Slashdot Mirror
Researchers Defeat Perceptual Ad Blockers, Declare 'New Arms Race' (vice.com)
dmoberhaus writes: Perceptual ad blockers were supposed to be the "superweapon" that put an end to the arms race between advertisers and users. According to new research, however, perceptual ad blockers will come out on the losing side in the war against internet advertisers and expose users to a host of new attack vectors in the process. Researchers at Stanford tricked six different visual classifiers used in perceptual ad blockers with adversarial ads designed to trick the ad blockers by making nearly imperceptible changes to the ads. "The researchers tried several different adversarial attacks on the perceptual ad blockers' visual classifiers," Motherboard reports. "One attack, for example, slightly altered the AdChoices logo that is commonly used to disclose advertisements to fool the perceptual ad blocker. In another attack, the researchers demonstrated how website publishers could overlay a transparent mask over a website that would allow ads to evade perceptual ad blockers."
"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."
"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."
Why would they test a visual ad blocker? Who uses those? All the ad blockers I have ever seen block domains. A visual ad blocker seems doomed to fail.
I don't respond to AC's.
If ads get too pervasive and hard to block people could just disable JavaScript completely.
If you want to get rid of ads, you shouldn't be looking to completely prevent them from loading because that's an eternal game of cat and mouse. Instead, you should be looking to poison advertisers click-though information. Basically, fooling ads into thinking you have clicked them and loading things in the background (after you have loaded the page excluding the ads) would have a very negative effect on advertisers because it spoils the very thing they keep track of: who clicks-through to a site. If most people provided a completely false click-through and browsing information it would diminish the value of ads entirely.
Honestly, people are fighting ad networks all wrong.
Anons need not reply. Questions end with a question mark.
The problem I have seen with ad blockers (and admittedly, I have only tried a few, and haven't put a lot of effort into trying to find the best or most useful one) is that they work by preventing the loading of certain parts of web sites. Like, they refuse to load images from a certain domain, or refuse to load and run javascript from a certain domain, or whatever. The important point is that I believe they work by not loading content that they want to block.
It is my experience that sites can detect this behavior - they can tell when you have loaded all of a page but not the ads, because they can see that your browser only fetched part of the page. They probably also embed javascript in ways that require that it be run and show an ad or else some other javascript notices that this did not happen, and then knows that you did not load the ad. And then they run other javascript that blocks out the content of the site itself because they have detected that you are running an ad blocker.
I don't know why ad blockers don't then just implement the obvious:
Load the ad. Load the javascript. Just turn all the pixels that you display for those ads to white, and all the sound to zero volume. The javascript won't know that behind the scenes the APIs that would display images have instead decided to show white pixels. The remote server will still see you fetching all the content and "presenting" it to the user.
I'm talking about switching ad blocking from a detectable and defeatable "don't show ads" to an undetectable (by the ad displayer) "do everything you would have done up to the last possible moment which is the presentation of the ad image/sound, instead showing nothing".
This seems so much more foolproof to me. It doesn't have the nice property of reducing your bandwidth usage by not even loading ads but ... I personally don't care much about that. I just don't want to see the ads.
The only recourse of the advertisers at that point would be to make the content of the ads intrinsic to the content of the site; like the site text renders in javascript that also renders ads, or something. At that point, I don't know what we do to stop ads ... maybe stop allowing javascript?
In terms of how to detect what is an ad, just let users clock on anything that shows up as an ad image, choose a pop-up "this is an ad", when they select that, white out the image, and add the URL of the ad image to a voting database. Then when fetching images, if enough votes have been cast saying that it's an ad ... treat it as such.
What are the obvious flaws to this design that I am missing?
You know, I've given internet marketers a chance to explain themselves. An opportunity to prove they're not complete morons who not only don't understand their product, but their customer. I've been patient with them as they introduce new and ever more obnoxious and invasive advertising techniques that are heavily lauded, but that don't actually work. I've read their blogs. I've commented on their forums. I've tried to speak reason to power. And now... I'm done.
As I've explained to these intrepid idiots in the marketing industry for the last decade, people block ads because they're a blight. They're implemented poorly. They often contain malware which largely goes unpoliced, and they diminish the reading experience on pretty much any site they're on. If you're on a website, and the ads don't completely destroy both the credibility and quality of the host site, you're probably on buzzfeed. Nearly everywhere else, you're going to notice this nonsense.
The war on adblockers is a lost cause. Breaking adblockers is not going to result in higher clickthrough rates. It never has, in the entire time it's been around. If a user LOVES your website, they might whitelist you. Short of that, they'll bounce and get your content from somewhere else. Calling attention to and requesting a modification in the software a user runs is a violation of user rights. Period. Plain and simple. And it raises suspicions about the host site, bringing to the user's mind the other invasive practices a site might be engaged in, and the handling of their personal data in general. If you wouldn't demand to look in someone's underwear drawer when selling them a newspaper, you shouldn't engage in the ongoing harassment of your users in this way. There is no moral difference.
Asking users who are taking aggressive steps not to see ads will only result in lower documented clickthrough rates. It'll result in more bounce traffic. It'll result in fewer people showing an interest in your site, and less exposure over social media. Mind you, a lot of people that have never clicked on an ad in their lives think nothing of sharing your article with their network of followers. If you track the engagement numbers on sites that behave in this way, you'll see a downward trend overall in their engagement numbers -- resulting, ironically, in fewer ad impressions, and fewer clicks.
I don't know if there's anything to do about it. If the industry wants to sit there and gnaw off its own leg, they're welcome to do it. And I'm sure they will. Like I said in the beginning of this rant, they're not exactly the brightest bulbs to begin with.
This signature has Super Cow Powers