arXiv AI By Douglas Leith

Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker

Read the original on arXiv AI →

The paper examines the use of large language models (LLMs) to reverse‑engineer the protobuf schemas that iPhones send to Apple’s location services. Using Claude Opus 4.8 and Codex GPT‑Sol 5.6, the authors find that most AI‑generated schemas contain significant errors that are difficult to detect, making direct AI assistance unsuitable for forensic or privacy analysis. However, they demonstrate that an LLM can be employed to build a reliable Python tool, Extractor, which accurately recovers protobuf schemas from Apple binaries and successfully decodes network traffic from a jailbroken iPhone 8 running iOS 16.7.11.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

arXiv Machine Learning
Sep 22

MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes

arXiv:2609.23980v1 Announce Type: cross Abstract: AI agents now report vulnerabilities faster than maintainers can review them. Reports often depend on security properties specific to the application...

By Andy K. Zhang, Ava Huang, Joey Ji, Wai Han, Thomas Qin, Nardos Demilew, Michael Tian-Yue Liu, Brian Song, Riya Dulepet, Brian Wang, Kyleen Liao, Cuiyuanxiu Chen, Nishka Kacheria, Andrew Wu, Pratham Rangwala, Xinjie Wang, Laura Gomezjurado Gonzalez, Anita Ding, Benjamin Yi, Daniel E. Ho, Dan Boneh, Dawn Song, Ion Stoica, Percy Liang
arXiv AI
Aug 19

MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps

MobileWorldSafety is a benchmark that evaluates the safety of large language model–powered GUI agents on Android by exposing them to 142 real-world risk tasks involving environmental injection attacks. The benchmark uses a two‑stage verification pipeline—rule‑based checks for clear cases and an LLM judge for ambiguous ones—to distinguish safety failures from capability failures. Experiments on six agents show high vulnerability, with attack success rates between 40.4% and 66.9%, highlighting that current agents often fail to remain safe when faced with adversarial content presented as normal mobile context.

By Sujin Chen, Lijun Li, Tianyi Du, Jing Shao