Malicious QR Code Classification Using Machine Learning, Deep Learning, and Explainable AI

The increasing use of Quick Response (QR) codes in daily life has also brought security risks. The automatic detection of malicious QR codes has become a critical area of research in terms of cybersecurity and user safety. This study aims to classify QR codes as safe or malicious using both machine learning (KNN, Random Forest, LightGBM) and deep learning-based methods (DenseNet121, EfficientNetB0, ResNet18/50). Experimental results show that Convolutional Neural Network (CNN)-based models have a clear advantage over Machine Learning (ML) methods. In particular, the DenseNet121 model demonstrated the most successful performance with 89.9% accuracy and a Receiver Operating Characteristic – Area Under Curve (ROC-AUC) value of 0.94. On the ML side, LightGBM stood out with 80.8% accuracy. Furthermore, model decision processes were made transparent using explainable artificial intelligence methods such as LIME, SHAP, and Grad-CAM. These results highlight the effectiveness of deep learning in detecting QR code-based threats and reveal its potential for integration into security systems.