{"id":"42b976a8-c072-4dee-978c-d709353eaac5","arxiv_id":"2607.20003","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"INT8-quantized 3- and 4-layer MLPs give near-identical Android malware detection accuracy with smaller models, but the claimed energy savings are calculated from latency, not measured on hardware.","lead":"The paper tested small neural networks that detect Android malware, comparing full-precision and INT8-quantized versions on two public datasets. It reports 3.5x smaller models and low energy per scan, but the energy numbers are computed from run time, not measured on a phone.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Energy claim is internally inconsistent: Table II's DREBIN rows show INT8 increases energy, and Eq. (1) is applied with an unreported P_cpu on an x86_64 emulator.","rationale":"The reader's weakest assumption correctly targets the energy calculation: P_cpu is never measured or reported, and the AVD environment cannot provide battery instrumentation. My independent read of Table II strengthens that objection rather than softening it. The implied power E/t_enc differs across rows, which is incompatible with the fixed-P_cpu reading of Eq. (1), and the DREBIN data show the opposite of the headline claim: quantized models consume more energy than FP32 in all three depths. Since the paper's contribution is specifically the energy/security trade-off, this is load-bearing; the accuracy and size results are not the issue. The limitation statement in Section VI acknowledges the emulator/hardware gap, but it does not address the internal inconsistency or the contradiction in Table II. No code or artifacts are provided, so the numbers cannot be independently checked. Classification performance appears plausible, but the central energy claim is unsupported. Therefore the reader's REJECT verdict stands; no verdict change is needed.","tokens_in":8109,"tokens_out":5685,"duration_ms":53365,"concrete_test":"Obtain the raw benchmark logs and the exact values of P_cpu and E_io used to fill Table II. Recompute each energy entry from Eq. (1); if the recomputed values do not reproduce Table II without a different P_cpu per row, the energy model is invalid. Then run the same six TFLite models on a physical ARM device (e.g., a Pixel 6) using a power monitor/Monsoon or on-chip energy counters, and compare FP32 vs INT8 energy. If DREBIN INT8 still exceeds FP32, or if P_cpu is not reported/constant, the central energy claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim—that INT8 quantization lowers energy consumption to 0.0189 mJ while retaining >99.2% accuracy—rests on the energy column of Table II. That column is not trustworthy and is contradicted by the paper's own data.\n\nEq. (1), E = P_cpu × t_enc + E_io, is borrowed from a disk-encryption study (Hu et al. [19]). The paper never reports P_cpu or E_io, and Section IV-C states the AVD has no physical battery instrumentation, so no power value was measured. If E_io is ignored and a fixed P_cpu were used, E/t_enc should be constant across rows. In Table II it varies from about 0.89 to 0.996 mW (e.g., TUANDROMD QNN 3-layer: 0.0189/0.0210 ≈ 0.90 mW; FP32 3-layer: 0.0238/0.0240 ≈ 0.99 mW), so the table cannot have been produced with a single measured P_cpu. The implicit P differs by model, with no explanation.\n\nMore directly, the DREBIN rows contradict the abstract's blanket claim: every QNN INT8 configuration has higher energy than its FP32 counterpart (3-layer: 0.0248 vs 0.0219 mJ; 4-layer: 0.0231 vs 0.0224 mJ; 5-layer: 0.0244 vs 0.0238 mJ). The 0.0189 mJ headline is a single TUANDROMD 3-layer result, not a general quantization benefit. Section VI concedes that emulators do not capture real hardware behavior, but the problem is more serious than representativeness: the energy metric itself is unvalidated, internally inconsistent, and unsupported by any measured power value.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper reports an empirical comparison of FP32 and post-training-quantized INT8 MLP classifiers for Android malware detection on the TUANDROMD and DREBIN datasets. Three model depths (3, 4, and 5 layers) are compared in terms of classification metrics (accuracy, precision, recall, F1, MCC) and resource/efficiency metrics (model size, throughput, latency, and 'energy' computed from Eq. (1)). The claimed finding is that shallow INT8 models preserve high accuracy while reducing model size by about 3.5x and energy to 0.0189 mJ per inference, identifying a 3-layer QNN for TUANDROMD and a 4-layer QNN for DREBIN as optimal.","tokens_in":8620,"tokens_out":12055,"duration_ms":114370,"significance":"The paper addresses a genuine and timely problem: quantifying the trade-off between detection accuracy and on-device energy consumption in Android malware scanning. The classification results in Table I are plausible and suggest that INT8 quantization has little effect on detection quality for these MLP models, which is a useful observation. However, the paper's central contribution—the energy analysis—is not established. The energy values are derived from Eq. (1) with unmeasured coefficients, are internally inconsistent with that equation, and are contradicted for DREBIN by the paper's own data. Because the energy claims are the claimed novelty, the paper as written does not deliver its main result. The comparison of latency and model size is more credible, but those are not the metrics highlighted in the abstract.","major_comments":[{"comment":"The energy numbers are not measurements. Eq. (1) requires P_cpu and E_io, but neither is reported or justified for neural-network inference; Section IV-C concedes the AVD has no physical battery instrumentation. The energy values are therefore rescaled latencies, and the 'linear energy-latency relation' in Section V-B1 is a direct consequence of the definition, not an empirical finding. No error bars or confidence intervals accompany the 10-run averages. The abstract's 0.0189 mJ headline and the conclusions in Section VI rest entirely on this unvalidated computation.","section":"§IV-C, Eq. (1), Table II"},{"comment":"With fixed P_cpu and E_io, E/t_enc should be approximately constant unless E_io dominates. The table is not consistent with any single (P_cpu, E_io): FP32 rows cluster near 0.99 mW (e.g., TUANDROMD FP32 3-layer: 0.0238/0.0240 = 0.992 mW), while QNN rows cluster near 0.89 mW (e.g., TUANDROMD QNN 3-layer: 0.0189/0.0210 = 0.900 mW). Thus the implicit power coefficient changes between model classes without explanation. The reported energy numbers cannot have been produced by applying Eq. (1) with one measured P_cpu.","section":"Table II vs Eq. (1)"},{"comment":"The blanket claim that INT8 quantization reduces energy is contradicted by the DREBIN rows: each QNN configuration uses more energy than its FP32 counterpart (3-layer 0.0248 vs 0.0219 mJ; 4-layer 0.0231 vs 0.0224 mJ; 5-layer 0.0244 vs 0.0238 mJ) and has lower throughput. The 0.0189 mJ value is one TUANDROMD 3-layer point. §V-B2's statement that 'computational efficiency increased when the model precision was changed from FP32 to INT8' is therefore not supported as a general conclusion.","section":"Table II, DREBIN rows, abstract, §V-B2"},{"comment":"The abstract claims 'more than 99.2% detection accuracy,' but the DREBIN results are all below 99.2% (maximum 98.63% for the identified optimal 4-layer QNN), and even TUANDROMD FP32 4-layer is 99.19%. The headline accuracy claim is therefore not representative of the paper's results, including the proclaimed optimal configuration for DREBIN.","section":"Abstract vs Table I"},{"comment":"The MLP architectures are under-specified. Layer widths, optimizer, learning rate, batch size, epochs, and training details are not reported; only the number of layers is given. The 'optimal configurations' in §V-B3 cannot be reproduced or independently verified without these details or release of code/models.","section":"§IV-A"}],"minor_comments":[{"comment":"The variable t_enc is defined in Eq. (1) as encryption/decryption time in the cited disk-encryption work, but Table II uses it as inference latency. The mapping should be justified and clearly labeled.","section":"§II-D, Table II"},{"comment":"Several references are not archival scholarly sources: [16] (GeeksforGeeks), [21] (ICML call for papers), [30] (KDD call for papers), and [31] (ResearchGate). The related-work claims should be grounded in peer-reviewed literature.","section":"References"},{"comment":"There are formatting errors in the 5-layer rows, e.g., '599.31' should read '5 99.31'.","section":"Table I"},{"comment":"The assertion that quantization reduces RAM consumption is not supported by any measured RAM metric in Table II or elsewhere.","section":"§V-B2"},{"comment":"Metrics are reported as point averages without standard deviations or statistical significance tests. Given the 5-fold cross-validation and 10-run protocol, dispersion should be reported.","section":"Tables I–II"},{"comment":"'Optimal balance' is not defined quantitatively; no Pareto front or scalarized trade-off criterion is given. For DREBIN, the 4-layer QNN is selected despite having higher energy than the FP32 3-layer (0.0231 vs 0.0219 mJ), so the trade-off rationale is unclear.","section":"§V-B3"}],"recommendation":"reject","confidential_remarks":"The energy analysis is the paper's central claimed novelty, and it is unsupported: P_cpu and E_io are unreported, the table is internally inconsistent with Eq. (1), and the DREBIN results contradict the abstract. These are not copy-editing issues; they require new measurements on physical hardware or a validated power model, which the paper explicitly leaves to future work. I therefore recommend rejection despite the potentially relevant accuracy comparison."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a straightforward benchmark of INT8 post-training quantization for small MLPs on two Android malware datasets. The classification and model-size numbers are believable and consistent with prior work, but the energy analysis is not. The headline claim of 0.0189 mJ per inference comes from a single TUANDROMD configuration and is contradicted by the paper's own DREBIN table, where every INT8 model uses more energy than its FP32 counterpart.\n\nWhat the paper does well: the experimental design is simple and transparent. They vary three depths, two precisions, and two datasets, report standard classification metrics, and make the emulator limitation explicit in the conclusion. The ~3.5x size reduction from FP32 to INT8 is what you'd expect, and the accuracy numbers (99%+ on TUANDROMD, 98.5% on DREBIN) are plausible. If you need a quick reference for TFLite latency of small MLPs on an x86 AVD, the throughput and latency columns have some empirical value.\n\nThe problem is the energy column. Eq. (1) from Hu et al. requires a measured or reported P_cpu and E_io. Neither is given. The paper states the AVD can't do battery instrumentation, which is fine for an admission, but then they apply the equation anyway. Dividing their energy by latency reveals implied P_cpu values around 0.99 mW for FP32 and 0.89 mW for INT8 models—different per model, with no explanation. That means the energy numbers are not a faithful application of their own equation; they're either arbitrary or the result of arithmetic inconsistency. And the DREBIN rows show quantization increasing energy, which is a direct contradiction of the abstract's blanket claim. The 0.0189 mJ figure is a single TUANDROMD 3-layer result that gets repeated in the abstract and conclusion as if it were general.\n\nWho this is for: developers looking for a rough sense of model size and inference latency for tiny ML malware detectors on an Android emulator. That's a narrow audience, and they'd be better served by measuring on real hardware. The energy conclusions should not be cited until redone with actual power instrumentation.\n\nAs submitted, I would not accept this for peer review. The central quantitative claim is unsupported, and the fix requires new experiments, not just a rewrite. The classification findings are fine but too thin to stand alone. If the authors measure power on real devices and report their parameters, a revised version could be worth a look.","headline":"The classification and size benchmarks are fine, but the energy analysis is a restatement of latency with an unmeasured, inconsistent power coefficient, so the headline claim doesn't hold.","tokens_in":9049,"tokens_out":4864,"would_cite":false,"duration_ms":47825,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"INT8 quantization can reduce Android malware-detection energy to 0.0189 mJ per inference while preserving accuracy.","keywords":["Android malware detection","INT8 quantization","post-training quantization","multilayer perceptron","energy-efficient AI","TensorFlow Lite","TUANDROMD","DREBIN"],"falsifier":"Run the same 3-layer INT8 TensorFlow Lite model on the TUANDROMD feature set inside a physical Android smartphone with battery instrumentation, measure average energy per 1,000 inferences, and compare to the paper's estimated 0.0189 mJ. If measured energy deviates by more than the 22% spread the paper reports across configurations, the fixed-P_cpu assumption is not transferable to real hardware.","tokens_in":8040,"feed_emoji":"⚡","tokens_out":7693,"duration_ms":73480,"temperature":0.7,"pith_summary":"This paper tries to show that the usual trade-off between strong Android malware detection and battery drain can be largely avoided by pairing shallow multilayer-perceptron models with post-training INT8 quantization. Across the TUANDROMD and DREBIN datasets, it reports that quantized 3- and 4-layer networks match or nearly match the accuracy of full-precision models while cutting model size by about 3.5 times and lowering estimated energy to as little as 0.0189 mJ per inference. The proposed mechanism is that smaller, lower-bit models finish inference faster, so the CPU spends less time in a high-power state and energy falls roughly with latency. If the estimates hold, developers get a concrete recipe for real-time background malware scanning that barely affects battery life. The energy figures are estimated, not measured on physical hardware, which is the paper's own stated limitation.","feed_headline":"INT8 models cut Android malware-detection energy to 0.0189 mJ","feed_subtitle":"Small quantized 3- and 4-layer nets keep accuracy near 99% while shrinking model size 3.5x for on-device scanning.","key_machinery":"The load-bearing ingredient is post-training quantization - converting a trained FP32 model's weights to 8-bit integers without retraining - applied to multilayer perceptrons and packaged as TensorFlow Lite models for on-device execution. Depth (3, 4, or 5 layers) and precision (FP32 vs INT8) are the two independent variables. Energy is estimated with E = P_cpu x t_enc + E_io, where P_cpu is a fixed processor power value and t_enc is per-inference latency, so lowering latency directly lowers reported energy; throughput and model size are the supporting metrics.","core_discovery":"The paper's central claim is that post-training quantization from FP32 to INT8, combined with limited network depth, resolves the accuracy-energy tension in Android malware detection. Using 3-, 4-, and 5-layer MLPs on two public datasets, it reports that an INT8 3-layer network on TUANDROMD achieves 99.24% accuracy at 0.0189 mJ per inference, and an INT8 4-layer network on DREBIN achieves 98.63% accuracy at 0.0231 mJ; these are the configurations the paper recommends. Quantization reduces model size from 405.42 KB to 115.46 KB in the TUANDROMD case, and the paper ties energy consumption to the product of a constant CPU power and inference time. The conclusion is that strong security performa","pith_inferences":["The same quantization-and-depth trade-off likely transfers to other tabular Android feature sets, so a shallow INT8 model could become a general default for on-device scanning; this is an extrapolation beyond the two datasets tested.","The absolute 0.0189 mJ figure is probably less durable than the relative ordering of configurations, since the ordering follows from latency alone while the absolute figure depends on the unmeasured P_cpu value.","A testable follow-up suggested by the paper's own future-work list: check whether INT8 quantization shifts the calibration of predictive confidence; even if accuracy holds, security decisions based on score thresholds could change.","Because the experiments ran on an x86_64 Android emulator rather than an ARM phone, the 3.5x size reduction is hardware-independent but the energy advantage itself needs confirmation on physical devices with battery instrumentation."],"forward_implications":["INT8 quantization would give near-lossless malware detection (accuracy loss of at most a few hundredths of a point in the reported tables) while shrinking model size by roughly 3.5x, easing memory pressure on low-end phones.","Because the paper reports a linear energy-latency relationship, any optimization that shortens inference time - not just quantization - should proportionally reduce battery cost for background security scans.","Throughput of about 47,000 inferences per second on the TUANDROMD 3-layer QNN suggests real-time continuous scanning is feasible without noticeable user-visible lag.","Developers can treat the identified configurations (3-layer INT8 for behavioral feature sets, 4-layer INT8 for manifest-based feature sets) as starting points for energy-aware malware-detector deployment."],"fun_headline_variants":["INT8 quantization shrinks Android malware models 3.5x, keeps 99% accuracy","Small quantized nets keep 99% Android malware accuracy, slash battery drain","Green AI for mobile security: INT8 models balance accuracy and energy","Quantized neural nets deliver 99% malware accuracy at a fraction of energy"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that a single fixed CPU power value, applied to an x86_64 Android emulator, accurately represents a real phone's power draw during ML inference; if that value is wrong, every energy figure in the comparison, including the headline 0.0189 mJ, would shift.","fun_headline_variants_meta":{"raw":{"variants":["INT8 quantization shrinks Android malware models 3.5x, keeps 99% accuracy","Small quantized nets keep 99% Android malware accuracy, slash battery drain","Green AI for mobile security: INT8 models balance accuracy and energy","Quantized neural nets deliver 99% malware accuracy at a fraction of energy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001232,"raw_usage":{"total_tokens":4911,"prompt_tokens":774,"completion_tokens":4137,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":518,"completion_tokens_details":{"reasoning_tokens":4052}},"tokens_in":518,"tokens_out":4137,"duration_ms":26277,"temperature":1.0,"reasoning_tokens":4052,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T11:02:32.780682+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same 3-layer INT8 TensorFlow Lite model on the TUANDROMD feature set inside a physical Android smartphone with battery instrumentation, measure average energy per 1,000 inferences, and compare to the paper's estimated 0.0189 mJ. If measured energy deviates by more than the 22% spread the paper reports across configurations, the fixed-P_cpu assumption is not transferable to real hardware.","supporting_citations":[],"review_version":1}