# Privacy-Friendly Cohort Determination: Sealed, CSP-Independent In-Browser ML Inference of Professional Segments for Identity-Less Advertising

arXiv: https://arxiv.org/abs/2609.36153 · HTML: https://mlsanity.com/paper/2609.36153/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 78 references that are in the map.
- First posted on arXiv 28 Sep 2026.

## Builds on (most cited first, 21 of 21)

- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks From First Principles](https://mlsanity.com/paper/2112.03570/) (2021)
- [Quantifying Memorization Across Neural Language Models](https://mlsanity.com/paper/2202.07646/) (2022)
- [RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response](https://mlsanity.com/paper/1407.6981/) (2014)
- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Discrete Distribution Estimation under Local Privacy](https://mlsanity.com/paper/1602.07387/) (2016)
- [Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Apps](https://mlsanity.com/paper/2002.07687/) (2020)
- [Auditing for Discrimination in Algorithms Delivering Job Ads](https://mlsanity.com/paper/2104.04502/) (2021)
- [Moving Deep Learning into Web Browser: How Far Can We Go?](https://mlsanity.com/paper/1901.09388/) (2019)
- [Measuring Re-identification Risk](https://mlsanity.com/paper/2304.07210/) (2023)
- [Anatomizing Deep Learning Inference in Web Browsers](https://mlsanity.com/paper/2402.05981/) (2024)
- [Privacy in Targeted Advertising: A Survey](https://mlsanity.com/paper/2009.06861/) (2020)
- [A Multi-perspective Analysis of Carrier-Grade NAT Deployment](https://mlsanity.com/paper/1605.05606/) (2016)
- [Privacy Limitations Of Interest-based Advertising On The Web: A Post-mortem Empirical Analysis Of Google's FLoC](https://mlsanity.com/paper/2201.13402/) (2022)
- [Towards a Tectonic Traffic Shift? Investigating Apple's New Relay Network](https://mlsanity.com/paper/2207.02112/) (2022)
- [Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)](https://mlsanity.com/paper/2306.03825/) (2023)
- [On the Robustness of Topics API to a Re-Identification Attack](https://mlsanity.com/paper/2306.05094/) (2023)
- [Evaluating Google's Protected Audience Protocol](https://mlsanity.com/paper/2405.08102/) (2024)
- [WorkR: Occupation Inference for Intelligent Task Assistance](https://mlsanity.com/paper/2407.18518/) (2024)
- [Longitudinal Adoption and Deprecation of the Privacy Sandbox Web APIs](https://mlsanity.com/paper/2606.26390/) (2026)
- [The Rise and Fall of Google's Privacy Sandbox](https://mlsanity.com/paper/2607.00693/) (2026)

## Abstract (arXiv)

B2B advertising targets a viewer's professional attributes (employer size and industry, function, seniority) and has obtained them by matching identities across sites. Safari and Firefox block third-party cookies, Google retired the Privacy Sandbox cohort APIs in 2025, and reverse-IP firmographics decay under remote work. We present SIF (Sealed Inference Frame), which infers coarse professional cohorts on the device and emits only a locally differentially private, taxonomy-coded label into the OpenRTB bid stream, with no cross-site identifier. It rests on a property of the web platform we make precise: a navigated cross-origin iframe is the only way third-party code obtains a policy it controls, so inference runs in WebAssembly even where the publisher's CSP forbids it, and a nested worker served with default-src 'none' gives the model no network. Even a malicious model leaks at most about 5 bits per site per week. Labels pass through a memoised k-ary randomised response keyed to the publisher's first-party identifier, which gives varepsilon-local differential privacy, defeats averaging, and links requests no better than the identifier already sent. An org-conditional k-anonymity rule suppresses cells, more strictly on corporate networks than at home. Cohorts ride OpenRTB user.data in a LinkedIn-aligned taxonomy, and attribution uses LinkedIn's click-scoped lifatid without bridging identities. We report a crawl of CSP deployment on 7,969 top sites and 431 B2B publishers, Heavy-Ad budgets, closed-form privacy-utility trade-offs, a re-identification simulation, and an assessment of which attributes are predictable at all: company type and size are, seniority largely is not. On-device is a design property, not a consent exemption.