Privacy-Friendly Cohort Determination: Sealed, CSP-Independent In-Browser ML Inference of Professional Segments for Identity-Less Advertising

Om Shankar Tiwari; Navnit Shukla; Guanyu Wang; Akshay Jain

cs.CRSep 28, 2026

Privacy-Friendly Cohort Determination: Sealed, CSP-Independent In-Browser ML Inference of Professional Segments for Identity-Less Advertising

Authors: Om Shankar Tiwari, Navnit Shukla, Guanyu Wang, Akshay Jain

Organizations: Applied AI Technical Lead, Google · Principal AI Architect, Snowflake Inc. · Staff Software Engineer, TikTok · Staff Software Engineer, LinkedIn

Abstract

B2B advertising targets a viewer's professional attributes (employer size and industry, function, seniority) and has obtained them by matching identities across sites. Safari and Firefox block third-party cookies, Google retired the Privacy Sandbox cohort APIs in 2025, and reverse-IP firmographics decay under remote work. We present SIF (Sealed Inference Frame), which infers coarse professional cohorts on the device and emits only a locally differentially private, taxonomy-coded label into the OpenRTB bid stream, with no cross-site identifier. It rests on a property of the web platform we make precise: a navigated cross-origin iframe is the only way third-party code obtains a policy it controls, so inference runs in WebAssembly even where the publisher's CSP forbids it, and a nested worker served with default-src 'none' gives the model no network. Even a malicious model leaks at most about 5 bits per site per week. Labels pass through a memoised k-ary randomised response keyed to the publisher's first-party identifier, which gives $\varepsilon$ -local differential privacy, defeats averaging, and links requests no better than the identifier already sent. An org-conditional k-anonymity rule suppresses cells, more strictly on corporate networks than at home. Cohorts ride OpenRTB user.data in a LinkedIn-aligned taxonomy, and attribution uses LinkedIn's click-scoped li_fat_id without bridging identities. We report a crawl of CSP deployment on 7,969 top sites and 431 B2B publishers, Heavy-Ad budgets, closed-form privacy-utility trade-offs, a re-identification simulation, and an assessment of which attributes are predictable at all: company type and size are, seniority largely is not. On-device is a design property, not a consent exemption.

Figures & tables

Panel of Figure 1 — Fig. 1: Parties and data flows. The only tier with network access to the vendor is T1, which receives model bytes and the coarse IP-context vector and emits a noised label to T0. The bid stream carries the cohort as OpenRTB user.data alongside whatever the publisher already sends. Attribution on the demand side uses the click-scoped li_fat_id the DSP already has, and cohort-level counts are released under the platform’s existing floors.

Panel of Figure 2 — Fig. 2: The three tiers of SIF. Egress exists only from T0 (the bid request) and T1 (model and IP-context fetch to the vendor origin). T2 has none by construction. The noise is applied in T1, not in the model.

Panel of Figure 3 — Fig. 3: Who authors the CSP of each execution context that third-party script can open from a publisher page, under HTML’s policy-container rules [ 48 , 49 ] . Every local-scheme frame and every worker created from the page keeps the publisher’s policy or is gated by it. Only a navigated cross-origin iframe takes its policy from the third party’s own response (Proposition 1 ); a worker created inside that frame takes its policy from its own script response, which is how T2 is sealed.

Panel of Figure 4 — Fig. 4: One auction. Network requests leave the browser only from T1 (to the vendor origin) and from T0 (the bid request). T2 receives everything by postMessage and answers the same way. On later auctions within the epoch, T1 serves the label from its memo table without running T2.

	Tranco 10k	B2B/news
Reachable sites ( $n$ )	7,969	431
Any enforced CSP	33.7%	52.7%
script-src or default-src present	17.4%	24.4%
lacking unsafe-eval and wasm-unsafe-eval	3.8%	5.3%
Page-context Wasm blocked (dynamic probe)	3.7%	4.9%
Vendor frame permitted ( frame-src chain)	88.8%	86.8%

TABLE I: CSP deployment relevant to SIF, as a percentage of reachable sites.

	$\varepsilon=2$			$\varepsilon=3$			$\varepsilon=4$
Axis ( $C$ )	$p$	cap.	adv.	$p$	cap.	adv.	$p$	cap.	adv.
Size (4)	.71	.68	.28	.87	1.24	.51	.95	1.62	.65
Seniority (5)	.65	.68	.25	.83	1.34	.50	.93	1.83	.67
Function (10)	.45	.59	.14	.69	1.45	.39	.86	2.29	.64
Industry (20)	.28	.41	.06	.51	1.26	.23	.74	2.40	.50

TABLE II: Operating points of the per-axis mechanism.

p

: probability of emitting the true value. cap.: covert-channel capacity per emission (bits). adv.: linkage advantage under a uniform prior.

Fig. 5: Probability that an employee is unique within a resolved organisation, by organisation size. Unnoised seniority

\times

function labels single out most employees of small firms. Value-dependent suppression followed by randomised response over the full value set leaves a bump in mid-sized firms, because flipped coins land on values nobody else emits. Definition 1 lies on the organisation-only baseline at both budgets.

Online Advertising

Online advertising studies how digital ads are targeted, ranked, priced, measured, and delivered while balancing budgets, business goals, and user interests.

See all 87 papers

Jun 15, 2026

Cross-Silo De-Anonymization Under Local Differential Privacy: Threat Model, Phase Transition, and Coordination Necessity

When a person's records appear in k independent data silos, each protected by (epsilon, delta)-differential privacy, standard composition yields a valid (kepsilon, kdelta)-DP guarantee for the joint output. This worst-case bound, however, does not answer the concrete inference question: at what k can an adversary actually identify a target person? This paper develops the information-theoretic framework needed to answer that question. We introduce cross-silo person-level DP (XSP-DP), a Pufferfish-style privacy notion whose adjacency relation captures all records of a single person across all silos simultaneously, and verify that the standard basic composition bound carries over to this adjacency model. Within this framework we prove that de-anonymization undergoes a phase transition at k* = Theta(log n / epsilon^2) (population size n, per-silo RR parameter epsilon): a Fano lower bound shows any estimator fails for k << k*, while a matching maximum-likelihood upper bound shows the attack succeeds for k >> k*. An explicit XOR + randomized-response construction demonstrates information synergy: each silo's output is individually uninformative about the target, yet the joint mutual information is strictly positive. For non-coordinated binary randomized-response mechanisms, we prove that de-anonymization is inevitable once k exceeds the threshold, establishing that cross-silo coordination is necessary. These results provide a baseline threat model and Theta-level threshold for cross-silo inference attacks under local DP.

Ziniu Liu, Aiping Li

National University of Defense Technology

Differential Privacy

Ask PDF

Jun 13, 2026

Attribute Inference from Interactive Targeted Ads

Targeted advertising systems can pair audiences selected by advertisers with ad units that expose visible user actions. When an interaction remains linked to the campaign that elicited it, the advertiser may receive an observation tied to a user rather than only an aggregate report. We model that channel as a noisy oracle for attribute inference. The model separates targeting predicates, exposure, interaction, and disclosure. These boundaries capture the gap between eligibility and delivery, and the gap between interaction and advertiser visibility. We build a reproducible benchmark using synthetic populations calibrated with public data, each with known sensitive labels. A generated campaign semantics layer provides topic variants and response priors. The simulator generates the ground truth, event traces, disclosed observations, and metrics. The evaluation compares Bayesian, supervised, positive and unlabeled, and adaptive attacks under common campaign and disclosure definitions. The final evaluation uses four topic variants, seven simulator seeds, and two interaction settings. Repeated campaigns with identity exposure produce measurable but bounded inference signal. At

160

campaigns, Bayesian and supervised attacks reach about

0.64

AUC in the main setting and about

0.65

AUC in the higher interaction setting. Disclosure policy is the strongest control. Aggregate reporting removes the evaluated oracle input tied to users. Type filtering and randomized disclosure reduce the released signal. The result is a model, artifact, and defense evaluation method for privacy in interactive targeted advertising. The code is available at https://github.com/P-HOW/Interactive-Ad-Oracle.

Peihao Li

Privacy Auditing Adversarial Attacks Online Advertising User Attribute Inference Attacks

Ask PDF

Jul 14, 2026

Proximity Features: Privacy-Compliant Cold-Start Personalization at Airbnb

Personalization in two-sided marketplaces relies heavily on user-level features, yet for platforms with infrequent, high-consideration purchases, a large fraction of users lack sufficient history for effective recommendation, spanning both paid and organic channels. At Airbnb, a substantial share of search requests comes from logged-out or first-time users, with this challenge especially pronounced on paid-channel landing pages, leaving traditional user-level features unavailable for a large fraction of traffic. Privacy regulations and increasing restrictions on third-party cookies further limit identifier-based tracking for non-essential use cases. This paper introduces Proximity Features, a privacy-compliant feature system that groups users by geographic proximity using geo-IP data and an adaptive clustering algorithm, producing aggregated user-level signals for groups of approximately 1,000 nearby users without requiring a persistent individual identifier at inference time. Privacy is preserved by design: the pipeline operates on consented, aggregated data only within consent-gated privacy controls. The system is deployed in production at Airbnb, serving multiple surfaces including marketing landing pages and destination recommendation, with engagement emails integration under way. Online A/B experiments demonstrate statistically significant lifts in bookings, with the largest gains observed among users with absent or stale history.

Wei Jiang, Bin Xu, Hui Gao +6

Airbnb Inc. San Francisco, USA

Cold-Start Recommendation Privacy-Preserving ML User Modeling Recommender Systems

Ask PDF

Abstract

Online Advertising

Explore similar work

Cross-Silo De-Anonymization Under Local Differential Privacy: Threat Model, Phase Transition, and Coordination Necessity

Attribute Inference from Interactive Targeted Ads

Proximity Features: Privacy-Compliant Cold-Start Personalization at Airbnb