paperbot · PL 论文追踪

全部论文 待读 收藏

P2 RightsGen: Automated Generation of User Rights Declaration on Android via LLM-Guided UI Traversal

RightsGen：通过 LLM 引导的 UI 遍历自动生成 Android 用户权利声明
FSE Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering2026匹配度 4/10 · 该论文使用 LLM GUI Agent 自动化遍历 Android UI 以发现用户权利声明，属于 LLM Agent 在移动隐私合规中的工程应用，与 Agentic/LLM 工具有弱关联；但其核心是动态 UI 遍历与信息抽取，不涉及静态分析、形式化验证、浮点程序分析或贝叶斯程序分析，与用户研究方向的核心交集有限。引用 0 inbox
Chengjun Li, Tao Liu, Yi Wu, Ming Fan
机器学习与程序语言安全与隐私
crossref: 2026-09-12dblp: 2026-09-12

AI 速览

一句话：用 LLM 引导的 GUI Agent 遍历 Android 应用 UI，自动发现并抽取用户权利声明的路径与结构化信息。

移动应用需遵守 GDPR、CCPA 等隐私法规，为用户提供账户删除、数据导出等权利行使路径，但这些入口常深藏于复杂 UI 层级中，人工审计难以规模化。本文提出 RightsGen 框架，利用大语言模型的语义推理能力在动态 UI 状态中导航，替代传统随机 UI fuzzer。它采用路径导向机制，并以结构化权利元组（rights tuples）指导一个 GUI Agent 充当权利测试者，自动发现并文档化 Android 应用中的用户权利声明。作者在 144 个流行应用上评估，RightsGen 在动态测试中识别用户权利路径的召回率达 92.5%，抽取权利元组的召回率达 87.3%，表明其能有效自动化生成用户权利声明。

问题
移动应用中的用户权利行使路径常被埋藏在复杂 UI 层级深处，传统人工审计不可扩展，随机 UI fuzzer 又缺乏语义理解，难以可靠发现这些路径。
方法
RightsGen 使用 LLM 的语义推理能力进行动态 UI 遍历，采用路径导向机制，并让 GUI Agent 在结构化权利元组引导下充当权利测试者，自动发现并抽取用户权利声明。
评估
在 144 个流行 Android 应用上进行动态测试评估，识别用户权利路径的召回率为 92.5%，抽取权利元组的召回率为 87.3%。
原文摘要（Abstract）

Ensuring compliance with privacy regulations, such as GDPR and CCPA, has become a critical challenge for mobile applications. These regulations mandate that apps provide accessible paths for users to exercise rights, such as account deletion and data export. However, these paths are often buried deep within complex UI hierarchies, making manual auditing unscalable. In this paper, we introduce RightsGen, a framework that leverages Large Language Models (LLMs) to automate the discovery and documentation of user rights declarations in Android applications. Unlike traditional random UI fuzzers, RightsGen utilizes the semantic reasoning capabilities of LLMs to navigate dynamic UI states. It employs a path-oriented mechanism and a GUI Agent acting as a rights tester guided by structured rights tuples. In our evaluation across 144 popular apps, RightsGen demonstrated high efficiency in dynamic testing, achieving a recall rate of 92.5% in recognizing user rights paths and 87.3% in extracting rights tuples. These results highlight the effectiveness of RightsGen in automating the generation of user rights declarations.

链接与引用

DOI 原文 · PDF（开放获取） · DBLP

BibTeX 
@inproceedings{LiLWF26,
  title = {RightsGen: Automated Generation of User Rights Declaration on Android via LLM-Guided UI Traversal},
  author = {Chengjun Li and Tao Liu and Yi Wu and Ming Fan},
  booktitle = {FSE},
  year = {2026},
  doi = {10.1145/3803437.3805538}
}