Phishing-Safe URL Recommendation with Open Large Language Models via Exposure-Minimizing Admission Control

Large language models are increasingly embedded in e-commerce assistants that recommend links to shopping destinations. When the candidate set contains adversarially crafted phishing URLs, a fluent model can recommend a malicious link with the same confidence it recommends a legitimate one, turning a helpful assistant into a delivery channel for fraud. Rather than treating phishing defense as per-link URL classification, this work frames the problem as recommendation-level exposure minimization: the output set itself must be secured, and a recommendation is counted as useful and safe only when it surfaces a benign destination and exposes no phishing URL. We first organize phishing URL constructions into four families spanning brand padding, typosquatting, homograph substitution, and subdomain impersonation, and use them to build candidate pools that mix benign links with plausible distractors. Evaluating four widely used open models under prompt-only defenses reveals a persistent gap: the strongest prompt baseline reaches only a 47.4 percent four-model average useful-safe rate, and weaker models fall below 20 percent even after careful prompting. We then present SAFER, a Security-Adaptive Filtering framework for Exposure-Minimized URL Recommendation. SAFER separates contextual selection from safety admission by coupling a deterministic lexical and structural pre-filter, an evidence-augmented single reasoning pass, and a deny-by-default post-verification stage with a deterministic fallback. The same deterministic URL evidence is injected before generation to condition the model’s reasoning and reused after generation to constrain which model-selected URLs may reach the user. SAFER issues exactly one model call per query, matching the prompt baselines, so its gains come from structure rather than additional inference. Across the four models SAFER raises the average useful-safe rate to 87.0 percent, a 39.6-point improvement over the best prompt baseline, and the deny-by-default stage yields a positive net gain for every model, largest where the model is weakest. Shrinking the deterministic layer’s brand coverage in a held-out analysis degrades the pipeline gracefully rather than collapsing it, indicating that within the range we tested its robustness does not rest solely on memorizing a fixed brand list. Additional robustness experiments confirm that SAFER transfers to real phishing URLs from the OpenPhish feed, generalizes to unseen attack families, maintains zero exposure on hard benign negatives, outperforms supervised URL classifiers as an admission gate, and maintains exposure minimization under realistic pool structures within the evaluated threat model.