Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code

• URL: http://arxiv.org/abs/2402.07367v1
• Date: Mon, 12 Feb 2024 01:55:40 GMT
• Title: Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code
• Abstract summary: Mini-applications, commonly referred to as mini-apps, are compact software programs embedded within larger applications or platforms. This paper investigates the potential of employing Large Language Models (LLMs) to detect privacy breaches within WeChat Mini Programs.
• Score: 19.7220607313348
• License: http://creativecommons.org/publicdomain/zero/1.0/
• Abstract: Mini-applications, commonly referred to as mini-apps, are compact software programs embedded within larger applications or platforms, offering targeted functionality without the need for separate installations. Typically web-based or cloud-hosted, these mini-apps streamline user experiences by providing focused services accessible through web browsers or mobile apps. Their simplicity, speed, and integration capabilities make them valuable additions to messaging platforms, social media networks, e-commerce sites, and various digital environments. WeChat Mini Programs, a prominent feature of China's leading messaging app, exemplify this trend, offering users a seamless array of services without additional downloads. Leveraging WeChat's extensive user base and payment infrastructure, Mini Programs facilitate efficient transactions and bridge online and offline experiences, shaping China's digital landscape significantly. This paper investigates the potential of employing Large Language Models (LLMs) to detect privacy breaches within WeChat Mini Programs. Given the widespread use of Mini Programs and growing concerns about data privacy, this research seeks to determine if LLMs can effectively identify instances of privacy leakage within this ecosystem. Through meticulous analysis and experimentation, we aim to highlight the efficacy of LLMs in safeguarding user privacy and security within the WeChat Mini Program environment, thereby contributing to a more secure digital landscape.

Related papers

• Don't Trust the Super-App: A Case Study of Russia's Max [6.434185166424619]
  Super-apps host third-party mini-apps inside a single app.<n>We show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps.
  arXiv  Detail & Related papers  (2026-09-10T17:08:00Z)
• TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps [3.345437353879255]
  Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
  arXiv  Detail & Related papers  (2026-08-13T15:51:18Z)
• MCP-Persona: Benchmarking LLM Agents on Real-World Personal Applications via Environment Simulation [55.14253918630382]
  We introduce MCP-Persona, the first benchmark specifically designed for evaluating agent performance on real-world, personalized MCP tools.<n> MCP-Persona encompasses a diverse set of widely-used applications, ranging from social media platforms like Reddit and Xiaohongshu (Rednote) to enterprise collaboration suites such as Lark (Feishu) and Slack.<n>Our experiments on various state-of-the-art (SOTA) agents demonstrate their significant struggles with personalized tool use, thereby highlighting the benchmark's crucial role in identifying and addressing these limitations.
  arXiv  Detail & Related papers  (2026-06-01T16:44:10Z)
• PWC-MoE: Privacy-Aware Wireless Collaborative Mixture of Experts [59.5243730853157]
  Large language models (LLMs) hosted on cloud servers alleviate the computational and storage burdens on local devices but raise privacy concerns.<n>Small language models (SLMs) running locally enhance privacy but suffer from limited performance on complex tasks.<n>We propose a privacy-aware wireless collaborative mixture of experts (PWC-MoE) framework to balance computational cost, performance, and privacy protection under bandwidth constraints.
  arXiv  Detail & Related papers  (2025-05-13T16:27:07Z)
• Porting an LLM based Application from ChatGPT to an On-Premise Environment [2.4742581572364126]
  We study the porting process of a real-life application using ChatGPT to an on-premise environment. The main considerations in the porting process include transparency of open source models and cost of hardware.
  arXiv  Detail & Related papers  (2025-04-10T16:29:26Z)
• I Can Tell Your Secrets: Inferring Privacy Attributes from Mini-app Interaction History in Super-apps [14.642699257599991]
  This paper reveals a new privacy leakage source in super-apps: mini-app interaction history (Mini-H) and operation history (Op-H) Mini-H refers to the history of mini-apps accessed by users, such as their frequency and categories. Op-H captures user interactions within mini-apps, including button clicks, bar drags, and image views. We design a mini-app interaction history-oriented inference attack (THEFT), to exploit this new vulnerability.
  arXiv  Detail & Related papers  (2025-03-13T10:29:40Z)
• Darkit: A User-Friendly Software Toolkit for Spiking Large Language Model [50.37090759139591]
  Large language models (LLMs) have been widely applied in various practical applications, typically comprising billions of parameters. The human brain, employing bio-plausible spiking mechanisms, can accomplish the same tasks while significantly reducing energy consumption. We are releasing a software toolkit named DarwinKit (Darkit) to accelerate the adoption of brain-inspired large language models.
  arXiv  Detail & Related papers  (2024-12-20T07:50:08Z)
• PAPILLON: PrivAcy Preservation from Internet-based and Local Language MOdel ENsembles [21.340456482528136]
  We propose Privacy-Conscious Delegation, a novel task for chaining API-based and local models. We utilize recent public collections of user-LLM interactions to construct a natural benchmark called PUPA. Our best pipeline maintains high response quality for 85.5% of user queries while restricting privacy leakage to only 7.5%.
  arXiv  Detail & Related papers  (2024-10-22T16:00:26Z)
• CAMPHOR: Collaborative Agents for Multi-input Planning and High-Order Reasoning On Device [2.4100803794273005]
  We introduce an on-device Small Language Models (SLMs) framework designed to handle multiple user inputs and reason over personal context locally. CAMPHOR employs a hierarchical architecture where a high-order reasoning agent decomposes complex tasks and coordinates expert agents responsible for personal context retrieval, tool interaction, and dynamic plan generation. By implementing parameter sharing across agents and leveraging prompt compression, we significantly reduce model size, latency, and memory usage.
  arXiv  Detail & Related papers  (2024-10-12T07:28:10Z)
• Exploring ChatGPT App Ecosystem: Distribution, Deployment and Security [3.0924093890016904]
  ChatGPT has enabled third-party developers to create plugins to expand ChatGPT's capabilities. We conduct the first comprehensive study of the ChatGPT app ecosystem, aiming to illuminate its landscape for our research community. We uncover an uneven distribution of functionality among ChatGPT plugins, highlighting prevalent and emerging topics.
  arXiv  Detail & Related papers  (2024-08-26T15:31:58Z)
• LLM-PBE: Assessing Data Privacy in Large Language Models [111.58198436835036]
  Large Language Models (LLMs) have become integral to numerous domains, significantly advancing applications in data management, mining, and analysis. Despite the critical nature of this issue, there has been no existing literature to offer a comprehensive assessment of data privacy risks in LLMs. Our paper introduces LLM-PBE, a toolkit crafted specifically for the systematic evaluation of data privacy risks in LLMs.
  arXiv  Detail & Related papers  (2024-08-23T01:37:29Z)
• VidyaRANG: Conversational Learning Based Platform powered by Large Language Model [0.0]
  Large Language Models fail to provide answers to questions derived from sensitive confidential information. This is where knowledge-augmented retrieval techniques become particularly useful. The proposed platform is designed to cater to the needs of learners from divergent fields.
  arXiv  Detail & Related papers  (2024-07-23T06:30:35Z)
• On the Multi-turn Instruction Following for Conversational Web Agents [83.51251174629084]
  We introduce a new task of Conversational Web Navigation, which necessitates sophisticated interactions that span multiple turns with both the users and the environment. We propose a novel framework, named self-reflective memory-augmented planning (Self-MAP), which employs memory utilization and self-reflection techniques.
  arXiv  Detail & Related papers  (2024-02-23T02:18:12Z)
• PIN: Positional Insert Unlocks Object Localisation Abilities in VLMs [55.8550939439138]
  Vision-Language Models (VLMs) have shown immense potential by integrating large language models with vision systems. These models face challenges in the fundamental computer vision task of object localisation, due to their training on multimodal data containing mostly captions. We introduce an input-agnostic Positional Insert (PIN), a learnable spatial prompt, containing a minimal set of parameters that are slid inside the frozen VLM. Our PIN module is trained with a simple next-token prediction task on synthetic data without requiring the introduction of new output heads.
  arXiv  Detail & Related papers  (2024-02-13T18:39:18Z)
• OS-Copilot: Towards Generalist Computer Agents with Self-Improvement [48.29860831901484]
  We introduce OS-Copilot, a framework to build generalist agents capable of interfacing with comprehensive elements in an operating system (OS) We use OS-Copilot to create FRIDAY, a self-improving embodied agent for automating general computer tasks. On GAIA, a general AI assistants benchmark, FRIDAY outperforms previous methods by 35%, showcasing strong generalization to unseen applications via accumulated skills from previous tasks.
  arXiv  Detail & Related papers  (2024-02-12T07:29:22Z)
• MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis [15.579663449357144]
  MiniApps offer a wide range of services without the need for individual app downloads. These MiniApps often require access to sensitive data, potentially leading to privacy violations. Our research addresses the critical gaps in the analysis of MiniApps' privacy practices.
  arXiv  Detail & Related papers  (2024-01-06T13:54:36Z)
• YMIR: A Rapid Data-centric Development Platform for Vision Applications [82.67319997259622]
  This paper introduces an open source platform for rapid development of computer vision applications. The platform puts the efficient data development at the center of the machine learning development process.
  arXiv  Detail & Related papers  (2021-11-19T05:02:55Z)
• Local Differential Privacy based Federated Learning for Internet of Things [72.83684013377433]
  Internet of Vehicles (IoV) simulates a large variety of crowdsourcing applications such as Waze, Uber, and Amazon Mechanical Turk, etc. Users of these applications report the real-time traffic information to the cloud server which trains a machine learning model based on traffic information reported by users for intelligent traffic management. In this paper, we propose to integrate federated learning and local differential privacy (LDP) to facilitate the crowdsourcing applications to achieve the machine learning model.
  arXiv  Detail & Related papers  (2020-04-19T14:03:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.