RankBridge: Privacy-Preserving Rank-Based Explanation Clustering for Heterogeneous Federated Phishing Detection

Federated learning lets organizations train a shared model without pooling private data. The standard method, Federated Averaging, requires all participants to use the same input features, a condition that fails in cross-sector phishing detection, where banks analyze URL structure and hospitals analyze email content. We present RankBridge, a system that groups participants by comparing ranked lists of SHapley Additive exPlanations (SHAP) feature importance rather than model weights or gradients. Each participant trains a local LightGBM model, extracts the top-K features by SHAP importance, and sends only 60 bytes of ranked indices to a central server. The server applies rank correlation and Ward’s hierarchical clustering to identify similarly threatened organizations, then combines models only within each discovered group. Across 32 participants in five organization types, RankBridge achieves F1 =0.854 on synthetic data and F1 =0.775 on real phishing data. Federated Averaging collapses to F1 =0.278 on the same data. RankBridge recovers the correct organizational groupings with Normalized Mutual Information (NMI) =0.978 while each participant transmits roughly 10,000× less data per round than a full model upload.