# When Ads Become Profiles: Uncovering the Invisible Risk of Web Advertising at Scale with LLMs

arXiv: https://arxiv.org/abs/2509.18874 · HTML: https://mlsanity.com/paper/2509.18874/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 43 references that are in the map.
- First posted on arXiv 23 Sep 2025.

## Builds on (most cited first, 15 of 15)

- [Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities](https://mlsanity.com/paper/2507.06261/) (2025)
- [Representation Learning with Large Language Models for Recommendation](https://mlsanity.com/paper/2310.15950/) (2023)
- [Towards Open-World Recommendation with Knowledge Augmentation from Large Language Models](https://mlsanity.com/paper/2306.10933/) (2023)
- [Pedestrian Attribute Recognition: A Survey](https://mlsanity.com/paper/1901.07474/) (2019)
- [Private Attribute Inference from Images with Vision-Language Models](https://mlsanity.com/paper/2404.10618/) (2024)
- [AgentMove: A Large Language Model based Agentic Framework for Zero-shot Next Location Prediction](https://mlsanity.com/paper/2408.13986/) (2024)
- [Transparent and Scrutable Recommendations Using Natural Language User Profiles](https://mlsanity.com/paper/2402.05810/) (2024)
- [On Natural Language User Profiles for Transparent and Scrutable Recommendation](https://mlsanity.com/paper/2205.09403/) (2022)
- [Auditing for Discrimination in Algorithms Delivering Job Ads](https://mlsanity.com/paper/2104.04502/) (2021)
- [Discrimination through optimization: How Facebook's ad delivery can lead to skewed outcomes](https://mlsanity.com/paper/1904.02095/) (2019)
- [The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework](https://mlsanity.com/paper/2505.19139/) (2025)
- [GenUP: Generative User Profilers as In-Context Learners for Next POI Recommender Systems](https://mlsanity.com/paper/2410.20643/) (2024)
- [A Study on Malicious Browser Extensions in 2025](https://mlsanity.com/paper/2503.04292/) (2025)
- [Problematic Advertising and its Disparate Exposure on Facebook](https://mlsanity.com/paper/2306.06052/) (2023)
- ["All of Me": Mining Users' Attributes from their Public Spotify Playlists](https://mlsanity.com/paper/2401.14296/) (2024)

## Built on by (most cited first, 1 of 1)

- [Generative AI Advertising as a Problem of Trustworthy Commercial Intervention](https://mlsanity.com/paper/2605.18673/) (2026)

## Abstract (arXiv)

Regulatory limits on explicit targeting have not eliminated algorithmic profiling on the Web, as optimisation systems still adapt ad delivery to users' private attributes. The widespread availability of powerful zero-shot multimodal Large Language Models (LLMs) has dramatically lowered the barrier for exploiting these latent signals for adversarial inference. We investigate this emerging societal risk, specifically how adversaries can now exploit these signals to reverse-engineer private attributes from ad exposure alone. We introduce a novel pipeline that leverages LLMs as adversarial inference engines to perform natural language profiling. Applying this method to a longitudinal dataset comprising over 435,000 Facebook ad impressions collected from 891 users, we conducted a large-scale study to assess the feasibility and precision of inferring private attributes from passive online ad observations. Our results demonstrate that off-the-shelf LLMs can accurately reconstruct complex user private attributes, including party preference, employment status, and education level, consistently outperforming strong census-based priors and matching or exceeding human social perception at only a fraction of the cost (223x lower) and time (52x faster) required by humans. Critically, actionable profiling is feasible even within short observation windows, indicating that prolonged tracking is not a prerequisite for a successful attack. These findings provide the first empirical evidence that ad streams serve as a high-fidelity digital footprint, enabling off-platform profiling that inherently bypasses current platform safeguards, highlighting a systemic vulnerability in the ad ecosystem and the urgent need for responsible web AI governance in the generative AI era. The code is available at https://github.com/Breezelled/when-ads-become-profiles.