RankBridge: Privacy-Preserving Rank-Based Explanation Clustering for Heterogeneous Federated Phishing Detection

Federated learning lets organizations train a shared model without pooling private data. The standard method, Federated Averaging, requires all participants to use the same input features, a condition that fails in cross-sector phishing detection, where banks analyze URL structure and hospitals analyze email content. We present RankBridge, a system that groups participants by comparing ranked lists of SHapley Additive exPlanations (SHAP) feature importance rather than model weights or gradients. Each participant trains a local LightGBM model, extracts the top-K features by SHAP importance, and sends a 60-byte ranked list of feature indices to a central server. The server applies rank correlation and Ward’s hierarchical clustering to identify similarly threatened organizations. RankBridge operates in two modes: ModelShare, where models are also shared within each discovered group for prediction ensembling, and RankOnly, where the server returns only a group label and each participant keeps their model private. Across 32 participants in five organization types, RankBridge (ModelShare) achieves F1 =0.853 (AUC =0.926) on synthetic data and F1 =0.772 (AUC =0.812) on real phishing data, and it is the only method to outperform isolated local training on both. On real heterogeneous data the standard baselines adapted to LightGBM, including Federated Averaging, retain a moderate thresholded F1 (≈0.73) but their ranking quality collapses to near-random (AUC ≈0.59, PR-AUC ≈0.66), whereas RankBridge sustains AUC =0.812 and PR-AUC =0.819. RankBridge recovers the correct organizational groupings with Normalized Mutual Information (NMI) =0.973. The rank-based grouping channel itself transmits 60 bytes per participant per round, roughly 10,000× less than a full model upload.