TRIDENT-SE: Translation-Divergence and Intent Graph Learning for Cross-Lingual Phishing and Social Engineering Detection in Arabic–English Communication

In multilingual communication, dialectal differences, code-switching, and culturally influenced persuasive approaches make phishing and social engineering attacks more widespread, testing existing detection technologies. Traditional monolingual and multilingual transformer-based methods concentrate on lexical and semantic similarities and are less resistant to paraphrase or translation-induced semantic changes. TRIDENT-SE (Translation-Divergence and Intent Graph-based Detection of Social Engineering) is a hybrid cross-lingual cyber threat detection system that uses massive language models and graph-based behavioral reasoning. An instruction-tuned Large Language Model contextualizes English, Modern Standard Arabic, regional Arabic dialects, and romanized Arabic phrases. TDE modules assess semantic differences between original and translated messages, enhancing translation noise and language change resilience. An Intent–Action Graph Reasoning (IAGR) module simulates attacker strategies by correlating urgency, impersonation, credential solicitation, authority exploitation, and money demands. TRIDENT-SE increases F1-score by 9.4% over monolingual baselines and 5.1% over state-of-the-art multilingual transformer models in code-switching, dialect-shift, and adversarial paraphrase situations on an annotated Arabic–English dataset. Arabic-speaking human-centered evaluation participants had 18.7% more correct risk assessments and 22.3% less harmful user responses. Multilingual phishing and social engineering detection is robust and interpretable using translation-aware semantic analysis and intent-driven graph learning.