# HARPO: Learning to Subvert Online Behavioral Advertising

arXiv: https://arxiv.org/abs/2111.05792 · HTML: https://mlsanity.com/paper/2111.05792/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 101 references that are in the map.
- First posted on arXiv 9 Nov 2021.

## Builds on (most cited first, 17 of 17)

- [Convolutional Neural Networks for Sentence Classification](https://mlsanity.com/paper/1408.5882/) (2014)
- [Distributed Representations of Sentences and Documents](https://mlsanity.com/paper/1405.4053/) (2014)
- [Deep Recurrent Q-Learning for Partially Observable MDPs](https://mlsanity.com/paper/1507.06527/) (2015)
- [A C-LSTM Neural Network for Text Classification](https://mlsanity.com/paper/1511.08630/) (2015)
- [Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset](https://mlsanity.com/paper/2008.09159/) (2020)
- [Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors](https://mlsanity.com/paper/2008.04480/) (2020)
- [Ad-Blocking and Counter Blocking: A Slice of the Arms Race](https://mlsanity.com/paper/1605.05077/) (2016)
- [The Future of Ad Blocking: An Analytical Framework and New Techniques](https://mlsanity.com/paper/1705.08568/) (2017)
- [Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask](https://mlsanity.com/paper/1805.10505/) (2018)
- [If you are not paying for it, you are the product: How much do advertisers pay to reach you?](https://mlsanity.com/paper/1701.07058/) (2017)
- [Who Filters the Filters: Understanding the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking](https://mlsanity.com/paper/1810.09160/) (2018)
- [No More Chasing Waterfalls: A Measurement Study of the Header Bidding Ad-Ecosystem](https://mlsanity.com/paper/1907.12649/) (2019)
- [Protecting User Privacy: An Approach for Untraceable Web Browsing History and Unambiguous User Profiles](https://mlsanity.com/paper/1811.09340/) (2018)
- [Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning](https://mlsanity.com/paper/1603.06289/) (2016)
- [MyTrackingChoices: Pacifying the Ad-Block War by Enforcing User Privacy Preferences](https://mlsanity.com/paper/1604.04495/) (2016)
- [Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding](https://mlsanity.com/paper/1907.07275/) (2019)
- [Measuring Abuse in Web Push Advertising](https://mlsanity.com/paper/2002.06448/) (2020)

## Built on by (most cited first, 2 of 2)

- [Preserving Privacy and Utility in LLM-Based Product Recommendations](https://mlsanity.com/paper/2505.00951/) (2025)
- [PromptPET: Privacy-Utility Optimized Prompt Obfuscation](https://mlsanity.com/paper/2607.02932/) (2026)

## Abstract (arXiv)

Online behavioral advertising, and the associated tracking paraphernalia, poses a real privacy threat. Unfortunately, existing privacy-enhancing tools are not always effective against online advertising and tracking. We propose Harpo, a principled learning-based approach to subvert online behavioral advertising through obfuscation. Harpo uses reinforcement learning to adaptively interleave real page visits with fake pages to distort a tracker's view of a user's browsing profile. We evaluate Harpo against real-world user profiling and ad targeting models used for online behavioral advertising. The results show that Harpo improves privacy by triggering more than 40% incorrect interest segments and 6x higher bid values. Harpo outperforms existing obfuscation tools by as much as 16x for the same overhead. Harpo is also able to achieve better stealthiness to adversarial detection than existing obfuscation tools. Harpo meaningfully advances the state-of-the-art in leveraging obfuscation to subvert online behavioral advertising