Phishing can turn stolen personal information into financial harm, yet some sites hide data collection beyond the landing page. We present a site-level workflow for Korean-language phishing that tracks linked pages and supplies LLMs with relation-centered DOM summaries. The 256 landing URLs treated as phishing in the full collection were labeled primarily by the initial LLM, with human labels taking precedence for reviewed sites. Of these, 161 (62.9%) were detected by at least one VirusTotal engine; 215 of 217 linked URLs (99.1%) had no prior query record, and neither remaining URL was detected. On 70 human-validated landing pages, summarization increased Gemini 2.5 Flash-Lite’s F1 from 0.621 to 0.925, while F1 changes for the other three Gemini models ranged from -0.011 to +0.035. In a six-site case study, data collection was detected only on linked pages, while page-level aggregation retained landing-page impersonation targets more consistently than concatenation. These results highlight the importance of exploration scope and show model-dependent accuracy effects of relation-centered DOM summaries in phishing detection.

Financial institutions must prevent personally identifiable information (PII) and adversarial instructions from entering large language models (LLMs). We present regression-aware policy maintenance for Korean financial LLM input guardrails, supported by a cost-ordered Regex–NER–LLM cascade. On a privacy-preserving controlled set of 1,000 synthetic attacks and 200 routine requests, four manual iterations reduce in-distribution attack success rate (ASR) from 8.9% to 0.3% with a 0.5% false-positive rate (FPR) on the original tuning set. On a held-out split, a policy tuned only on the tuning split achieves 0/300 attack successes and 1/60 false positives, with Wilson 95% CIs of [0, 1.26]% and [0.29, 8.86]%, respectively. For policy maintenance, an LLM generates candidate patches, while paired McNemar tests, an FPR constraint, and cumulative regression checks determine acceptance or rejection. Paired regression testing detects an intermediate regression introduced in manual Round 3, while the gate rejects all five automatically generated candidates, preventing statistically unsupported changes from entering the policy. For boundary diagnosis, the rejected fifth-round candidate yields a pre-mitigation overall FPR of 28.9% across 350 benign examples, including 150 hard negatives, revealing context-blind Regex blocking and LLM-judge over-blocking hidden by routine benign requests. These results support regression-aware policy maintenance in the controlled setting while highlighting the need for broader boundary and deployment-specific evaluation.