arXiv subjects

Xueqiang Wang

Publications and source records attributed to Xueqiang Wang.

8 recordsLinked to original sources

arXiv2026

When Ad Networks Misbehave: Understanding Risks of Semi-Drive-By Splash Ads

We investigate the mobile splash ads ecosystem, i.e., full-screen advertisements shown at app launch, where monetization relies on interaction signals that are difficult to verify end-to-end. This setting is especially sensitive because incidental touches and sensor-driven callbacks are common yet easy to misattribute as engagement. Prior work has largely framed mobile ad fraud as a publisher-side problem, while some studies attribute fraudulent operations to embedded ad libraries. Yet an important risk remains underexplored: ad SDKs control how interaction signals are interpreted, measured, and reported, creating an opportunity to reinterpret ambiguous user or device signals as valid advertising interactions. We uncover a previously less-known form of fraud at the ad-network layer in which splash ads are triggered not by intentional user actions but by incidental or indirect interactions, which we term semi-drive-by splash ads. By translating non-ad interactions into billable engagement events, ad networks can inflate performance metrics, overcharge advertisers, and erode user trust. To expose this behavior in the wild, we design AdHive, an automated honeypot-like analysis framework that induces evasive splash-ad delivery and landing behaviors under realistic device conditions. AdHive reproduces human-like activity through LLM-generated usage traces and sensor dynamics, enabling execution paths that remain hidden in conventional analysis environments. Our large-scale measurement across thousands of popular Android applications shows that semi-drive-by splash ads are widespread and are often triggered by subtle signals such as minor sensor variations. We further confirm real-world impact by working with one of China's largest advertisers, identifying multiple ad networks engaging in this fraud and leading to enforced repayments of about 4 million Yuan (approximately US$600,000).

cs.CR↗

arXiv2026

AgentRaft: Automated Detection of Data Over-Exposure in LLM Agents

The rapid integration of Large Language Model (LLM) agents into autonomous task execution has introduced significant privacy concerns within cross-tool data flows. In this paper, we systematically investigate and define a novel risk termed Data Over-Exposure (DOE) in LLM Agent, where an Agent inadvertently transmits sensitive data beyond the scope of user intent and functional necessity. We identify that DOE is primarily driven by the broad data paradigms in tool design and the coarse-grained data processing inherent in LLMs. In this paper, we present AgentRaft, the first automated framework for detecting DOE risks in LLM agents. AgentRaft combines program analysis with semantic reasoning through three synergistic modules: (1) it constructs a Cross-Tool Function Call Graph (FCG) to model the interaction landscape of heterogeneous tools; (2) it traverses the FCG to synthesize high-quality testing user prompts that act as deterministic triggers for deep-layer tool execution; and (3) it performs runtime taint tracking and employs a multi-LLM voting committee grounded in global privacy regulations (e.g., GDPR, CCPA, PIPL) to accurately identify privacy violations. We evaluate AgentRaft on a testing environment of 6,675 real-world agent tools. Our findings reveal that DOE is indeed a systemic risk, prevalent in 57.07% of potential tool interaction paths. AgentRaft achieves a high detection accuracy and effectiveness, outperforming baselines by 87.24%. Furthermore, AgentRaft reaches near-total DOE coverage (99%) within only 150 prompts while reducing per-chain verification costs by 88.6%. Our work provides a practical foundation for building auditable and privacy-compliant LLM agent systems.

cs.SE↗

arXiv2025

Resolving Kane's Puzzle in Oblique Collisions of Rigid Bodies

We examined the asymmetric deformation in collisions and the transition conditions from oblique to normal collisions and non-collisions to address the problem of oblique collisions of rigid bodies in classical mechanics. A closed solution satisfying the fundamental equations and adhering to the energy conservation law without introducing new material parameters was derived. The solution exhibited a nonlinear relationship between post-collision velocity and initial state parameters, contrasting with the linear results of existing studies. This solution avoided the fallacy in Whittaker's hypothesis that kinetic energy might increase after a collision. Consequently, the solution presented herein fundamentally resolves Kane's puzzle, previously overlooked in classical mechanics.

physics.class-ph↗

arXiv2025

Understanding the Sneaky Patterns of Pop-up Windows in the Mobile Ecosystem

In mobile applications, Pop-up window (PoW) plays a crucial role in improving user experience, guiding user actions, and delivering key information. Unfortunately, the excessive use of PoWs severely degrades the user experience. These PoWs often sneakily mislead users in their choices, employing tactics that subtly manipulate decision-making processes. In this paper, we provide the first in-depth study on the Sneaky patterns in the mobile ecosystem. Our research first highlights five distinct Sneaky patterns that compromise user experience, including text mislead, UI mislead, forced action, out of context and privacy-intrusive by default. To further evaluate the impact of such Sneaky patterns at large, we developed an automated analysis pipeline called Poker, to tackle the challenges of identifying, dismissing, and collecting diverse PoWs in real-world apps. Evaluation results showed that Poker achieves high precision and recall in detecting PoWs, efficiently dismissed over 88% of PoWs with minimal user interaction, with good robustness and reliability in comprehensive app exploration. Further, our systematic analysis over the top 100 popular apps in China and U.S. revealing that both regions displayed significant ratios of Sneaky patterns, particularly in promotional contexts, with high occurrences in categories such as shopping and video apps. The findings highlight the strategic deployment of Sneaky tactics that compromise user trust and ethical app design.

cs.SE↗

arXiv2025

DexFlow: A Unified Approach for Dexterous Hand Pose Retargeting and Interaction

Despite advances in hand-object interaction modeling, generating realistic dexterous manipulation data for robotic hands remains a challenge. Retargeting methods often suffer from low accuracy and fail to account for hand-object interactions, leading to artifacts like interpenetration. Generative methods, lacking human hand priors, produce limited and unnatural poses. We propose a data transformation pipeline that combines human hand and object data from multiple sources for high-precision retargeting. Our approach uses a differential loss constraint to ensure temporal consistency and generates contact maps to refine hand-object interactions. Experiments show our method significantly improves pose accuracy, naturalness, and diversity, providing a robust solution for hand-object interaction modeling.

cs.RO↗

arXiv2025

Privacy Law Enforcement Under Centralized Governance: A Qualitative Analysis of Four Years' Special Privacy Rectification Campaigns

In recent years, major privacy laws like the GDPR have brought about positive changes. However, challenges remain in enforcing the laws, particularly due to under-resourced regulators facing a large number of potential privacy-violating software applications (apps) and the high costs of investigating them. Since 2019, China has launched a series of privacy enforcement campaigns known as Special Privacy Rectification Campaigns (SPRCs) to address widespread privacy violations in its mobile application (app) ecosystem. Unlike the enforcement of the GDPR, SPRCs are characterized by large-scale privacy reviews and strict sanctions, under the strong control of central authorities. In SPRCs, central government authorities issue administrative orders to mobilize various resources for market-wide privacy reviews of mobile apps. They enforce strict sanctions by requiring privacy-violating apps to rectify issues within a short timeframe or face removal from app stores. While there are a few reports on SPRCs, the effectiveness and potential problems of this campaign-style privacy enforcement approach remain unclear to the community. In this study, we conducted 18 semi-structured interviews with app-related engineers involved in SPRCs to better understand the campaign-style privacy enforcement. Based on the interviews, we reported our findings on a variety of aspects of SPRCs, such as the processes that app engineers regularly follow to achieve privacy compliance in SPRCs, the challenges they encounter, the solutions they adopt to address these challenges, and the impacts of SPRCs, etc. We found that app engineers face a series of challenges in achieving privacy compliance in their apps...

cs.HC↗

arXiv2024

CryptoTrain: Fast Secure Training on Encrypted Dataset

Secure training, while protecting the confidentiality of both data and model weights, typically incurs significant training overhead. Traditional Fully Homomorphic Encryption (FHE)-based non-inter-active training models are heavily burdened by computationally demanding bootstrapping. To develop an efficient secure training system, we established a foundational framework, CryptoTrain-B, utilizing a hybrid cryptographic protocol that merges FHE with Oblivious Transfer (OT) for handling linear and non-linear operations, respectively. This integration eliminates the need for costly bootstrapping. Although CryptoTrain-B sets a new baseline in performance, reducing its training overhead remains essential. We found that ciphertext-ciphertext multiplication (CCMul) is a critical bottleneck in operations involving encrypted inputs and models. Our solution, the CCMul-Precompute technique, involves precomputing CCMul offline and resorting to the less resource-intensive ciphertext-plaintext multiplication (CPMul) during private training. Furthermore, conventional polynomial convolution in FHE systems tends to encode irrelevant and redundant values into polynomial slots, necessitating additional polynomials and ciphertexts for input representation and leading to extra multiplications. Addressing this, we introduce correlated polynomial convolution, which encodes only related input values into polynomials, thus drastically reducing the number of computations and overheads. By integrating CCMul-Precompute and correlated polynomial convolution into CryptoTrain-B, we facilitate a rapid and efficient secure training framework, CryptoTrain. Extensive experiments demonstrate that CryptoTrain achieves a ~5.3X training time reduction compared to prior methods.

cs.CR↗

arXiv2017

Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12

In June 2016, Apple announced that it will deploy differential privacy for some user data collection in order to ensure privacy of user data, even from Apple. The details of Apple's approach remained sparse. Although several patents have since appeared hinting at the algorithms that may be used to achieve differential privacy, they did not include a precise explanation of the approach taken to privacy parameter choice. Such choice and the overall approach to privacy budget use and management are key questions for understanding the privacy protections provided by any deployment of differential privacy. In this work, through a combination of experiments, static and dynamic code analysis of macOS Sierra (Version 10.12) implementation, we shed light on the choices Apple made for privacy budget management. We discover and describe Apple's set-up for differentially private data processing, including the overall data pipeline, the parameters used for differentially private perturbation of each piece of data, and the frequency with which such data is sent to Apple's servers. We find that although Apple's deployment ensures that the (differential) privacy loss per each datum submitted to its servers is $1$ or $2$, the overall privacy loss permitted by the system is significantly higher, as high as $16$ per day for the four initially announced applications of Emojis, New words, Deeplinks and Lookup Hints. Furthermore, Apple renews the privacy budget available every day, which leads to a possible privacy loss of 16 times the number of days since user opt-in to differentially private data collection for those four applications. We advocate that in order to claim the full benefits of differentially private data collection, Apple must give full transparency of its implementation, enable user choice in areas related to privacy loss, and set meaningful defaults on the privacy loss permitted.

cs.CR↗