Paper deep dive
MANA: Towards Efficient Mobile Ad Detection via Multimodal Agentic UI Navigation
Yizhe Zhao, Yongjian Fu, Zihao Feng, Hao Pan, Yongheng Deng, Yaoxue Zhang, Ju Ren
Intelligence
Status: succeeded | Model: anthropic/claude-sonnet-4.6 | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/24/2026, 2:43:01 AM
Summary
MANA is a multimodal agentic UI navigation framework for mobile ad detection on Android. It fuses static, visual, temporal, and experiential signals using LLMs/VLMs to guide exploration toward ad-hosting UI states. Evaluated on 200 apps, MANA achieves 77% detection rate, improving over baselines by 30.5–56.3% and reducing exploration steps by 29.7–63.3%. Key components include offline profiling (screen/slot/trigger/network priors), multimodal reasoning-guided navigation with a User Transition Graph, and memory-driven runtime optimization via reusable experience embeddings.
Entities (38)
Relation Signals (30)
MANA → addressestask → Mobile Ad Detection
confidence 99% · we present MANA, the first agentic multimodal reasoning framework for mobile ad detection
Zihao Feng → affiliatedwith → University of Southern California
confidence 99% · † University of Southern California, USA
Yizhe Zhao → affiliatedwith → Tsinghua University
confidence 99% · ‡ Department of Computer Science and Technology, Tsinghua University, China
Hao Pan → affiliatedwith → Shanghai Jiao Tong University
confidence 99% · § Shanghai Jiao Tong University, China
MANA → uses → Vision-Language Models
confidence 98% · By leveraging large language and vision-language models (LLMs/VLMs)
MANA → uses → Large Language Models
confidence 98% · By leveraging large language and vision-language models (LLMs/VLMs), it interprets ambiguous and dynamically evolving heterogeneous signals
MANA → compatiblewith → Llama-4
confidence 97% · MANA further adapts to diverse reasoning models (i.e., GPT-4o mini, Llama-4, Qwen-2.5)
MANA → compatiblewith → GPT-4o mini
confidence 97% · MANA further adapts to diverse reasoning models (i.e., GPT-4o mini, Llama-4, Qwen-2.5)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Mobile advertising dominates app monetization but introduces risks ranging from intrusive user experience to malware delivery. Existing detection methods rely either on static analysis, which misses runtime behaviors, or on heuristic UI exploration, which struggles with sparse and obfuscated ads. In this paper, we present MANA, the first agentic multimodal reasoning framework for mobile ad detection. MANA integrates static, visual, temporal, and experiential signals into a reasoning-guided navigation strategy that determines not only how to traverse interfaces but also where to focus, enabling efficient and robust exploration. We implement and evaluate MANA on commercial smartphones over 200 apps, achieving state-of-the-art accuracy and efficiency. Compared to baselines, it improves detection accuracy by 30.5%-56.3% and reduces exploration steps by 29.7%-63.3%. Case studies further demonstrate its ability to uncover obfuscated and malicious ads, underscoring its practicality for mobile ad auditing and its potential for broader runtime UI analysis (e.g., permission abuse). Code and dataset are available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2603.20351v1
- Canonical: https://arxiv.org/abs/2603.20351v1
Trouble viewing inline? Open PDF directly →
Full Text
101,112 characters extracted from source content.
Expand or collapse full text
MANA: Towards Efficient Mobile Ad Detection via Multimodal Agentic UI Navigation Yizhe Zhao ‡ , Yongjian Fu ‡⋄ , Zihao Feng † , Hao Pan § , Yongheng Deng ‡ , Yaoxue Zhang ‡ , Ju Ren ‡¶⋄ ‡ Department of Computer Science and Technology, Tsinghua University, China, † University of Southern California, USA, § Shanghai Jiao Tong University, China, ¶ State Key Laboratory of Internet Architecture, Tsinghua University, China, ‡ zhao-yz24@mails.tsinghua.edu.cn, ‡ fuyongjian,dyh2024,zhangyx,renju@tsinghua.edu.cn, † zihaofen@usc.edu, § panh09@sjtu.edu.cn ABSTRACT Mobile advertising dominates app monetization but intro- duces risks ranging from intrusive user experience to mal- ware delivery. Existing detection methods rely either on static analysis, which misses runtime behaviors, or on heuris- tic UI exploration, which struggles with sparse and obfus- cated ads. In this paper, we present MANA, the first agentic multimodal reasoning framework for mobile ad detection. MANA integrates static, visual, temporal, and experiential signals into a reasoning-guided navigation strategy that de- termines not only how to traverse interfaces but also where to focus, enabling efficient and robust exploration. We imple- ment and evaluate MANA on commercial smartphones over 200 apps, achieving state-of-the-art accuracy and efficiency. Compared to baselines, it improves detection accuracy by 30.5%–56.3% and reduces exploration steps by 29.7%–63.3%. Case studies further demonstrate its ability to uncover ob- fuscated and malicious ads, underscoring its practicality for mobile ad auditing and its potential for broader runtime UI analysis (e.g., permission abuse). Code and dataset are available at https://github.com/MANA-2026/MANA. CCS Concepts • Human-centered computing→Ubiquitous and mo- bile computing;• Computing methodologies→Arti- ficial intelligence;• Security and privacy→Software and application security. Keywords Mobile Advertising Detection, Large Language Models, Mul- timodal Agents ⋄ Corresponding author. 1 Introduction Mobile advertising has become the economic backbone of the mobile ecosystem, with a global market projected to sur- pass USD 1 trillion by 2032 [14]. Recent reports show that ads appear in over 60% of Google Play apps [1], most com- monly delivered through third-party SDKs such as Google AdMob [16], Meta Audience Network [35], and Applovin [6]. However, this prevalence introduces substantial risks. Ads may disrupt interaction with intrusive pop-ups [19], simu- late native interface elements through deceptive design [53], or be weaponized to deliver malware and trigger malicious redirects [41]. In the current environment, ads are not merely peripheral annoyances but instead constitute a significant attack surface with direct implications for both user security and platform integrity. Consequently, the ability to automat- ically and reliably detect in-app ads is no longer a matter of mere convenience, but a critical requirement for vetting apps at scale and securing the mobile ecosystem. Pioneering efforts in mobile ad detection have progressed along two main directions. Static analysis [13,24,25,47] inspects manifests, layouts, or bytecode to identify ad SDK signatures. While scalable, this approach offers no visibility into when or where ads actually appear at runtime and is easily defeated by obfuscation or dynamic code loading. To address these limitations, dynamic exploration driven by au- tomated UI navigation has become the dominant paradigm. Tools such as Monkey [15] rely on random event gener- ation, DroidBot [27] maintains a lightweight state model, and systems like MadDroid [29] and ADGPE [31] prioritize UI components based on keywords or class names, while FraudDroid [11] combines exploration with network traffic analysis. Despite improving runtime visibility, these methods are fundamentally limited by their reliance on narrow, single- source signals (e.g., view metadata). Their navigation strate- gies remain brittle and inefficient, often cycling through shallow states while failing to uncover ads hidden in deeper, more complex interaction flows. arXiv:2603.20351v1 [cs.CR] 20 Mar 2026 3 Reasoning Process ConstructPrompt “Where ads may occur?” “How to navigate?” Heterogeneous Signals 1 UI Navigation Action1 UI-1 UI-2 UI-3 Action2 Update Advertising Detector2 Are ads triggered? Signals Injection Ads Analysis No Yes Static Knowledge Visual Clues Temporal Context Cross-app Experience 4 Figure 1: MANA as a multimodal reasoning agent for efficient mobile ad detection, fusing heterogeneous signals to jointly reason about “where and how to go”. This limitation becomes critical as modern apps adopt evasive patterns that break metadata-dependent heuristics. UI metadata is often missing, ambiguous, or bypassed, as seen with indistinguishableImageViewelements or in apps (e.g., games) that use full canvas rendering, concealing the entire widget hierarchy. Such practices underscore the need for a paradigm shift: from brittle, single-signal heuristics to a robust reasoning framework that can fuse heterogeneous signals to guide exploration. Therefore, how to turn diverse and often incomplete runtime evidence into coherent guidance for efficiently exposing hidden ads remains an open challenge. In this paper, we propose MANA, aMultimodalAgentic UINavigation framework for mobileAd detection that opera- tionalizes this paradigm shift, as depicted in Figure 1. MANA moves beyond simple heuristics to act as a reasoning agent that fuses static footprints, visual cues, temporal context and cross-app experience to steer exploration toward high-yield states. By leveraging large language and vision-language models (LLMs/VLMs) [26,37], it interprets ambiguous and dynamically evolving heterogeneous signals at runtime, en- abling robust and efficient discovery of ads concealed in diverse interaction flows. MANA contributes to agentic UI navigation by shifting the focus from goal-oriented task com- pletion [30,45,54] to adversarial exploratory search. Generic agents excel at explicit task completion (e.g., “add item to cart”), where the goal is clear and targets are structurally exposed. In contrast, ad detection is an exploratory search problem: the targets are hidden, sparsely distributed, and triggered by non-obvious event sequences. This challenge is not just “how to go” but also “where to go” when the destina- tion is unknown. This necessitates a reasoning framework over heterogeneous signals, where the model synthesizes static footprints with dynamic cues to infer latent UI states, addressing a form of “detecting the unseen” that extends beyond standard LLM-based navigation heuristics. To realize this vision, our design overcomes three funda- mental challenges. First, addressing the cold start problem. Automated exploration starts without prior knowledge of ad locations, resulting in inefficient and budget-wasting searches across the vast state space. To mitigate this, we conduct a large- scale empirical analysis of advertising apps, revealing that ad-hosting structures consistently leave traces in manifests, layouts, and bytecode. Building on these insights, we intro- duce offline profiling, which combines static analysis with lightweight probing to derive actionable priors (screen, slot, trigger, network) and to construct an initial User Transition Graph (UTG). These priors seed navigation with structural knowledge, providing principled guidance from the outset. Second, overcoming fragmented observability. Ad-re- lated signals are scattered across modalities and time. Meta- data may be sparse, canvas-based UIs hide their structure, and visual cues are often subtle. Furthermore, ads can be time-gated or require specific interaction sequences. Our insight is that observability must be reconstructed by fusing modalities and aligning them across time. We therefore de- sign multimodal reasoning–guided navigation, which unifies metadata with visual cues, grounds exploration in temporal and structural context via the UTG and interaction history. It further leverages LLM/VLM reasoning to interpret incom- plete and dynamic signals into a coherent action plan, guid- ing not only how to navigate the interface but also where to focus in order to surface hidden ads. Third, bridging the cross-app knowledge gap. Ad-trig- gering patterns often repeat across different apps, but tra- ditional explorers learn nothing from past runs, repeatedly rediscovering the same strategies. This failure to generalize leads to redundant effort and poor scalability. Motivated by the observation that ad-triggering patterns exhibit strong structural and semantic regularities, we propose memory- driven runtime optimization. The system records successful ad-triggered trajectories as “experiences”, abstracts them into reusable, semantically encoded strategies, and transfers this knowledge to new exploration contexts. By learning from past successes, the agent accelerates discovery in new apps and makes more informed decisions about where to search and how to proceed. We implement MANA on commercial smartphones (i.e., Honor V20 and Huawei Mate 40 Pro), leveraging heteroge- neous signals for agentic multimodal reasoning. Evaluation on 200 apps (i.e., ADGPE and a newly curated MANAZoo) shows that MANA achieves state-of-the-art performance, reaching detection rates of 77.0% with improvements of 2 30.5%–56.3% over baselines and reducing redundant explo- ration paths by 29.7%–63.3%. MANA further adapts to di- verse reasoning models (i.e., GPT-4o mini [20], Llama-4 [34], Qwen-2.5 [2]) and mobile devices, with case studies confirm- ing its ability to uncover obfuscated and policy-violating ads. Beyond ad auditing, it generalizes to broader runtime UI analysis tasks such as malware detection, while preserving the same agentic multimodal reasoning workflow. Our contributions are threefold: • We introduce MANA, the first multimodal agentic frame- work for mobile ad detection. It pioneers an exploratory search paradigm that fuses static, visual, temporal, and experiential signals to discover sparse, evasive, and diverse advertising behaviors. •We design a reasoning-guided UI navigation strategy that integrates heterogeneous and evolving signals to infer hidden ad-related triggers. This enables the agent to deter- mine both where to focus and how to traverse the interface, ensuring efficient and robust exploration. •We implement and evaluate MANA on commercial smart- phones across two representative datasets. MANA attains state-of-the-art detection accuracy and efficiency, with case studies demonstrating its effectiveness in uncovering obfuscated and malicious ads. These findings underscore its practicality for mobile ad auditing and broader runtime UI analysis (e.g., permission abuse). Code and dataset will be released to facilitate future research. 2 Background and Motivation 2.1 The workflow of mobile advertising. Mobile ad in Android apps is primarily enabled through the integration of third-party ad SDKs (e.g., Google AdMob [16], Meta Audience Network [4,5]). Once embedded, these SDKs dynamically fetch and render ad creatives from remote ad networks at runtime, supporting diverse formats such as banners, interstitials, native, or rewarded ads [31]. When triggered, an ad widget initiates a network request to re- trieve content, which may lead to further UI transitions. For example, redirecting the user to an in-app landing page, the Google Play Store, or external web content [29]. In MANA, these behaviors are treated as potential ad triggers. Modern ad platforms increasingly rely on runtime auctions and user profiling for monetization, but this also brings risks such as intrusive ads, unwanted redirections, and even malware delivery [40,42]. Diverse ad embedding and runtime deliv- ery strategies call for robust ad detection frameworks that generalize across app categories. We group mobile ads into three types (Figure 2): Embedded ads blend into the content flow and may resemble functional UI; Popup ads are inter- ruptive overlays and are typically easier to detect; Custom (a)EmbeddedAd (b)PopupAd(c)CustomAd Figure 2: Examples of different ad types: (a) integrated within the app interface as a banner; (b) shown as an intrusive interstitial that blocks normal interaction; (c) implemented as a “More Apps” list without standard SDK patterns, requiring semantic reasoning to recog- nize as advertising. ads use app-specific/non-standard rendering with few SDK or textual cues, making them the hardest to identify. 2.2 Challenges in Mobile Ad Detection. In this section, we reveal that ads in mobile apps exhibit three fundamental properties that complicate detection. Sparsity and Obscured. Ad-triggering events are rare and often depend on specific multi-step, time-gated interaction sequences rather than immediate UI feedback (e.g., “Sub- scribe”→“Watch Video”→wait for loading). Large-scale studies confirm this sparsity: automated exploration can spend up to 98.6% of time in repetitive loops without reach- ing deeper ad-hosting states [44], and many ads only appear along deep execution paths [29]. As a result, blind explo- ration wastes budget and easily misses hidden ads, motivat- ing reasoning-guided navigation. Visual Cues Beyond Metadata. Many ad detectors rely on view metadata (e.g.,class,content-desc)[29,31], but these fields are often empty, generic, or ambiguous. As Fig- ure3(a) shows, twoImageViewelements share identical meta- data (i.e., 1 and 2 ), yet only one visually contains a play icon indicating a video ad; metadata-only methods cannot separate them. Prior work also shows developers may delib- erately obscure ad cues, such as embedding close buttons into banners or mimicking native UI elements [33]. Together, these observations motivate vision-based reasoning for ro- bust ad detection. Heterogeneous Rendering Pipelines. Many apps expose structured view hierarchies that can be systematically parsed via the Accessibility Service [17]. In contrast, an increas- ing fraction of apps, especially games, adopt canvas-based 3 <node class="android.widget.ImageView" content-desc="" bounds="[570,1266][1041,1737]" /> </node> <node class="android.widget.ImageView" content-desc="" bounds="[39,1266][510,1737] "/> </node> <node class="android.view.View" content-desc="" bounds="[0,102][1080,2208]" /> </node> 1 2 3 3 1 2 (a)(b) Figure 3: Screenshots of two example apps. The mid- dle panels show the view-hierarchy nodes correspond- ing to the blue-boxed components in the screenshots, while red boxes highlight ad-related elements. rendering (e.g., Unity). In such cases, the entire interface is painted as a bitmap, leaving no widget-level metadata avail- able for accessibility-based inspection [39,51]. As shown in Figure 3(b), ad-triggering components become invisible to the hierarchy, making screenshot-level analysis the only vi- able option (i.e., 3 ). This heterogeneity highlights the need for a unified abstraction that can normalize accessibility- based and vision-based evidence into a consistent represen- tation of actionable UI elements. 2.3 Multimodal Reasoning-Guided UI Navigation for Ad Detection. Mobile ads exhibit sparse triggers, subtle visual cues, and diverse rendering pipelines, which impose three methodolog- ical requirements: (i) reasoning over sparse and obscured sig- nals, (i) leveraging visual cues to distinguish ad-specific pat- terns, and (i) normalizing heterogeneous rendering mecha- nisms into a consistent abstraction of actionable UI compo- nents. Conventional approaches such as static SDK detectors, metadata-based classifiers, and heuristic exploration strate- gies cannot satisfy these requirements; they often fail to localize ads, miss critical visual evidence, or waste interac- tion budget in redundant exploration [29, 31–33]. LLMs and VLMs enable multimodal UI reasoning: LLMs process textual metadata and context, while VLMs capture vi- sual cues from screenshots. Prior work shows that combining textual, visual, and historical signals prioritizes high-yield paths and outperforms RL or heuristic navigation [30,45,54], making these models promising for ad-oriented exploration. However, generic task-driven UI agents assume explicit goals and dense rewards, whereas ads are sparse, deliberately ob- scured, and often buried deep in interaction paths. Effective ad exploration therefore requires reasoning over temporal and visual evidence to surface ad cues and identify which UI components to interact with to trigger ads. To meet these needs, we build a multimodal structured reasoning agent on LLMs and VLMs for targeted mobile ad exploration, rather than a generic click predictor. 3 MANA Design 3.1 System Overview As illustrated in Figure 4, MANA operates in three tightly integrated stages: (1) Offline Profiling extracts ad-related priors and a coarse UTG through static analysis and light- weight exploration, providing early guidance for UI naviga- tion; (2) Multimodal Reasoning-Guided UI Navigation enriches each UI state with these priors, semantic descrip- tions generated by the VLM, and UTG-based temporal and structural context, enabling the LLM to perform informed reasoning and avoid redundant exploration; (3) Memory- Driven Runtime Optimization distills successful ad-trig- gering trajectories into reusable experiences, allowing the system to recall effective strategies across similar states and thereby improve both accuraccy and efficiency. 3.2 Offline Profiling At the outset of ad-oriented exploration, the detector en- counters a cold start: it lacks guidance on which screens are likely to host ads, which widgets to operate, or how long to wait before ads appear. This absence of prior knowledge inflates the state–action space, diminishes early coverage, and wastes exploration budget, with the additional risk of trapping the process in repetitive loops [44]. To address this issue, we incorporate prior knowledge to guide detection, motivated by two observations from our preliminary study. (1) We analyze ads in 100 apps from the ADGPE dataset [31]. As shown in Figure 5, declarative ev- idence (manifest) appears in∼98% of cases, structural evi- dence (layout files with ad-specificViewclasses) in 65% of apps, and behavioral evidence (e.g.,loadAd/show) in 77%. We also find strong temporal traces: in random exploration logs, 40.9% of ad-related network requests occur within 3–5 seconds after the triggering interaction, indicating the value of network-based evidence. (2) We further examine ad-type distribution (Figure 6) and find that custom ads dominate, while embedded and popup ads are less frequent. This di- rectly impacts evidence availability: popup ads often expose explicit API calls, embedded ads more often leave layout traces, whereas custom ads may bypass both, making single- modality detection unreliable. In summary, while declarative ad evidence is almost al- ways present, structural, behavioral, and network signals vary across ad types. This motivates using multiple priors from offline profiling to narrow the search space, prioritize high-potential actions, and provide temporal guidance for 4 OfflineProfilingMultimodal Reasoning-Guided UI Navigation Memory-DrivenOptimization Temporal Grounding UTG History PriorFeatures ReuseableExperience Memory Embeddings EventTrace Experience Touchview Scroll ... Update Summarize Dynamic Probing ScreenPrior SlotPrior Retrieve relevant experiencefrommemory. Record experience. Termination: Timeout or max events reached. TriggerPrior NetworkPrior Cross-Rendering Consistency VisionHierarchy LLM Action Prompt TriggerAd Static Analysis UI1UI2 UI3 UTG Figure 4: The system overview of MANA. Manifest Layout APINetwork 25 50 75 100 Percentage (%) Figure 5: Distribution of dif- ferent evidence. EmbeddedPopupCustom 15 30 45 Percentage (%) Figure 6: Proportions of different ad types. ad discovery. Concretely, we perform three layers of static analysis to extract screen, slot, and trigger priors, and use lightweight dynamic probing to build a coarse UTG and network priors. We next describe how each prior is obtained. 3.2.1 Ad-oriented Static Analysis. To extract actionable pri- ors from static analysis, we follow a three-layer structure: declarative, structural, and behavioral, each uncovering com- plementary aspects of ad integration. Screen prior. We start fromAndroidManifest.xml, which encodes mandatory specifications for every app. Since ad SDKs must explicitly declare network permissions, register components such asAdActivity, and provide initialization metadata, the manifest offers reliable but coarse-grained ev- idence of ad integration. However, this evidence may be absent or misleading in adversarial cases, such as malicious apps that dynamically load ad code via reflection or obfus- cate SDK entries [8], or in aggregation SDKs where ad com- ponents are hidden behind generic declarations [12]. We therefore treat manifest entries only as global integration signals that contribute to screen priors, to be cross-checked against structural and behavioral clues. Slot prior. Layout XML resources reveal the UI containers in which ads are hosted. We parse files underres/layoutand identifyViewclasses whose package names match known ad SDK prefixes. For each matched component, we record its resource identifier and position in the hierarchy, thereby mapping candidate ad containers to specific screens. Beyond simple presence detection, we further infer the likely ad type (e.g., banner, interstitial, native, rewarded) from naming con- ventions and placement within the layout. This process con- verts raw layout definitions into slot priors, specifying where ads are likely to appear and in what form, thus providing spatial guidance for subsequent navigation and detection. Trigger prior. Dalvik bytecode exposes operational logic beyond what manifests and layouts can show. We there- fore propose an activity-centric attribution model: ad-related calls (e.g.,loadAd,show) and lifecycle callbacks are first de- tected in the code, and then traced upward through the class hierarchy until they are bound to a manifest-registered Ac- tivity. This attribution ties low-level invocations to concrete screens, ensuring that behavioral evidence is localized to specific Activities rather than scattered across helper classes. In addition, attribution enables us to rank triggers by impor- tance (e.g.,show*> load*> init*), thereby yielding trigger priors that indicate when ads are most likely to surface. 3.2.2 Ad-oriented Lightweight Dynamic Probing. During on- line navigation, the UTG is gradually expanded as new states and transitions are explored, providing structural and tem- poral context for interaction. However, when an app is first analyzed, such context is largely unavailable, making the early phase inefficient. To mitigate this, we construct a coarse UTG using DroidBot [27] during offline profiling. Coarse UTG construction. Although existing static analy- sis tools [7, 22, 48] can in principle generate similar graphs, they often incur high computational costs, produce redun- dant paths due to over-approximation, and fail to capture runtime-specific behaviors. We therefore adopt a lightweight dynamic random exploration that quickly samples represen- tative transitions, yielding a more realistic and computation- ally efficient preliminary UTG. The UTG provides a struc- tural model of the state space, where nodes carry activity- level metadata and edges encode triggering events. Network prior. Random exploration traces are noisy, so we post-process them by aligning dynamic states with static ad 5 clues. During coarse UTG construction, MANA captures run- time events from the Android system log (logcat.txt), then extracts ad-related network requests by matching known ad domains and characteristic parameters. Since each DroidBot event is timestamped, we correlate interactions with subse- quent requests within a short window, linking UTG states to ad-loading activity. This yields network priors that estimate the likelihood and timing of ad activation, and together with screen, slot, and trigger priors, provides structured evidence to guide online navigation. 3.3 Multimodal Reasoning–Guided UI Navigation As described in Section 2.3, ad-oriented UI navigation must reason over heterogeneous signals across modalities and time scales, rather than relying on single-modality or single- step decisions. To achieve this goal, we propose a multimodal reasoning algorithm for UI navigation. 3.3.1 Decision Policy. At each step푡, MANA instantiates an LLM-based decision policy휋 MANA (· | 푍 푡 )via in-context reasoning. We construct an augmented context 푍 푡 =Φ(푀 푡 ,푉 푡 ,Σ,퐻 푡 ,E mem ,G 푡 ),(1) where푀 푡 is the current UI metadata,푉 푡 contains optional visual cues from the screenshot,Σdenotes offline priors, 퐻 푡 is the interaction history,E mem are retrieved cross-app experiences, andG 푡 is the local neighborhood of the UTG. Normalized actionable observation. Instead of prompt- ing the LLM with raw UI trees, MANA converts the raw observation표 푡 =(푀 푡 ,푉 푡 )into a structured actionable set푥 푡 . Each element in푥 푡 corresponds to an interactable widget with consistent attributes (e.g., type, text, content description, bounds, and optional visual semantics), yielding a normal- ized action space across different rendering pipelines. The policy output is constrained to selecting one executable ac- tion푎 푡 from푥 푡 (plus a small set of global actions such as back/scroll), which preserves executability and reduces hallucinated actions. Output:Actionablecomponentswithdescriptions Hierarchy-based Step1:Localization AccessibilityService Step2:Semantic Enrichment TextualVisual Container TextDesc/VLMInherit child Annotated screenshot Canvas-rendered Hybrid vision detector VLM x x x x Figure 7: Cross-rendering consistency scheme, which combines Accessibility Service with visual techniques to produce semantically described actionable compo- nents for hierarchy-based and canvas-rendered apps. Choosing element 4, as the text 'FREE COINS' is a high-confidence ad trigger and is marked with an '[AD HINT]'. LLMOutputfor(b) (b)An aircraft shooting game developed by unity. (a)An ordinary music player. #15 Choosing element 15, as the text 'Other apps' suggests a potential for ad- relatedcontent, which aligns with the heuristic of exploring options that may lead toadvertisements. LLMOutputfor(a) #1 #2 #4 #3 #4 VLMOutput "id": 3, "desc": "[AD HINT] A blue button with the text 'FREE COINS'. " Detected by Hybrid Vision Detector Figure 8: Examples of MANA reasoning on a single UI screen. (a) a view-metadata case where hierarchical metadata identifies the “Other apps” button as a pro- motional redirection; (b) A visual cues case (e.g., “FREE COINS”) in a rendering app reveal advertising intent. Per-step outputs and temporal guidance. Given푍 푡 and푥 푡 , the LLM outputs (i) an action choice푎 푡 , (i) a brief rationale, and (i) an instantaneous ad-relevance score ˆ 푠 푡 ∈ [0,1]for Eq. (2). After executing푎 푡 , MANA updates the UTG with the observed transition and smooths ˆ 푠 푡 into a node-level belief via EMA for temporal guidance and loop avoidance. The formal definition of푍 푡 and the coverage analysis are detailed in Appendix C. Termination. The navigation loop terminates when an ad is detected, or when a predefined interaction budget푁 max or time budget푇 max is exhausted. Design principles. We realize this policy through via princi- ples: (i) Cross-Rendering Consistency to normalize hierarchy- based and canvas-rendered UIs into actionable components, (i) Temporal Grounding to leverage history and UTG struc- ture, and (i) Heterogeneous Signal Fusion to integrate priors, runtime observations, and reusable experiences into a unified prompt for robust decision-making. 3.3.2 Cross-Rendering Consistency. To handle rendering het- erogeneity, MANA unifies UI identification into two stages: localization of candidate interactive regions and semantic en- richment of their roles. As depicted in Figure 7, for hierarchy- based apps, localization is obtained from the Android Ac- cessibility Service, which exposes widget metadata such as class names, resource identifiers, and textual labels. With such metadata, the LLM can infer potential advertising in- tent (Figure 8 (a)). However, canvas-rendered apps lack hier- archical metadata and thus require vision-based inference to recover actionable components. To this end, MANA in- troduces a hybrid vision detector that integrates a domain- 6 adapted deep detector 1 with a heuristic visual analyzer [27]. The deep detector, tuned for canvas-rendered UIs, ensures high recall on domain-specific widgets, while the analyzer leverages lightweight geometric and pattern-based heuristics to augment coverage on general-purpose screens and low- complexity elements. The outputs of hybrid vision detector are unified through region consolidation, after which each candidate region is enriched with concise semantic captions by the VLM and subsequently provided to the LLM for down- stream reasoning (Figure 8 (b)). Our design ensures that both canvas-based and hierarchy-based UIs are normalized into a consistent abstraction of actionable widgets. Selective Vision Invocation. In addition to using VLMs to enrich the semantics of canvas-rendered apps, we also apply them to enhance widget level information in hierarch-based apps. However, applying VLMs to all UI elements incurs pro- hibitive costs in both monetary and computation, so MANA adopts a lightweight pre-filter based on UI hierarchy meta- data. Specifically, in hierarchy-based apps, VLM invocation is triggered only for widgets with ambiguous or missing metadata, particularly media container components such as ImageViewthat lack descriptive attributes. Overall, MANA invokes VLMs to perform semantic enrichment only on can- didate regions identified by the hybrid vision detector in canvas-rendered apps or on widgets with missing metadata in hierarchy-based apps. This selective invocation strategy ensures robust ad detection while avoiding the overhead of applying VLMs to every UI element. 3.3.3 Temporal Grounding. Ad-triggering behaviors are tem- poral: a click may only surface an ad after a short delay, re- peated visits to the same screen may be required, and lack of temporal awareness can lead to redundant loops. To capture these dynamics, we design a unified context manager that integrates recent interaction history with the evolving UTG. The history buffer records short-term trajectories, includ- ing executed events and ad outcomes, and uses an adaptive window to detect stagnation when the agent lingers in the same activity. The window expands to provide additional activity context, signaling to the LLM that it has remained in the current activity for several steps, prompting explo- ration of other activities and prevents excessive repetition within a single state. The UTG is initialized with a coarse of- fline graph and refined incrementally online. As exploration proceeds, the UTG is continuously updated with newly ob- served transitions and revisit frequencies. At each decision step, it provides activities reachable within two hops from the current state, allowing MANA to leverage structural in- formation and decide whether to navigate toward neighbors more likely to contain ads. Together, these two views situate the agent in both temporal and structural context, enabling 1 Instantiated with a fine-tuned YOLOv11 model in our prototype reasoning beyond single-step interactions. This context is then consolidated into the prompt with static priors and cur- rent UI descriptions. The LLM both selects the next action and estimates the ad-relevance of the current state This estimation produces a smoothed relevancescore 푡+1 , which is refined through an exponential moving average (EMA) mechanism: score 푡+1 =(1− 훼)· score 푡 + 훼 · ˆ 푠 푡 ,(2) where훼is the smoothing factor and ˆ 푠 푡 denotes the instanta- neous ad-relevance score assigned by the LLM to the current state based on the above information. This dual role trans- forms the LLM from a reactive agent into an adaptive scorer, gradually steering exploration toward ad-relevant regions while avoiding redundant or cyclic behavior. 3.3.4 Heterogeneous Signal Fusion. Even with consistent UI representations and temporal grounding, screen-only deci- sions remain fragile: visually similar components can lead to different outcomes, and short trajectories may miss deeper ad logic. To address this, we fuse heterogeneous signals from offline priors, runtime observations, and cross-app experi- ences into a unified prompt. Concretely, we preprocess static analysis into a three-level knowledge base: (i) activity-level signals that mark ad-related screens, potential triggers, and previously observed ad hosts; (i) component-level matches between visible widgets and ad-related classes/resource IDs; and (i) global priors such as ad libraries and network do- mains for consistency checks. These priors are combined with runtime UI layout and VLM semantics, as well as UTG and history context. We further retrieve memory-based ex- periences via embedding similarity and inject the distilled heuristics into the prompt. Together, this fusion yields a holistic decision context that improves navigation reliability, reduces redundant interactions, and increases ad discovery across diverse apps. 3.4Memory-Driven Runtime Optimization Ad-triggering events in mobile apps are inherently sparse and context-dependent, often concealed behind ordinary- looking states. Unlike regular UI interactions, ads may sur- face only after specific sequences (e.g., clicking “watch video” followed by a short delay), or even require repeated visits to the same screen. Without a memory mechanism, exist- ing agents are forced to rediscover such trajectories from scratch, leading to redundant exploration, wasted budget, and even indefinite loops that fail to reach deeper ad-hosting states. This limitation becomes particularly acute in large applications, where the state space is vast but genuine ad opportunities remain rare. Our insight is that successful ad triggers exhibit reusable patterns: the same types of screens, widgets, and transitions 7 "summary": "Interacting with options or settings menus often leads to ad displays or offers.", "fingerprint": "Activity:|[LinearLayout]contains [FrameLayout]contains...", "screen_vector":[-0.0087,0.0155,...,0.0029] (a)Areligious app. (b)Amusicplayer. (c)Memoryexample. Figure 9: Cross-app regularities captured by memory. (a) and (b) both exhibit recurring ad-triggering pat- terns via the “Hidden Menu→More Apps” option, (c) shows the corresponding memory entry abstracted into a reusable representation. frequently precede advertisements across diverse applica- tions, as illustrated in Figures 9(a) and 9(b). Motivated by this observation, we design a memory-driven optimization layer that systematically records, abstracts, and reuses prior suc- cesses to guide runtime navigation. Whenever a trajectory successfully leads to an advertisement, the system records it as a new experience. Each experience consists of two parts: (i) the triggering state immediately preceding the ad, encoded as a hierarchical fingerprint of the UI that preserves class names, resource identifiers, and textual content in the view hierarchy; and (i) a high-level summary generated by the LLM that describes the effective interaction sequence in natu- ral language, capturing actionable heuristics. The fingerprint is further embedded into a high-dimensional semantic space, allowing structurally and semantically similar states across apps to be aligned. To control memory growth and main- tain high retrieval efficiency, we perform offline clustering and pruning of near-duplicate or outdated trajectories. For- mally, letE=v 1 , v 2 , . . ., v 푁 denote the set of fingerprint embeddings, and define the cosine similarity between any two embeddings assim(v 푖 ,v 푗 )= v 푖 ·v 푗 ∥v 푖 ∥ ∥v 푗 ∥ . For a similarity threshold휏, any pair(v 푖 ,v 푗 )withsim(v 푖 ,v 푗 ) ≥ 휏is consid- ered redundant, and only one embedding is retained. This pruning procedure produces a compact setE ′ ⊆ Ethat preserves coverage while reducing redundancy. At runtime, when the agent encounters a new state, it applies the same fingerprinting and embedding to query the experience repository. For small to moderate repository sizes, full in-memory similarity computation is sufficient; 2. Static App Knowledge [General Info] App uses ad libraries:Google AdMob [Task]You are an AI agent that analyzes the context and choose the best UI to interact with on the current screen. [Screen Analysis]Outputad score from 0.0 to 1.0 for the current screen. [OutputFormat]Your response must be a single, valid JSON. [DecisionmakingHeuristics] 1.Identify Ad Triggers: (a)Text with strong ad-related intent. (b)Indicators from static knowledge. 2.Strategic Exploration: Use strategic context and recent history to guide exploration and avoid redundant loops. 1. Current Screen Options - View 0: Type=TextView, Text=Question Papers - View 1: Type=BackButton, Text=Return to previous screen 3. Strategic Context (a)Annotated Local Map: -Current StateA (visited2 times), score:0.03 -Reachable in 1hop: -State B(visited 0 times),score: 0.10, event: TouchEvent(state=A, view=button) -Reachable in 2hops: -... 4. Past Experiences Interacting with reward or bonus-related options in apps often (b)Recent History -Cto D:TouchEvent(state=C, name=button) (AD!) -Dto A:RestartAppEvent() triggers advertisement offers. SystemPromptIntegrated Prompt Figure 10: An illustration of the structured prompt in MANA. The system prompt defines the task and heuristics, while the integrated prompt supplies multi- faceted context for decision-making. however, for scalability, we optionally employ an approxi- mate nearest neighbor (ANN) search. This allows the sys- tem to efficiently retrieve relevant experiences even as the number of stored trajectories grows, while preserving the fidelity of similarity-based retrieval. Retrieved experiences provide both a similarity score and the distilled summaries as shown in Figure 9(c), which are injected into the agent’s reasoning process. This enables the system to recall past ad- triggering strategies and adapt them to the current context, converting exploration from a purely reactive process into an experience-guided one. As a result, the agent converges more quickly toward ad-relevant states, reduces redundant navigation, and improves efficiency in diverse application environments. 3.5 Structured Prompt Design In order to inject multi-stage context into the LLM, we design a structured prompt that turns heterogeneous exploration signals into a coherent input for reasoning. Our structured prompt has two layers. System Prompt provides stable guid- ance by specifying the agent’s objective, decision heuristics, and output format (e.g., identify ad triggers, avoid redundant loops, and return normalized scores). Integrated Prompt augments this backbone with contextual signals collected at runtime. As shown in Figure 10, it organizes information into four slots: (i) current screen options, describing visible widgets and their textual attributes; (i) static app knowledge, distilled from offline profiling, which highlights ad-related SDKs, com- ponents, and identifiers; (i) strategic context, including both an annotated local UTG (reachable states, event transitions, and ad-likelihood scores) and the recent interaction history; 8 and (iv) past experiences, retrieved from the memory reposi- tory, which summarizes effective ad-triggering trajectories observed previously. This multi-stage injection ensures that the LLM receives both stable objectives and structured evidence spanning cur- rent, offline, temporal, and experiential dimensions. Thus, the prompt enables the agent to reason jointly about where to act, what to prioritize, and how to adapt past heuristics to the current context. 4 Implementation Experimental Setup. We deploy and evaluate our system on two commercial smartphones, an Honor V20 (Android 9) and a Huawei Mate 40 Pro (Android 12). Each app is ex- plored for푅=5 independent runs with different random seeds, capped at푇 max =300 s and푁 max =60 steps per app. A 5s interval between events allows ads to fully load, which is independent of MANA’s reasoning time and can be reduced to 1-2 s in practice. For fairness, all baselines are re-executed under identical budgets and device condi- tions. We encode hierarchical fingerprints of each screen using OpenAI’stext-embedding-ada-002[36] to measure structural similarity across screens. The backbone model is GPT-4o mini [20], with additional comparisons to LLaMA4- Scout [34] and Qwen2.5-7B [2] under identical API settings. MANA obtains runtime information via the Android Ac- cessibility Service. For hierarchy-based apps, VLMs enrich se- mantic understanding only when widget metadata is missing. For canvas-rendered apps, MANA employs a hybrid vision detector: a fine-tuned YOLOv11 model (trained on the Game GUI dataset [51]) identifies UI widget boundaries, which are combined with results from traditional edge-based con- tour analysis to reconstruct fine-grained component bound- aries. VLMs are then applied to semantically enrich these detected components. Ultimately, both app types yield a uni- fied representation of the currently interactable components, which serves as input for subsequent LLM reasoning. The YOLO fine-tuning step is performed once offline on a server equipped with an NVIDIA RTX 4090 GPU. At runtime, all experiments are executed directly on mobile devices, relying only on lightweight API calls. These calls cover UI explo- ration, perception, and multimodal reasoning. This design ensures that MANA remains both practical for deployment on commodity devices and fairly comparable to baselines under identical evaluation conditions. Dataset. We evaluate MANA on two datasets: ADGPE [31]: This dataset contains 100 Android apps with 139 ads and is relatively recent. However, it has several limitations: many older apps no longer function correctly; it includes clusters of highly similar apps (e.g., dictionary apps that differ only in language but share nearly identical APK structures); and it contains very few canvas-based apps, making it less suitable for evaluating our model’s handling of such interfaces. MAN- AZoo: We curate a new dataset from AndroZoo [3] based on criteria ensuring both diversity and relevance: (i) apps released after 2020 to reflect current advertising practices; (i) confirmed presence of ad libraries, indicating a likelihood of containing ads; (i) availability on Google Play as a proxy for app quality; and (iv) a download range between 10,000 and 100 million to capture apps of varying popularity. Using metadata retrieved via the AndroZoo API and subsequent filtering, we collect 100 apps with 119 ads, which we denote as MANAZoo, including 27 canvas-rendered apps. Baselines. We compare MANA with four representative dynamic exploration baselines. •Monkey [15]. A system-level tool that generates random events for basic UI exploration and stress testing. •DroidBot [27]. A general-purpose testing tool that aug- ments random exploration with a lightweight runtime state model for more structured navigation. In our evalua- tion, we employ it with a breadth-first strategy. •MadDroid [29]. An ad-oriented exploration tool that priori- tizes UI components likely to display ads, such asWebView, ImageView, and ViewFlipper. •DARPA [9]. A vision based method that identifies trap UI components from application screenshots using an object detection model. As DARPA does not support UI explo- ration, we directly collect ad containing pages and perform component detection on their screenshots. •ADGPE [31]. A state-of-the-art mobile ad detection frame- work that identifies candidate ad widgets using a keyword- driven strategy, prioritizing UI elements whose attributes (e.g., text, resource-id, class) contain ad-related terms (e.g., “Install Now”, “Learn More”). We compare only against its first-stage ad-navigating UI exploration, as its subse- quent graph-learning module targets cross-app malware detection and is out of our scope. Metrics. We employ two complementary metrics. (1) Detec- tion Rate quantifies effectiveness as the number of distinct ads discovered within a fixed exploration window, with re- peated refreshes of the same component counted only once. (2) Average Steps quantifies efficiency as the mean number of interactions required to trigger an ad, where fewer steps indicate more direct navigation to ad components. 5 Evaluation 5.1 Overall Performance We evaluate MANA against the baselines on both the ADGPE and MANAZoo datasets. Figure 11 shows a representative case in MANAZoo where MANA uncovers a highly con- cealed ad. Instead of an obvious banner or popup, the ad is hidden behind the “Scan” entry of a QR code tool (a), leading 9 (a)(b)(c) Figure 11: Representative success case of MANA. through a camera interface (b) before redirecting to an ex- ternal app store page (c). Such multi-step obfuscation easily defeats heuristic exploration, but MANA efficiently pinpoints the trigger by combining heterogeneous signals, reasoning both “where to go” and “how to go”. In addition, Figure 12(a) shows that MANA consistently outperforms the baselines in coverage, achieving detection rates of 77.0% on ADGPE and 72.1% on MANAZoo, which represent 30.5%–56.3% relative improvements and set a new state-of-the-art. These gains can be better understood through a breakdown by ad category, as defined in Sec. 2.1 (Fig- ure 13(a)–13(b)), which highlights the sources of improve- ment. Popup ads are typically easier to detect because of their intrusive interaction patterns, which allows even sim- ple baseline methods to achieve relatively strong detection performance; however, in MANAZoo many are embedded within functional buttons, which makes them substantially harder to capture. Notably, ADGPE underperforms in this category because its keyword-driven heuristics fail to cap- ture popups lacking explicit textual cues, whereas MANA attains higher detection rates by leveraging complementary multimodal reasoning. For Embedded and Custom ads, ADGPE outperforms other baseline methods, yet still falls substantially short of MANA. We further observe that while baseline detection rates are of- ten limited to 20%–40%, MANA consistently attains 70%–80%, demonstrating robustness to obfuscation and non-standard implementations. This contrast is particularly evident when compared with heuristic exploration methods such as Droid- Bot and MadDroid. DroidBot explores apps using UI-state modeling with rule-based event generation, whereas Mad- Droid augments this approach with ad-specific media UI con- tainer heuristics. These strategies are adequate for obvious cases but break down when ads are obfuscated or rendered through custom components. DARPA represents a vision based approach that detects specific UI components from screenshots. While it performs relatively well on Popup ads, it exhibits clear limitations on other ad categories, partic- ularly Custom ads, as such carefully crafted ads often lack explicit visual cues. In contrast, MANA adopts an agentic multimodal reasoning paradigm that infers advertising in- tent from heterogeneous signals, thereby maintaining high detection performance even under obfuscation and evolving implementations. System Efficiency. Figure 12(b) demonstrates that MANA markedly reduces redundant UI exploration, requiring sub- stantially fewer steps for ad detection. Average steps are not applicable to DARPA, as it lacks navigation capability and an- alyzes only the current screenshot. Compared with random baselines (Monkey and DroidBot), it shortens trajectories by 29.8%–63.3%, and against heuristic baselines (MadDroid and ADGPE) by 29.7%–53.8%, while simultaneously achieving higher detection rates. The average step count converges to 2.4, approaching the practical lower bound. The average LLM reasoning latency is∼2.96s per step, resulting in fewer interactions under a fixed time budget, yet higher detection rates, indicating more effective per-step decisions. These results indicate that efficiency gains arise from the agent’s ability to infer “where to go”, yielding a improvement of higher detection accuracy and lower exploration costs. From a deployment perspective, fewer steps also translate into reduced computational overhead, energy consumption, and latency, underscoring the practicality of MANA. 5.2 Ablation Study We further evaluate the role of heterogeneous signals by ablating static profiling, contextual reasoning, and memory (Figure 14). Without these signals, performance degrades substantially, with detection rates dropping to∼50% and average steps rising to nearly 3, underscoring their impor- tance in avoiding blind exploration. Removing static profiling markedly increases steps, reflecting that in MANA, static analysis primarily serves as a cold start prior that acceler- ates early exploration and prunes redundant paths rather than acting as a strict dependency, since the system remains effective through multimodal inference even when static cues are unavailable or obfuscated. In contrast, eliminating contextual signal leads to detection rates dropping below 60%, highlighting the necessity of this heterogeneous cue for inferring implicit ad semantics. Memory improves both detection and efficiency by retaining cross-app knowledge of effective and ineffective trajectories, thereby enhancing ro- bustness under obfuscation. In its full configuration, MANA achieves the highest detection rate (>75%) and the fewest steps, approaching the practical lower bound. 10 Monkey MadDroid Droidbot DARPA ADGPE MANA 20 40 60 80 Detection Rate (%) ADGPEMANAZoo (a) Detection Rate Monkey MadDroid Droidbot DARPA ADGPE MANA 0 2 4 6 Average Steps N/A ADGPEMANAZoo (b) Average Steps Figure 12: Overall detection performance. Monkey MadDroid Droidbot DARPA ADGPE MANA 20 40 60 80 Detection Rate (%) EmbeddedPopupCustom (a) ADGPE Monkey MadDroid Droidbot DARPA ADGPE MANA 20 40 60 80 Detection Rate (%) EmbeddedPopupCustom (b) MANAZoo Figure 13: Category-wise detection performance. 2.0 2.5 3.0 Average Steps w/o All w/o Static w/o Context w/o Memory MANA 0 25 50 75 100 Detection Rate (%) Detection RateSteps (a) ADGPE 2.0 2.5 3.0 Average Steps w/o All w/o Static w/o Context w/o Memory MANA 40 50 60 70 80 Detection Rate (%) Detection RateSteps (b) MANAZoo Figure 14: Overall ablation results. w/o All w/o Static w/o Context w/o Memory MANA 0 25 50 75 100 Detection Rate (%) EmbeddedPopupCustom (a) ADGPE w/o All w/o Static w/o Context w/o Memory MANA 40 60 80 Detection Rate (%) EmbeddedPopupCustom (b) MANAZoo Figure 15: Ablation impact across ad categories. Figure 15 reports category-wise results and shows that heterogeneous signals contribute differently across ad types. Popup ads are relatively easy, but static signals still improve reliability by reducing spurious interactions. Embedded and Custom ads degrade sharply without contextual signals, in- dicating their importance for reasoning under weak or obfus- cated cues. Memory is most helpful for Custom ads, where non-standard implementations benefit from accumulated experience. With all signals enabled, MANA achieves the best accuracy across categories (≈85% Popup,≈80% Em- bedded,≈75% Custom), confirming complementary roles of static profiling, contextual reasoning, and memory for accuracy–efficiency trade-offs. Impact of Visual Cues. As shown in Figure 16, adding the VLM significantly improves detection, especially for Embed- ded and Custom ads where explicit textual cues are limited and keyword/structure-based exploration falls short. By map- ping subtle visual elements (e.g., icons, banners) to semantic meaning, the VLM boosts performance by 21.1%–67.2% in these categories, while gains for Popup ads are marginal given their already explicit interaction patterns. In contrast, the impact on efficiency is less pronounced: the average steps in the VLM-enabled setting is slightly increased. This out- come is due to the VLM’s capacity to identify and explore extra interaction paths associated with visually subtle ads, which are otherwise overlooked. Therefore, the VLM mainly expands semantic coverage rather than shortening naviga- tion paths. Overall, these results confirm that visual clues are indispensable for capturing heterogeneous ad seman- tics, though its contribution lies primarily in robustness of detection rather than step-wise efficiency. 5.3 Comparison across Reasoning Models We evaluate MANA with three base models: GPT-4o-mini (8B), Llama-4 (17B), and Qwen-2.5 (7B). Figure 17 shows per- formance tracks reasoning ability more than model size. GPT- 4o-mini performs best (74.3% detection, 2.5 steps), Llama-4 is moderate (67.3%, 2.5 steps), and Qwen-2.5 is lowest (60.4%, 2.9 steps). Notably, GPT-4o-mini and Qwen-2.5 are similar in size, yet GPT-4o-mini is more accurate and efficient, rein- forcing that cross-modal reasoning, not parameter count, is key for robust ad detection. Figure 18 decomposes token consumption into text-prompt, UI-element, and screenshot tokens. UI element tokens rep- resent widget screenshots without metadata in hierarchy- based apps, whereas screenshot tokens represent full screen captures in canvas-rendered apps. Screenshot tokens domi- nate the overall budget, often one to two orders of magnitude larger than the other components, making them the primary cost driver. While text and UI tokens remain relatively sta- ble across models, the variance in screenshot tokens aligns closely with performance, reflecting the importance of visual grounding. Our design reduces unnecessary image invoca- tions by leveraging static profiling, metadata, and memory first, invoking screenshots only when necessary. This adap- tive routing lowers the cost of vision-unrelated queries by 56.8%–68.4% in token usage compared with a VLM-first strat- egy, while maintaining or even improving coverage, thereby offering a more cost-efficient solution. Furthermore, MANA’s performance is influenced by both the LLM and VLM. Qwen-2.5 and Llama-4 both use relatively low default image processing resolution, resulting in fewer screenshot and UI element tokens, as shown in Figure 18. 11 1 2 3 Average Steps Embedded Popup Custom Total Steps 0 40 80 Detection Rate (%) with VLMw/o VLM Figure 16: Impact of visual cues. GPT4o-mini Llama 4 Qwen 2.5 40 60 80 Detection Rate (%) Detection Rate Steps 2 3 4 Average Steps Figure 17: Models. GPT4o-mini Llama 4 Qwen 2.5 10 3 10 4 Average Tokens Text Prompt Screenshot UI Element Figure 18: Tokens cost. 1 2 3 Average Steps Embedded Popup Custom Total Steps 0 25 50 75 100 Detection Rate (%) Honor V20Mate 40 Pro Figure 19: Phone comparison. (a)Custom ads in app.(b)Redirected website. (c)Browser warning. 2/98 security vendors flagged this URL as malicious. (d)VirusTotalresult. Figure 20: Automatic detection and analysis of mali- cious advertising by MANA. (a) A custom in-app ad is detected. (b) The interaction triggers a redirection to a suspicious website. (c) The system captures the ensuing browser warning, and (d) submits the URL to VirusTotal, which confirms it as malicious. However, Llama-4, being a larger 17B model with stronger reasoning ability, achieves better detection performance than Qwen-2.5, as reflected in Figure 17. This illustrates a prac- tical trade-off between default processing resolution, token consumption, and reasoning capability. 5.4 Comparison across Smartphones Figure 19 compares Honor V20 and Mate 40 Pro. MANA maintains consistently high detection on both, with only minor category-wise differences. Mate 40 Pro is slightly more accurate on Embedded and Custom ads (≈2–3%), likely due to more stable rendering and screenshot processing, while Popup accuracy is essentially identical across devices. Average exploration steps are also similar (≈2.5), suggesting MANA is largely hardware-agnostic and remains reliable even on resource-constrained phones. 5.5 Case Studies We present a set of case studies to illustrate the practical behaviors captured by MANA. 5.5.1 Malicious ad regulation. This case shows MANA’s ability to go beyond conventional ad detection and support #4 #1 (d)LLM reasoning output. (a)(b) "reasoning": "Choosing element 4, as the text 'Edit' suggests a potential for mediamanipulation, which often requires permissions such as camera or storage access." (a)(b)(c) (b)(c) "reasoning": "Choosing element 1, as the text 'Allow' suggests a high- confidence permission trigger that may lead to requesting access." Figure 21: Case study on permission abuse. malicious advertising oversight. Starting from an in-app cus- tom ad (Figure 20 (a)), MANA traces the user-triggered redi- rection to an external website (Figure 20 (b)), automatically captures subsequent browser warnings (Figure 20 (c)), and verifies the target URL using security services such as Virus- Total (Figure 20 (d)). This end-to-end capability highlights two key regulatory values: first, the ability to uncover decep- tive ad flows that cross the app–web boundary and escape static analysis; second, the capacity to automatically link ad-triggering interactions to concrete evidence of security risks, such as phishing or malware distribution. By bridg- ing detection with forensic validation, MANA provides a practical foundation for auditing compliance with platform policies and industry standards, thereby extending its utility from ad transparency to mobile ecosystem security. 5.5.2 Extending where-oriented reasoning to permission abuse. Figure 21 presents a case of UI-to-permission escalation. The app first displays a benign interface (Figure 21(a)), where the Edit button seems harmless. Once selected, however, the workflow quickly escalates: a permission grant dialog (Fig- ure 21(b)) is followed by a system-level request for access to local photos and media (Figure 21(c)). MANA’s reasoning (Figure 21(d)) highlights the analysis process. It interprets Edit not as a random click, but as a semantic cue likely linked to sensitive resources (e.g., storage or camera). This infer- ence guides exploration “toward” the path where escalation may occur. When the Allow option appears, the system cor- rectly recognizes it as a privilege-escalation trigger, thereby 12 (a)A screen with ads.(b)Averification screen. #10 Figure 22: Representative failure case of MANA. reconstructing the hidden chain from benign entry to sensi- tive permission abuse. This case demonstrates that MANA’s where-oriented reasoning generalizes beyond advertising: by inferring UI paths likely to expose sensitive operations, it can also uncover evasive behaviors such as permission misuse. 5.5.3 When multimodal reasoning fails? As shown in Fig- ure 22, after clicking an ad button, the app jumps to a parental verification screen that requires solving a math puzzle. Un- like typical ad-related interfaces, this screen provides no visual or textual ad cues. The VLM extracts literal elements (e.g., “15” and “21”), while the LLM often fails to infer that the puzzle must be solved to proceed. Thus, the agent tends to backtrack instead of progressing. This is not a corner case: ad triggers can be placed behind puzzles, age checks, or multi-step verification flows. Handling such cases requires hybrid reasoning that infers the hidden task requirement and tracks the goal across steps. More broadly, this points to future work: moving from locating “where ads might be” to identifying “what reasoning steps are needed” to reveal them. 6 Related Work Detecting Mobile Ads on Android. Research on mo- bile ad detection has evolved from static analysis, which inspects manifests, layouts, or bytecode to flag advertis- ing SDKs [10,13,24,25,28,46,47,49], to dynamic explo- ration that uncovers ads at runtime through automated UI navigation. Static systems such as Gator [49], Frontmat- ter [21], and IconIntent [46] link callbacks to UI widgets, while later work (StoryDroid [10], Promal [28]) builds tran- sition graphs to model inter-/component interactions. Dy- namic tools range from general-/purpose explorers (e.g., Monkey [15], DroidBot [27]) to ad-specific strategies, in- cluding breadth-first exploration with HTTP hooking [29], network-augmented analysis [11], keyword/metadata pri- oritization [31], and computer-/vision–based detection [9]. Overall, these approaches often rely on single-source cues and coarse navigation, making sparse, concealed, or visually ambiguous ads hard to uncover. LLM/VLM-based Mobile GUI Agent. Recently, numer- ous LLM/VLM-based mobile agents have been proposed [18, 30,38,43,45,50,52,54]. Some focus on prompt-centric de- sign, improving task execution via structured prompting and memory (e.g., AutoDroid [45], MobileGPT [23]). Others adopt perception-enhanced strategies, leveraging grounding mod- els to parse complex UIs (e.g., UGround [18], Aria-UI [50], UITARS [38], OmniParser [43], Ferret-UI [52]). While these systems show the promise of LLMs/VLMs for GUI automa- tion, they largely target explicit task completion with dense, well-defined rewards. By contrast, mobile ad detection in- volves concealed objectives, limited observability, and sparse triggers. Our work instead targets ad-relevant states, facilitat- ing discovery of hidden advertising behaviors and expanding agentic UI reasoning. 7 Discussion Scalability and deployment. MANA leverages the general reasoning capabilities of LLMs and VLMs to achieve more effective ad detection, while incurring additional computa- tion and latency. To mitigate this overhead, MANA adopts selective VLM invocation and is instantiated with relatively compact models such as GPT-4o-mini, which opens up oppor- tunities for future on device deployment to enhance privacy or for adopting more lightweight models to balance detec- tion performance and latency in practical settings. For large scale analysis, mobile SoC clusters can be employed to enable parallel execution and improve throughput. Robustness under practical constraints. MANA operates under practical constraints shared by current LLM based systems. In scenarios involving CAPTCHAs or other human verification mechanisms, automated interaction may be im- peded. Addressing such cases represents a broader challenge for LLM driven task automation, where systems must reason and act under explicitly restricted interaction channels. Ex- ploring more robust strategies for handling these constraints remains an important direction for future research. 8 Conclusion In this paper, we present MANA, an agentic multimodal framework that unifies static, visual, temporal, and experien- tial signals to enable robust ad detection in modern mobile apps. Experiments show that it outperforms existing ap- proaches in both coverage and efficiency, while generalizing across apps through reusable trajectories. Beyond mobile advertising, our design points to a broader paradigm of mul- timodal reasoning–guided UI navigation for securing and testing mobile ecosystems, highlighting its potential as a versatile foundation for future research. 13 9 Acknowledgment This research was supported in part by the National Natural Science Foundation of China under Grant No. 62432004, and by a grant from the Guoqiang Institute, Tsinghua University. References [1]Md Ahasanuzzaman, Safwat Hassan, and Ahmed E. Hassan. 2022. Studying Ad Library Integration Strategies of Top Free-to-Download Apps. IEEE Transactions on Software Engineering 48, 1 (2022), 209–224. https://doi.org/10.1109/TSE.2020.2983399 [2] Alibaba Cloud / Qwen Team. 2025. Qwen2.5-7B Model (Qwen2.5 Series). https://huggingface.co/Qwen/Qwen2.5-7B. Accessed: 2025- 09-03. [3]Kevin Allix, Tegawendé F Bissyandé, Jacques Klein, and Yves Le Traon. 2016. Androzoo: Collecting millions of android apps for the research community. In Proceedings of the 13th international conference on min- ing software repositories. 468–471. [4]Athanasios Andreou, Márcio Silva, Fabrício Benevenuto, Oana Goga, Patrick Loiseau, and Alan Mislove. 2019. Measuring the Facebook advertising ecosystem. In NDSS 2019-Proceedings of the Network and Distributed System Security Symposium. 1–15. [5]Athanasios Andreou, Giridhari Venkatadri, Oana Goga, Krishna P Gummadi, Patrick Loiseau, and Alan Mislove. 2018. Investigating ad transparency mechanisms in social media: A case study of Facebook’s explanations. In NDSS 2018-Network and distributed system security symposium. 1–15. [6]AppLovin Corporation. [n. d.]. AppLovin — Mobile Ad Platform. Offi- cial website. https://w.applovin.com/ Accessed: March 24, 2026. [7]Tanzirul Azim and Iulian Neamtiu. 2013. Targeted and depth-first exploration for systematic testing of android apps. In Proceedings of the 2013 ACM SIGPLAN international conference on Object oriented programming systems languages & applications. 641–660. [8]Rati Bhan, Rajendra Pamula, K Susheel Kumar, Nand Kumar Jyotish, Prasun Chandra Tripathi, Parvez Faruki, and Jyoti Gajrani. 2025. DL- CDroid an android apps analysis framework to analyse the dynamically loaded code. Scientific Reports 15, 1 (2025), 3292. [9] Zhaoxin Cai, Yuhong Nan, Xueqiang Wang, Mengyi Long, Qihua Ou, Min Yang, and Zibin Zheng. 2023. DARPA: combating asymmetric dark UI patterns on android with run-time view decorator. In 2023 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 480–493. [10] Sen Chen, Lingling Fan, Chunyang Chen, Ting Su, Wenhe Li, Yang Liu, and Lihua Xu. 2019. Storydroid: Automated generation of storyboard for android apps. In 2019 IEEE/ACM 41st international conference on software engineering (ICSE). IEEE, 596–607. [11]Feng Dong, Haoyu Wang, Li Li, Yao Guo, Tegawendé F Bissyandé, Tianming Liu, Guoai Xu, and Jacques Klein. 2018. Frauddroid: Auto- mated ad fraud detection for android apps. In Proceedings of the 2018 26th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering. 257–268. [12]Shuaike Dong, Menghao Li, Wenrui Diao, Xiangyu Liu, Jian Liu, Zhou Li, Fenghao Xu, Kai Chen, Xiaofeng Wang, and Kehuan Zhang. 2018. Understanding android obfuscation techniques: A large-scale investi- gation in the wild. In International conference on security and privacy in communication systems. Springer, 172–192. [13] Stephen Feldman, Dillon Stadther, and Bing Wang. 2014. Manilyzer: automated android malware detection through manifest analysis. In 2014 IEEE 11th International Conference on Mobile Ad Hoc and Sensor Systems. IEEE, 767–772. [14]Fortune Business Insights. 2024. Mobile Advertising Market Size, Share, Trends. https://w.fortunebusinessinsights.com/mobile-advertising- market-102496. [15] Google. 2023. UI Application Exerciser Monkey. https://developer. android.com/studio/test/other-testing-tools/monkey. [Online]. [16]Google. 2025. AdMob by Google. https://admob.google.com/home/. Accessed: 2025-08-13. [17]Google. n.d..AccessibilityService API Reference.https: //developer.android.com/reference/android/accessibilityservice/ AccessibilityService. [18]Boyu Gou, Ruohan Wang, Boyuan Zheng, Yanan Xie, Cheng Chang, Yiheng Shu, Huan Sun, and Yu Su. 2025. Navigating the Digital World as Humans Do: Universal Visual Grounding for GUI Agents. In The Thirteenth International Conference on Learning Representations. https: //openreview.net/forum?id=kxnoqaisCT [19]Alaa Hanbazazh and Carlton Reeve. 2021. Pop-up Ads and Behaviour Patterns: A Quantitative Analysis Involving Perception of Saudi Users. International Journal of Marketing Studies 13, 4 (2021), 31. [20] Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al.2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276 (2024). [21]Konstantin Kuznetsov, Chen Fu, Song Gao, David N Jansen, Lijun Zhang, and Andreas Zeller. 2021. Frontmatter: mining android user interfaces at scale. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foun- dations of Software Engineering. 1580–1584. [22] Duling Lai and Julia Rubin. 2019. Goal-driven exploration for an- droid applications. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 115–127. [23]Sunjae Lee, Junyoung Choi, Jungjae Lee, Munim Hasan Wasi, Hojun Choi, Steve Ko, Sangeun Oh, and Insik Shin. 2024. Mobilegpt: Aug- menting llm with human-like app memory for mobile task automation. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. 1119–1133. [24]Sungho Lee, Julian Dolby, and Sukyoung Ryu. 2016. HybriDroid: static analysis framework for Android hybrid applications. In Proceedings of the 31st IEEE/ACM international conference on automated software engineering. 250–261. [25]Sungho Lee and Sukyoung Ryu. 2019. Adlib: Analyzer for mobile ad platform libraries. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis. 262–272. [26] Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Peiyuan Zhang, Yanwei Li, Ziwei Liu, et al.2024. Llava- onevision: Easy visual task transfer. arXiv preprint arXiv:2408.03326 (2024). [27] Yuanchun Li, Ziyue Yang, Yao Guo, and Xiangqun Chen. 2017. Droid- bot: a lightweight ui-guided test input generator for android. In 2017 IEEE/ACM 39th international conference on software engineering com- panion (ICSE-C). IEEE, 23–26. [28]Changlin Liu, Hanlin Wang, Tianming Liu, Diandian Gu, Yun Ma, Haoyu Wang, and Xusheng Xiao. 2022. ProMal: precise window transi- tion graphs for android via synergy of program analysis and machine learning. In Proceedings of the 44th International Conference on Software Engineering. 1755–1767. [29]Tianming Liu, Haoyu Wang, Li Li, Xiapu Luo, Feng Dong, Yao Guo, Liu Wang, Tegawendé Bissyandé, and Jacques Klein. 2020. Maddroid: Characterizing and detecting devious ad contents for android apps. In Proceedings of The Web Conference 2020. 1715–1726. [30]Zhe Liu, Chunyang Chen, Junjie Wang, Mengzhuo Chen, Boyu Wu, Xing Che, Dandan Wang, and Qing Wang. 2024. Make llm a test- ing expert: Bringing human-like interaction to mobile gui testing via 14 functionality-aware decisions. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. 1–13. [31]Shang Ma, Chaoran Chen, Shao Yang, Shifu Hou, Toby Jia-Jun Li, Xusheng Xiao, Tao Xie, and Yanfang Ye. 2025. Careful about what app promotion ads recommend! detecting and explaining malware promotion via app promotion graph. In The Network and Distributed System Security (NDSS). [32]Ke Mao, Mark Harman, and Yue Jia. 2016. Sapienz: Multi-objective automated testing for android applications. In Proceedings of the 25th international symposium on software testing and analysis. 94–105. [33]Arunesh Mathur, Gunes Acar, Michael J Friedman, Eli Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan. 2019. Dark patterns at scale: Findings from a crawl of 11K shopping websites. Pro- ceedings of the ACM on human-computer interaction 3, CSCW (2019), 1–32. [34]Meta AI. 2024. Introducing LLaMA 4: Advancing Multimodal Intel- ligence. https://ai.meta.com/blog/llama-4-multimodal-intelligence/. Accessed: 2025-09-03. [35]Meta Platforms, Inc. [n. d.]. Audience Network. Facebook page. https: //w.facebook.com/audiencenetwork/ Accessed: March 24, 2026. [36] OpenAI. 2022. OpenAI text-embedding-ada-002 model. https:// platform.openai.com/docs/models/text-embedding-ada-002. Accessed: 2025-09-03. [37]OpenAI. 2023. GPT-4V (ision) System Card. https://openai.com/index/ gpt-4v-system-card/ Accessed: 2025-08-23. [38] Yujia Qin, Yining Ye, Junjie Fang, Haoming Wang, Shihao Liang, Shizuo Tian, Junda Zhang, Jiahao Li, Yunxin Li, Shijue Huang, et al.2025. Ui- tars: Pioneering automated gui interaction with native agents. arXiv preprint arXiv:2501.12326 (2025). [39]Vaibhav Rastogi, Rui Shao, Yan Chen, Xiang Pan, Shihong Zou, and Ryan D Riley. 2016. Are these Ads Safe: Detecting Hidden Attacks through the Mobile App-Web Interfaces.. In NDSS. [40]Till Speicher, Muhammad Ali, Giridhari Venkatadri, Filipe Nunes Ribeiro, George Arvanitakis, Fabrício Benevenuto, Krishna P Gummadi, Patrick Loiseau, and Alan Mislove. 2018. Potential for discrimination in online targeted advertising. In Conference on fairness, accountability and transparency. PMLR, 5–19. [41]Karthika Subramani, Xingzi Yuan, Omid Setayeshfar, Phani Vadrevu, Kyu Hyung Lee, and Roberto Perdisci. 2020. When push comes to ads: Measuring the rise of (malicious) push advertising. In Proceedings of the ACM Internet Measurement Conference. 724–737. [42]Giridhari Venkatadri, Athanasios Andreou, Yabing Liu, Alan Mislove, Krishna P Gummadi, Patrick Loiseau, and Oana Goga. 2018. Privacy risks with Facebook’s PII-based targeting: Auditing a data broker’s advertising interface. In 2018 IEEE Symposium on Security and Privacy (SP). IEEE, 89–107. [43] Jianqiang Wan, Sibo Song, Wenwen Yu, Yuliang Liu, Wenqing Cheng, Fei Huang, Xiang Bai, Cong Yao, and Zhibo Yang. 2024. Omniparser: A unified framework for text spotting key information extraction and table recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 15641–15653. [44]Wenyu Wang, Wei Yang, Tianyin Xu, and Tao Xie. 2021. Vet: identi- fying and avoiding UI exploration tarpits. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 83–94. [45]Hao Wen, Yuanchun Li, Guohong Liu, Shanhui Zhao, Tao Yu, Toby Jia-Jun Li, Shiqi Jiang, Yunhao Liu, Yaqin Zhang, and Yunxin Liu. 2024. Autodroid: Llm-powered task automation in android. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. 543–557. [46]Xusheng Xiao, Xiaoyin Wang, Zhihao Cao, Hanlin Wang, and Peng Gao. 2019. Iconintent: automatic identification of sensitive ui widgets based on icon classification for android apps. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE). IEEE, 257–268. [47]Liu Xinyu, Jin Ze, Liu Jiaxi, Liu Wei, Wang Xiaoxi, and Liu Qixu. 2023. ANDetect: A third-party ad network libraries detection framework for android applications. In Proceedings of the 39th Annual Computer Security Applications Conference. 98–112. [48]Shengqian Yang, Haowei Wu, Hailong Zhang, Yan Wang, Chan- drasekar Swaminathan, Dacong Yan, and Atanas Rountev. 2018. Static window transition graphs for Android. Automated Software Engineer- ing 25, 4 (2018), 833–873. [49]Shengqian Yang, Dacong Yan, Haowei Wu, Yan Wang, and Atanas Rountev. 2015. Static control-flow analysis of user-driven callbacks in Android applications. In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, Vol. 1. IEEE, 89–99. [50]Yuhao Yang, Yue Wang, Dongxu Li, Ziyang Luo, Bei Chen, Chao Huang, and Junnan Li. 2024. Aria-UI: Visual Grounding for GUI Instructions. arXiv preprint arXiv:2412.16256 (2024). [51]Jiaming Ye, Ke Chen, Xiaofei Xie, Lei Ma, Ruochen Huang, Yingfeng Chen, Yinxing Xue, and Jianjun Zhao. 2021. An empirical study of GUI widget detection for industrial mobile games. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 1427–1437. [52]Keen You, Haotian Zhang, Eldon Schoop, Floris Weers, Amanda Swearngin, Jeffrey Nichols, Yinfei Yang, and Zhe Gan. 2024. Ferret-ui: Grounded mobile ui understanding with multimodal llms. In European Conference on Computer Vision. Springer, 240–255. [53] Wei Zha and H Denis Wu. 2014. The Impact of Online Disruptive Ads on Users’ Comprehension, Evaluation of Site Credibility, and Sentiment of Intrusiveness. American Communication Journal 16, 2 (2014). [54]Shanhui Zhao, Hao Wen, Wenjie Du, Cheng Liang, Yunxin Liu, Xi- aozhou Ye, Ye Ouyang, and Yuanchun Li. 2025. LLM-Explorer: Towards Efficient and Affordable LLM-based Exploration for Mobile Apps. In The 31st Annual International Conference on Mobile Computing and Networking (Mobicom’25). A Workflow Before initiating online navigation, we perform an offline profiling phase that consists of static analysis and dynamic probing. A.1 Offline Profiling: Static Analysis The static analysis pipeline constructs three types of priors: screen priors, slot priors, and trigger priors. Given an APK and its decompiled resources as input, we leverage Androguard and related toolchains to extract three types of ad-related priors. Specifically, (i) Screen prior: we parse the manifest to col- lect all registered Activities and extract declared permissions and metadata, which are matched against known ad library prefixes. parse manifest from decompiledRes, extract permissions and metadata if permissions/metadata matches config.sdk_prefixes: record as offlineResult.screen 15 (i) Slot prior: we traverse layout resource files and match View class names against a preconfigured set of ad SDK signatures to localize potential ad widgets. Using the com- piled resource mapping table, string identifiers are further resolved into unique hexadecimal resource IDs. iterate over each layoutFile in decompiledRes: parse XML tree as viewTree iterate over node in viewTree: if node.class matches config.sdk_prefixes: resolve resource ID using resource map, as id_hex record node.class, id_hex into offlineResult.slot (i) Trigger prior: we scan bytecode across all classes, and upon detecting ad SDK API invocations or listener callbacks, it recursively backtraces along the inheritance chain. Once a superclass matches a manifest-registered Activity, the corre- sponding code evidence is attributed to that Activity. This process transforms isolated code fragments into an Activity- centric contextual mapping. iterate over each class in apkFile: if class calls Ad APIs or implements Ad Listeners: extract method signatures as clues # Backtrace to find the owner Activity while currClass has superclass: if currClass is an Activity: associate clues with currClass in offlineResult.trigger break loop set currClass to currClass.super A.2 Offline Profiling: Dynamic Probing Following static analysis, we perform dynamic probing by executing the app with DroidBot to construct a coarse UTG and collect system logs. Each UI transition is recorded as a timestamped event sequence. run DroidBot on apkFile, record transition graph as UTG and system logs as sysLogs Next, we extract ad-related network traffic by filtering log entries using keyword matching and known ad domains, yielding a set of timestamped requests. To derive network prior, we temporally correlate UI events with network re- quests within a sliding windowΔ, and associate triggering events with nearby ad traffic. iterate over log in sysLogs: if log matches keywords or known ad domains: extract log.url and log.timestamp, add to adTraffic sort UTG.events and adTraffic by time iterate over event in UTG.events: find traffic in adTraffic where time difference <Δ if traffic exists: link event to traffic in networkPrior Finally, we merge these network-level priors with the static priors to produce a unified offline knowledge base, which serves as structured guidance for subsequent online naviga- tion. A.3 Multi-Source Prompt Construction Based on the integrated offline knowledge, we further con- struct a multi-source structured prompt to guide per-step decision making. At each state, the prompt aggregates four complementary information sources: (i) current screen options, which enumerate all actionable views with textual or visual descriptions; iterate over view in views: combine view.text, view.desc, view.vlm_desc add to prompt.screen (i) offline priors, injecting activity-level, component-level, and method-level ad evidence derived from offline profiling; if currentState.activity in priors.ad_activities: add "Activity Listed as ad-related" to prompt.offline if any view in views matches priors.ad_components: add "view is a potential Ad View" to prompt.offline if currentState.activity in priors.methods_by_activity: get methods m from priors.methods_by_activity add "m are identified as Ad Methods" to prompt. offline (i) strategic context, capturing the local UTG neighbor- hood and recent interaction history to avoid redundant ex- ploration; get neighborhood nodes of currentState from UTG within 2 hops as localNeighbors iterate over node in localNeighbors: add node.id, node.visits, node.score to prompt. context get recent k steps from history as recentPath add recentPath to prompt.context and (iv) past experiences, retrieved from an experience database to reuse previously successful behaviors. retrieve relevant experiences from experienceDB similar to currentState as rel_exp iterate over exp_item in rel_exp: add exp_item to exp These elements are concatenated into a unified, structured prompt, providing the LLM with a holistic and temporally grounded view of the current decision context. 16 A.4 LLM-driven UI navigation Building upon the structured prompt, we employ an LLM- driven UI navigation policy to actively trigger ad-related be- haviors. At each step, the agent observes the current de- vice state and first checks a success condition, where reach- ing a known ad-related Activity terminates the episode and records the corresponding trigger path. The discovered path is summarized into a reusable heuristic and stored in an experience database to guide future exploration. set step to 0 initialize currentTrajectory as empty while step < maxSteps: get device state as state # 1. Check Success if state.activity matches offlinePriors. success_activities: summarize currentTrajectory as heuristic save heuristic to experienceDB restart app continue loop If the app enters an abnormal state, a lightweight recovery procedure is applied to ensure robustness. while step < maxSteps: # 1. ... 2. Recovery Mechanism if app is crashed or in background: perform "Back" or "Restart" continue loop The agent then extracts all actionable UI elements, optionally enriching them with visual descriptions via a VLM. while step < maxSteps: # 1,2. ... 3. Perception if app is hierarchy-apps: get views from Accessibility Service as views else if app is canvas-apps: capture screenshot run vision detector to segment views regions run VLM to annotate views Conditioned on the multi-source prompt constructed in Section A.3, the LLM selects the next action and estimates its ad relevance. while step < maxSteps: # 1,2,3. ... # 4. Reasoning and Action execute function "ConstructPrompt" with state, views , offlinePriors... get result as prompt query LLM with prompt, get actionIdx and adScore execute action on device Finally, the UTG and interaction history are updated, and the selected action is executed, enabling iterative, experience- aware navigation until the step budget is exhausted. while step < maxSteps: # 1,2,3,4. ... # 5. Update State update history with state, action if node, edge not in UTG: update node, edge in UTG update node score in UTG with adScore increment step B Examples B.1 Hierarchy-based apps w/o VLM 1 (a) Ad trigger path. 2 (b) Offline priors example. Figure 23: An example of a hierarchy-based app. We first present a simple example of a hierarchy-based app that does not require VLM assistance. Figure 23(a) illustrates the ad-triggering workflow in this app: MANA first clicks (1) the navigation bar icon to open the side drawer, and then clicks (2) Other Apps, which redirects to the Google Play Store, which is a classic ad-triggering path. Figure 23(b) shows a JSON example of the offline profiling results. The detailed online navigation workflow of MANA in this case is described as follows: At the entry screen, MANA constructs the prompt as shown below. Specifically, MANA derives the current screen options from the view tree provided by the Android Accessibility Service, and builds the strategic context using the UTG and interaction history. Since this is the initial state, the interaction history only contains the app launch event. Finally, relevant past experiences are retrieved, where the first entry highlights navigation elements that exactly match the ad-triggering path in this example. For clarity, we present the first prompt with a relatively complete information structure, while subsequent prompt examples only include the most critical elements involved in decision making. [System prompt.] You are an agent designed to ... [Integrated prompt.] 1. Current Screen Options - View 0: Type='ImageButton', Text='Open navigation drawer' - View 1: Type='ListView', Res-ID='com.picolina.aymane. serhani:id/list1' - View 2: Type='LinearLayout', Text='Music 1' 17 - ... - View 11: Type='LinearLayout', Text='Music 10' - View 12: Type='BackButton', Text='[BACK] Return to previous screen' 2. Static App Knowledge [Activity Match] Current activity'MainActivity' is listed as ad-related. [Activity Match] This activity contains potential ad trigger (s) in method(s): ['onCreate']. [Component Match] A component with resource_id'com.picolina .aymane.serhani:id/adView' is a known ad container. [General Info] App uses ad libraries: ['Google AdMob'] 3. Strategic Context (a) Annotated Local Map (from UTG, 2-hop neighborhood) Current State[4662c1] (visited: 1 times), ad_score: 0.05 **Reachable in 1-hop(s):** - State: [38961e], event:'KeyEvent(state=4662c1, name=BACK) ', ad_score: 0.10 (visited: 0 times) - State: [09aff5], event:'TouchEvent(state=4662c1, view=[ button alt='Open navigation drawer' bound_box =0,102,168,270][/button])', ad_score: 0.10 (visited: 0 times) - State: [b1a47a], event:'TouchEvent(state=4662c1, view =[0,270,1080,480-LinearLayout-])', ad_score: 0.10 ( visited: 0 times) - ... **Reachable in 2-hop(s):** - State: [5c7efb], event:'TouchEvent(state=79130a, view =[389,622,691,718-ImageButton-])', ad_score: 0.10 ( visited: 0 times) - State: [e3f97e], event:'KeyEvent(state=401904, name=BACK) ', ad_score: 0.10 (visited: 0 times) (b) Recent History - Step 1 [166c5c] -> [4662c1] RestartAppEvent() 4. Past Experiences - Interacting with music playback or navigation elements often triggers promotional ads in media apps. - Interacting with promotional banners or offers related to specific age groups or financial products often triggers advertisements. - Interacting with buttons or views that suggest accessing additional content or resources often triggers advertisement offers. Given this prompt, the LLM produces the following action selection and corresponding reasoning: "reasoning": "Choosing element 0, as the'Open navigation drawer' button may lead to additional content or promotional offers, which could include advertisements.", "ad_score": 0.05, "choice": 0" By clicking the navigation button, the app opens the side drawer and transitions to a state that contains ad-related buttons. At this point, we query the LLM again with the following prompt, where only the most salient information is shown for brevity. [System prompt.] You are an agent designed to ... [Integrated prompt.] 1. Current Screen Options - View 0: Type='LinearLayoutCompat', Text='N/A' - View 1: Type='CheckedTextView', Text='Other App' - View 2: Type='LinearLayoutCompat', Text='Rate' - ... 2. Static App Knowledge... 3. Strategic Context (a) Annotated Local Map (from UTG, 2-hop neighborhood) ... (b) Recent History - Step 1 [166c5c] -> [4662c1] RestartAppEvent() - Step 2 [4662c1] -> [09aff5] TouchEvent(state=4662c1, view =[button alt='Open ...ation drawer' bound_box =0,102,168,270][/button]) 4. Past Experiences - Interacting with buttons or views that suggest accessing additional content or resources often triggers advertisement offers. - ... The LLM decides to click the Other App button, which trig- gers an app-promotion transition. "reasoning": "Choosing element 1, as the text'Other App' suggests a potential for ad-related content or promotions, which aligns with the heuristics for identifying ad triggers.", "ad_score": 0.05, "choice": 1" After successfully triggering the ad, MANA prompts the LLM to summarize the interaction history and distill it into a corresponding experience. You are an expert Android app tester specializing in identifying ad-triggering patterns. Your task is to ... Step 1: Touched a'ImageButton' with text/desc:'Open navigation drawer'. Step 2: Touched a'CheckedTextView' with text/desc:'Other App'. In this case, the distilled experience is shown below, which is consistent with our intuition. Interacting with navigation options that lead to external app suggestions often triggers advertisement displays. B.2 Hierarchy-based apps with VLM This example illustrates a case where MANA leverages a VLM to enrich UI elements with semantic descriptions. Fig- ure 24 shows the detailed scenario. At the entry screen, there already exists an element (i.e., 1 ) that triggers an adver- tisement video. However, theseImageViewelements (i.e.,1 and 2 ) lack content descriptions in the view tree, making it difficult to distinguish among different image components. Therefore, MANA first employs a VLM to annotate cropped screenshots of UI elements with semantic labels. You are an expert mobile ad detector. Analyze this UI screenshot and label the element according to the following categories: [AD]: ..., [POTENTIAL_AD]: ..., [UI_ELEMENT]: ... 18 (a) Ad trigger path.(b) Offline priors example. 1 2 Figure 24: An example of a hierarchy-based app with VLM-annotated UI element. For theseImageViewelements, the VLM produces the fol- lowing semantic annotations. # For element #1: [AD] A button with a play icon likely for a video advertisement. # For element #2: [UI_ELEMENT] A decorative skull and candles, likely part of the app's theme. Based on these semantic annotations, we construct the fol- lowing query prompt for the LLM. [System prompt.] You are an agent designed to ... [Integrated prompt.] 1. Current Screen Options - View 0: Type='ViewPager', Text='More You have no works yet , go to color your paintings!' - View 1: Type='ViewPager', Text='N/A', Res-ID='None' - View 2: Type='RecyclerView', Text='N/A', Res-ID='None' - View 3: Type='ImageView', Text='[POTENTIAL_AD] A speech bubble with a storefront icon, possibly indicating a virtual store or in-app purchase option.' - ... - View 8: Type='ImageView', Text='[UI_ELEMENT] A decorative skull and candles, likely part of the app's theme.' - View 9: Type='ImageView', Text='[AD] A button with a play icon likely for a video advertisement.' - ... 2. Static App Knowledge... 3. Strategic Context (a) Annotated Local Map (from UTG, 2-hop neighborhood) ... (b) Recent History ... 4. Past Experiences... Based on the enriched semantic descriptions of UI elements, the LLM selects element1for interaction, which triggers an interstitial video advertisement. "reasoning": "Choosing element 9, as it is a clear ad indicator with a play icon, which is a high-confidence ad trigger.", "ad_score": 0.8, "choice": 9" B.3 Canvas-based apps 1 (a) Ad trigger path.(b) View tree example. Figure 25: An example of a canvas-based app. This example illustrates a canvas-rendered case. As shown in Figure 25(b), the view tree obtained via the Android Ac- cessibility Service contains only the bounding box of the entire canvas, without fine-grained semantic information for individual UI elements. MANA first applies a hybrid vision detector to identify coarse-grained UI component regions, as illustrated in Figure 25(a). Subsequently, a VLM is lever- aged to generate semantic annotations for each detected component. You are an expert Android UI analyst specializing in ad detection. Your task is to ... Your output MUST be a valid JSON array, where each object contains the'id' (the number from the box) and' description' (your analysis, with annotations if necessary) ... For Figure 25(a), the VLM provides the following annotation. ["id": 1, "description": "A blue Facebook icon indicating social media sharing.", ... "id": 8, "description": "[AD HINT] A large promotional image featuring a'FREE' surprise egg.", ... "id": 19, "description": "[AD HINT] A round button featuring a frog and the label'More Games'."]" Based on the above VLM annotation, we construct a corre- sponding current screen options prompt that incorporates semantic information. [System prompt.] You are an agent designed to ... [Integrated prompt.] 1. Current Screen Options - View 0, Text='A blue Facebook icon indicating social media sharing.' - ... - View 8, Text='[AD HINT] A large promotional image featuring a'FREE' surprise egg.' - ... 19 2. Static App Knowledge... 3. Strategic Context (a) Annotated Local Map (from UTG, 2-hop neighborhood) ... (b) Recent History ... 4. Past Experiences... Based on these key cues, MANA successfully selects the icon that triggers an advertisement. "reasoning": "Choosing element 7, as it features a large promotional image with the text'FREE', which is a high -confidence ad trigger indicating a potential advertisement opportunity.", "ad_score": 0.8, "choice": 7" C Mathematical Formalization and Coverage Analysis We formulate mobile ad detection as a sequential decision- making problem under partial observability, where an au- tonomous explorer interacts with a target application to uncover ad-related UI states. C.1 Environment and Interaction An Android application is modeled as an unknown UI tran- sition systemE= (S,A,T), whereSdenotes the set of latent UI states (activities or screens),Adenotes the set of executable UI actions (e.g., click, back), andT:S×A →S is the state transition function. A target ad trigger instance is a tuple훼= (푠,휏), where푠 ∈ Sis a latent state in which an ad is exposed,휏denotes the required interaction context required to trigger the ad. LetA ads denote the set of all such instances. Augmented State Representation (MANA). Standard baselines (e.g., DroidBot) typically rely on a restricted obser- vation space, such as the UI view hierarchy푀 푡 . In contrast, MANA operates on an Augmented Context푍 푡 , integrating heterogeneous signals to resolve ambiguity: 푍 푡 =Φ(푀 푡 ,푉 푡 ,Σ,퐻 푡 ,E 푚푒푚 )(3) where: • 푀 푡 : Structural metadata from Android Accessibility Service (widget hierarchy, text). • 푉 푡 : Optional visual features (e.g., screenshots processed by VLM) for canvas-rendered UIs. •Σ : Static analysis priors derived from offline profiling (Screen, Slot, and Trigger priors). • 퐻 푡 : The interaction history sequence, providing tem- poral grounding. • E 푚푒푚 : Retrieved cross-app experiences from the mem- ory bank. This enriched context is the primary input to the LLM-based policy 휋 MANA . C.2 Interaction History and UI Transition Graph Interaction History. MANA maintains a bounded interac- tion history 퐻 푡 =(표 푖 ,푎 푖 ) 푡−1 푖=푡−퐿 푡 . where퐾 푡 is a dynamic window size that adapts based on recent state diversity. Specifically, letU 푡 denote the set of unique UI states observed in the most recent퐾 base interac- tions. Then the adaptive window size is defined as 퐾 푡 = ( ⌈1.5· 퐾 base ⌉,if|U 푡 | ≤ 2, 퐾 base ,otherwise. The history buffer stores tuples of the form (표 푖 ,푎 푖 ,표 푖+1 ,푟 푖 ,휏 푖 ), where푟 푖 indicates whether an ad was observed during this transition, and휏 푖 denotes the timestamp. The interaction history퐻 푡 serves as the temporal grounding context, guiding MANA to avoid loops or repeated exploration of the same UI states. UI Transition Graph (UTG). MANA incrementally con- structs a UI Transition GraphG 푡 =(푉 푡 ,퐸 푡 ), where each node 푣 ∈ 푉 푡 corresponds to an UI state, and each directed edge (푣,푎,푣 ′ ) ∈ 퐸 푡 represents an observed transition triggered by action푎. Each node푣stores: (i) structural metadata (activity name, widget hierarchy), (i) semantic summaries inferred by the language model, and (i) an accumulated ad-relevance belief score 푆(푣). Upon observing a transition(표 푡 ,푎 푡 ,표 푡+1 ), the UTG is up- dated as: 푉 푡+1 =푉 푡 ∪푣 푡+1 , 퐸 푡+1 = 퐸 푡 ∪(푣 푡 ,푎 푡 ,푣 푡+1 ). Ad-Relevance Scoring. At each step, the language model estimates an instantaneous ad relevance ˆ 푠 푡 ∈ [0,1]based on (표 푡 ,퐻 푡 ,G 푡 ). The belief score of the current node is updated via an exponential moving average: 푆 푡 =(1− 훼)푆 푡−1 + 훼 ˆ 푠 푡 , where 훼 ∈ (0, 1) controls temporal smoothing. C.3 The Coverage Objective and the Challenge of Aliasing MANA’s goal is to maximize the discovery of distinct ad trigger instances within a finite interaction budget푇. We define the ad coverage of a policy 휋 as the set: C ad (휋,푇)=훼 ∈ A ads | 훼 is triggered by 휋 within푇. The objective is implicitly to maximize E[|C ad (휋,푇)|]. Standard baseline policies (e.g.,휋 base ) that rely solely on the structural metadata푀 푡 suffer from Structural Aliasing. 20 We define the Structural Equivalence Class for a latent state푠 as: [푠] struct =푠 ′ ∈S | 푀(푠 ′ )= 푀(푠). In content-rich apps, distinct latent states often share identi- cal UI structures (e.g., distinct pages in a dictionary sharing the same layout). A policy휋 base (푎 | 푀 푡 )cannot distinguish between them, leading to probabilistic loops: the agent may perpetually interact within the same equivalence class without progressing to deeper, unseen states or ad-triggering logic (e.g., cyclic navigation by repeatedly clicking the next word button in a dictionary app). This directly limits achiev- able coverage. C.4 MANA: Implicit Decision Criterion To reason about how MANA resolves aliasing and achieves broader coverage, we introduce an implicit decision criterion that analytically characterizes the preference underlying the LLM’s action selection. Concretely, we define 퐽(휋) E " 푇 ∑︁ 푡=0 ( 푅 sem (푍 푡 )− 휆· 푁(푣 푛푒푥푡 ) ) # ,(4) which serves as an analytical characterization of the trade-off guiding the LLM’s per-step decisions. Here, the criterion balances two complementary signals derived from the augmented context 푍 푡 : • Semantic Gain (푅 sem ): An estimated utility indicating whether an action is likely to lead to ad-related logic, inferred from textual and visual semantics in푍 푡 (e.g., prioritizing semantically meaningful navigation over repetitive interactions). •Exploration Penalty (푁): A penalty derived from visitation counts in the UI Transition Graph (UTG), discouraging redundant traversals of structurally iden- tical states. C.5 Theorem: Coverage Dominance Lemma C.1 (Loop Escape Implies Coverage Expansion). Escaping a structural loop that is absorbing under휋 푏푎푠푒 strictly increases the set of reachable latent states and ad triggers under a finite interaction budget. Proof.Since휋 푏푎푠푒 remains confined toS 푙표푝 with non- zero probability mass, any policy that exitsS 푙표푝 expands the reachable set.□ Theorem C.2 (Resolution of Structural Loops). Let C 푎푑 (휋)denote the set of ad trigger instances훼=(푠,휏,푐)cov- ered by policy휋within budget푇. Under the assumption that ad triggers are reachable via semantically distinguishable tran- sitions, MANA ensures broader coverage than structural base- lines: E[|C 푎푑 (휋 MANA )|]> E[|C 푎푑 (휋 푏푎푠푒 )|](5) Proof.Since each ad trigger requires reaching a specific latent state under a compatible interaction context, increased escape from structural loops strictly enlarges the reachable ad-trigger space. Consider a scenario where the agent is trapped in a structural loopS 푙표푝 ⊂ [푠] 푠푡푟푢푐푡 (e.g., infinite scrolling). 1. Baseline Stagnation: Since휋 푏푎푠푒 relies on invariant structure푀, the probability of selecting the exit action푎 푒푥푖푡 remains stationary and low. The agent performs a random walk within the equivalence class. 2. MANA Escape Mechanism: MANA utilizes푍 푡 to break the loop via two complementary mechanisms: •Semantic Un-aliasing: The LLM discerns semantic differences in푍 푡 even when푀is identical (e.g., "Home" vs. "Next"). It assigns a higher prior to the exit action: 푅 sem (푎 푒푥푖푡 )> 푅 sem (푎 푙표푝 ) , enabling an immediate se- mantic breakout. •Probabilistic Escape: If semantic cues are ambiguous, the visitation count푁(S 푙표푝 )increases monotonically. The penalty term−휆푁grows, progressively reducing the utility of the loop. Mathematically, there exists a time푡whereE[푅 푒푥푖푡 − 휆푁 푙표푤 ]> E[푅 푙표푝 − 휆푁 ℎ푖푔ℎ ], forcing a policy shift. Thus, MANA escapes local optima that trap baselines, ensur- ing a superset of state coverage. Notably, the escape mecha- nism does not rely on perfect semantic inference: even when 푅 sem is noisy, the monotonic growth of푁(·)ensures eventual exploration pressure.□ 21