Bridging LLM Reasoning and Classical Explainability in Phishing Email Classification: A Faithfulness and Robustness Comparison
Large language models (LLMs) are increasingly proposed as reasoning engines for cyber threat intelligence (CTI) triage and threat hunting, promising to reduce the alert-fatigue burden long documented in security operations research. However, most reported evaluations emphasize raw classification accuracy and give little attention to whether an LLM’s stated reasoning is actually faithful to the signal that drives its decision, or whether it is more robust than classical machine learning to adversarial text obfuscation. In this work we study phishing email classification — a canonical, high-volume CTI task — using a combined corpus of 81,880 labeled emails (CEAS 08, Enron, Nazario, Nigerian Fraud, SpamAssassin, and Ling). We train a TF-IDF + Logistic Regression baseline (98.55% accuracy, ROC-AUC 0.999) and use SHAP to obtain token-level feature attributions. We then construct a stratified 90-email case-study subsample — including all of the baseline’s misclassifications in the sample — and have an LLM (Claude Sonnet 5) independently classify each email zero-shot with a natural-language rationale. We find that (i) SHAP attributions frequently key on short character fragments produced by spam authors’ filter-evasion obfuscation (mean 1.25 fragment tokens among the top-5 SHAP features for obfuscated-spam emails, vs. 0.99 for non-obfuscated emails), indicating a degree of shortcut learning rather than pure semantic understanding; (ii) the LLM recovers 12 of the classical model’s 20 errors in the subsample (60%), achieving 100% accuracy specifically on character-obfuscated spam that defeats the bag-of-words model; and (iii) the LLM shares several genuine failure modes with the classical model on conversationally-phrased phishing and at least one likely case of label noise, showing that LLM-based triage is a complement to, rather than a strict replacement for, classical explainable models. We discuss the implications for LLM-assisted threat hunting and alert-fatigue reduction in security operations centers (SOCs).