CascadeGuard: Hardening Phishing Detection Against Character-Level Obfuscation, Semantic Paraphrasing, and Stealthy Indirect Prompt Injection

As phishing attacks against enterprise and Open and Distance e-Learning (ODeL) infrastructures grow increasingly sophisticated, defenders face an acute architectural dilemma: classical machine learning (ML) and unhardened Pre-trained Language Models (PLMs) suffer severe recall degradation when adversaries apply character-level Unicode homoglyphs, intentional cacography, or discourse-level paraphrasing, whereas zero-shot Large Language Model (LLM) email scanners—which naturally comprehend obfuscated and paraphrased text—are catastrophically vulnerable to stealthy indirect prompt injection embedded in HTML/CSS payloads. Furthermore, multi-agent LLM debate defenses incur prohibitive token costs and multi-second latencies. In this paper, we propose CascadeGuard, a lightweight, three-stage defense-in-depth framework that bridges the robustness-latency gap. CascadeGuard integrates: (1) a pre-classification DOM/meta-prompt injection guardrail and anomaly scorer, (2) a Unicode homoglyph canonicalization and cacography reconstruction module, and (3) a calibrated hybrid scoring engine combining lexical risk indicators with invariant semantic-intent patterns and institutional domain whitelisting. Evaluated on a realistic benchmark corpus of N = 1,000 emails (500 phishing, including subtle spear-phishing; 500 benign, including "hard negative" IT security advisories) across four adversarial threat vectors, we demonstrate that while unhardened PLMs drop to 35.0%-53.2% recall under cacography and homoglyph attacks and unprotected LLM judges collapse to 8.8% recall (91.2% Attack Success Rate) under indirect prompt injection, CascadeGuard achieves 96.3% ± 1.2% clean F1-score (ROC-AUC = 96.8%, MCC = 92.6%), maintains 96.4%-99.8% adversarial recall across all four attack vectors, reduces the False Positive Rate (FPR) from 11.2% to 3.8%, and operates at an ultra-fast average latency of 20.1 microseconds per email. Non-parametric McNemar chi-square tests confirm statistical significance (p < 0.0001) across all baselines, and component-wise ablation studies validate the complementary necessity of all three defensive stages.