When Ads Become Profiles: Uncovering the Invisible Risk of Web Advertising at Scale with LLMs

Technical Summary: When Ads Become Profiles

Problem Statement
Despite regulatory efforts to restrict explicit targeting of sensitive categories (e.g., political beliefs, health, sexual orientation) on platforms like Facebook, algorithmic optimization for user engagement continues to introduce demographic skews in ad delivery. Consequently, the stream of advertisements shown to a user acts as a high-fidelity proxy for their private attributes. While previous research established that ad streams contain latent signals, exploiting these signals traditionally required resource-intensive pipelines involving massive labeled datasets and the training of bespoke classifiers. The emergence of powerful, zero-shot multimodal Large Language Models (LLMs) has fundamentally altered this landscape. The paper posits that the barrier to exploiting these latent signals has been lowered, enabling adversaries to reverse-engineer complex user profiles from passive ad exposure alone, potentially bypassing current platform safeguards and regulatory frameworks.

Methodology
The authors propose a novel pipeline that leverages multimodal LLMs as adversarial inference engines to perform natural language profiling. The study utilizes a longitudinal dataset collected via a browser extension from 891 Australian Facebook users, comprising over 435,000 ad impressions across 63,864 sessions.

The technical pipeline consists of three stages:

1. Multimodal Feature Extraction: Using an LLM (Gemini 2.0 Flash), raw ad creatives (images and text) are processed to extract structured semantic features. This includes generating a caption, descriptive categories, IAB classifications, and key entities, transforming high-dimensional multimodal data into concise textual representations.
2. Session-Level Inference: The continuous ad stream is segmented into discrete sessions based on a data-driven time threshold (389 seconds). The LLM performs zero-shot classification on the textual representation of each session to predict private attributes (Gender, Age, Income, Education, Employment, Party Preference) and generates a reasoning summary.
3. Longitudinal User Profiling: Reasoning summaries from multiple sessions are aggregated into a narrative history. A final inference step synthesizes these cumulative signals to reconstruct a comprehensive user profile.

The study evaluates performance against strong baselines, including random guessing, census-based priors (derived from Australian census data), and human annotators.

Key Contributions

1. A Novel Pipeline for Societal Risk Uncovering: The authors introduce a methodology that uses multimodal LLMs to decode semantic signals from unstructured ad creatives without training bespoke models, shifting the focus from behavioral metadata to content-based inference.
2. Empirical Quantification of Privacy Risk: The paper provides the first large-scale empirical evidence that ad streams serve as a high-fidelity digital footprint. It demonstrates that off-the-shelf LLMs can reconstruct private attributes from passive observation with accuracy matching or exceeding human social perception, at a fraction of the cost (223× lower) and time (52× faster).
3. Characterization of Scalable Profiling: The study reveals that actionable profiling is feasible even within short observation windows (session-level), indicating that prolonged tracking is not a prerequisite for a successful attack. This highlights a systemic vulnerability where the platform's own optimization logic can be exploited locally.

Results

• Session-Level Performance: LLMs significantly outperformed random baselines in reconstructing attributes. For example, the model achieved 59.13% accuracy for Gender and 48.38% for Employment, compared to ~20% for random guessing. For ordinal attributes like Age and Income, the models demonstrated "directional correctness," with Mean Absolute Error (MAE) significantly lower than random baselines, indicating predictions were typically within 1-2 categories of the ground truth.
• Human vs. AI Comparison: In a human evaluation of 100 sessions, state-of-the-art LLMs (e.g., GPT-5, Gemini 2.5 Pro) matched or exceeded human performance in Gender classification (76% vs. 73.67%) and significantly outperformed humans in complex socio-economic attributes like Education (51% vs. 33.67%) and Employment (53% vs. 37.83%).
• User-Level Reconstruction: Aggregating signals across sessions further improved precision. The LLM achieved 76.38% accuracy for Gender and 41.60% for Party preference, substantially outperforming census-based priors. Notably, the "Random Control" group (where ad order was shuffled) performed comparably to the sequential model for socio-economic traits, suggesting that the cumulative semantic content is the primary signal, while temporal order aids in identifying life-stage stability (Age).
• Cost and Efficiency: The automated approach was found to be 223 times cheaper and 52 times faster than human analysis.

Significance and Claims
The paper claims to provide the first empirical evidence that ad streams function as a high-fidelity digital footprint capable of enabling off-platform profiling that inherently bypasses current platform safeguards. The authors argue that the convergence of latent ad signals and the zero-shot capabilities of LLMs creates a systemic vulnerability in the ad ecosystem.

The significance of this work lies in demonstrating that the threat of privacy violation has shifted from requiring specialized, resource-heavy attacks to being accessible via "off-the-shelf" tools. The authors highlight that this risk is particularly acute in the browser extension ecosystem, where benign-looking tools (e.g., ad blockers) possess the legitimate permissions necessary to harvest ad content silently. The findings suggest that current privacy policies may underestimate risks by focusing on exact identification rather than semantic profiling, and they underscore the urgent need for responsible web AI governance in the generative AI era. The paper concludes that passive exposure to algorithmic content constitutes a significant leakage vector, allowing adversaries to reconstruct user identities without the need for long-term tracking or direct access to user data.