AndroByte: LLM-Driven Privacy Analysis through Bytecode Summarization and Dynamic Dataflow Call Graph Generation

2025-10-16

AI Summary

Android applications frequently collect and share sensitive data—such as location, audio, and video—without explicit user consent, posing severe privacy risks. Existing static taint analysis approaches rely on predefined sink lists and manually crafted rules, suffering from taint explosion and exhibiting limited scalability and interpretability. This paper proposes an LLM-driven bytecode summarization framework—the first to integrate large language models into Android bytecode analysis—eliminating the need for pre-specified taint rules or sink definitions. It combines static analysis, iterative LLM-based bytecode summarization, and dynamic call graph construction to precisely trace sensitive data flows and generate natural-language explanations. Experimental results show that its dynamic data-flow call graph generation achieves an Fβ-Score of 89%, significantly outperforming FlowDroid and Amandroid. G-Eval assessment confirms its strong explanatory capability, establishing a new paradigm for privacy assessment that is high-accuracy, adaptive, and human-understandable.

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models
• Data Mining & Knowledge Management: Data Visualization & Summarization

Application Category

• Security and Privacy: Data transparency and provenance
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

With the exponential growth in mobile applications, protecting user privacy has become even more crucial. Android applications are often known for collecting, storing, and sharing sensitive user information such as contacts, location, camera, and microphone data often without the user's clear consent or awareness raising significant privacy risks and exposure. In the context of privacy assessment, dataflow analysis is particularly valuable for identifying data usage and potential leaks. Traditionally, this type of analysis has relied on formal methods, heuristics, and rule-based matching. However, these techniques are often complex to implement and prone to errors, such as taint explosion for large programs. Moreover, most existing Android dataflow analysis methods depend heavily on predefined list of sinks, limiting their flexibility and scalability. To address the limitations of these existing techniques, we propose AndroByte, an AI-driven privacy analysis tool that leverages LLM reasoning on bytecode summarization to dynamically generate accurate and explainable dataflow call graphs from static code analysis. AndroByte achieves a significant F{eta}-Score of 89% in generating dynamic dataflow call graphs on the fly, outperforming the effectiveness of traditional tools like FlowDroid and Amandroid in leak detection without relying on predefined propagation rules or sink lists. Moreover, AndroByte's iterative bytecode summarization provides comprehensive and explainable insights into dataflow and leak detection, achieving high, quantifiable scores based on the G-Eval metric.

Problem

• Analyzing Android app privacy risks from unauthorized data collection
• Overcoming limitations of traditional static analysis with predefined sinks
• Addressing complexity and errors in existing dataflow analysis methods

Innovation

• LLM-driven bytecode summarization for privacy analysis
• Dynamic dataflow call graph generation from static code
• Iterative summarization provides explainable leak detection insights