# Attribute Inference from Interactive Targeted Ads

arXiv: https://arxiv.org/abs/2606.15209 · HTML: https://mlsanity.com/paper/2606.15209/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 23 references that are in the map.
- First posted on arXiv 13 Jun 2026.

## Builds on (most cited first, 11 of 11)

- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [A Survey of Privacy Attacks in Machine Learning](https://mlsanity.com/paper/2007.07646/) (2020)
- [Are Attribute Inference Attacks Just Imputation?](https://mlsanity.com/paper/2209.01292/) (2022)
- [A Synthetic Dataset for Personal Attribute Inference](https://mlsanity.com/paper/2406.07217/) (2024)
- [Sociotechnical Audits: Broadening the Algorithm Auditing Lens to Investigate Targeted Advertising](https://mlsanity.com/paper/2308.15768/) (2023)
- [A Zero Auxiliary Knowledge Membership Inference Attack on Aggregate Location Data](https://mlsanity.com/paper/2406.18671/) (2024)
- [Systematic discrepancies in the delivery of political ads on Facebook and Instagram](https://mlsanity.com/paper/2310.10001/) (2023)
- [Unique on Facebook: Formulation and Evidence of (Nano)targeting Individual Users with non-PII Data](https://mlsanity.com/paper/2110.06636/) (2021)
- [Web3 Meets AI Marketplace: Exploring Opportunities, Analyzing Challenges, and Suggesting Solutions](https://mlsanity.com/paper/2310.19099/) (2023)
- [External Evaluation of Discrimination Mitigation Efforts in Meta's Ad Delivery](https://mlsanity.com/paper/2506.16560/) (2025)
- [Reckless Designs and Broken Promises: Privacy Implications of Targeted Interactive Advertisements on Social Media Platforms](https://mlsanity.com/paper/2603.03659/) (2026)

## Abstract (arXiv)

Targeted advertising systems can pair audiences selected by advertisers with ad units that expose visible user actions. When an interaction remains linked to the campaign that elicited it, the advertiser may receive an observation tied to a user rather than only an aggregate report. We model that channel as a noisy oracle for attribute inference. The model separates targeting predicates, exposure, interaction, and disclosure. These boundaries capture the gap between eligibility and delivery, and the gap between interaction and advertiser visibility. We build a reproducible benchmark using synthetic populations calibrated with public data, each with known sensitive labels. A generated campaign semantics layer provides topic variants and response priors. The simulator generates the ground truth, event traces, disclosed observations, and metrics. The evaluation compares Bayesian, supervised, positive and unlabeled, and adaptive attacks under common campaign and disclosure definitions. The final evaluation uses four topic variants, seven simulator seeds, and two interaction settings. Repeated campaigns with identity exposure produce measurable but bounded inference signal. At 160 campaigns, Bayesian and supervised attacks reach about 0.64 AUC in the main setting and about 0.65 AUC in the higher interaction setting. Disclosure policy is the strongest control. Aggregate reporting removes the evaluated oracle input tied to users. Type filtering and randomized disclosure reduce the released signal. The result is a model, artifact, and defense evaluation method for privacy in interactive targeted advertising. The code is available at https://github.com/P-HOW/Interactive-Ad-Oracle.