With the exponential growth in mobile applications, protecting user privacy has become even more crucial. Android applications are often known for collecting, storing, and sharing sensitive user information such as contacts, location, camera, and microphone data often without the user's clear consent or awareness raising significant privacy risks and exposure. In the context of privacy assessment, dataflow analysis is particularly valuable for identifying data usage and potential leaks. Traditionally, this type of analysis has relied on formal methods, heuristics, and rule-based matching. However, these techniques are often complex to implement and prone to errors, such as taint explosion for large programs. Moreover, most existing Android dataflow analysis methods depend heavily on predefined list of sinks, limiting their flexibility and scalability. To address the limitations of these existing techniques, we propose AndroByte, an AI-driven privacy analysis tool that leverages LLM reasoning on bytecode summarization to dynamically generate accurate and explainable dataflow call graphs from static code analysis. AndroByte achieves a significant F\b{eta}-Score of 89% in generating dynamic dataflow call graphs on the fly, outperforming the effectiveness of traditional tools like FlowDroid and Amandroid in leak detection without relying on predefined propagation rules or sink lists. Moreover, AndroByte's iterative bytecode summarization provides comprehensive and explainable insights into dataflow and leak detection, achieving high, quantifiable scores based on the G-Eval metric.

翻译：随着移动应用的指数级增长，保护用户隐私变得愈发关键。Android应用常被发现在未经用户明确同意或知情的情况下收集、存储并共享敏感用户信息（如联系人、位置、摄像头及麦克风数据），这引发了严重的隐私风险与暴露隐患。在隐私评估领域，数据流分析对于识别数据使用与潜在泄露尤为关键。传统上，此类分析依赖于形式化方法、启发式规则及基于规则的匹配技术。然而，这些方法通常实现复杂且易出错，例如在大规模程序中易出现污点爆炸问题。此外，现有的大多数Android数据流分析方法严重依赖于预定义的汇聚点列表，限制了其灵活性与可扩展性。为克服现有技术的局限性，我们提出了AndroByte——一种基于人工智能的隐私分析工具，其利用大语言模型对字节码摘要进行推理，从而通过静态代码分析动态生成精确且可解释的数据流调用图。AndroByte在动态生成数据流调用图方面实现了89%的显著Fβ分数，在无需依赖预定义传播规则或汇聚点列表的情况下，其泄露检测效果超越了FlowDroid、Amandroid等传统工具。此外，AndroByte通过迭代式字节码摘要为数据流与泄露检测提供了全面且可解释的洞察，并基于G-Eval指标获得了可量化的高分评价。