From UI to Code: Mobile Ads Detection via LLM-Unified Static-Dynamic Analysis

Abstract: Mobile advertisements (ads) are essential to the app economy, yet detecting them is challenging because ad content is dynamically fetched from remote servers and rendered through diverse user interfaces (UIs), making ads difficult to locate and trigger at runtime. To address this challenge, we present ADWISE, a novel framework that formulates mobile ads detection as LLM-guided, ad-oriented UI exploration. ADWISE first performs static program analysis to identify UI widgets used to place ads, which we call ad widgets. It then uses a grounded LLM reasoning loop to navigate toward and trigger these widgets under three complementary domain guidance signals: (1) WTG-based guidance, which provides global transition priors from a statically constructed window transition graph (WTG); (2) semantic guidance, which reasons over app functionality to prioritize user-likely interaction paths; and (3) structural guidance, which applies retrieval-augmented generation to match the current UI against recurring ad-heavy layouts from a knowledge base. By combining static program analysis with LLM-based reasoning over UI structure, app semantics, and retrieved analogies, ADWISE enables more effective ads detection in complex mobile UIs. Experiments on 100 benchmark apps show that ADWISE outperforms state-of-the-art baselines by 25.60% in ad widget detection. In addition, ADWISE uncovers 34.34% more ad regulation violations across six categories, directly benefiting downstream ad regulation.

• The paper demonstrates a unified framework integrating static program analysis with LLM-guided dynamic UI exploration to boost mobile ad widget detection.
• It combines a Window Transition Graph with semantic and structural guidance to navigate complex UI flows and trigger dynamic ads.
• Experimental results show a 62.4% detection rate and 133 identified regulation violations, outperforming existing baselines.

LLM-Guided Mobile Ads Detection: AdWise

Introduction

The mobile advertising ecosystem is characterized by an ever-growing diversity of in-app ad displays and placement strategies, which pose persistent challenges for detecting and regulating ad content in Android applications. Traditional approaches leveraging general-purpose UI exploration or static content matching often exhibit brittleness and inefficiency due to dynamic ad content and the proliferation of non-deterministic UI flows. The paper "From UI to Code: Mobile Ads Detection via LLM-Unified Static-Dynamic Analysis" (2604.03561) proposes AdWise, a systematic framework addressing these limitations via the integration of static program analysis with LLM-guided dynamic UI exploration. The design of AdWise systematically identifies ad widgets and leverages an iterative LLM agent loop for targeted UI traversal, improving both detection coverage and regulatory compliance assessment.

Figure 1: Examples of unwanted mobile ads, such as disruptive pop-ups and dynamically loaded banners.

Problem Formulation and Motivation

The core problem addressed is the identification and dynamic activation of ad widgets across app UIs, followed by the detection of regulation violations. Ad widgets are specifically defined as UI components responsible for rendering advertisements—either via bundled ad libraries, developer-authored redirections, or interactions triggering ads upon user input. A principal insight is that ad widgets exhibit both semantic placement (integrated into core user flows) and structural placement (repetitive layouts, e.g., interstitials or menu-based ads), confounding pure static or content-based detection.

Exhaustive UI exploration is computationally prohibitive due to widget and state explosion, while static approaches cannot feasibly determine dynamic control flow reachability or triggerability for every ad widget due to over-approximation and practical imprecision. The explicit formalization of the detection challenge involves both: (1) identification of widgets with ad delivery potential in UI layouts, and (2) runtime triggering along feasible paths, with coverage constraints and efficient action budgets.

AdWise: Hybrid Static-Dynamic Detection via LLMs

AdWise is constructed as a pipeline with clear offline (static analysis) and online (dynamic exploration) phases:

Figure 2: Overview of AdWise: static ad widget identification and WTG construction guide LLM-based interactive exploration of ad-related UIs, with WTG, semantic, and structural signals.

Static Ad Analysis

AdWise deploys dataflow analysis over APK code and layout resources to associate each widget with its view class, resource-id, and observed method invocations. Inference rules—parameterized over ad library APIs, method invocations, and intent destinations—classify widgets into three ad types: adview widgets, popup widgets, and native widgets. Overapproximate detections are retained for runtime pruning. The system synthesizes a Window Transition Graph (WTG), mapping possible transitions between windows (Activities, Dialogs, Menus, Fragments) with edge annotations specifying triggering widgets.

LLM-Guided UI Exploration

The LLM agent loop utilizes three orthogonal guidance signals at each step to maximally exploit prior knowledge and context:

• WTG-Based Guidance: Encodes global navigation priors using shortest-path distances, derived from the static WTG, and presented as textual context to optimize RL-based or instruction-following strategies.
• Semantic Guidance: Extracts application role, intent, and high-likelihood user flows using app store metadata (category, description), prompting the LLM to prioritize exploration trajectories consistent with typical usage.
• Structural Guidance: Employs retrieval-augmented generation (RAG), leveraging a knowledge base of prior ad-heavy UI layouts to supply analogical matches and common ad placement conventions, computed by embedding and similarity retrieval.

Critical to mitigating LLM hallucination are two runtime grounding techniques: explicit action reflection (comparing pre- and post-action UI states for effective feedback) and UI state verification (pruning non-clickable or occluded widgets), reinforcing the agent's reasoning with environment-grounded evidence.

Figure 3: Mobile ad pipeline, highlighting the flow from user UI interactions through ad widget triggering, network content retrieval, and regulatory check points.

Experimental Results

Extensive empirical evaluation is conducted on a 100-app dataset (271 ad widgets), sampled to represent modern ad practices. AdWise is compared to multiple detection and exploration baselines, including MadDroid (UI class), AdGPE (textual), DARPA (vision), GoalExplorer (static WTG), Guardian (LLM-guided), and the default Monkey tool.

Key findings and strong numerical results:

• AdWise achieves a 62.4% detection rate (micro-averaged) across all ad widgets, exceeding GoalExplorer by 25.60%, and surpassing Guardian (LLM-guided UI exploration) by 42.33%.
• Detection of regulation violations is significantly higher: AdWise uncovers 133 violations (placement, interaction, content), a 34.34% improvement over the next-best baseline.
• Efficiency is also enhanced, with per-widget detection latency reduced by 8.68–53.23% relative to other methods.

Ablation experiments confirm the critical role of each guidance signal, with removal of structural, semantic, or WTG-based guidance resulting in detection rate drops of up to 25.97 percentage points.

Figure 4: Case study illustrating AdWise's successful handling of non-trivial, multi-step UI navigation to trigger embedded popup and adview widgets.

Figure 5: Case study showing both correct static ad widget characterization and failure modes where dynamic exploration overcomes static imprecision.

Contradictory observation: Dynamic exploration can yield better coverage for certain ad widget placements (e.g., modal popups tied to non-explicit user actions) than static code analysis alone, demonstrating that holistic detection depends on the synergy of static and LLM-guided dynamic strategies.

Implications for AI, Mobile Security, and Future Work

The AdWise framework exemplifies how LLMs, when coupled with static program analysis, can operate as effective reasoning layers that reconcile over-approximate program semantics with observed UI dynamics, substantially improving task-oriented exploration in adversarial or highly dynamic mobile environments. The modular integration of domain signals (WTG, semantics, structure) provides a pattern for future agent-augmented program analysis systems.

The approach directly advances the state of compliance auditing for mobile ad ecosystems, enabling richer enforcement of placement, interaction, and content regulations—targeting both user experience degradation and privacy/security threats posed by malvertising.

Potential extensions include:

• Hybridization with multimodal LLMs or visual reasoning models for even greater generalization to non-canonical ad UIs.
• Application to broader classes of mobile security analysis (e.g., privacy leak paths, hidden abuse interfaces).
• Online adaptation and continual learning for evolution in ad library APIs and regulatory frameworks.

  Figure 6: AdWise enables actionable bug reporting for regulation violations, as demonstrated in a filed case for Meta Bug Bounty—Abuse Track.

Conclusion

AdWise delivers a unified LLM-guided static-dynamic analysis framework for robust, efficient detection of mobile ad widgets and regulation violations. The system demonstrates strong empirical gains in detection rate and analytical coverage over state-of-the-art baselines, driven by its domain-guided LLM reasoning loop. The research substantiates the utility of combining static program analysis with LLM-based UI reasoning in addressing complex, open-world software security and compliance tasks, and suggests a trajectory toward more intelligent and policy-aware automation in mobile app analysis.

Reference: (2604.03561)