Search papers, labs, and topics across Lattice.
This paper introduces FlowArk, a context-aware knowledge reuse system designed to enhance agentic data-flow analysis for Android applications by minimizing re-analysis costs. By distilling and packaging completed analysis histories into reusable knowledge candidates, FlowArk allows subsequent agent instances to leverage previously acquired insights, thereby improving efficiency in batch workloads. The evaluation shows that FlowArk reduces the end-to-end API cost by 26.83% while enabling a 36.66% increase in task completion under budget constraints compared to standard methods.
FlowArk cuts data-flow analysis costs by over a quarter while boosting task completion rates, making it a game-changer for Android app security auditing.
Data-flow analysis is foundational to Android app privacy and security auditing. Recent coding agents can assist with non-trivial source-to-sink data-flow analysis tasks by searching, reading, and reasoning over repository code. However, when these tasks are executed as a batch workload, current agentic analysis setups incur substantial re-analysis cost. Agent instances assigned to different taint sources may inspect shared code fragments, because code reuse in the target app can cause different data-flow paths to converge on shared program logic. Since these agent instances are context-isolated, analysis of these shared code fragments can be repeated within a batch, unnecessarily consuming API budget and limiting scalability. We propose FlowArk, a knowledge-reuse system that reduces re-analysis cost in batch agentic data-flow analysis by making knowledge from completed analyses available to later agent instances. Specifically, FlowArk distills completed analysis histories into reusable knowledge candidates, packages these candidates into matchable knowledge entries, and injects matched entries into a later agent instance's context. We implement FlowArk on OpenCode and evaluate it on 4,685 source-to-sink data-flow analysis tasks from 50 open-source Android apps. Compared with standard OpenCode, FlowArk-enabled OpenCode maintains comparable analysis quality while reducing end-to-end API cost by 26.83%. In addition, under a USD 100 budget, FlowArk completes 36.66% more tasks (1,060 vs. 776).
