs and benefits, this work lays the foundation for future research on the adaptation, fine-tuning, and deployment of SLMs in phishing detection systems, aiming to balance security effectiveness and economic practicality.