AI-Driven Phishing Detection: Comparing Transformer-Based Models against Traditional Heuristics

Abstract

Phishing remains one of the most prevalent and financially damaging categories of cyber-attack, exploiting human trust through deceptive emails, websites, and messages to harvest credentials, deliver malware, or facilitate fraud. Detection systems have historically relied on heuristic and rule-based methods — blacklists, URL pattern matching, header analysis, and handcrafted lexical features — that are fast and interpretable but brittle against novel or obfuscated attacks. The rise of transformer-based language models, pertained on massive text and code corpora, has introduced a new generation of phishing detectors capable of capturing deep semantic and contextual signals that static heuristics cannot. This paper presents a systematic comparison between transformer-based phishing detection models (including BERT-family classifiers and large generative LLMs used in zero-shot and fine-tuned configurations) and traditional heuristic-based systems (blocklists, rule engines, and classical machine learning models such as logistic regression, random forests, and support vector machines trained on handcrafted features). We evaluate both paradigms across email phishing, URL/website phishing, and SMS/smashing datasets, examining detection accuracy, false positive rates, robustness to adversarial obfuscation, latency, interpretability, and adaptability to novel campaigns. Our analysis of published benchmarks and experimental studies indicates that transformer-based models consistently achieve higher recall on novel and linguistically sophisticated phishing attempts, particularly those generated with the assistance of generative AI, while traditional heuristics retain advantages in inference speed, resource efficiency, and transparency for compliance-driven environments. We further explore hybrid architectures that combine rule-based pre-filtering with transformer-based semantic scoring to balance accuracy against operational cost. The paper concludes with a discussion of deployment considerations, the emerging arms race between generative AI-authored phishing content and AI-based defenses, and directions for future research including multimodal detection, real-time adaptation, and privacy-preserving on-device inference