This work filters app reviews for privacy- and security-related content, yielding a comprehensive corpus of over 600K reviews, and introduces TaxoScale, a pipeline that handles taxonomy construction at this scale by extending an expert-defined taxonomy via Recursive Hierarchical Clustering and LLM-based node naming.
Abstract
Mobile app reviews are a rich, continuously renewing source of how users experience privacy and security, yet existing taxonomies of these concerns are hand-crafted and cannot keep pace with the evolving nature of the data. Automating taxonomy construction is the natural response, but scalability is the core challenge: current LLM- and clustering-based methods are developed for scientific corpora of a few thousand documents and do not extend to app review collections numbering in the hundreds of thousands. We address this gap in two ways. First, we filter app reviews for privacy- and security-related content, yielding a comprehensive corpus of over 600K reviews. Second, we introduce TaxoScale, a pipeline that handles taxonomy construction at this scale by extending an expert-defined taxonomy via Recursive Hierarchical Clustering and LLM-based node naming. TaxoScale outperforms strong automatic-taxonomy baselines on path, level, coverage, and novelty metrics, and discovers novel branches absent from prior taxonomies.
Discovering personally identifiable information (PII) in mobile forensic databases is difficult because the relevant table-column regions are unknown, distributed across heterogeneous SQLite schemas, and may contain values embedded in free-text or semi-structured fields. We present a hypothesis-driven framework that treats PII localization as bounded, adaptive search under uncertainty. An agent ranks candidate table-column regions, probes sampled values, and maintains a memory of prior evidence, confidence scores, and decisions to refine subsequent hypotheses. The framework separates lightweight PII exploration from targeted extraction, normalization, and deduplication over validated regions, thereby limiting exhaustive inspection to regions supported by sampled evidence. We evaluate the framework on 25 SQLite databases from 10 Android and iOS applications in the Cellebrite CTF corpus, targeting email addresses, phone numbers, domain names, person names, and postal addresses. Against a corpus-level distinct ground-truth set of 3,751 entities, Gemini 2.5 Pro achieves 94.5% F1 while reducing the effective extraction search space by 79.9% on average. Results across 12 model backends show strong performance among several frontier models, but substantial sensitivity to model capability.
This work presents the first privacy- and security-oriented measurement of M365 third-party applications, and finds that only 1,069 of them expose both descriptions and permission sets, with significant inconsistencies in transparency across official distribution channels.
Vincenzo Longo, Alberto Verna, Nikhil Jha et al.· 0 citations
Retrieval-Augmented Generation (RAG) systems enable robust knowledge integration for large language models but also pose significant security and privacy risks. RAG systems combine two components: a retriever, which searches external data sources for relevant information, and a generator, typically a large language model that uses both the retrieved documents and user queries to produce answers. This study conducts a systematic literature review to assess these challenges using Socio-Technical Systems Theory (which considers interactions among people, technology, and organizational context) and Privacy by Design (PbD, a framework for embedding privacy into system design). Addressing five objectives, the research detects and classifies privacy attacks, evaluates risks throughout the storage, retrieval, and generation phases, scrutinizes measurement methods, contrasts mitigation strategies, and introduces a unified solution. The work culminates in the Integrated Privacy-Preserving RAG Framework (IPRAG), a five-tier architecture supported by a three-phase deployment protocol. This study presents a detailed, actionable approach to constructing secure, privacy-focused RAG systems.
Firoz Mohammed Ozman· International Journal of Fro...· 0 citations
: Portable Executable (PE) malware classifiers are routinely benchmarked on malware-only data or against small homogeneous benign corpora. Recent surveys (Ucci et al., 2019; Aboaoja et al., 2022) note that most existing PE-feature studies select attributes by availability or precedent rather than by security rationale, and large benchmarks such as EMBER (Anderson and Roth, 2018) group 2 , 381 features only by extraction source while Ahmadi et al. (Ahmadi et al., 2016) similarly use > 1 , 800 features without semantic categorisation. We argue this practice misrepresents which signals a deployed detector actually relies on: the relative importance of the same 60 PE-header features changes substantially when benign samples are added to the evaluation, and shifts further as the benign corpus is diversified beyond a single source. To support this claim we organise 60 PE-header attributes into seven security-rationale categories (Structure Integrity, Execution Context, Memory Layout, Security Posture, Code Characteristics, Resource/Import, Anomaly Indicators) and evaluate on 1,263 MalwareBazaar samples plus 1,132 benign PE files (170 SysInternals + 962 DikeDataset (Iosif, 2021)). The 60-feature taxonomy matches EMBER’s F1 in a directly compared head-to-head while using 39 × fewer features, a benign-source hold-out rules out a single-source artefact for the dominant feature, and Wilson-95% PPV bounds under deployment priors quantify what practitioners face at sub-1% malware prevalence.
Fabiha Jalal, Sadia Dhruba, M. Moniruzzaman· Proceedings of the 23rd Inte...· 0 citations
The advent of LLMs has significantly changed the research on privacy policy and data compliance analysis by enabling tasks that previously required specialized, domain-specific tools. However, it remains unclear to what extent LLMs can truly replicate the diverse functionalities, and the wide range of methodologies and analysis offered by prior work. In this paper, we conduct the first systematic evaluation of whether off-the-shelf LLMs can replace specialized privacy analysis tools. We study six representative tools spanning three major functionalities: contradiction detection, regulatory compliance analysis, and privacy policy summarization and aggregation, and across three intermediate tasks: structured data extraction using tuples, Semantic Role Labeling (SRL) and manual privacy policy labeling. We compare the performance of two state-of-the-art LLMs (GPT-5.2 and Gemini-2.5 in various configurations) against the tools by directly prompting the models to perform corresponding functionalities and tasks on a custom dataset of 10 privacy policies, allowing us to assess whether off-the-shelf models can produce tool-specific functionalities without further engineering or domain-specific training, major limitations in prior work. Our results show that LLMs consistently match or exceed the capabilities of existing tools across the functionalities. In manual labeling of first-party collection entities, LLMs achieved an average precision of 81.8% and recall of 70.9%, while for labeling of third-party sharing entities, they achieved an average precision of 91.4% and recall of 70.8% compared to the OPP-115 dataset. Overall, our findings indicate that LLMs can effectively perform a broad range of functionalities and tasks in privacy policy and regulation analysis that previously required specialized tools.
Madhav Aryal, Sudipa Saha, Sunil Manandhar et al.· 0 citations
This survey provides the first comprehensive and systematic review of text anonymization methods published between 2020 and 2025, covering 48 primary studies identified through a structured search and rigorous screening procedure and reveals a growing shift from identifier‐centric de‐identification toward context‐aware anonymization.
Marina Litvak, A. Jorge· WIREs Data Mining and Knowle...· 0 citations