Paper: 2608.06364 Authors: George Grispos, Sajda Qureshi Categories: cs.CY, cs.AI
The Gap
Digital sovereignty, as a research topic, has been almost entirely captured by states. The dominant literature is about the EU’s GAIA-X and data-localization law, about China’s data-export regime, about whether a government can run its ministries without depending on three American hyperscalers. The unit of analysis is a jurisdiction. The threat model is geopolitical dependence.
There’s a second, smaller literature on AI transparency, and it has a different weakness: it reads what platforms say. Privacy-policy corpus studies, disclosure-compliance checklists, GDPR Article 13/22 audits, and dark-pattern surveys all take the platform’s own text as the primary object. When researchers do measure behavior, it’s usually network-traffic studies of trackers — good at showing where data goes, silent on what models consume it.
Between these sits a hole. If a Lagos trader’s entire commercial life runs through Jumia, Konga, and Temu on a mid-range Android phone, her sovereignty is not being decided in Brussels. It is being decided by whether she has any idea that a ranking model, a credit-scoring model, and a fraud classifier are shaping what she sees and what she’s offered — and whether the app ever told her. Nobody had checked, in an underrepresented market, whether the AI inside the binary matches the AI described in the disclosure.
This paper does exactly that: it opens the APKs.
PROBLEM
[ AI shapes what Nigerian shoppers see; ]
[ nobody knows if users are told ]
|
v
ASSUMPTION
[ transparency is a usable proxy for ]
[ *individual* digital sovereignty: ]
[ no awareness == no control ]
|
+----------------------+
| |
v v
METHOD (technical) METHOD (contextual)
[ forensic analysis ] [ document analysis: ]
[ of Android apps: ] [ policies, T&C, ]
[ libraries, models,] [ national AI/socio- ]
[ endpoints, perms ] [ economic reports ]
| |
+----------+-----------+
v
EVIDENCE
[ AI present in nearly all apps ]
[ disclosure sparse / generic ]
[ rising platform dependence, ]
[ moderate AI awareness ]
|
v
CONCLUSION
[ individual sovereignty erodes quietly; ]
[ the gap is a measurable disclosure ]
[ deficit, not a vague anxiety ]
The Increment
One sentence: Before this paper, “users don’t understand the AI in their apps” was an assumption argued from policy text and surveys; after it, it is a claim backed by a side-by-side comparison of what the binary contains and what the disclosure admits, in a market the field usually ignores.
Core Mechanism
The method is a two-track audit joined by a comparison step. Track one is static forensic analysis of Android packages. You pull the APK for each selected shopping app, unpack it, and look for the fingerprints of machine learning: bundled inference runtimes (TensorFlow Lite, ONNX, ML Kit), model artifacts sitting in the assets directory, recommendation and personalization SDKs, analytics and attribution libraries, speech or vision entry points, and the permission set that feeds them. String and manifest inspection reveals the API endpoints the app talks to, which hints at server-side models the binary itself cannot contain. The output of this track is a per-app inventory: these AI capabilities are plausibly in play.
Track two is document analysis. For each app you collect the privacy policy, terms of service, in-app notices, and any help-center material, and you code them for AI-relevant disclosure: is automated decision-making mentioned, is personalization named as algorithmic, is profiling explained, is there any opt-out, is there a human-review path. Alongside this sits a layer of national context — connectivity and smartphone penetration, e-commerce growth, AI-awareness indicators, digital-literacy statistics — which turns the app-level finding into a socio-economic argument about who bears the consequences.
The join is the whole point. Inventory minus disclosure equals the transparency deficit, and that deficit is the paper’s operational definition of eroded individual sovereignty. An app that ships an on-device recommender and a fraud model but whose policy says only “we may use your data to improve your experience” produces a large, concrete, citable gap.
APK (binary) POLICY (text)
| |
v v
[ unpack ] [ collect: privacy ]
[ + decompile ] [ policy, ToS, in-app]
| |
v v
+---------------------+ +---------------------+
| scan for: | | code for: |
| * TFLite / ML Kit | | * "automated |
| * model assets | | decision" |
| * reco / ads SDKs | | * profiling |
| * perms + endpoints| | * opt-out / human |
+---------------------+ +---------------------+
| |
v v
CAPABILITY INVENTORY ------ vs ------ DISCLOSED SET
|
v
[ TRANSPARENCY DELTA ]
|
+---- overlay ----> [ national context: ]
| [ dependence, AI ]
| [ awareness, income ]
v
[ claim: individual digital sovereignty ]
[ is thin where delta is wide ]
Think of it as food-safety inspection. The privacy policy is the nutrition label on the packet: it’s what the manufacturer chose to print. The APK teardown is the laboratory assay: you actually run the sample through the machine and find out what’s in the food. The transparency delta is the discrepancy report — the label says “natural flavoring,” the assay says three synthetic additives. The socio-economic layer is the epidemiology: it tells you that this particular population eats this product daily, has limited access to alternatives, and mostly can’t read the label anyway, so the discrepancy matters more here than it would in a market with ten substitutes and a strong inspectorate. Take away any one part and the argument collapses: label-only is the existing literature, assay-only is a curiosity, and without epidemiology you can’t say why Nigeria specifically.
Key Concepts
-
Individual digital sovereignty: Sovereignty normally means a state controls what happens inside its borders. Shrink the border to one person. Do you know what the systems you depend on are doing to you, and can you change it? Concretely: a shopper sees a price and a product ranking. If she doesn’t know a model personalized both, she can’t ask whether she got a worse offer than her neighbor, can’t opt out, can’t shop around on informed terms. She still has legal rights on paper; she has no purchase on them. That’s sovereignty without leverage, and it’s why the paper uses transparency as the measuring stick — awareness is the precondition for every other form of control.
-
Forensic app analysis as social science instrument: Mobile forensics was built to recover evidence from seized phones — artifacts, databases, deleted records. Here the same toolkit is repurposed to interrogate a *company’s behavior rather than a suspect’s. Instead of asking a platform to describe its AI (they won’t, or will do so vaguely), you inspect the shipped artifact, which cannot lie about what libraries it links. Its limit is equally clear: server-side models leave only faint traces, so this method systematically undercounts AI. That asymmetry is useful — every finding is a lower bound.
-
Transparency as a proxy, and its price: The paper leans on a chain: disclosure enables awareness, awareness enables control, control constitutes sovereignty. Each link is contestable. Plenty of disclosed AI is still incomprehensible; plenty of undisclosed AI is harmless. The proxy is chosen because it’s measurable, not because it’s sufficient — worth holding in mind when reading the conclusions.
Framework Shift
Before (mainstream approach): After (this paper):
DIGITAL SOVEREIGNTY DIGITAL SOVEREIGNTY
| |
v v
[ the STATE ] [ the PERSON ]
| |
+----+----+ +-----+-----+
| | | |
v v v v
[ data ] [ cloud ] [ what AI ] [ was I ]
[ local ] [ indep ] [ actually] [ told? ]
[ -ity ] [ -ence ] [ runs? ] |
| | | |
+----+----+ +-----+-----+
| |
v v
measured by: measured by:
[ law + procurement ] [ APK teardown ]
[ + policy text ] [ vs policy ]
[ + local socio-]
[ economics ]
From jurisdictions to individuals, and from reading declarations to inspecting binaries, the core shift is treating sovereignty as something you can measure in the artifact a person actually installed.
Expert Assessment
Problem choice: Real gap, and well-picked. The state-centric framing of digital sovereignty genuinely has left the individual level thin, and the Global South is genuinely underserved in AI-transparency measurement — most disclosure audits are GDPR-shaped and Europe-shaped. Nigeria is the right site: enormous mobile-first commerce, fast-growing platform dependence, and a regulatory apparatus (NDPA, 2023) that is new and still finding its teeth. This sits in the field’s trajectory at a productive spot: after the “AI ethics principles” wave, during the current turn toward empirical accountability measurement.
Method maturity: Clever recombination rather than new technique. Nothing in the APK analysis is novel to mobile security — it’s standard static analysis — but pointing it at disclosure compliance in an underrepresented market is a good move, and the two-track design with an explicit delta is the paper’s real contribution as a template. The obvious weakness: library presence is a coarse proxy for “AI feature.” A bundled ML Kit dependency might be dead code, or a barcode scanner, and calling that “AI in use” is generous. Dynamic analysis or traffic interception would firm this up considerably, and the paper appears not to do it. A simpler alternative also goes unexplored: just asking the companies, and reporting the non-answers, which in accountability research is itself a finding.
Experimental integrity: This is where I’d push hardest. There are no baselines in the ML sense, which is fine for an interpretive study, but the design leans on choices the abstract doesn’t defend: how many apps, chosen how, and does the sample include the Chinese entrants (Temu, Shein, AliExpress) now dominant in the market? The socio-economic layer sounds like secondary statistics rather than primary data — “moderate AI awareness” and “uneven patterns of interaction” are the kind of phrases that need a named survey instrument behind them, and I suspect the paper is aggregating reports. Most importantly, the study makes claims about *user awareness without any users in it. That’s a real inferential leap: it measures what apps disclose, then asserts something about what people know. Flag it as a design limit, not a fatal one, but the conclusions should be read one notch weaker than they’re stated.
Writing quality: The abstract does the thing that hurts this genre — hedged aggregate verbs (“AI is widely implemented,” “transparency remains limited”) where the reader wants counts. The section that would elevate the paper most is the methods write-up: an explicit detection rubric (what counts as an AI feature, what evidence tier supports each claim, what the false-positive and false-negative modes are) plus a per-app matrix of capability-versus-disclosure. That single table would turn a plausible argument into a citable dataset, and it’s the difference between a workshop paper and one people build on. The socio-economic section also risks reading as context-setting filler unless it’s tied tightly to specific findings.
Verdict: weak accept — a genuinely underserved question addressed with a sensible, reproducible audit design, held back by a coarse AI-detection proxy and conclusions about user awareness that outrun the evidence collected.
Takeaways
The transferable asset here is the capability-versus-disclosure delta as a measurable unit. Any domain where a vendor ships an artifact and publishes a claim about it can be audited this way: browser extensions versus their store listings, IoT firmware versus spec sheets, medical apps versus their regulatory claims, model cards versus what’s actually in the weights. Build the inventory technically, code the claims textually, publish the difference. The difference is the finding.
Second, the framing move is worth stealing on its own: take a concept that has calcified at one scale (sovereignty at the nation-state level) and deliberately re-derive it one level down. Doing so usually exposes a measurement gap, because the instruments built for the big scale don’t work at the small one — which is exactly where a new method has room to matter.
Third, a practical note for anyone doing accountability work: design your proxy so its errors run one direction. Static APK analysis can’t see server-side models, so it can only undercount. That makes every number a floor, and a floor is much harder to argue with than an estimate.
If you build compliance or trust-and-safety tooling, the concrete pipeline — unpack, fingerprint ML dependencies and model assets, diff against the policy’s disclosure vocabulary — is something you could stand up this quarter with off-the-shelf tools.
论文: 2608.06364 作者: George Grispos, Sajda Qureshi 分类: cs.CY, cs.AI
缺口
“数字主权”这个题目基本被国家层面垄断了。
主流文献讨论的是欧盟的 GAIA-X 和数据本地化立法、中国的数据出境规则、某国政府能不能在不依赖三家美国云厂商的前提下跑完自己的政务系统。分析单位是”司法辖区”，威胁模型是”地缘依赖”。
旁边还有一支更小的文献，研究 AI 透明度，它的软肋不一样：它读的是平台”说了什么”。
隐私政策语料研究、告知合规清单、GDPR 第 13/22 条审计、暗黑模式调查，主要对象都是平台自己写的文本。少数做行为测量的工作以网络流量分析为主——能看出数据流向哪里，但对”哪些模型在消费这些数据”完全沉默。
两者之间有个洞。
如果一个拉各斯小商贩的全部生意都跑在中低端安卓机上的 Jumia、Konga 和 Temu 里，她的主权不是在布鲁塞尔被决定的。
决定它的是：她是否知道有一个排序模型、一个信用评分模型、一个反欺诈分类器正在塑造她看到什么、被报什么价——以及这些 App 有没有告诉过她。
在这类被忽视的市场里，没人真正核对过：二进制包里的 AI 和 告知文本里的 AI 是否对得上。
这篇论文就干了这件事：把 APK 拆开。
问题
[ AI 在塑造尼日利亚消费者看到的东西 ]
[ 但没人知道用户是否被告知 ]
|
v
假设
[ 透明度可作为"个人"数字主权的 ]
[ 可测代理: 不知情 == 无控制权 ]
|
+----------------------+
| |
v v
方法(技术侧) 方法(语境侧)
[ 安卓应用取证分析: ] [ 文档分析: 隐私 ]
[ 库/模型文件/端点/ ] [ 政策/条款/国家 ]
[ 权限 ] [ AI 与社经报告 ]
| |
+----------+-----------+
v
证据
[ 几乎所有应用都内置 AI ]
[ 告知稀少且笼统 ]
[ 平台依赖上升, AI 认知中等 ]
|
v
结论
[ 个人主权在无声中流失; 这个缺口 ]
[ 是可量化的告知赤字, 不是模糊 ]
[ 的焦虑 ]
增量
一句话：这篇论文之前，“用户不了解自己 App 里的 AI”是靠政策文本和问卷推论出的假设；之后，它变成了一个有证据的判断——把二进制包里查到的能力和告知文本里承认的能力摆在一起对照，而且做在一个学界通常不看的市场里。
核心机制
方法是两条线的审计，最后靠一个”对照”步骤合流。
第一条线是安卓包的静态取证。拉取每个目标购物 App 的 APK，解包，找机器学习的指纹：捆绑的推理运行时（TensorFlow Lite、ONNX、ML Kit）、放在 assets 目录里的模型文件、推荐与个性化 SDK、分析与归因库、语音或视觉入口，以及为它们供料的权限集合。
字符串和清单文件还能暴露 App 通信的 API 端点，从而推测那些二进制包本身装不下的服务端模型。
这条线的产出是逐 App 的”能力清单”：这些 AI 能力大概率在运作。
第二条线是文档分析。收集每个 App 的隐私政策、服务条款、应用内提示和帮助中心内容，按 AI 相关告知维度编码：有没有提到自动化决策、有没有把个性化说成是算法驱动的、有没有解释用户画像、有没有退出选项、有没有人工复核通道。
再叠上一层国家语境——联网率与智能机普及、电商增速、AI 认知指标、数字素养统计——把 App 层面的发现变成”谁承担后果”的社会经济论证。
合流才是关键。
能力清单减去已告知集合，等于透明度赤字；这个赤字就是论文对”个人主权受侵蚀”的操作化定义。
一个 App 内置了端侧推荐器和欺诈模型，而政策里只写”我们可能使用您的数据来改善您的体验”——这就构成一个具体、可量化、可引用的落差。
APK (二进制) POLICY (文本)
| |
v v
[ 解包 ] [ 收集: 隐私政策 / ]
[ + 反编译 ] [ 条款 / 应用内提示 ]
| |
v v
+---------------------+ +---------------------+
| 扫描: | | 编码: |
| * TFLite / ML Kit | | * "自动化决策" |
| * 模型文件 | | * 用户画像 |
| * 推荐/广告 SDK | | * 退出 / 人工复核 |
| * 权限 + 端点 | | |
+---------------------+ +---------------------+
| |
v v
能力清单 ---------- 对照 ---------- 已告知集合
|
v
[ 透明度落差 ]
|
+---- 叠加 ----> [ 国家语境: ]
| [ 依赖度 / AI 认 ]
| [ 知 / 收入水平 ]
v
[ 论断: 落差越大, 个人数字主权越薄 ]
可以把它想成食品安全抽检。
隐私政策是包装上的营养标签：厂商愿意印什么就印什么。
APK 拆解是实验室化验：把样品真放进仪器，看里面到底有什么。
透明度落差就是那份差异报告——标签写”天然香料”，化验单上是三种合成添加剂。
社会经济那一层是流行病学：它告诉你这个人群每天吃这个产品、没有多少替代品、而且大多数人本来就读不懂标签，所以同样的差异在这里比在一个有十种替代品、监管有牙的市场里严重得多。
抽掉任何一块论证就塌：只看标签就是既有文献，只做化验只是猎奇，没有流行病学就说不出”为什么偏偏是尼日利亚”。
关键概念
-
个人数字主权：主权通常指国家能掌控自己边界内发生的事。把边界缩小到一个人身上就是这个概念。你知道你所依赖的系统正在对你做什么吗？你能改变它吗？具体点说：一个消费者看到一个价格和一份商品排序。如果她不知道两者都被模型个性化过，她就无法追问自己是不是拿到了比邻居更差的报价，无法退出，无法在知情的基础上去比价。法律权利在纸面上还在，但她没有任何抓手。这就是”没有杠杆的主权”，也是论文为什么拿透明度当尺子——知情是其他一切控制形式的前提。
-
把取证分析当社会科学仪器用：移动取证原本是为了从扣押的手机里恢复证据——痕迹、数据库、被删记录。这里同一套工具被转向去审问一家公司的行为，而不是嫌疑人的行为。你不去请平台自述它的 AI（它不会说，或者说得很含糊），而是直接检查它发出来的成品，成品链接了哪些库是骗不了人的。它的局限同样清楚：服务端模型只留下微弱痕迹，所以这个方法系统性地低估 AI 的使用量。这个不对称其实很好用——每个结论都是下界。
-
透明度作为代理，及其代价：论文依赖一条链：告知带来知情，知情带来控制，控制构成主权。每一环都可争议。很多已披露的 AI 依然不可理解；很多未披露的 AI 其实无害。选这个代理是因为它可测，而不是因为它充分——读结论时值得把这点放在心上。
框架转变
之前(主流方法): 之后(本文方法):
数字主权 数字主权
| |
v v
[ 国家 ] [ 个人 ]
| |
+----+----+ +-----+-----+
| | | |
v v v v
[ 数据 ] [ 云基 ] [ 实际跑 ] [ 我被 ]
[ 本地 ] [ 础自 ] [ 的是什 ] [ 告知 ]
[ 化 ] [ 主 ] [ 么 AI? ] [ 了吗?]
| | | |
+----+----+ +-----+-----+
| |
v v
测量手段: 测量手段:
[ 法律 + 采购 ] [ APK 拆解 ]
[ + 政策文本 ] [ 对照 政策 ]
[ + 本地社经 ]
从辖区到个人、从读声明到验二进制，核心转变是：把主权变成可以在用户真正装进手机的那个文件里测出来的东西。
专家评审
选题眼光：真缺口，而且挑得准。数字主权的国家中心化叙事确实把个人层面留得很薄，而 AI 透明度测量在全球南方确实供给不足——大部分告知审计都是 GDPR 形状、欧洲形状的。
尼日利亚是对的现场：巨大的移动优先商业体量、快速上升的平台依赖、以及一套 2023 年才出台、还在长牙的监管框架（NDPA）。
在领域轨迹上，它落在一个有产出的位置：在”AI 伦理原则”那波浪潮之后，在当前转向”可实证的问责测量”之中。
方法成熟度：是聪明的重组，不是新技术。
APK 分析里没有任何东西对移动安全领域来说是新的——就是标准静态分析——但把它对准一个被忽视市场的告知合规问题，这一步走得好；两条线加一个显式落差的设计，作为模板才是论文真正的贡献。
明显的弱点：把”库的存在”当作”有 AI 功能”是很粗的代理。捆绑了 ML Kit 依赖可能是死代码，也可能只是个条码扫描器，把这个算成”AI 在使用中”是慷慨的算法。
动态分析或流量抓包能把这一点夯实很多，而论文看起来没做。
另一条更简单的路也没被探索：直接去问这些公司，然后把”不回答”本身报告出来——在问责研究里，沉默就是发现。
实验诚意：这是我最想追问的地方。
按 ML 的标准这里没有基线，对解释性研究来说没问题，但设计依赖了一些摘要没有交代的选择：样本有多少个 App、怎么选的、有没有包含如今在该市场攻势凶猛的中国玩家（Temu、Shein、AliExpress）？
社会经济那一层听起来是二手统计的汇编而非一手数据——“AI 认知中等""交互模式不均”这类表述后面需要一个具名的调查工具，我怀疑论文是在聚合报告。
最要紧的是：研究对用户认知下了判断，但研究里没有用户。
这是一次实打实的推论跳跃——它测的是 App 披露了什么，然后断言人们知道什么。
我把这标为设计局限而非致命伤，但结论应当比它写出来的口气降一档来读。
写作功力：摘要犯了这个体裁的典型毛病——在读者想要数字的位置上给了对冲式的聚合动词（“AI 被广泛实现""透明度仍然有限”）。
最能提升整篇论文的是方法部分：一份显式的检测规则（什么算 AI 功能、每条论断由哪一级证据支撑、误报和漏报的模式是什么），加上一张逐 App 的”能力 vs 告知”矩阵。
就这一张表，能把一个听起来合理的论证变成一份可被引用的数据集——这也是”研讨会论文”和”别人愿意在上面接着做”之间的差别。
社会经济那一节如果不和具体发现紧紧绑住，也很容易读成背景填充。
判决：弱接收 —— 一个确实供给不足的问题，配上一个合理且可复现的审计设计；但 AI 检测代理过粗，关于用户认知的结论跑在了所采集证据的前面。
要点总结
这篇最能带走的资产是把”能力 vs 告知”的落差做成一个可测量的单位。
任何”厂商交付一个成品、同时公开一份关于它的声明”的领域，都能这样审计：浏览器扩展 vs 商店描述、IoT 固件 vs 规格书、医疗 App vs 报备用途、model card vs 权重里真实存在的东西。
技术侧建清单，文本侧编码声明，公布两者之差。差值本身就是发现。
第二，那个框架动作本身就值得偷：拿一个已经在某个尺度上板结的概念（民族国家层面的主权），刻意往下推一层重新推导一遍。
这么做通常会暴露一个测量缺口——因为为大尺度造的仪器在小尺度上不管用，而那正是新方法有空间的位置。
第三，给做问责研究的人一条实操建议：把你的代理设计成误差只往一个方向跑。
静态 APK 分析看不见服务端模型，所以它只会少算。
这让每个数字都成为下界，而下界比估计值难反驳得多。
如果你在做合规或信任与安全的工具，这条具体流水线——解包、指纹识别 ML 依赖与模型文件、和政策的告知词汇做 diff——用现成工具这个季度就能搭起来。