The Web Conference Workshop 2026 Workshop Report

The Research Track

Accepted Papers

1. Towards Automated Brand-Safety Detection: A Novel Dataset and Comparative Analysis of Language Models, Xin Peng and Gerald Penn
2. Feedback Control for Small Budget Campaigns in Advertising, Sreeja Apparaju, Yichuan Niu and Xixi Qi
3. Calculating Narrative Tension for Ad Placement in Online Narrative Fiction, Vedansh Mehta, Sajad Shirali-Shahreza and Gerald Penn
4. Anatomy of Generative Scam Campaigns in Online Advertising Ecosystems, Ewelina Bartuzi-Trokielewicz and Alicja Martinek
5. Smart Fast Finish: Preventing Overdelivery via Daily Budget Pacing at DoorDash, Rohan Garg, Yongjin Xiao, Jason Yang and Mandar Rahurkar

Research Outcomes

Content Integrity and Automated Brand Safety

As the volume of user-generated content (UGC) grows, the industry faces a "nuance gap" in protecting brand reputations.

• Brand Safety Dataset: Researchers presented the first comprehensive English text dataset for brand safety using Wattpad stories, utilising the GARM framework to classify nine safety categories, using 435 chapters from Wattpad annotated against the GARM framework. The study revealed that while zero-shot LLMs like ChatGPT show promise for explicit content, domain-specific fine-tuning (e.g., RoBERTa) remains essential for nuanced categories such as "Debated Sensitive Social Issues".
• The GARM Framework: The use of the Global Alliance for Responsible Media (GARM) floor remains the primary taxonomical source for brand safety. However, the "nuance gap" in zero-shot LLMs suggests that domain-specific fine-tuning (e.g., RoBERTa) is required for reliable on-device or TEE-based classification.
• The Nuance Gap: The study revealed that while zero-shot Large Language Models (LLMs) like ChatGPT can identify explicit content, they struggle with context-dependent safety issues, particularly "Debated Sensitive Social Issues".
• Technical Benchmarking: Fine-tuned encoder models like RoBERTa demonstrated superior consistency, maintaining F1 scores above 0.83 by optimising for multi-label classification and learning the relationships between safety categories.

Algorithmic Marketplace Stability and Budget Pacing

The second session focused on the mathematical stabilisation of ad delivery, particularly for campaigns sensitive to auction volatility and attribution lag. Ensuring that ad marketplaces remain stable, especially for small advertisers, requires moving beyond ad-hoc tuning toward rigorous control-theoretic frameworks.

• Bucketized Hysteresis for Small Budgets: To address the extreme sensitivity of small-budget campaigns, researchers introduced the Bucketized Hysteresis Controller (BHC). By discretising error space into bands and applying multiplicative updates, the "slowed-bands" variant reduced pacing error by 13% and λ-volatility by 54% compared to legacy production systems.
• Mitigating Overdelivery via Smart Fast Finish (SFF): DoorDash presented a solution for delayed attribution and overdelivery, where advertisers are billed for conversions that occur after a budget is depleted due to lag. SFF uses a non-linear function to dynamically set ASAP start times based on 6-month historical overspend ratios, successfully reducing average overdelivery from 7% to 4.7% while increasing campaign "live hours" by 4.2%.

Psychological Contextualisation of Ad Placement

As browsers take on more synthesis and summary tasks, the standards for identifying "safe" and "appropriate" context must be refined. The paper proposed a shift toward Narrative Tension as a metric for placement. It explored how deep learning can better align advertisements with the context and psychological state of the reader.

• Baroni's Tripartite Model: Based on the poetics of plot, the paper evaluated how LLMs could detect Suspense, Curiosity, and Surprise.
• Narrative Tension Profiles: Proposing narrative tension (suspense, curiosity, surprise) as an ad-insertion metric offers a more psychological approach than arbitrary time-based breaks. However, the extremely low inter-annotator reliability (κ = 0.08) suggests that "psychological appropriateness" remains difficult to standardise objectively.
• The Reliability Challenge: A critical finding for standardisation experts was the extremely low inter-annotator reliability (κ = 0.08) among human readers. This suggests that while LLMs can generate consistent "tension profiles," the industry still lacks a stabilised, objective definition of what constitutes a "high-tension" moment for a general audience.

Defensive Architectures Against Generative Fraud

The emergence of generative AI has industrialised scam production, rendering traditional "asset-level" detection (checking one ad at a time) obsolete. Also, Generative AI has industrialised deception, lowering the time to create convincing phishing from 16 hours to 5 minutes, with a 14-fold surge in AI-generated campaigns recently.

• Anatomy of Generative Scams: A 1.5-year longitudinal study revealed that scammers have shifted from individual ads to industrialised production pipelines. Fraud is now organised into a multi-layered hierarchy: Narratives → Production Templates → Creative Variants → Cloaking Layers to scale.
• The Role of Cloaking: Findings show that auxiliary "cloaking" content (neutral or synthetic filler) is used as a first-class strategy to dilute abuse signals and mask core scam creatives. Because adversaries generate massive volumes of near-duplicate variants through minor perturbations, the workshop concluded that artifact-level detection is structurally disadvantaged and must be replaced by campaign-level structural analysis.
• Operational Findings: Scammers use synthetic audio (found in 95% of analysed creatives) as a cheap narrative carrier while rotating thousands of near-duplicate visual variants to evade filters.
• Strategic Imperative: Mitigation must shift to campaign-level analysis, targeting the "production templates" and "bursty" publication patterns rather than individual files. Standards must ensure that privacy obfuscation does not inadvertently hide the structural signals (like bursty publishing patterns and auxiliary cloaking content) needed to identify these coordinated pipelines.

Concerns Raised During the Research

Agent-Mediated Advertising and the Loss of Traditional Signals

A recurring concern from the brainstorming responses was that emerging platforms disrupt the basic assumptions of the current advertising ecosystem. Traditional advertising models depend on a chain of human actions: a user searches, visits a page, sees an advert, clicks and converts. AI browsers, voice assistants and XR environments may break this chain because the agent can recommend, compare, filter or transact before the user ever opens a conventional page. Participants argued that this is not merely a measurement problem, but a more fundamental question about what advertising means when the decision-making intermediary is a machine.

This issue becomes especially relevant for immersive commerce. In AR product previews, virtual try-ons, 3D configurators, spatial shopping environments or marker-triggered retail experiences, the commercial interaction may be exploratory, embodied and agent assisted rather than page based. The workshop therefore identified a need to define concepts such as agent mediated recommendations, immersive product influence, spatial engagement and agent mediated impressions before these behaviours become embedded in proprietary platform models.

Trust, Disclosure and Commercial Influence

Participants highlighted that there is limited empirical evidence on how users interpret commercial recommendations made by agents. It remains unclear whether users perceive agent recommendations as neutral assistance, personalised advice, paid placement or brand influence. This concern is amplified in immersive environments, where recommendations may be presented through spatial interfaces, product overlays, AR mirrors, virtual showrooms or contextual objects in the user's surroundings.

The report should therefore recognise the need for research into how disclosures, labels and explanations affect user trust in immersive and agent-mediated commerce. This includes whether users understand when an agent is recommending a product because it is genuinely relevant, because it has a commercial relationship with a brand or because certain products are more machine readable or better represented in structured data.

Consent, Data Flows and Sensor-Derived Context

The survey responses strongly emphasised the gap between consent banner compliance and actual behavioural compliance across the advertising stack. Participants argued that companies need to audit whether user choices genuinely change how data moves through downstream systems. In immersive and WebXR contexts, this issue expands beyond cookies and identifiers to include sensor derived, spatial and environmental data.

Immersive advertising may involve signals such as spatial placement, interaction timing, physical movement, room context, product markers, accessibility adaptations or agent mediated user preferences. Participants therefore identified consent propagation as a central standardisation challenge: user choices should travel with data requests, agent actions and measurement events rather than remaining at the original page boundary.

Shared Abuse Infrastructure Across Emerging Platforms

Participants also raised the concern that abuse infrastructure is increasingly shared across many different bad actors. Scam campaigns may reuse cloaking templates, creative variants, asset pools and campaign structures across multiple platforms. This creates a particular risk for emerging platforms, including immersive and agentic environments, because they may not yet have enough historical data to recognise known abuse patterns.

For immersive advertising, the equivalent risk may include reused deceptive templates for AR overlays, fake product previews, misleading marker triggered experiences, synthetic product demonstrations or manipulative spatial interfaces. Participants suggested that research and standardisation should shift from analysing isolated scam creatives to identifying reusable infrastructure, shared templates and cross-platform abuse patterns.

Privacy and Post-cookie Advertising

The discussions in brainstorming emphasise the challenges posed by agentic browsers, which disrupt traditional browsing models and threaten current post-cookie infrastructures. These browsers, where AI agents research without user interaction, could lead to a measurement crisis in 3–5 years. To address this, new attribution frameworks focused on influence rather than action are needed, and the W3C Attribution standard should include agentic scenarios. Brands and publishers must also optimise for AI recommendation presence.

The post-cookie transition has negatively impacted publisher economics, especially for smaller publishers, leading to ad spend concentration in walled gardens. To address this, research should quantify the transition's impact on revenue, and content monetisation standards like CoMP should ensure publishers are compensated for AI-generated summaries. Publishers must proactively build authenticated audience relationships and adopt structured content metadata to stay competitive. Content monetisation for AI-consumed content is a near-term problem with aligned incentives, and implementing minimal content access standards can pave the way for future frameworks.

Standardisation Impact Summary

1. The Browser as Mediator and Strategic Mediator

The browser is evolving into the central coordination layer for the web, mediating relationships between users, brands, publishers, and agents. For standardisation, this necessitates moving beyond "passive rendering" specs toward protocols that support bounded autonomy, where agents have scoped authority rather than ambient power. A critical lesson from the Privacy Sandbox initiative is that this mediation must be transparent and work for all stakeholders to avoid becoming a new form of gatekeeping. This trajectory can have impacts on the standard scope of web user agents.

2. Privacy-Preserving Architecture and Scoped Consent

• Machine-Readable Trust: Privacy policies must shift from human-oriented legal text to machine-readable rules that AI agents can interpret directly.
• Partitioned State: Standards like CHIPS (Cookies Having Independent Partitioned State) and the tightening of SameSite attributes are foundational to Samsung's approach to browser privacy, moving away from broad cross-site tracking.
• Consent Portability: Privacy preferences must travel through the entire stack, across ad tech systems and agentic workflows, requiring new standardised ways to communicate scoped permission.

3. Rethinking Attribution and Monetisation Protocols

• Upstream Attribution: Current models built on "the click" are insufficient for AI-mediated journeys where influence occurs during the synthesis phase. Measurement must evolve to capture "recommendation influence" rather than just last-click conversion.
• Content Monetization Protocol (CoMP): There is a critical need for frameworks like CoMP to allow AI systems and publishers to exchange permissions and licensing terms, ensuring value flows back to creators when agents summarise or recommend their content.
• Server-Side Signals: As browser-side observability declines, standards should prioritise trusted server-side events and privacy-safe data collaboration environments (clean rooms).

3a. Immersive and Agent-Mediated Commerce

• Agent Mediated Impressions: Current ad measurement assumes page visits, impressions, clicks and conversions. Immersive and agent mediated journeys may require new definitions for influence, including when an agent recommends, summarises, compares or selects a product without the user seeing a conventional advert.
• Spatial Product Metadata: AR assisted shopping, 3D configurators, virtual try-ons and marker triggered commerce experiences require product information that can be interpreted by humans, browsers and AI agents. Standardisation may be needed around how 3D products, spatial interactions, product constraints, accessibility fallbacks and commercial relationships are described.
• Physical to Digital Entry Points: QR-code like markers, product packaging, shelf labels, posters, catalogues and receipts can act as bridges between physical commerce and digital or immersive experiences. Standards work should consider how these entry points are recognised, described and made usable by both people and agents, while protecting privacy and accessibility.
• Sensor and Context Boundaries: Immersive advertising creates new consent boundaries around spatial data, device pose, hand input, environment understanding and other context-sensitive signals. Standards should support data minimisation, clear permission boundaries, and user control over how spatial or sensor-derived data is used for advertising and measurement.

4. Integrity and Anti-Fraud Standards

• Campaign-Level Structural Analysis: Standardisers must account for the shift from artifact-level detection to campaign-level analysis. If privacy specs obfuscate all cross-asset signals, platforms may lose the ability to detect industrialised fraud pipelines that use "cloaking" to hide scam creatives.
• Cross-Platform Threat Intelligence for Emerging Interfaces: Participants noted that newer platforms may lack historical data to recognise reused scam infrastructure. For immersive and agentic interfaces, this suggests a need for shared ways to report infrastructure level abuse signals, such as reused templates, cloaking patterns, asset pools, suspicious marker-triggered flows or synthetic product demonstrations, without exposing personal user data.
• Prompt Injection Mitigation: Security specs for agentic browsers must incorporate the principle of "least privilege" to prevent hijacking through untrusted content, requiring an auditable trace for every agent action.

5. Technical Pacing and Auction Stability

• Hysteresis-Based Controllers: For private auction environments (e.g., Protected Audience), the use of Bucketized Hysteresis provides a blueprint for stabilising small-budget campaigns, which are prone to oscillations in high-gain regimes.
• Delayed Attribution Handling: Pacing standards must address "overdelivery" via non-linear timing functions (like Smart Fast Finish) to handle the conversion-lag inherent in charge-per-conversion models.

Summary For Standardisation Experts

Additional Immersive and Emerging-Platform Considerations