Eluding ML-based Adblockers With Actionable Adversarial Examples

Online advertisers have been quite successful in circumventing traditional adblockers that rely on manually curated rules to detect ads. As a result, adblockers have started to use machine learning (ML) classifiers for more robust detection and blocking of ads. Among these, AdGraph which leverages rich contextual information to classify ads, is arguably, the state of the art ML-based adblocker. In this paper, we present A(4), a tool that intelligently crafts adversarial ads to evade AdGraph. Unlike traditional adversarial examples in the computer vision domain that can perturb any pixels (i.e., unconstrained), adversarial ads generated by A(4) are actionable in the sense that they preserve the application semantics of the web page. Through a series of experiments we show that A(4) can bypass AdGraph about 81% of the time, which surpasses the state-of-theart attack by a significant margin of 145.5%, with an overhead of <20% and perturbations that are visually imperceptible in the rendered webpage. We envision that A(4)'s framework can be used to potentially launch adversarial attacks against other ML-based web applications.