ALIBIS: Assessing and mitigating the risk of sensitive metadata Leakage In moBile Image Sharing

Smartphones have become necessary in modern life and can replace traditional devices like cameras. The high demand for taking and sharing photos via smartphones, especially with the explosion of social networks and instant messaging, highlights the importance of smartphones. Android, the leading smartphone operating system, has continuously improved user security and privacy over its 17 years of development (2008–2025). However, security vulnerabilities still exist because of its open-source nature. This paper introduces ALIBIS, a framework that automatically estimates the risk of leakage of sensitive data contained in EXIF metadata when users share images online by combining static analysis and Large Language Models (LLMs). ALIBIS demonstrates consistent and robust estimation capabilities, achieving an average accuracy, precision, recall, and f1 score in k-fold cross-validation (k=5) of 0.8686, 0.8902, 0.881, and 0.8854, respectively. In addition, a survey of 130 global participants, including Android app developers and end-users, revealed a significant lack of awareness about image metadata and its risks: 82.3% of participants (user role) do not delete sensitive metadata before sharing images, and 62.3% do not know how to remove metadata. Furthermore, only 1.9% of participants (developer role) proactively remove EXIF metadata during programming. We propose ExifMetadataLib, a lightweight library for easy integration with Android OS, to mitigate sensitive metadata leakage.