Privacy-critical domains require phishing detection systems that satisfy contradictory constraints: near-zero false positives to prevent workflow disruption, transparent explanations for non-expert staff, strict regulatory compliance prohibiting sensitive data exposure to external APIs, and robustness against AI-generated attacks. Existing rule-based systems are brittle to novel campaigns, while LLM-based detectors violate privacy regulations through unredacted data transmission. We introduce CyberCane, a neuro-symbolic framework integrating deterministic symbolic analysis with privacy-preserving retrieval-augmented generation (RAG). Our dual-phase pipeline applies lightweight symbolic rules to email metadata, then escalates borderline cases to semantic classification via RAG with automated sensitive data redaction and retrieval from a phishing-only corpus. We further introduce PhishOnt, an OWL ontology enabling verifiable attack classification through formal reasoning chains. Evaluation on DataPhish2025 (12.3k emails; mixed human/LLM) and Nazario/SpamAssassin demonstrates a 78.6-point recall gain over symbolic-only detection on AI-generated threats, with precision exceeding 98% and FPR as low as 0.16%. Healthcare deployment projects a 542x ROI; tunable operating points support diverse risk tolerances, with open-source implementation at https://github.com/sbhakim/Cybercane.

翻译：隐私关键领域要求钓鱼检测系统满足相互矛盾的约束：接近零的误报率以防止工作流程中断、面向非专业人员的透明化解释、禁止敏感数据暴露给外部API的严格合规性要求、以及对AI生成攻击的鲁棒性。现有基于规则的系统难以应对新型攻击，而基于LLM的检测器因未脱敏的数据传输违反隐私法规。我们提出CyberCane，一个融合确定性符号分析与隐私保护检索增强生成（RAG）的神经符号化框架。其双阶段流水线首先对邮件元数据应用轻量级符号规则，随后通过RAG将边界案例升级至语义分类阶段，该过程实现了敏感数据自动脱敏及仅限钓鱼语料库的检索。我们进一步引入PhishOnt——一个基于OWL的本体，通过形式化推理链实现可验证的攻击分类。在DataPhish2025（含12,300封由人类和LLM混合生成的邮件）及Nazario/SpamAssassin数据集上的评估表明，相较于纯符号化检测方法，本方案在AI生成威胁检测中召回率提升78.6个百分点，准确率超过98%，假阳性率低至0.16%。医疗部署场景预计实现542倍投资回报率；可调的操作点支持多样化的风险容忍度，开源实现见https://github.com/sbhakim/Cybercane。