Search for: All records

The zip archive contains all resources necessary to reproduce and replicate the results presented in this paper, including the complete source code, detailed findings, and the comprehensive list of analyzed applications. To reproduce our results, it is encouraged to consult the README.md file included in the archive, which provides step-by-step instructions for setup and execution. 

As mobile applications (i.e., apps) increasingly man- age a wide variety of user needs, their access to sensitive data intensifies privacy concerns among users. While app markets employ permissions to regulate private data access, the lack of explanation for permission usage renders this mechanism less effective. Existing techniques that extract explanatory sentences from app descriptions to inform users about sensitive behaviors are also limited. Many app behaviors remain unexplained in app descriptions. To address these issues, we propose APPBDS, a novel approach that integrates program analysis with Large Language Models (LLMs) to process code semantics and UI con- texts, further complemented by privacy policies and information from similar apps, in order to generate detailed explanations for apps’ sensitive behaviors. Specifically, APPBDS integrates code semantics with UI contexts to build a UI-Fused Call Graph (UCG) for each app. Additionally, APPBDS summarizes permission-related propositions from privacy policies and utilizes similar apps’ information from a knowledge base (PP-KB) to improve LLMs’ domain knowledge in explaining permission usage. Our evaluation on 270 real-world apps demonstrates that APPBDS significantly outperforms state-of-the-art approaches in richness, specificity, and semantic relatedness, while also proving highly robust against common code obfuscation. 

With the growing adoption of privacy-preserving machine learning algorithms, such as Differentially Private Stochastic Gradient Descent (DP-SGD), training or fine-tuning models on private datasets has become increasingly prevalent. This shift has led to the need for models offering varying privacy guarantees and utility levels to satisfy diverse user requirements. Managing numerous versions of large models introduces significant operational challenges, including increased inference latency, higher resource consumption, and elevated costs. Model deduplication is a technique widely used by many model serving and database systems to support high-performance and low-cost inference queries and model diagnosis queries. However, none of the existing model deduplication works has considered privacy, leading to unbounded aggregation of privacy costs for certain deduplicated models and inefficiencies when applied to deduplicate DP-trained models. We formalize the problem of deduplicating DP-trained models for the first time and propose a novel privacy- and accuracy-aware deduplication mechanism to address the problem. We developed a greedy strategy to select and assign base models to target models to minimize storage and privacy costs. When deduplicating a target model, we dynamically schedule accuracy validations and apply the Sparse Vector Technique to reduce the privacy costs associated with private validation data. Compared to baselines, our approach improved the compression ratio by up to 35× for individual models (including large language models and vision transformers). We also observed up to 43× inference speedup due to the reduction of I/O operations.