Pith. sign in

REVIEW 3 major objections 5 minor 94 references

LM-Scout: Analyzing the Security of Language Model Integration in Android Apps

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper shows that 70% of Android apps using language models allow an attacker to bypass at least one restriction, and that the same access can be obtained automatically in 120 of 2,950 scanned apps.

desk verdict Good taxonomy and first large-scale measurement, but the headline '120 unrestricted access' claim is not supported by the paper's own verification, so treat the prevalence numbers as an upper bound until the discrepancy is resolved. read the letter →

arxiv 2505.08204 v1 pith:YCCDF6FS submitted 2025-05-13 cs.CR

Muhammad Ibrahim (1) , Gűliz Seray Tuncay (2) , Z. Berkay Celik (3) , Aravind Machiry (3) , Antonio Bianchi (3) ((1) Georgia Institute of Technology , (2) Google , (3) Purdue University) This is my paper · ORCID
classification cs.CR
keywords languagemodelsecurityAndroidappLLMintegrationjailbreakattacksAPIkeyleakagepromptmobiletamperingLM-Scout
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LM-Scout reports that the majority of Android apps that integrate language models do not securely enforce limits on how the model is used. In a manually analyzed sample of 181 apps, at least one restriction—query quotas, topic limits, content moderation, or secrecy of the model's hidden instructions—could be bypassed in 127 apps. Scaling the analysis to 2,950 recent apps, the paper's automated tool generated working scripts for 120 apps that give an attacker unrestricted access to the underlying language model. The result matters because app developers pay per query and per token; unrestricted access means financial loss, reputational abuse, and exposure of proprietary prompts. The paper identifies root causes—hard-coded credentials, client-side-only enforcement, and SDKs that require insecure integration—and argues for server-side enforcement as the fix.

What carries the argument

The carrying mechanism is a two-layer analysis. First comes a taxonomy of restrictions: each restriction is classified by what it limits (Quota-R, Topic-R, Mod-R, PIP-R) and whether it is enforced inside the LM framework or inside the app framework. Second comes LM-Scout, an automated tool that combines static analysis of decompiled code, dynamic app interaction driven by a vision-based LLM and randomized exploration, network interception of the app's traffic, and LLM-assisted synthesis of a Python exploit script. The tool locates the LM endpoint, extracts authentication credentials or token-generation logic, and then tests whether the model itself can be jailbroken with crafted prompts. The exploit's success is verified by executing it and checking that the answer to a known question appears.

What would settle it

Re-run the automated pipeline on the same 2,950 apps with a different, independently validated jailbreak prompt set and with a stricter success criterion that requires demonstrating topic, moderation, and quota bypass separately; if the number of working exploit scripts drops to near zero, the claim that most LM integrations are insecure would be contradicted. Alternatively, an independent replication of the manual 181-app analysis that fails to reproduce the 127-app bypass count would directly test the central claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that an adversary who can reverse-engineer an Android app and monitor or manipulate its network traffic can, in most cases, obtain unrestricted access to the language model that powers the app. Unrestricted means three things: the attacker can query any topic, including ones the developer intended to block; can exceed the app's limits on the number and length of queries; and can extract proprietary data, including the developer's hidden system prompt. The evidence is empirical: in 127 of 181 (70%) manually analyzed apps at least one restriction was bypassed, and the fully automated LM-Scout pipeline produced working exploit scripts for 120 of 2,950 scanned apps. The paper frames the vulnerability as a consequence of enforcing restrictions in the app itself, which a tampering attacker controls, rather than on the server.

Load-bearing premise

The counts of vulnerable apps rest on a fixed set of jailbreak prompts (AIM and HYP, plus custom prompts) and on treating an app as exploitable when a generated script can send an arbitrary request and receive an answer; if a real attacker has stronger or weaker prompts than this set, or if bypassing one restriction is taken as 'unrestricted' access without proving that topic, moderation, and quota limits all fail, the prevalence numbers change.

Editorial extensions

If this is right

  • App-side enforcement of quotas, input length, and moderation is unreliable: a tampered app can skip or rewrite the checks, so any restriction that depends on the client can be bypassed.
  • Hard-coded LM API keys in Android apps are a direct path to unrestricted access; static scan of the decompiled code alone found 65 apps with exposed credentials.
  • Authentication frameworks, when used, are often misconfigured so that free-query tokens can be minted repeatedly, effectively removing payment walls.
  • The same integration flaws create an ecosystem-wide risk: a single insecure SDK can propagate the same vulnerability to every app that adopts it, as happened with a keyboard SDK used by 22 apps in the dataset.
  • Secure integration requires moving restrictions to the app's backend server and providing Android-specific LM SDKs that never expose credentials or prompts to the client.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the root causes are platform-level rather than app-specific, the same vulnerability classes should appear in iOS apps, where apps also embed credentials and enforce limits client-side; a cross-platform scan would test that prediction.
  • The paper's automation (LLM-guided UI interaction plus network analysis) suggests that attackers can generalize the scraping step and harvest many endpoints cheaply; the cost asymmetry favors the attacker, so the paper's prevalence numbers may be a lower bound for real-world exploitation.
  • An immediate, testable extension is to re-run LM-Scout on the same or a fresh sample after the disclosure window: the 16 apps that reportedly added anti-tampering could be checked for whether server-side enforcement actually followed, or only obfuscation.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper studies the security of language model (LM) integration in Android apps. It first manually analyzes 181 LM-using apps, develops a taxonomy of LM restrictions (quota, topic, moderation, proprietary-information protection), and reports that at least one restriction can be bypassed in 127 of those apps. The authors then build LM-Scout, an automated pipeline combining static analysis, LLM-guided dynamic UI interaction, network traffic analysis, and LLM-based exploit-script synthesis, and run it on 2,950 PlayStore apps. The paper's headline result is that LM-Scout automatically generates scripts granting 'unrestricted access' to the LM for 120 apps. The paper also reports root causes for the insecure integrations and recommends server-side enforcement of restrictions. A manual-follow-up experiment yields 18 additional scripts when the UI-interaction step is performed by a human.

Significance. The study addresses a timely and under-explored problem and provides one of the first large-scale measurements of LM-integration security in mobile apps. Its strengths include a clear threat model, a useful taxonomy, a substantial measurement infrastructure, and responsible-disclosure efforts that led to fixes in 16 apps. The manual reconnaissance data (127/181) is credible and the case studies are informative. However, the automated headline claim of 120 apps with 'unrestricted access' is currently not supported by the verification methodology: the script success criterion only checks a single benign trivia response, and the paper's own jailbreak testing succeeds for only 46 apps. If the claim is narrowed or re-verified, the paper would be a valuable contribution to the security literature; in its current form, the central quantitative claim overstates what is measured.

major comments (3)
  1. [Section I; Section VII-C] The verification criterion does not match the definition of 'unrestricted access' used in the paper. Section I defines unrestricted access as the ability to query any topic (including harmful topics), with no limits on query number or length, and to access proprietary data. Section VII-C states that an exploit script is considered successful when the answer to the fixed LM-query ('Tell only in three words, the capital of Country A, Country B, Country C') is present in the script logs, and that only after this does LM-Scout test the LM against jailbreak prompts. This criterion establishes only that the script can send a request to the LM endpoint and receive a response to one benign, common-knowledge question; it does not establish that quota limits, output-length limits, topic restrictions, moderation, or pre-prompt protections are bypassed. This gap is confirmed by the paper's own Section VIII, which reports successful jailbreaks for only 46 apps; for the remaining apps among the claimed 120, the 'any topic' and moderation components of 'unrestricted access' are unverified. The authors should either narrow the headline claim to 'automatically generated scripts that can access the LM endpoint' and report the 46-app jailbreak figure as a separate result, or extend the verification to include out-of-domain queries, harmful-content queries, and quota-exceeding queries.
  2. [Abstract; Section VIII] The paper reports 65 attack scripts from static analysis and 61 from dynamic analysis, totaling 126, yet the abstract and Section I state that LM-Scout found 120 vulnerable apps. The discrepancy of six is never explained. If some scripts were not verified or some apps appear in both the static and dynamic sets, that needs to be stated; as written, the headline count is arithmetically inconsistent with the supporting results.
  3. [Section VIII (additional experiment)] The paper describes a manual-interaction follow-up in which a human performs the app-interaction step for 40 apps and LM-Scout completes the rest automatically, yielding 18 additional working scripts. It is not stated whether these 18 are included in the 120 claimed in the abstract or are an additional result. Because the paper elsewhere emphasizes that LM-Scout is 'fully automated,' readers need to know whether the 120 count is purely automatic or includes human-assisted cases. Please clarify the inclusion criterion and, if these 18 are not included, state the combined total.
minor comments (5)
  1. [Figure 1 caption] The captions for sub-figures (b) and (c) are identical ('An app utilizing LM-Server hosted by the developer by communicating through the App-Server'), but Section II-B describes (c) as a third-party LM-Server. Please correct the caption to match the text.
  2. [Table II] The subcategory counts under Quota-R (52+13+115+68+6 = 254) exceed the reported total of 139; since apps can implement multiple restrictions, please add a note explaining that the categories are not mutually exclusive.
  3. [Section VIII] The dynamic-exploit breakdown (13 API-key leaks + 30 proprietary authentication frameworks + 12 Android authentication frameworks = 55) falls short of the reported 61 dynamic exploits; please account for the remaining six exploits.
  4. [Section VII-B] For reproducibility, please specify the concrete countries used in the LM-query, rather than the placeholders 'Country A, Country B, Country C'.
  5. [Various sections] Minor typos and wording issues: 'underlining LM' should be 'underlying LM' (Sections I and XI); 'Sore' should be 'Store' (Section VI-A); 'relaying' should be 'relying' (Section X); 'folowing' should be 'following' (Section VIII); '11 apps that are performing' should be '11 apps that perform' (Section V-B).

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: LM-Scout's findings are empirical measurements against live endpoints, not derivations from the paper's own assumptions.

full rationale

The paper's claims rest on direct empirical evidence: manual reverse engineering and live probing of apps (Section V-B), interception of real network traffic, and automated generation and execution of Python scripts against the apps' actual LM endpoints (Section VII). The 127/181 and 120/2950 counts are measurements of what the authors' prompt set, tooling, and threat model could achieve, not predictions derived from a fitted parameter or a self-referential equation. The taxonomy of restrictions is explicitly described as derived from iterative analysis of the apps themselves, so it is a descriptive classification rather than a derivation that reduces to its own output. The only notable concern is a gap between the paper's broad definition of 'unrestricted access' (Section I: any topic, no query or length limits, proprietary data protection) and the automated verification in Section VII-C, which checks only whether the answer to a fixed trivia query appears in the exploit script's logs. Section VIII further reports that jailbreak attacks succeeded for only 46 apps, so the 120-app claim does not by itself establish all three aspects of the Section I definition. This is a correctness/validity limitation or overclaim, not circularity: the reported numbers are not forced by the definitions or by any fitted input. The paper also contains several self-citations (e.g., [31], [39], [78]), but these support general Android instrumentation and security-analysis methodology and are not load-bearing for the LM-integration vulnerability findings. No uniqueness theorem, ansatz, or 'prediction' is imported from the authors' prior work. Accordingly, there is no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper is an empirical measurement, so the ledger records hand-chosen methodological thresholds and domain assumptions that condition the headline counts. None of these are fitted physical parameters; changing the dataset filters, the verification query, or the jailbreak prompts would change the reported vulnerability rates. The paper introduces no new physical entities.

free parameters (4)
  • Automated dataset filters = updated < 4 months, installs > 1000
    Section VIII Dataset; these cutoffs define the 2,950-app population that yields the 120 vulnerable apps.
  • Manual dataset download threshold = 1M+ downloads
    Section V App Collection; this filter restricts the 181-app manual dataset and shapes the reported 70% bypass rate.
  • Jailbreak prompt set = AIM (highest votes) and HYP (highest score) from Jailbreak Chat
    Section V-B Bypassing Restrictions; the Mod-R and Topic-R bypass counts depend on these chosen prompts.
  • LM-query = 'Tell only in three words, the capital of Country A, Country B, Country C.'
    Section VII-B; this deterministic query is the success marker used in exploit verification.
assumptions (4)
  • domain assumption Android apps can be reverse engineered and their network traffic intercepted; attackers can also use Frida to hook methods.
    Threat model in Section III and setup in Section V-B; this is standard for Android security research but limits generalization to heavily hardened apps.
  • domain assumption The AIM and HYP jailbreak prompts, plus custom crafted prompts, are sufficient to determine whether an app's LM restrictions can be bypassed.
    Section V-B and the Appendix; the reported bypass counts (127/181, 98/120 Mod-R, etc.) are conditioned on this specific prompt set.
  • domain assumption Apps sampled from the Play Store with over 1M downloads (manual phase) or updated in the last 4 months with over 1000 installs (automated phase) represent the LM-app ecosystem.
    Section V and Section VIII; these selection filters affect prevalence and may not generalize to all LM-using Android apps.
  • domain assumption A script that lets an attacker send an arbitrary query to the LM endpoint and receive the answer constitutes exploitation.
    Section VII-C exploit verification; the verification check is the authors' success criterion and does not by itself prove topic or moderation bypass.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LM-Scout: Analyzing the Security of Language Model Integration in Android Apps." pith.science (2026). https://pith.science/paper/YCCDF6FS

@misc{pith2026250508204,
  author       = {Pith},
  title        = {Pith review of: LM-Scout: Analyzing the Security of Language Model Integration in Android Apps},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YCCDF6FS}},
  note         = {Machine review of arXiv:2505.08204}
}
read the original abstract

Developers are increasingly integrating Language Models (LMs) into their mobile apps to provide features such as chat-based assistants. To prevent LM misuse, they impose various restrictions, including limits on the number of queries, input length, and allowed topics. However, if the LM integration is insecure, attackers can bypass these restrictions and gain unrestricted access to the LM, potentially harming developers' reputations and leading to significant financial losses. This paper presents the first systematic study of insecure usage of LMs by Android apps. We first manually analyze a preliminary dataset of apps to investigate LM integration methods, construct a taxonomy that categorizes the LM usage restrictions implemented by the apps, and determine how to bypass them. Alarmingly, we can bypass restrictions in 127 out of 181 apps. Then, we develop LM-Scout, a fully automated tool to detect on a large-scale vulnerable usage of LMs in 2,950 mobile apps. LM-Scout shows that, in many cases (i.e., 120 apps), it is possible to find and exploit such security issues automatically. Finally, we identify the root causes for the identified issues and offer recommendations for secure LM integration.

Figures

Figures reproduced from arXiv: 2505.08204 by the authors.

Figure 1
Figure 1. Language Model app integration frameworks. Solid lines represent app developer’s infrastructure. Dashed lines represent third-party services. (a) An [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. App analysis and LM restriction taxonomy (R-App and R-LM) [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Overview of LM-Scout developed Template Exploit Scripts in Python for each LM provider. With the appropriate API authentication credentials, these scripts enable unrestricted access to the LM integrated within the Android app. Given the package name of the target app, LM-Scout downloads the APK of the target app onto the Android device, pulls the downloaded APK to the PC using adb and decompiles it to Java using jad… view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: LM-Scout App Interaction. 1) Box 2 is selected to continue. 2) Partially loaded advertisement bypassed by tapping Box 2. 3) Box 16 selected to access [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: ChatAIApp exhibiting Quota-R-App by limiting the input length to the LM [PITH_FULL_IMAGE:figures/full_fig_p018_5.png]
Figure 7
Figure 7. Figure 7: Topic-R-LM bypassed in BeautyApp by employing a specially crafted [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 6
Figure 6. Figure 6: Quota-R-App exhibited by BrowserApp by restricting the output length and bypassed by a malicious user query [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]
Figure 8
Figure 8. Figure 8: PIP-R bypassed in ShopApp by employing a specially crafted query [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Example of an LM instructed to provide false information about itself. [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 11
Figure 11. Figure 11: Quota-R-App exhibited by ChatApp3 by cutting off part of response [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 10
Figure 10. Figure 10: Examples of apps showing a non-interactive demo interface, which [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 12
Figure 12. Figure 12: LM-Scout app interaction requiring 11 steps to perform query on the LM [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

94 extracted references · 73 canonical work pages

  1. [1]

    A survey of large language models,

    W. X. Zhaoet al., “A survey of large language models,” 2023

    2023

  2. [2]

    A Survey on Large Language Models: Applications, Challenges, Limitations, and Practical Usage,

    M. U. Hadiet al., “A Survey on Large Language Models: Applications, Challenges, Limitations, and Practical Usage,” 7 2023. [Online]. Available: https://techrxiv.figshare.com/articles/preprint/A Survey on Large Language Models Applications Challenges Limitations and Practical Usage/23589741

    work page arXiv 2023

  3. [3]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” 2022

    2022

  4. [4]

    Propile: Probing privacy leakage in large language models,

    S. Kim, S. Yun, H. Lee, M. Gubri, S. Yoon, and S. J. Oh, “Propile: Probing privacy leakage in large language models,” 2023

    2023

  5. [5]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?” 2023

    2023

  6. [6]

    Prompt injection attack against llm-integrated applications,

    Y . Liu, G. Deng, Y . Li, K. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zheng, and Y . Liu, “Prompt injection attack against llm-integrated applications,” 2023

    2023

  7. [7]

    Llmjacking: Stolen cloud credentials used in new ai attack,

    A. Brucato, “Llmjacking: Stolen cloud credentials used in new ai attack,” https://sysdig.com/blog/ llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/, 2024, accessed: 2024-09-03

    2024

  8. [8]

    Demystifying rce vulnerabilities in llm-integrated apps,

    T. Liu, Z. Deng, G. Meng, Y . Li, and K. Chen, “Demystifying rce vulnerabilities in llm-integrated apps,” 2023. [Online]. Available: https://arxiv.org/abs/2309.02926

    arXiv 2023

Show all 94 references
  1. [9]

    Exploring chatgpt app ecosystem: Distribution, deployment and security,

    C. Yan, R. Ren, M. H. Meng, L. Wan, T. Y . Ooi, and G. Bai, “Exploring chatgpt app ecosystem: Distribution, deployment and security,” 2024. [Online]. Available: https://arxiv.org/abs/2408.14357

    2024 arXiv

  2. [10]

    Open ai,

    OpenAI, “Open ai,” https://openai.com/, 2024, accessed: 2024-01-16

    2024

  3. [11]

    Chatgpt plugins,

    ——, “Chatgpt plugins,” https://openai.com/blog/chatgpt-plugins, 2023, accessed: 2023-12-05

    2023

  4. [12]

    Taxonomy of risks posed by language models,

    L. Weidingeret al., “Taxonomy of risks posed by language models,” ser. FAccT ’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 214–229, proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency

    2022

  5. [13]

    Bad actor, good advisor: Exploring the role of large language models in fake news detection,

    B. Hu, Q. Sheng, J. Cao, Y . Shi, Y . Li, D. Wang, and P. Qi, “Bad actor, good advisor: Exploring the role of large language models in fake news detection,” 2023

    2023

  6. [14]

    Gpt-3 powers the next generation of apps,

    OpenAI, “Gpt-3 powers the next generation of apps,” https://openai.com/ blog/gpt-3-apps, 2021, accessed: 2024-01-10

    2021

  7. [15]

    ——, “Gpt-4,” https://openai.com/research/gpt-4, 2023, accessed: 2024- 01-10

    2023

  8. [16]

    AI, “Palm 2,” https://ai.google/discover/palm2/, 2023, accessed: 2024- 01-10

    G. AI, “Palm 2,” https://ai.google/discover/palm2/, 2023, accessed: 2024- 01-10

    2023

  9. [17]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” 2023

    2023

  10. [18]

    Orca 2: Teaching small language models how to reason,

    A. Mitra, L. D. Corro, S. Mahajan, A. Codas, C. Simoes, S. Agarwal, X. Chen, A. Razdaibiedina, E. Jones, K. Aggarwal, H. Palangi, G. Zheng, C. Rosset, H. Khanpour, and A. Awadallah, “Orca 2: Teaching small language models how to reason,” 2023

    2023

  11. [19]

    Phi-2: The surprising power of small language models,

    M. R. Blog, “Phi-2: The surprising power of small language models,” https://www.microsoft.com/en-us/research/blog/ phi-2-the-surprising-power-of-small-language-models/, 2023, accessed: 2024-01-10

    2023

  12. [20]

    Tinyllama: An open-source small language model,

    P. Zhang, G. Zeng, T. Wang, and W. Lu, “Tinyllama: An open-source small language model,” 2024

    2024

  13. [21]

    Jailbreak chat,

    @alexalbert, “Jailbreak chat,” 2023, accessed: 2023-10-31. [Online]. Available: https://www.jailbreakchat.com/

    2023

  14. [22]

    ”do anything now

    X. Shen, Z. Chen, M. Backes, Y . Shen, and Y . Zhang, “”do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models,” 2023

    2023

  15. [23]

    Jailbreaking chatgpt via prompt engineering: An empirical study,

    Y . Liu, G. Deng, Z. Xu, Y . Li, Y . Zheng, Y . Zhang, L. Zhao, T. Zhang, and Y . Liu, “Jailbreaking chatgpt via prompt engineering: An empirical study,” 2023

    2023

  16. [24]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” ser. AISec ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 79–90

    2023

  17. [25]

    Masterkey: Automated jailbreak across multiple large language model chatbots,

    G. Deng, Y . Liu, Y . Li, K. Wang, Y . Zhang, Z. Li, H. Wang, T. Zhang, and Y . Liu, “Masterkey: Automated jailbreak across multiple large language model chatbots,” 2023

    2023

  18. [26]

    Anthropic,

    A. PBC, “Anthropic,” https://www.anthropic.com/, 2024, accessed: 2024- 01-16

    2024

  19. [27]

    Cohere, “Cohere,” https://cohere.com/, 2024, accessed: 2024-01-16

    2024

  20. [28]

    Vertex ai,

    G. Cloud, “Vertex ai,” https://cloud.google.com/vertex-ai/, 2024, accessed: 2024-01-16

    2024

  21. [29]

    Mobile os market share worldwide,

    S. G. Stats, “Mobile os market share worldwide,” https://gs.statcounter. com/os-market-share/mobile/worldwide, 2023, accessed: 2023-12-05

    2023

  22. [30]

    awesome-llm-webapps,

    snowfort ai, “awesome-llm-webapps,” https://github.com/snowfort-ai/ awesome-llm-webapps, 2024, accessed: 2024-04-15

    2024

  23. [31]

    Aot - attack on things: A security analysis of iot firmware updates,

    M. Ibrahim, A. Continella, and A. Bianchi, “Aot - attack on things: A security analysis of iot firmware updates,” July 2023, proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P). 14

    2023

  24. [32]

    Why johnny can’t make money with his contents: Pitfalls of designing and implementing content delivery apps,

    S. Y . Chau, B. Wang, J. Wang, O. Chowdhury, A. Kate, and N. Li, “Why johnny can’t make money with his contents: Pitfalls of designing and implementing content delivery apps,” ser. ACSAC ’18. New York, NY , USA: Association for Computing Machinery, 2018, p. 236–251, proceeding...

    2018

  25. [33]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” 2018

    2018

  26. [34]

    Androzoo: Collecting millions of android apps for the research community,

    K. Allix, T. F. Bissyand ´e, J. Klein, and Y . Le Traon, “Androzoo: Collecting millions of android apps for the research community,” ser. MSR ’16. New York, NY , USA: ACM, 2016, pp. 468–471, proceedings of the 13th International Conference on Mining Software Repositories

    2016

  27. [35]

    Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers,

    F. Contributors, “Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers,” 2023, accessed: 2023-12-05. [Online]. Available: https://github.com/frida/frida

    2023

  28. [36]

    Http toolkit: Open-source tool for debugging, testing, and building with http(s),

    T. Perry, “Http toolkit: Open-source tool for debugging, testing, and building with http(s),” 2023, accessed: 2023-12-05. [Online]. Available: https://github.com/httptoolkit/httptoolkit

    2023

  29. [37]

    [Online]

    skylot, “Jadx,” 2024, accessed: 2024-01-23. [Online]. Available: https://github.com/skylot/jadx

    2024

  30. [38]

    Decoding the true cost of generative ai for your enterprise,

    M. Ashoori, “Decoding the true cost of generative ai for your enterprise,” https://www.linkedin.com/pulse/ decoding-true-cost-generative-ai-your-enterprise-maryam-ashoori-phd/, 2024, accessed: 2024-01-21

    2024

  31. [39]

    Safetynot: on the usage of the safetynet attestation api in android,

    M. Ibrahim, A. Imran, and A. Bianchi, “Safetynot: on the usage of the safetynet attestation api in android,” ser. MobiSys ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 150–162, proceedings of the 19th Annual International Conference on Mobile Systems, ...

    2021

  32. [40]

    Safetynet attestation api,

    Google, “Safetynet attestation api,” https://developer.android.com/ training/safetynet/attestation, 2024, accessed: 2024-01-29

    2024

  33. [41]

    Play integrity api,

    ——, “Play integrity api,” https://developer.android.com/google/play/ integrity, 2024, accessed: 2024-01-29

    2024

  34. [42]

    Appjitsu: Investi- gating the resiliency of android applications,

    O. Zungur, A. Bianchi, G. Stringhini, and M. Egele, “Appjitsu: Investi- gating the resiliency of android applications,” 2021, pp. 457–471

    2021

  35. [43]

    Android debug bridge (adb),

    Google, “Android debug bridge (adb),” 2024, accessed: 2024-04-15. [Online]. Available: https://developer.android.com/tools/adb

    2024

  36. [44]

    Accessed: 2025-04-22

    Lm-scout demo. Accessed: 2025-04-22. [Online]. Available: https: //www.youtube.com/watch?v=SUI1-10uW4E

    2025

  37. [45]

    The tappa keyboard,

    Tappa, “The tappa keyboard,” https://www.tappa.com/, 2024, accessed: 2024-09-04

    2024

  38. [46]

    Ai21 labs,

    AI21, “Ai21 labs,” https://www.ai21.com/, 2024, accessed: 2024-09-04

    2024

  39. [47]

    Elevenlabs,

    ElevenLabs, “Elevenlabs,” https://elevenlabs.io/, 2024, accessed: 2024- 09-04

    2024

  40. [48]

    Make with makersuite,

    R. Thai, “Make with makersuite,” https://developers.googleblog.com/en/ make-with-makersuite-part-1-an-introduction/, 2024, accessed: 2024-09- 04

    2024

  41. [49]

    Mistral ai,

    M. AI, “Mistral ai,” https://mistral.ai/, 2024, accessed: 2024-09-04

    2024

  42. [50]

    Microsoft,

    A. AI, “Microsoft,” https://azure.microsoft.com/en-us/solutions/ai, 2024, accessed: 2024-09-04

    2024

  43. [51]

    Openrouter llc,

    OpenRouter, “Openrouter llc,” https://openrouter.ai/, 2024, accessed: 2024-09-04

    2024

  44. [52]

    Ui/application exerciser monkey,

    Google, “Ui/application exerciser monkey,” 2024, accessed: 2024- 08-28. [Online]. Available: https://developer.android.com/studio/test/ other-testing-tools/monkey

    2024

  45. [53]

    Appagent: Multimodal agents as smartphone users,

    C. Zhang, Z. Yang, J. Liu, Y . Han, X. Chen, Z. Huang, B. Fu, and G. Yu, “Appagent: Multimodal agents as smartphone users,” 2023

    2023

  46. [54]

    Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v,

    J. Yang, H. Zhang, F. Li, X. Zou, C. Li, and J. Gao, “Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v,” 2023. [Online]. Available: https://arxiv.org/abs/2310.11441

    2023 arXiv

  47. [55]

    Identity toolkit api,

    Google, “Identity toolkit api,” https://cloud.google.com/identity-platform/ docs/reference/rest, 2024, accessed: 2024-09-04

    2024

  48. [56]

    keemoji-demos,

    tappa keyboards, “keemoji-demos,” https://bitbucket.org/tappa-keyboards/ android-kotlin/src/master/, 2024, accessed: 2025-04-21

    2024

  49. [57]

    Client sdks,

    Anthropic, “Client sdks,” https://docs.anthropic.com/en/api/client-sdks, accessed: 2025-04-24

    2025

  50. [58]

    Anthropic java sdk,

    ——, “Anthropic java sdk,” https://github.com/anthropics/ anthropic-sdk-java, accessed: 2025-04-24

    2025

  51. [59]

    Security with network protocols,

    Google, “Security with network protocols,” https://developer.android. com/privacy-and-security/security-ssl, 2024, accessed: 2024-06-04

    2024

  52. [60]

    Survey of vulnerabilities in large language models revealed by adversarial attacks,

    E. Shayegani, M. A. A. Mamun, Y . Fu, P. Zaree, Y . Dong, and N. Abu- Ghazaleh, “Survey of vulnerabilities in large language models revealed by adversarial attacks,” 2023

    2023

  53. [61]

    Prompting frameworks for large language models: A survey,

    X. Liu, J. Wang, J. Sun, X. Yuan, G. Dong, P. Di, W. Wang, and D. Wang, “Prompting frameworks for large language models: A survey,” 2023

    2023

  54. [62]

    Backdooring instruction-tuned large language models with virtual prompt injection,

    J. Yan, V . Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V . Srinivasan, X. Ren, and H. Jin, “Backdooring instruction-tuned large language models with virtual prompt injection,” 2023

    2023

  55. [63]

    Prompt injection attacks and defenses in llm-integrated applications,

    Y . Liu, Y . Jia, R. Geng, J. Jia, and N. Z. Gong, “Prompt injection attacks and defenses in llm-integrated applications,” 2023

    2023

  56. [64]

    Mondrian: Prompt abstraction attack against large language models for cheaper api pricing,

    W. M. Si, M. Backes, and Y . Zhang, “Mondrian: Prompt abstraction attack against large language models for cheaper api pricing,” 2023

    2023

  57. [65]

    Risk taxonomy, mitigation, and assessment benchmarks of large language model systems,

    T. Cui, Y . Wang, C. Fu, Y . Xiao, S. Li, X. Deng, Y . Liu, Q. Zhang, Z. Qiu, P. Li, Z. Tan, J. Xiong, X. Kong, Z. Wen, K. Xu, and Q. Li, “Risk taxonomy, mitigation, and assessment benchmarks of large language model systems,” 2024

    2024

  58. [66]

    Llm platform security: Applying a systematic evaluation framework to openai’s chatgpt plugins,

    U. Iqbal, T. Kohno, and F. Roesner, “Llm platform security: Applying a systematic evaluation framework to openai’s chatgpt plugins,” 2023

    2023

  59. [67]

    Trick- ing llms into disobedience: Understanding, analyzing, and preventing jailbreaks,

    A. Rao, S. Vashistha, A. Naik, S. Aditya, and M. Choudhury, “Trick- ing llms into disobedience: Understanding, analyzing, and preventing jailbreaks,” 2023

    2023

  60. [68]

    Role-play with large language models,

    M. Shanahan, K. McDonell, and L. Reynolds, “Role-play with large language models,” 2023

    2023

  61. [69]

    Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts,

    J. Yu, X. Lin, Z. Yu, and X. Xing, “Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts,” 2023

    2023

  62. [70]

    Plug and pray: Exploiting off-the-shelf components of multi-modal models,

    E. Shayegani, Y . Dong, and N. Abu-Ghazaleh, “Plug and pray: Exploiting off-the-shelf components of multi-modal models,” 2023

    2023

  63. [71]

    Why so toxic? measuring and triggering toxic behavior in open-domain chatbots,

    W. M. Si, M. Backes, J. Blackburn, E. De Cristofaro, G. Stringhini, S. Zannettou, and Y . Zhang, “Why so toxic? measuring and triggering toxic behavior in open-domain chatbots,” ser. CCS ’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 2659–2673

    2022

  64. [72]

    Artprompt: Ascii art-based jailbreak attacks against aligned llms,

    F. Jiang, Z. Xu, L. Niu, Z. Xiang, B. Ramasubramanian, B. Li, and R. Poovendran, “Artprompt: Ascii art-based jailbreak attacks against aligned llms,” 2024

    2024

  65. [73]

    From prompt injections to sql injection attacks: How protected is your llm-integrated web application?

    R. Pedro, D. Castro, P. Carreira, and N. Santos, “From prompt injections to sql injection attacks: How protected is your llm-integrated web application?” 2023

    2023

  66. [74]

    Owasp top 10 for large lan- guage model applications,

    O. Foundation, “Owasp top 10 for large lan- guage model applications,” https://owasp.org/ www-project-top-10-for-large-language-model-applications/, 2023, accessed: 2023-12-05

    2023

  67. [75]

    The android platform security model (2023)

    R. Mayrhofer, J. Vander Stoep, C. Brubaker, D. Hackborn, B. Bonn ´e, G. S. Tuncay, R. P. Jover, and M. Specter, “The android platform security model (2023).”

    2023

  68. [76]

    Android rooting: An arms race between evasion and detection,

    L. Nguyen Vu, N.-T. Chau, S. Kang, and S. Jung, “Android rooting: An arms race between evasion and detection,” vol. 2017, 10 2017

    2017

  69. [77]

    Broken Fingers: On the Usage of the Fingerprint API in Android,

    A. Bianchi, Y . Fratantonio, A. Machiry, C. Kruegel, G. Vigna, S. P. H. Chung, and W. Lee, “Broken Fingers: On the Usage of the Fingerprint API in Android,” 2018

    2018

  70. [78]

    SARA: Secure android remote authorization

    A. Imran, H. Farrukh, M. Ibrahim, Z. B. Celik, and A. Bianchi, “SARA: Secure android remote authorization.” Boston, MA: USENIX Association, Aug. 2022, pp. 1561–1578. [Online]. Available: https: //www.usenix.org/conference/usenixsecurity22/presentation/imran

    2022

  71. [79]

    Android sensitive data leakage prevention with rooting detection using java function hooking,

    B. Soewito and A. Suwandaru, “Android sensitive data leakage prevention with rooting detection using java function hooking,” 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S1319157820304201

    2020

  72. [80]

    Armand: Anti- repackaging through multi-pattern anti-tampering based on native detec- tion,

    A. Merlo, A. Ruggia, L. Sciolla, and L. Verderame, “Armand: Anti- repackaging through multi-pattern anti-tampering based on native detec- tion,” 2020

    2020

  73. [81]

    Android rooting: Methods, detection, and evasion,

    S.-T. Sun, A. Cuadros, and K. Beznosov, “Android rooting: Methods, detection, and evasion,” ser. SPSM ’15. New York, NY , USA: Association for Computing Machinery, 2015

    2015

  74. [82]

    An empirical study of cryptographic misuse in android applications,

    M. Egele, D. Brumley, Y . Fratantonio, and C. Kr ¨ugel, “An empirical study of cryptographic misuse in android applications,” 2013

    2013

  75. [83]

    Detecting android root exploits by learning from root providers

    I. Gasparis, Z. Qian, C. Song, and S. V . Krishnamurthy, “Detecting android root exploits by learning from root providers.” Vancouver, BC: USENIX Association, Aug. 2017. [Online]. Available: https://www.usenix.org/conference/usenixsecurity17/ technical-sessions/presentation/gasparis

    2017

  76. [84]

    You shall not repackage! demystifying anti-repackaging on android,

    A. Merlo, A. Ruggia, L. Sciolla, and L. Verderame, “You shall not repackage! demystifying anti-repackaging on android,” 2020

    2020

  77. [85]

    Breaking ad-hoc runtime integrity protection mechanisms in android financial apps,

    T. Kim, H. Ha, S. Choi, J. Jung, and B.-G. Chun, “Breaking ad-hoc runtime integrity protection mechanisms in android financial apps,” 04 2017. 15

    2017

  78. [86]

    Draco: A system for uniform and fine-grained access control for web code on android

    G. S. Tuncay, S. Demetriou, and C. A. Gunter, “Draco: A system for uniform and fine-grained access control for web code on android.” ACM SIGSAC Conference on Computer and Communications Security (CCS), 2016

    2016

  79. [87]

    Source attribution of cryptographic api misuse in android applications,

    I. Muslukhov, Y . Boshmaf, and K. Beznosov, “Source attribution of cryptographic api misuse in android applications,” ser. ASIACCS ’18. New York, NY , USA: Association for Computing Machinery, 2018

    2018

  80. [88]

    Mod- elling analysis and auto-detection of cryptographic misuse in android applications,

    S. Shuai, D. Guowei, G. Tao, Y . Tianchang, and S. Chenjie, “Mod- elling analysis and auto-detection of cryptographic misuse in android applications,” 2014

    2014

  81. [89]

    Why eve and mallory still love android: Revisiting TLS (in)security in android applications

    “Why eve and mallory still love android: Revisiting TLS (in)security in android applications.” Vancouver, B.C.: USENIX Association, 2021. [Online]. Available: https://www.usenix.org/conference/usenixsecurity21/ presentation/oltrogge

    2021

  82. [90]

    Cardpliance: PCI DSS compliance of android applications

    S. Y . Mahmud, A. Acharya, B. Andow, W. Enck, and B. Reaves, “Cardpliance: PCI DSS compliance of android applications.” USENIX Association, Aug. 2020. [Online]. Available: https://www.usenix.org/ conference/usenixsecurity20/presentation/mahmud

    2020

  83. [91]

    Why eve and mallory love android: An analysis of android ssl (in)security,

    S. Fahl, M. Harbach, T. Muders, L. Baumg ¨artner, B. Freisleben, and M. Smith, “Why eve and mallory love android: An analysis of android ssl (in)security,” ser. CCS ’12. New York, NY , USA: Association for Computing Machinery, 2012

    2012

  84. [92]

    Wear’s my data? understanding the cross-device runtime permission model in wearables

    D. Yeke, M. Ibrahim, G. Tuncay, H. Farrukh, A. Imran, A. Bianchi, and Z. Celik, “Wear’s my data? understanding the cross-device runtime permission model in wearables.” Los Alamitos, CA, USA: IEEE Computer Society, may 2024, pp. 77–77

    2024

  85. [93]

    Are you spying on me? {Large-Scale} analysis on {IoT} data exposure through companion apps,

    Y . Nan, X. Wang, L. Xing, X. Liao, R. Wu, J. Wu, Y . Zhang, and X. Wang, “Are you spying on me? {Large-Scale} analysis on {IoT} data exposure through companion apps,” 2023, pp. 6665–6682, 32nd USENIX Security Symposium (USENIX Security 23)

    2023

  86. [94]

    Understanding iot security from a market-scale perspective,

    X. Jin, S. Manandhar, K. Kafle, Z. Lin, and A. Nadkarni, “Understanding iot security from a market-scale perspective,” ser. 2022. APPENDIX CASESTUDIES Below we derive case studies from reconnaissance app analysis illustrating how LM restrictions are implemented in Android apps...

    2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.