2026 · Preprint
Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker
Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. It shows how plausible recovered schemas can silently decode values incorrectly.
Scope and limitations
The direct-agent study uses 17 seeds with 7,788 field occurrences, 4,987 distinct. Apple's true schemas remain unpublished; synthetic tests share the recovered template's assumptions. Traffic comes from one jailbroken iPhone 8 on iOS 16.7.11. Matching fields in newer OS binaries does not verify their network behavior. The maintained code also documents estimated or unresolved fields.
Why it fits this collection
A concrete binary-to-protocol-schema recovery study that separates parseable output from verified interpretation.
Publication and review details
- Venue
- arXiv
- Status
- Preprint
- Publication / posting date
- October 15, 2026
- Date source
- First arXiv submission; the reviewed version is v1, not a verified proceedings publication.
- First arXiv submission
- October 15, 2026
- arXiv
- 2610.21597
- Reviewed arXiv version
- v1
ArXiv names Douglas Leith; the manuscript uses D.J. Leith. The author-linked code and data READMEs were inspected at pinned commits. No repository-wide license was verified. No Apple binaries, traffic datasets or tests were downloaded or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://arxiv.org/abs/2610.21597
- https://arxiv.org/html/2610.21597v1
- README.md GitHub · doug-leith/ios-protobuf-decoding · Revision 9a4a688
- README.md GitHub · doug-leith/ios-location-services-study-data · Revision a091d8d