Obfuscation Is for Size, Not Security — How One Keep Rule Sabotaged It for Two Years
Treating R8 obfuscation as a security feature leads to over-broad keep rules that silently cancel its size and performance benefits; the four-metric audit approach gives any Android team a concrete way to avoid a two-year silent regression.
Android obfuscation's original purpose is reducing dex size, not preventing reverse engineering. A developer found their project's `-keep class com.example.** { *; }` rule had been keeping the entire business package intact, leaving seeds.txt larger than mapping.txt and rename coverage under 10%. Removing it caused production ClassNotFoundExceptions from reflection, JNI, and serialization paths, forcing a systematic cleanup.
The article walks through the history of obfuscation from ProGuard to R8, showing how full mode changed rule semantics in four ways, and details a 12-round workflow with the AI assistant Trae. Each round uses explicit goals, constraints, and validation to measure four metrics: rename coverage, seeds count, usage count, and dex size. The final state: coverage 79.6%, dex down from 21.4 MB to 17.9 MB, and a CI gate that fails on any broad keep or disabled optimization.
The article's core claim that obfuscation is a volume optimization is backed by R8's official docs and the historical record, but it implies that many teams misdirect effort toward perceived security, as shown by the developer's own two-year blind spot.
The 12-round prompt engineering demonstrates that AI coding assistants can be held to measurable deliverables when given explicit constraints and validation criteria, yet the initial staging crash shows that even with a correct regression checklist, human discipline is required to execute it.
The negative result on custom dictionaries contradicts a common belief that more exotic obfuscation is better; the measured dex bloat and decompiler resilience make the default shortest-name strategy the rational choice.
The mapping.txt leak warnings and the deliberately-wrong-mapping retrace drill highlight that operational hygiene is more important than the obfuscation algorithm itself.