Enhancing Adversarial Defense in Phishing Detection Using Deep Reinforcement Learning

Abstract

Phishing classifiers trained on static data can underperform when slight adversarial modifications are made to URLs and HTML to evade both humans and traditional machine learning algorithms. During this research, a published XGBoost baseline from Aljofey et al. was reproduced and verified for reproducibility with multi-seed evaluation. The reproduced model attained a 94.76% accuracy, 92.19% F1, and 98.40% AUC with low seed variance on the clean data. To quantify adversarial vulnerability, homoglyph substitutions, zero-width character injections, and benign keyword padding were used. These adversarial modifications reduced phishing recall from 90.96% to 75.34%, a decrease of 15.62 percentage points (pp). To combat this, a DDQN preprocessor that learns to apply minimal, deterministic “repair” actions before the frozen XGBoost classifier was developed. On a mixed-label adversarial test, the DDQN+XGBoost improved F1 by +10.08 pp and accuracy by +9.65 pp versus the adversarial baseline, cuts FPR by -16.68 pp (60.35% relative), and maintains high recall (-3.12 pp trade-off). The defence requires no retraining of the base classifier, is interpretable at the action level, and adds modest inference overhead. These results demonstrate that learned preprocessing can restore deployable performance in the face of targeted adversarial attacks. This research shows that learned preprocessing can enhance adversarial defence for phishing detection at inference time, without changing the underlying classifier.