AI-Driven Phishing Email Detection: A Comparative Review of Ensemble Learning, Explainable AI, and Stylometric Analysis

Phishing is a social-engineering attack in which fraudulent messages impersonate trusted entities to obtain credentials or other sensitive information; email remains one of its main delivery channels, and the reviewed studies motivate their work by its continuing financial and security impact [1]–[3]. Detection research has progressed from rule- and blacklistbased filtering, which is brittle against novel messages, to machine-learning classifiers trained on engineered features [1], [2], and more recently to explainable models and writingstyle (stylometric) analysis [3]. Explainability in this literature is commonly provided by Local Interpretable Model-agnostic Explanations (LIME) [4]. Generative AI changes the detection problem. Heiding et al. showed that GPT-4 can produce phishing emails automatically; in a 112-participant study their GPT-generated emails reached click-through rates of 30–44%, against 19– 28% for a generic control [5]. Opara et al. found that Gmail and Outlook let more GPT-4o-generated phishing emails through than Yahoo did [3]. Fluent, grammatically clean text weakens cues such as spelling errors, which motivates comparing conventional content/structural features with linguistic and stylometric ones. Fig. 1 contrasts the two settings.

Scope and contribution. This paper (i) compares three principal studies [1]–[3] on explicit criteria; (ii) separates what the sources report from our interpretation; (iii) proposes a conceptual integrated workflow, clearly marked as unvalidated; and (iv) specifies a reproducible future experiment. It is a focused narrative review, not a systematic one, and it contains no new experiments. Literature-based comparative review · Page 1

QUESTIONS The motivating observation, taken from the seminar synopsis, is that the reviewed literature falls into two largely separate tracks. Track A (content-based and ensemble detection) [1], [2] reports very high in-corpus accuracy on legacy humanauthored corpora such as Enron, SpamAssassin, CEAS, Nazario, Ling-Spam and Nigerian Fraud. Track B (stylometric detection of AI-generated phishing) [3] tests LLM-generated emails against commercial filters and a stylometric classifier. In the three reviewed papers, neither track is tested on the other’s data. Whether either feature family generalizes across both phishing generations is therefore a question arising from this comparison, not a proven universal gap. The paper addresses five research questions: › RQ1. How do content/structural features differ from stylometric features? › RQ2. What evidence exists on their performance for conventional and AI-generated phishing? › RQ3. What role can ensemble methods play? › RQ4. How can LIME assist interpretation and error analysis? › RQ5. What evidence is still needed on cross-dataset and cross-generation generalization?

This is a focused narrative comparative review. It was not conducted as a systematic review and does not follow PRISMA; no search counts or screening statistics are reported because none exist. The corpus started from the three principal studies named in the seminar synopsis [1]–[3], selected for peer-reviewed venue, direct relevance to AI/ML phishing email detection, and complementary coverage (two conventional/ensemble, one AI-generated/stylometric), plus the foundational LIME paper [4]. Bibliographic metadata were checked on 18 October 2026 through web searches of publisher pages (ScienceDirect, IEEE Xplore, ACM metadata), DOI records, a university repository (Teesside), DBLP and arXiv, using the titles and author names as queries. Two complementary papers [5], [6] were added where they bear directly on AI-generated phishing and crossmodel generalization. Limitation: publisher full texts of [1]– [3] could not be retrieved automatically during preparation, so details drawn only from the seminar synopsis are marked with a dagger (†) and require full-text confirmation by the author. Studies are compared on: objective; data and sample size; feature family; model; evaluation protocol; reported metrics; explainability; strengths; and limitations. All numerical results are attributed to their source studies and are not pooled.

A. Conventional phishing detection A simplified progression, used in the synopsis rather than as a formal taxonomy, runs from rule/keyword filtering and blacklists, to classical machine learning on engineered features, to explainable and stylometric approaches. Rulebased systems are transparent but easily evaded by novel messages; learned models can capture combinations of weak cues but depend on the data they were trained on. B. Headers, URLs, HTML and content features Structural features describe an email’s technical form: header fields, embedded URLs, and the presence or structure of HTML. Content features describe its text, for example term weights or embeddings. Study [1] combines text embeddings with 20 selected header/HTML “phishing-attribute” features†, whereas the platform in [2] accepts email text as input. C. TF-IDF and Word2Vec TF-IDF weights a term t in document d by its frequency and rarity across N documents: tfidf(t, d) = tf(t, d) · log( N / df(t) ) (1) where df(t) is the number of documents containing t (smoothed variants exist). Word2Vec [7] learns dense vectors in which words used in similar contexts lie close together; a document vector is typically obtained by aggregating its word vectors. TF-IDF is sparse and lexical; Word2Vec is dense and captures some semantic similarity. D. Stylometric and linguistic features Stylometry quantifies writing style rather than topic. Opara et al. [3] use 60 features, 47 of which they describe as new to phishing detection; the synopsis† groups them into syntactic, lexical, punctuation, readability, word-category, stylistic, email-specific and complexity categories, with imperativeverb count, clause density and first-person-pronoun usage reported as strong predictors†. Fig. 2 contrasts the two feature families.

A. Ahmed and Sumesh (2026) [1] Problem. Efficient, interpretable ensemble-based phishing email detection [1]. Method. The authors evaluate soft- and hard-voting ensembles, add XAI-driven error analysis, and report comparison with transformer-based baselines [1]. Per the synopsis†, the final system is a soft-voting ensemble of XGBoost and Random Forest on Word2Vec embeddings plus 20 selected header/HTML features, with mutual-information feature selection. Data. Enron, SpamAssassin and Nazario corpora: 35,317 emails for training/validation and 2,761 held out†. Findings. The synopsis† reports 99.86% training and 99.75% unseen-data accuracy, with feature selection and tuning cutting training time by up to 95% and inference time by up to 78%. The publisher abstract states that XAI-driven error analysis reduced overfitting and raised validation phishing recall from 0.9914 to 0.9924 [1]. A second pair of recall values given in the seminar synopsis† could not be checked against the full text, which was not accessible, and is omitted here. Full-text confirmation of the recall figures is still needed. Strengths. Attention to efficiency, a held-out test set and use of XAI inside the development loop. Limitations. Human-authored, largely pre-2020 corpora and partial reliance on HTML/URL cues†. Interpretation: near-ceiling accuracy on legacy corpora gives little room to discriminate between methods. Relevance. Representative of Track A and the main source for ensemble and error-analysis practice. B. Al-Subaiey et al. (2024) [2] Problem. Reliance on proprietary datasets and lack of realworld application in earlier phishing-email work [2]. Method. TF-IDF and Word2Vec vectorization compared across SVM, Multinomial Naive Bayes and Random Forest, with feature ablation and XAI, deployed as a Flask web application that accepts email text [2]. Data. Six public datasets merged into an 82,486-email corpus (Enron, Ling-Spam, CEAS, Nazario, Nigerian Fraud, SpamAssassin)†. Findings. The preprint abstract reports an F1 score of 0.99; the synopsis† adds that TF-IDF with a linear SVM was best at 99.1% accuracy. Strengths. Large public corpus, reproducible-by-design choice of public data, real-time deployment and user-facing explanations. Limitations. Legacy datasets; no test on LLMgenerated phishing or multiple live providers†. Interpretation: merging six sources raises the risk that a model learns sourcespecific artifacts unless sources are held out. Relevance. Shows that a simple lexical model can reach very high incorpus scores and be explained with LIME. C. Opara, Modesti and Golightly (2025) [3] Problem. How well do major email services and stylometric classifiers handle AI-generated phishing? [3] Method. 63 GPT-4o-generated phishing emails were tested against Gmail, Outlook and Yahoo; 60 stylometric features were then evaluated with Logistic Regression, SVM, Random Forest and XGBoost [3]. Data. 63 phishing plus 63 legitimate AIgenerated emails†; the phishing set is reported as publicly available on Kaggle [3]. The synopsis† describes an 80/20 split. Findings. Gmail and Outlook allowed more phishing emails through than Yahoo; XGBoost reached 96% accuracy and an AUC of 99% [3]. The authors’ project page reports an 86% Gmail bypass rate and that Yahoo wrongly flagged 58– 66% of legitimate AI-generated emails; the synopsis† gives approximate ranges of 86–100% (Gmail/Outlook) and 10– 28% (Yahoo) that vary by sending account. Strengths. Direct test of commercial filters and a feature set designed for textonly phishing. Limitations. Very small dataset, a single LLM and three providers; the project page lists dataset size as a limitation. Interpretation: with 126 emails and legitimate emails also LLM-generated, a high score may partly reflect prompt-specific style, and confidence intervals would be wide. Relevance. The main source for Track B. D. Complementary studies Heiding et al. [5] compared GPT-4-generated, humandesigned and combined phishing emails in a 112-participant study, and found that LLMs could also detect malicious intent in non-obvious phishing emails; it supports the premise that LLM-generated phishing is effective but is not a feature-based detector. A later study [6] (Gutierrez et al., 2026) evaluates stylometric detectors trained on phishing from one LLM against phishing from other LLMs, using 17 stylometric features with Logistic Regression and XGBoost and, per its abstract, also in cross-dataset settings; it frames the task as separating human-written from LLM-generated phishing rather than phishing from legitimate email. Cross-model evaluation of stylometric detectors is therefore already established and is not claimed as new here. Transfer between Literature-based comparative review · Page 3 content/structural and stylometric detectors across conventional and AI-generated corpora, as framed here, remains to be checked against the wider literature; the full text of [6] was not reviewed.

TABLE I. COMPARISON OF THE REVIEWED STUDIES Attribute Ahmed & Sumesh (2026) [1] Al-Subaiey et al. (2024) [2] Opara et al. (2025) [3] Objective Efficient, interpretable ensemble phishingemail detection Accurate, deployable, interpretable email classifier on public data Test commercial filters and stylometric detection on AI-generated phishing Dataset Enron, SpamAssassin, Nazario; 35,317 train/val + 2,761 held out† Six public corpora merged; 82,486 emails† 63 GPT-4o phishing + 63 legitimate AIgenerated emails† Feature family Word2Vec text + 20 header/HTML features†; MI selection† TF-IDF vs Word2Vec text features 60 stylometric/linguistic features Model Soft-voting XGBoost + Random Forest† SVM, Multinomial NB, Random Forest (linear SVM best†) LR, SVM, Random Forest, XGBoost (XGBoost best) Evaluation protocol Train/validation and held-out unseen set†; compared with transformer baselines [1] Not reported in the reviewed source (fulltext check needed) Filter test on 3 providers; ML stage 80/20 split† Reported metrics (own dataset only) 99.86% train / 99.75% unseen accuracy†; validation phishing recall 0.9914→0.9924 [1] 99.1% accuracy†; F1 = 0.99 96% accuracy; AUC 99%; Gmail bypass 86% (project page) Explainability XAI-driven error analysis (LIME per synopsis†) LIME in a Flask app with user feedback† Not reported in the reviewed source (ablation reported†) Strengths Efficiency gains†; error analysis; held-out test Large public data; real-time deployment Direct filter evaluation; features for textonly attacks Limitations Legacy human-authored corpora; HTML/URL reliance† Legacy data; no LLM phishing or live providers† Very small dataset; one LLM; three providers

Fig. 3 (below) summarizes the same comparison as a matrix of design choices. Why high accuracy does not imply real-world robustness. (i) Dataset age and representativeness: corpora such as Enron and Nazario predate current attack styles and LLM text. (ii) Class imbalance: accuracy can look high even when a rare class is handled poorly, so precision, recall, false-positive rate and PR-AUC are needed. (iii) Train–test leakage: duplicated or templated emails shared across splits inflate scores. (iv) Source dependence: when corpora differ systematically, a model may learn the source rather than the threat. (v) Generalization: random splits within one corpus measure indistribution performance only. (vi) Error costs: a missed phishing email can cause credential or financial loss, while false positives block legitimate mail and erode trust; [3] documents this tension in commercial filters.

Fig. 3. Matrix of design choices in the reviewed studies. Entries marked * follow the synopsis† and need full-text confirmation. “Not reported” means not reported in the reviewed sources as summarised.

FRAMEWORK

Fig. 4 shows a conceptual and proposed workflow informed by the reviewed literature. It is not implemented or validated, and no performance claim is made for it. Literature-based comparative review · Page 4

Each item below is an open question motivated by the reviewed sources, not a verified claim of novelty; a wider literature search is needed before any gap is asserted globally.

• Cross-dataset generalization. None of [1]–[3] reports testing across conventional and AI-generated corpora (synopsis comparison). Related work [6] evaluates stylometric detectors across LLMs and, per its abstract, across datasets, but frames the task as human-written versus LLM-generated phishing rather than phishing versus legitimate email; whether its findings transfer to the content/structural classifiers of [1], [2] is not established here.
• Across email-generation systems. [3] uses one LLM (GPT-4o); cross-model generalization of stylometric detectors has since been evaluated in [6], so it is not claimed as a gap here.
• Dataset recency and representativeness. [1] and [2] use legacy public corpora†; [3] uses 126 emails.
• Class imbalance and leakage. Merged or small corpora [2], [3] make duplicate and source control essential; protocols are not detailed in the reviewed summaries.
• Combining feature families. Plausible but unproven; added features may help, add noise or overfit.
• Explainability overhead and stability. The synopsis notes that interpretability costs are not fully quantified across the studies; stability of LIME across runs is not reported in the reviewed material.
• Deployment and privacy. Real mail contains personal data; the reviewed studies use public or synthetic data†.

The following protocol is proposed future work and has not been carried out. Hypotheses. Table III lists the hypotheses and the outcomes that would support or contradict each.

Privacy: real email contains personal information, so research should use public, anonymized or synthetic data as the reviewed studies do†. Dataset bias: [2] discusses source, temporal and class-imbalance bias†; legacy corpora underrepresent current attacks and some languages. False positives and negatives: missed phishing risks financial and data loss, while over-blocking disrupts legitimate communication [3]. Explainability: explanations can increase trust beyond what accuracy warrants if their limits are not communicated. Dual use: generating phishing with LLMs [3], [5] is a defensive research method and must remain confined to authorized defensive work, not be repurposed for attacks.

The reviewed literature establishes that high in-corpus accuracy is attainable with simple lexical or ensemble models on legacy data [1], [2], that LLM-generated phishing can pass commercial filters and be separated by writing-style features in a small sample [3], and that LIME is used in these works to support error analysis and trust [1], [2]. The studies differ in task, data and protocol rather than disagreeing on a shared benchmark, so their metrics cannot support claims about which approach is best.

Fig. 3 (Section VI) compares the design choices of the three studies side by side. What cannot yet be concluded is whether content/structural detectors fail on AI-generated emails, whether stylometric detectors survive on older human-authored corpora, or whether combining feature families helps; each needs the cross-dataset evidence outlined in Section IX. Table II makes clear which parts of the proposed framework are supported and which are conjecture. The framing also carries a methodological caution: in [3] both classes are LLMgenerated, so a stylometric model there separates malicious from benign intent in generated text, whereas a cross-corpus test would additionally mix authorship type with class.

This focused comparative review examined three recent studies on ensemble, explainable and stylometric phishingemail detection. Content-based and ensemble methods report very high accuracy on legacy corpora [1], [2]; stylometric features show promise on a small AI-generated set while commercial filters let many such emails pass [3]. The evidence does not yet show how either family generalizes across conventional and AI-generated phishing, and the proposed integrated workflow remains an unvalidated concept. The most important next steps are leakage-controlled, cross-dataset experiments with feature ablation, LIME stability analysis and cost-aware metrics, as specified in Section IX. All figures attributed to prior studies belong to those studies and do not constitute results of this paper.