Attribute Inference from Interactive Targeted Ads

A new study models interactive targeted advertising as a noisy oracle that can infer sensitive user attributes, finding that disclosure policy — not just data collection — is the strongest lever for limiting privacy leakage [1]. The paper, posted to the arXiv preprint server on June 13, 2026, formalizes the advertising delivery pipeline as a chain of targeting predicates, exposure, interaction, and disclosure [1][2]. The framework isolates two gaps: the gap between who is eligible to see an ad and who actually receives it, and the gap between a user’s interaction and what the advertiser ultimately observes [2]. When an interaction remains linked to the campaign that elicited it, the advertiser can receive an observation tied to a user rather than only an aggregate report, creating a side channel for attribute inference [2]. To measure the risk, the researchers built a reproducible benchmark using synthetic populations calibrated with public data, each carrying known sensitive labels [2]. A generated campaign-semantics layer supplies topic variants and response priors, while a custom simulator produces ground truth, event traces, disclosed observations, and evaluation metrics [2]. The evaluation compares Bayesian, supervised, positive-and-unlabeled, and adaptive attacks under common campaign and disclosure definitions [1][2]. Across four topic variants, seven simulator seeds, and two interaction settings, repeated campaigns with identity exposure produced measurable but bounded inference signal [2]. After 160 campaigns, Bayesian and supervised attacks reached an area under the curve of about 0.64 in the main setting and about 0.65 in the higher-interaction setting [1][2]. The study identifies disclosure policy as the strongest control: aggregate reporting removes the oracle input tied to users, while type filtering and randomized disclosure further reduce the released signal [1][2]. The work arrives as advertising remains the dominant revenue engine for major platforms. Meta Platforms, which owns Facebook and Instagram, derived 97.8 percent of its total revenue from advertising in 2023 [4]. Instagram alone surpassed 1 billion registered users in June 2018 and reported 500 million daily Stories users as of January 2019 [3]. The paper’s artifact and defense-evaluation method are publicly available on GitHub, and the preprint is hosted on arXiv, an open-access repository that has grown to more than two million articles since its launch in 1991 [2][11].