Adaptive Spam Detection: Leveraging Federated Learning for Privacy-Preserving Email Security

Abstract

Email spam and spear phishing are and always will be a security and usability issue, and it is increasingly difficult to scale and protect centralized approaches that depend on aggregating users' mail data due to privacy and regulatory considerations (GDPR, CCPA, etc.). This paper formalizes the inherent tension between the need to collect massive, heterogeneous data to train good detectors, and the need to protect the privacy of individual emails, and presents Federated Learning (FL) as a principled solution: models are trained in collaboration across users' devices, without any raw messages ever leaving a client host and with only model updates being shared. We train a FedAvg-based pipeline on a small hybrid classifier that uses text features (TF-IDF and optionally contextual embeddings) and metadata signals (sender reputation, number of links, and attachment flags), and we test it on a user-partitioned simulation built from a synthetic corpus of 120k emails from 1,200 non-IID anonymized users with topic and label skews. Our main takeaways are that (i) the FL-trained global model can achieve comparable performance to the pooled (centralized) baseline while maintaining data locality and (ii) local fine-tuning on each client provides useful client-level personalization that can benefit users with unusual local data distributions, improving detection performance. We also quantify the trade-offs involved in choices for the number of clients participating in each round, the amount of local computation, and the number of communication rounds. We investigate robustness to label noise and regularization. These findings suggest that FL-based spam detection is a promising and privacy-preserving building block for future next-generation anti-spam systems, and they motivate future directions in secure aggregation, adversarial robustness, and deployment-aware optimization. Keywords: Federated Learning; Spam Detection; Privacy-Preserving Machine Learning; Email Security; Non-IID Data