AndroByte: LLM-Driven Privacy Analysis through Bytecode Summarization and Dynamic Dataflow Call Graph Generation

• URL: http://arxiv.org/abs/2510.15112v2
• Date: Tue, 04 Nov 2025 03:23:20 GMT
• Title: AndroByte: LLM-Driven Privacy Analysis through Bytecode Summarization and Dynamic Dataflow Call Graph Generation
• Abstract summary: AndroByte is an AI-driven privacy analysis tool for Android apps.<n>It generates accurate and explainable dataflow call graphs from static code analysis.<n>AndrosByte achieves a significant Fbeta-Score of 89% in generating dynamic dataflow call graphs on the fly.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: With the exponential growth in mobile applications, protecting user privacy has become even more crucial. Android applications are often known for collecting, storing, and sharing sensitive user information such as contacts, location, camera, and microphone data often without the user's clear consent or awareness raising significant privacy risks and exposure. In the context of privacy assessment, dataflow analysis is particularly valuable for identifying data usage and potential leaks. Traditionally, this type of analysis has relied on formal methods, heuristics, and rule-based matching. However, these techniques are often complex to implement and prone to errors, such as taint explosion for large programs. Moreover, most existing Android dataflow analysis methods depend heavily on predefined list of sinks, limiting their flexibility and scalability. To address the limitations of these existing techniques, we propose AndroByte, an AI-driven privacy analysis tool that leverages LLM reasoning on bytecode summarization to dynamically generate accurate and explainable dataflow call graphs from static code analysis. AndroByte achieves a significant F\b{eta}-Score of 89% in generating dynamic dataflow call graphs on the fly, outperforming the effectiveness of traditional tools like FlowDroid and Amandroid in leak detection without relying on predefined propagation rules or sink lists. Moreover, AndroByte's iterative bytecode summarization provides comprehensive and explainable insights into dataflow and leak detection, achieving high, quantifiable scores based on the G-Eval metric.

Related papers

• Towards LLM-Enhanced Android Taint Analysis [7.264089733230453]
  We investigate whether off-the-shelf Large Language Models can effectively reason about taint flows in Android apps.<n>Our approach relies on an agentic interaction strategy, enabling the LLM to iteratively explore code and reason about data flows.<n>Preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.
  arXiv  Detail & Related papers  (2026-08-25T08:57:13Z)
• Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps [9.426024604008406]
  We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store.<n>We identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's.<n>These findings provide technical grounding for widespread user concerns, but also underscore the importance of consumer choice in the privacy implications of app-based fertility tracking.
  arXiv  Detail & Related papers  (2026-06-24T18:17:04Z)
• Phantoms and Disclosures: a Causal Framework for Auditing Synthetic Data [56.86147283213652]
  We present a customizable empirical auditing framework designed to detect and explain data disclosures.<n>Our framework introduces a mechanism to distinguish between "true disclosures"-where the system directly reproduces a user's information-and "phantom disclosures"-where the system incidentally generates a user's data.
  arXiv  Detail & Related papers  (2026-06-15T16:54:02Z)
• Don't Trust Us: A privacy-by-design android malware detection pipeline [0.7009487789080343]
  Existing privacy-aware approaches typically enforce privacy after data collection.<n>We argue that this requirement should be removed rather than managed.<n>Android malware detection should be privacy-aware by design, so that effective analysis does not depend on sensitive data being accessed in the first place.
  arXiv  Detail & Related papers  (2026-06-02T14:36:31Z)
• Efficient and Privacy-Preserving Distribution Statistics Analytics on Mobile Spatial Data [76.32349627923843]
  Performing efficient distributed statistical analysis on spatial data is crucial for real-time mobile computing applications.<n>Existing privacy-preserving techniques often introduce excessive overhead or inaccuracies.<n>In this paper, we design, implement, and evaluate the first system that supports efficient and privacy-preserving distribution statistics analysis for mobile spatial data.
  arXiv  Detail & Related papers  (2026-05-25T12:37:27Z)
• PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store [7.8875412433566465]
  We introduce PrivSTRUCT, a novel and systematic encoder and decoder combined framework that untangles complex privacy disclosures.<n>By applying PrivSTRUCT to a large-scale dataset of 3,756 Android apps, we uncover a critical transparency gap.<n>Alarmingly, we find that sensitive third-party data flows are frequently diluted and entangled into generic or unrelated categories.
  arXiv  Detail & Related papers  (2026-04-24T02:12:11Z)
• Leave No TRACE: Black-box Detection of Copyrighted Dataset Usage in Large Language Models via Watermarking [51.74368870268278]
  We propose TRACE, a framework for fully black-box detection of copyrighted dataset usage in large language models.<n>textttTRACE rewrites datasets with distortion-free watermarks guided by a private key.<n>Across diverse datasets and model families, TRACE consistently achieves significant detections.
  arXiv  Detail & Related papers  (2025-10-03T12:53:02Z)
• Differentially Private Synthetic Data Release for Topics API Outputs [63.79476766779742]
  We focus on one Privacy-Preserving Ads API: the Topics API, part of Google Chrome's Privacy Sandbox.<n>We generate a differentially-private dataset that closely matches the re-identification risk properties of the real Topics API data.<n>We hope this will enable external researchers to analyze the API in-depth and replicate prior and future work on a realistic large-scale dataset.
  arXiv  Detail & Related papers  (2025-06-30T13:46:57Z)
• Enhancing Android Malware Detection with Retrieval-Augmented Generation [1.413488665073795]
  In this work, we focus on a Machine Learning-based method utilizing static features.<n>To mitigate hallucinations, which are a known vulnerability of LLM, we integrated Retrieval-Augmented Generation.<n>Using carefully designed prompts, we guide the LLM to produce coherent function summaries, which are then analyzed using a transformer-based model.
  arXiv  Detail & Related papers  (2025-06-28T04:36:31Z)
• Robust Utility-Preserving Text Anonymization Based on Large Language Models [80.5266278002083]
  Anonymizing text that contains sensitive information is crucial for a wide range of applications.<n>Existing techniques face the emerging challenges of the re-identification ability of large language models.<n>We propose a framework composed of three key components: a privacy evaluator, a utility evaluator, and an optimization component.
  arXiv  Detail & Related papers  (2024-07-16T14:28:56Z)
• PriRoAgg: Achieving Robust Model Aggregation with Minimum Privacy Leakage for Federated Learning [49.916365792036636]
  Federated learning (FL) has recently gained significant momentum due to its potential to leverage large-scale distributed user data.<n>The transmitted model updates can potentially leak sensitive user information, and the lack of central control of the local training process leaves the global model susceptible to malicious manipulations on model updates.<n>We develop a general framework PriRoAgg, utilizing Lagrange coded computing and distributed zero-knowledge proof, to execute a wide range of robust aggregation algorithms while satisfying aggregated privacy.
  arXiv  Detail & Related papers  (2024-07-12T03:18:08Z)
• Differentially Private Graph Diffusion with Applications in Personalized PageRanks [15.529891375174165]
  This work proposes a novel graph diffusion framework with edge-level differential privacy guarantees by using noisy diffusion iterates.<n>The algorithm injects Laplace noise per diffusion and adopts a degree-based thresholding function to mitigate the high sensitivity induced by low-degree nodes.<n>Our privacy loss analysis is based on Privacy Amplification by Iteration (PABI), which to our best knowledge, is the first effort that analyzes PABI with Laplace noise.
  arXiv  Detail & Related papers  (2024-06-22T15:32:53Z)
• Analysis of the Memorization and Generalization Capabilities of AI Agents: Are Continual Learners Robust? [91.682459306359]
  In continual learning (CL), an AI agent learns from non-stationary data streams under dynamic environments. In this paper, a novel CL framework is proposed to achieve robust generalization to dynamic environments while retaining past knowledge. The generalization and memorization performance of the proposed framework are theoretically analyzed.
  arXiv  Detail & Related papers  (2023-09-18T21:00:01Z)
• How Much Privacy Does Federated Learning with Secure Aggregation Guarantee? [22.7443077369789]
  Federated learning (FL) has attracted growing interest for enabling privacy-preserving machine learning on data stored at multiple users. While data never leaves users' devices, privacy still cannot be guaranteed since significant computations on users' training data are shared in the form of trained local models. Secure Aggregation (SA) has been developed as a framework to preserve privacy in FL.
  arXiv  Detail & Related papers  (2022-08-03T18:44:17Z)
• Privacy-Utility Trades in Crowdsourced Signal Map Obfuscation [20.58763760239068]
  Crowdsource celluar signal strength measurements can be used to generate signal maps to improve network performance. We consider obfuscating such data before the data leaves the mobile device. Our evaluation results, based on multiple, diverse, real-world signal map datasets, demonstrate the feasibility of concurrently achieving adequate privacy and utility.
  arXiv  Detail & Related papers  (2022-01-13T03:46:22Z)
• Deep Directed Information-Based Learning for Privacy-Preserving Smart Meter Data Release [30.409342804445306]
  We study the problem in the context of time series data and smart meters (SMs) power consumption measurements. We introduce the Directed Information (DI) as a more meaningful measure of privacy in the considered setting. Our empirical studies on real-world data sets from SMs measurements in the worst-case scenario show the existing trade-offs between privacy and utility.
  arXiv  Detail & Related papers  (2020-11-20T13:41:11Z)
• Privacy-preserving Traffic Flow Prediction: A Federated Learning Approach [61.64006416975458]
  We propose a privacy-preserving machine learning technique named Federated Learning-based Gated Recurrent Unit neural network algorithm (FedGRU) for traffic flow prediction. FedGRU differs from current centralized learning methods and updates universal learning models through a secure parameter aggregation mechanism. It is shown that FedGRU's prediction accuracy is 90.96% higher than the advanced deep learning models.
  arXiv  Detail & Related papers  (2020-03-19T13:07:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.