There are two things that you should do to solve your issue. 

One is look into [mutual SSL][1]. This will allow your client to authenticate your server *and* your server will authenticate your client avoiding repudiation. There are a few links on SE about this. 

> Mutual SSL provides the same things as SSL, with the addition of authentication and non-repudiation of the client authentication, using digital signatures. When mutual authentication is used the server would request the client to provide a certificate in addition to the server certificate issued to the client. 

https://security.stackexchange.com/questions/43968/mutual-authentication-between-two-clients

https://stackoverflow.com/questions/23114049/ssl-mutual-authentication-fail-on-android-client-accepts-servers-certificate-but

The second thing that you should make sure you do regardless is to lock down your server's API. Validate all the input that you receive regardless. 


Realize that in Android the user gets your apk, so in many cases security efforts can be overcome. However with the above steps you should be able to increase the level of effort so much so that malicious users will not be interested in spending the time to break your app.

  [1]: http://en.wikipedia.org/wiki/Mutual_authentication