{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/ad-versarial-perceptual-ad-blocking-meets","title":"AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning","arxiv_id":"1811.03194","date":"2018-11-08","proceeding":null,"authors":["Florian Tramèr","Pascal Dupré","Gili Rusak","Giancarlo Pellegrino","Dan Boneh"],"abstract":"Perceptual ad-blocking is a novel approach that detects online advertisements based on their visual content. Compared to traditional filter lists, the use of perceptual signals is believed to be less prone to an arms race with web publishers and ad networks. We demonstrate that this may not be the case. We describe attacks on multiple perceptual ad-blocking techniques, and unveil a new arms race that likely disfavors ad-blockers. Unexpectedly, perceptual ad-blocking can also introduce new vulnerabilities that let an attacker bypass web security boundaries and mount DDoS attacks. We first analyze the design space of perceptual ad-blockers and present a unified architecture that incorporates prior academic and commercial work. We then explore a variety of attacks on the ad-blocker's detection pipeline, that enable publishers or ad networks to evade or detect ad-blocking, and at times even abuse its high privilege level to bypass web security boundaries. On one hand, we show that perceptual ad-blocking must visually classify rendered web content to escape an arms race centered on obfuscation of page markup. On the other, we present a concrete set of attacks on visual ad-blockers by constructing adversarial examples in a real web page context. For seven ad-detectors, we create perturbed ads, ad-disclosure logos, and native web content that misleads perceptual ad-blocking with 100% success rates. In one of our attacks, we demonstrate how a malicious user can upload adversarial content, such as a perturbed image in a Facebook post, that fools the ad-blocker into removing another users' non-ad content. Moving beyond the Web and visual domain, we also build adversarial examples for AdblockRadio, an open source radio client that uses machine learning to detects ads in raw audio streams.","url_abs":"https://arxiv.org/abs/1811.03194v3","url_pdf":"https://arxiv.org/pdf/1811.03194v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"ad-versarial-perceptual-ad-blocking-meets","repo_url":"https://github.com/ftramer/ad-versarial","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"},{"task_slug":"blocking","task_name":"Blocking"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=1811.03194","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1811.03194"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ftramer/ad-versarial","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":15},"by_repo_kind":{"official":{"samples":15,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7471ef5863e35839","entry":"batch_eval","repo":"ftramer/ad-versarial","repo_kind":"official","path":"page-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/page-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7471ef5863e35839"}},{"code_sha256_prefix":"1f1b48c13ddfd7f1","entry":"batch_eval_ch","repo":"ftramer/ad-versarial","repo_kind":"official","path":"page-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/page-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1f1b48c13ddfd7f1"}},{"code_sha256_prefix":"f11417cdc9ea3460","entry":"blend_transparent","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f11417cdc9ea3460"}},{"code_sha256_prefix":"6f84e0253750d23a","entry":"blend_white","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6f84e0253750d23a"}},{"code_sha256_prefix":"35ac26a4707546ca","entry":"compare_hash","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/phash/model.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/phash/model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"35ac26a4707546ca"}},{"code_sha256_prefix":"f7a281adc4fb2f95","entry":"is_equal","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/exact_match.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/exact_match.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f7a281adc4fb2f95"}},{"code_sha256_prefix":"35a4a4659ccecb7a","entry":"load_example","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/OCR/evade_or_fp_attack.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/OCR/evade_or_fp_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"35a4a4659ccecb7a"}},{"code_sha256_prefix":"b7e77d2bb35e1278","entry":"load_image","repo":"ftramer/ad-versarial","repo_kind":"official","path":"page-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/page-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b7e77d2bb35e1278"}},{"code_sha256_prefix":"968725378659c630","entry":"load_weights","repo":"ftramer/ad-versarial","repo_kind":"official","path":"page-based/yolo_v3.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/page-based/yolo_v3.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"968725378659c630"}},{"code_sha256_prefix":"4622646a7161f4cc","entry":"phash_dct_tf","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/phash/model.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/phash/model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4622646a7161f4cc"}},{"code_sha256_prefix":"c347a1bee1e9939f","entry":"remove_alpha","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/phash/model.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/phash/model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c347a1bee1e9939f"}},{"code_sha256_prefix":"4ceb2d6022efa952","entry":"resize","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/sift/model.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/sift/model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4ceb2d6022efa952"}},{"code_sha256_prefix":"fdf8f85f406426a8","entry":"squeezenet1_0","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/percival/ModuleSqueezeNet1.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/percival/ModuleSqueezeNet1.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fdf8f85f406426a8"}},{"code_sha256_prefix":"43cd5c22cd650a33","entry":"squeezenet1_1","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/percival/ModuleSqueezeNet1.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/percival/ModuleSqueezeNet1.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"43cd5c22cd650a33"}},{"code_sha256_prefix":"45c374c2c75105a5","entry":"to_gray","repo":"ftramer/ad-versarial","repo_kind":"official","path":"element-frame-based/utils.py","file_url":"https://github.com/ftramer/ad-versarial/blob/HEAD/element-frame-based/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"45c374c2c75105a5"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}