Privacy-Preserving Phishing Detection: A Systematic Review of LLMs, Federated Learning, and Blockchain Integration

The rapid growth of phishing attempts in the enterprise could potentially lead to bankruptcy. The primary focus of the research is on detecting phishing attacks, with no interest in how the data is processed. Attackers use fraudulent methods to obtain valuable, confidential information, resulting in billions of dollars in financial losses for enterprises. In our review, we examined the methods used in phishing-detection studies. We concluded that the two main sections, centralized and decentralized methods, were the centralized ones, which aggregate data in a central server and thus violate data protection regulations, such as GDPR. In order to properly investigate the field, we put four main questions to give the reader a proper understanding of the field: what are the major detection approaches, what are their limitations and gaps, which datasets are most commonly used and trusted across different studies, and which privacy-preserving detection approaches are used and investigated in the field of phishing detection. To address these questions, we examined 105 different papers published from 2015 to 2024. Our review covers machine learning, deep learning, hybrid methods, large language models (LLMs), federated learning, and blockchain-based detection. Our investigation led to centralized approaches that achieved more than 95% accuracy but raised privacy concerns. Keeping data local on user devices offers privacy protection, as in decentralized strategies such as federated learning, at the cost of an accuracy trade-off of 1%–3%. Other decentralized methods, such as blockchain-based systems, enhance security and transparency in the pricing of computational challenges.