Emerging Technologies and Intelligent Systems: Theory, Applications and Innovations
Injection-First Staged Inference: Balancing Robustness and Reasoning Cost in LLM-Based Phishing Detection
Authors: Zhenwei Zhu and Jia Liu
Publishing Date: 15-11-2026
ISBN: 978-81-975670-4-9
Abstract
Large language models (LLMs) can recognize semantic evidence in phishing emails, yet the same capability for instruction-following may expose LLM-based detectors to attackerinjected instructions within email content itself. We propose injection-first staged inference, a single-call protocol that first assesses classifier-directed prompt injection and then completes the phishing judgment without treating injection presence as the label. A designed evaluation combines clean email, injected phishing email, and matched injected legitimate controls across two datasets, three models, and thinking/non-thinking modes. For non-thinking inference, the protocol improves attacked-phishing recall over Direct for Qwen3.5-9B, Qwen3.6-35B-A3B, and DeepSeek-v4-pro on both datasets, with gains of up to 18.2 percentage points. Against the generic Robust protocol, three model–dataset comparisons show significant additional gains after Holm correction. Although these benefits narrow with thinking enabled, non-thinking staged inference uses 86.6–98.0% fewer output tokens than direct thinking. Overall, the results reveal a model-dependent robustness–cost trade-off rather than universal superiority.
Keywords
phishing detection, large language models, indirect prompt injection, staged inference, security evaluation.
Cite as
Zhenwei Zhu and Jia Liu, "Injection-First Staged Inference: Balancing Robustness and Reasoning Cost in LLM-Based Phishing Detection", In: Harish Sharma and Mukesh Saraswat (eds), Emerging Technologies and Intelligent Systems: Theory, Applications and Innovations, SCRS, India, 2026, pp. 51-67. https://doi.org/10.56155/978-81-975670-4-9-3