Publication Date

6-12-2026

Document Type

Article

Publication Title

Electronics Switzerland

Volume

15

Issue

12

DOI

10.3390/electronics15122606

Abstract

Phishing email remains a persistent and operationally critical cybersecurity threat, yet existing detection approaches, including traditional machine learning and single-pass large language model systems, either lack native interpretability or provide explanations that are difficult to standardize and audit. This paper introduces an explainable multi-agent LLM framework that decomposes phishing evidence across three role-specialized agents focused on linguistic patterns, psychological manipulation, and sender identity consistency. The framework then aggregates specialist outputs through schema-governed synthesis, enabling each intermediate and final decision to be structured, comparable, and auditable. The central contribution is the treatment of role-specialized evidence decomposition and explanation structure as first-class design constraints rather than post hoc additions. The framework is evaluated on a fixed 1000-email subset drawn from a unified TREC/Nazario corpus of 56,212 emails under controlled zero-shot conditions. The full multi-agent Meta-Judge system achieves Macro-F1 = 98.28% and phishing recall = 99.45%, improving Macro-F1 by 6.3 percentage points over a zero-shot single-model GPT-4o-mini baseline. Paired statistical testing confirms that this improvement is significant and is driven primarily by reduced false positives on legitimate emails while preserving high phishing recall. Additional evaluation on an independent LLM-attributed email benchmark shows a consistent Macro-F1 improvement of 0.0773 over the zero-shot baseline under distribution shift. Ablation results show that role-specialized decomposition is the primary performance driver, while deterministic voting provides a competitive raw-classification aggregator and Meta-Judge synthesis provides structured, analyst-facing explanations. These results indicate that role-specialized evidence decomposition combined with schema-governed explanation can improve both detection reliability and auditability in phishing classification workflows.

Funding Sponsor

San José State University

Keywords

email security, evidence decomposition, explainability, large language models, multi-agent systems, phishing detection, schema-governed outputs

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Department

Applied Data Science

Download

Share

COinS