FlowArk: Boosting Agentic Data-flow Analysis for Android Apps via Context-Aware Knowledge Reuse

2026-07-13

AI Summary

This work addresses the inefficiency in batch-wise, agent-based dataflow analysis of Android applications, where context isolation leads to redundant analysis of shared code, resulting in excessive API resource consumption and scalability bottlenecks. To overcome this, the paper introduces the first context-aware cross-task knowledge reuse mechanism, which enables efficient reuse of prior analysis results within the OpenCode framework through historical analysis distillation, encapsulation of knowledge entries, and context-aware injection. Experimental evaluation across 4,685 tasks demonstrates that the proposed approach reduces API costs by 26.83% and increases task throughput by 36.66% under a fixed $100 budget—completing 1,060 tasks compared to 776 with the baseline—while preserving analysis accuracy.

Abstract

Data-flow analysis is foundational to Android app privacy and security auditing. Recent coding agents can assist with non-trivial source-to-sink data-flow analysis tasks by searching, reading, and reasoning over repository code. However, when these tasks are executed as a batch workload, current agentic analysis setups incur substantial re-analysis cost. Agent instances assigned to different taint sources may inspect shared code fragments, because code reuse in the target app can cause different data-flow paths to converge on shared program logic. Since these agent instances are context-isolated, analysis of these shared code fragments can be repeated within a batch, unnecessarily consuming API budget and limiting scalability. We propose FlowArk, a knowledge-reuse system that reduces re-analysis cost in batch agentic data-flow analysis by making knowledge from completed analyses available to later agent instances. Specifically, FlowArk distills completed analysis histories into reusable knowledge candidates, packages these candidates into matchable knowledge entries, and injects matched entries into a later agent instance's context. We implement FlowArk on OpenCode and evaluate it on 4,685 source-to-sink data-flow analysis tasks from 50 open-source Android apps. Compared with standard OpenCode, FlowArk-enabled OpenCode maintains comparable analysis quality while reducing end-to-end API cost by 26.83%. In addition, under a USD 100 budget, FlowArk completes 36.66% more tasks (1,060 vs. 776).

Problem

• data-flow analysis
• agentic analysis
• knowledge reuse
• Android apps
• API cost

Innovation

• knowledge reuse
• agentic data-flow analysis
• context-aware
• Android security
• code reuse