Attribute Inference from Interactive Targeted Ads

Technical Summary: Attribute Inference from Interactive Targeted Ads

Problem Statement
The paper addresses a specific privacy vulnerability in interactive targeted advertising systems where ad units invite visible user actions (e.g., comments, reactions). While prior work has identified risks in audience construction and aggregate reporting, this work focuses on the channel created when an identifiable user interaction is linked to a specific campaign predicate chosen by an advertiser. The core problem is whether these interactions function as a "noisy oracle" that allows an advertiser to infer sensitive attributes (e.g., health interests, political affiliation) about a user, even when the platform does not explicitly disclose those attributes. The attack vector relies on the advertiser treating the platform as a query surface: by selecting specific targeting predicates and observing which users interact with their ads, the advertiser accumulates a history of observations that can be used for probabilistic inference.

Methodology and System Model
The authors formalize the advertising pipeline as a four-stage process:

1. Targeting: The advertiser selects a predicate $g_c$ defining an eligible audience.
2. Exposure: The platform delivers the ad to a subset of the eligible audience (introducing noise, as eligibility $\neq$ delivery).
3. Interaction: Users may interact with the ad (introducing further noise, as delivery $\neq$ attention/action).
4. Disclosure: The platform releases records based on a disclosure policy $D$. This policy determines whether the advertiser sees aggregate statistics or identity-linked traces (e.g., "User X reacted to Ad Y").

The paper introduces a noisy oracle abstraction where the output is an engagement record tied to a user only if the disclosure policy permits it. The authors define the observation history $H_u^{(T)}$ for a user $u$ after $T$ campaigns, consisting of the sequence of predicates, campaign metadata, and disclosed interactions.

To evaluate this, the authors construct a reproducible benchmark using:

• Synthetic Populations: Calibrated with public data to ensure realistic attribute distributions and correlations, with known ground-truth sensitive labels.
• Campaign Semantics Layer: An automated layer generating topic variants and response priors to simulate realistic campaign diversity.
• Simulation: A generator that produces ground truth, event traces (exposure and interaction), and disclosed observations based on varying parameters (campaign count, interaction rates, predicate granularity, and disclosure rules).

Key Contributions

1. Formal Oracle Model: The paper defines interactive targeted ads as noisy attribute inference oracles, explicitly separating the campaign predicate, the latent user attribute, and the noisy interaction process. This formalizes the conditions under which campaign predicates become inference evidence.
2. Attack Framework: The authors instantiate and evaluate four distinct attack strategies:
   • Bayesian Attack: Uses explicit likelihood models and conditional independence assumptions.
   • Supervised Shadow Attack: Uses machine learning (logistic regression, random forests, gradient boosting) trained on synthetic data to learn correlations without explicit independence assumptions.
   • Positive and Unlabeled (PU) Attack: Treats observed interactions as positive evidence and absence from disclosed lists as either negative (closed world) or unlabeled (open world).
   • Adaptive Attack: Selects subsequent campaigns based on expected information gain to minimize cost or maximize confidence.
3. Reproducible Benchmark: A complete artifact allowing parameter sweeps over campaign counts, interaction rates, and disclosure policies without collecting sensitive data from real users.
4. Defense Evaluation: The paper evaluates platform-side defenses as transformations of the disclosure map $D$, including type filtering, randomized identity disclosure, thresholding, and aggregate reporting.

Results
The evaluation, conducted across 56 runs (4 topic variants, 7 seeds, 2 interaction settings) with 8,000 synthetic users and 160 campaigns, yields the following findings:

• Measurable Signal: Repeated campaigns with identity exposure produce a measurable inference signal. At 160 campaigns, Bayesian and supervised attacks achieve approximately 0.64 AUC in the main setting and 0.65 AUC in a higher interaction setting. This indicates that while the signal is bounded by noise (delivery and interaction rates), it is statistically significant above random chance.
• Disclosure Policy is the Primary Control: The disclosure map $D$ is the strongest determinant of risk.
  • Aggregate Reporting: Completely removes the user-indexed history input required for the evaluated attacks, reducing performance to prior ranking (AUC $\approx$ 0.50).
  • Type Filtering & Randomized Disclosure: These reduce the signal (e.g., Type filtering drops AUC to ~0.58–0.60) but do not eliminate it.
  • Thresholding: In the simulated event distributions, the evaluated threshold setting did not bind strongly, performing similarly to full identity exposure.
• Adaptive Efficiency: Adaptive campaign selection can reduce the number of campaigns or cost required to reach a target confidence level, though high-confidence inference (posterior > 0.70) remains a minority outcome in the main setting.
• Granularity Limits: Narrower predicates (longer lengths) do not automatically improve inference; they often reduce exposure opportunities due to minimum audience constraints, sometimes lowering the signal to near-prior levels.

Significance and Claims
The paper claims to provide a model, artifact, and defense evaluation method for privacy in interactive targeted advertising. Its significance lies in:

• Systematic Account: It provides the first systematic account of the interaction between advertiser-chosen targeting predicates and identity-exposing interactions as an oracle for attribute inference.
• Defense Focus: It shifts the privacy discussion from targeting policy text to the disclosure interface. The results suggest that defenses must be evaluated at the level of the disclosure map (what is released) rather than just the targeting rules (who is eligible).
• Bounded Risk: The paper modestly claims that while the inference channel exists and is measurable, the signal is bounded by the noise inherent in the delivery and interaction processes. It does not claim that these attacks can perfectly reconstruct user profiles, but rather that they can statistically infer sensitive attributes with better-than-chance accuracy under specific disclosure conditions.
• Benchmark Utility: By using synthetic data calibrated to public sources, the work enables repeatable, controlled evaluation of privacy attacks and defenses without the ethical and legal complexities of collecting sensitive labels from real users.

The authors conclude that platform governance must address the design of disclosure interfaces to mitigate privacy leakage, as aggregate reporting effectively removes the evaluated oracle input, while other mechanisms (filtering, randomization) offer partial mitigation.