Search query logs are invaluable for scientific research, particularly in the medical domain, yet they pose significant privacy risks through the potential exposure of Personally Identifiable Information (PII). This work addresses the dual challenge of quantifying PII vulnerability and evaluating effective anonymization strategies to prevent these vulnerabilities. We collected search query logs and PII information of 11 attributes from 19 consenting participants. Human analysts and an offline Large Language Model (LLM) attempted to identify the PII from the query logs. Our findings show that some PII values are easily identified (e.g., age group, which was identified in 67% of cases) but others, such as participant name, are much more difficult, though the risk is non-negligible (8%). Notably, human analysts exhibit significant inconsistency in the PII they were able to infer. The LLM reached identification results that were statistically indistinguishable from those of human analysts, and both were statistically significant better than classic Named-Entity Recognition methods. We tested the ability to hinder identification of PII through two techniques: Sanitization (data removal) and Obfuscation (noise addition). While the former did not provide statistically significant reductions in identification of PII, the latter did. Specifically, the Dissimilar Addition method, where queries from a user with dissimilar PII values were injected, achieved a statistically significant reduction in identification accuracy (absolute reduction of 18%) while requiring significantly fewer data modifications than the best sanitization techniques. These findings indicate that effectively anonymizing query logs requires masking the signal rather than simple data suppression. Our work shows that query logs reveal some PII values, but that these can be masked to a certain extent using appropriate techniques. This opens the way to protecting privacy in query logs with minimal effect on the utility of the logs and, more broadly, to the development and testing of new deidentification methods.
This special issue brings together six contributions that explore the Web as a space where meaning is produced, negotiated, and preserved. Spanning topics such as digital archiving, generative AI, accessibility, and interactive narrative, the articles reflect a diversity of approaches while converging on a shared concern with how digital infrastructures shape expression and interpretation. Rather than offering a unified framework, the issue highlights key tensions—between scale and situated practices, human authorship and algorithmic generation, and inclusion and exclusion in digital memory—inviting a reconsideration of the Web as a sociotechnical system of meaning-making.
In recent years, causal disentanglement, which seeks to separate user interest from social conformity, has attracted growing attention for its potential to mitigate popularity bias in recommender systems. The key to completing this task is accurately modeling the causal drivers of user interactions with items. Due to the rapid development of causal inference, most state-of-the-art (SOTA) approaches aim to learn representations of interest and conformity from interaction data. Despite their accomplishments, two limitations remain. First, most existing approaches rely on global random sampling, which overlooks the time-varying nature of popularity and leads to temporal confounding bias. Second, most ID-based approaches suffer from semantic sparsity, neglecting the rich textual metadata crucial to understanding the intrinsic content of mobile apps (short for applications). To this end, we propose a temporal causal semantic enhancement (TCSE) framework to robustly disentangle user interest from conformity by integrating time-aware sampling and semantic reasoning. More specifically, we introduce a semantic knowledge enhancement module to augment mobile app representations with generalized semantics extracted from large language models. Then, we design a temporal causal sampling strategy to construct locally unbiased interaction pairs within the same temporal window, effectively capturing dynamic popularity shifts. Extensive experiments on two real-world large-scale datasets indicate that TCSE can outperform SOTA models in both recommendation accuracy and debiasing effectiveness. An ablation study also demonstrates the necessity of TCSE’s semantic and temporal components.
Recommender systems (RS) are widely deployed in domains such as e-commerce and online media, yet often intensify the filter bubble problem by repeatedly exposing similar items. While prior studies generally regard such homogeneity as detrimental, its nuanced effects in interactive recommendation systems (IRS) remain underexplored. In particular, the dynamic feedback loop between user preferences and system responses complicates the relationship between homogeneity, diversity, and engagement. This paper presents the first fine-grained analysis of homogeneity in IRS, revealing that homogeneous recommendations can be beneficial in the early repetition stages before becoming detrimental. Building on this insight, we propose Diversity- and Debias-aware Interactive Recommendation (DDIR), an offline reinforcement learning framework that dynamically balances homogeneity and diversity over user sessions. DDIR employs a Transformer-based state encoder to capture time-aware diversity preferences, a homogeneity-friendly diversity model to estimate evolving tolerance to repetition, and a debiased interest model that disentangles intrinsic preferences from conformity bias while considering item quality. These components jointly guide a policy learner to sustain long-term engagement. Experiments on two realistic RL environments, KuaiEnv and KuaiRand, constructed from large-scale short-video logs, demonstrate that DDIR effectively mitigates filter bubbles, increasing average session length by 4.35% and long-term engagement by 25.65% over state-of-the-art baselines in KuaiRand simulated environment. Codes are available at https://github.com/16061025/DDIR.
Even though generative artificial intelligence (GenAI) is increasingly integrated into user-facing technologies like social media, its impact on content marketing remains unverified. Early evidence suggests that language models (LLMs) can generate content that rivals human-created content (HCC) in terms of appeal. However, the question of adapting such content for various social media platforms remains unanswered. This study examines the effectiveness of an LLM, GPT-4, in customizing cross-platform content for Facebook, Instagram, and X. A total of 892 participants evaluated 30 pairs of AI-created content (ACC) and HCC. The findings reveal that ACC was preferred by users, delivered stronger calls to action, and elicited more user engagement than HCC, especially on Facebook, with a less pronounced effect for shorter posts on X and Instagram. We further generated six data-driven user personas of the 892 participants, illustrating the differences between those who preferred ACC or HCC on the three platforms. The results indicate that GPT-4 can adapt content to platform-specific requirements and maintain high perceived quality, making LLMs applicable for cross-platform content creation for user engagement. Findings contribute to understanding user engagement with AI-generated content across platforms. We also discuss the role of LLMs in content creation, including their ethical implications.
The rapid development of the internet has led to an exponential increase in the scale of computing, storage, networking, and service resources. Traditional monolithic architectures are increasingly insufficient for managing these complexities. In contrast, microservice architectures have emerged as the mainstream solution with their inherent flexibility in deployment and scalability. To ensure system reliability, modern microservice architectures rely heavily on observability data, including logs, metrics, and traces. However, challenges such as network instability, service instance restarts, and system overloads frequently lead to intermittent loss of metric data. These missing data points impede comprehensive assessments of system health, significantly threatening system stability and reliability. To address the above challenge, we propose an anomaly detection model, ADmM, which integrates logs, metrics, and traces. ADmM first extracts template-level and semantic-level features from multimodal inputs. Then, a multi-scale autoencoder module is applied to impute missing metrics. For anomaly detection, the model represents microservice dependencies as a directed acyclic graph and leverages a graph neural network to learn generative patterns from normal system behavior. By measuring the deviation between observed values and reconstructed values, ADmM assigns anomaly scores to identify anomalies. Experiments conducted on three open-source benchmarks demonstrate that ADmM outperforms state-of-the-art methods across multiple anomaly detection metrics. Notably, it achieves F1-Score improvements of 5.77%, 5.48%, and 2.16% in scenarios with 40% incomplete metrics.
The rapid proliferation of Internet of Things (IoT) devices across sectors such as smart homes, healthcare, and industrial automation has significantly increased the attack surface, making IoT networks prime targets for cyberattacks. Traditional Intrusion Detection Systems (IDS) often struggle to balance detection accuracy with the resource constraints inherent in IoT devices. While deep learning-based IDS have shown promise, they are frequently computationally intensive, limiting their applicability in real-time, resource-constrained environments. To address these challenges, we propose a lightweight, two-stage IDS that integrates dynamic, time-aware profiling with a Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) classifier. This hybrid approach reduces computational overhead while maintaining high detection accuracy. Building upon our previous DLA-ABIDS work, this paper introduces dynamic profiling capabilities and real-time evaluation methodology. The approach is evaluated using the Ton-IoT and Bot-IoT datasets, encompassing diverse normal and malicious traffic scenarios. Experimental results demonstrate that the proposed system achieves a 98% overall accuracy with a 5% false-negative rate, indicating its potential to improve security and resilience in IoT networks.
Affiliate marketing is a growing performance-based marketing arrangement in which affiliates are rewarded for getting users to register, purchase, or visit a shopping website [ 16 , 38 ]. This marketing strategy is valued at $18.5 billion USD for 2025 [ 31 , 67 ]. Deal-sharing platforms take advantage of this marketing strategy by acting as storefronts for sellers that showcase promotions and deals. As the service is free to use, they earn commissions through affiliate links [ 36 ] when they lead to sales. We perform an in-depth, end-to-end study of the tracking techniques leveraged by Pepper [ 1 ] and its extended environment, a key player in deal-sharing platforms. Through a systematic 1-month crawl, we analyze the tracking ecosystem of 10 deal-sharing websites active in a diverse range of countries abiding by different privacy laws. Our analysis reveals that a significant part of the tracking occurs during redirect chains [ 40 ] between the deal-sharing platform and the shopping website. We quantify the tracking-specific use of cookies, CNAME cloaking [ 14 ], and link decorations [ 52 , 58 ] within redirect chains. We find that 67.9% of redirect chains leverage at least one of these additional tracking techniques. We show that redirect chains examined in prior work (limited to HTTP-based redirects) are significantly more constrained than those observed in our study (HTTP-, HTML-, and JS-based), which enable more aggressive behavior by dynamically loading additional tracking resources at runtime. Finally, by analyzing the ecosystem of third-party services and the privacy policies of deal-sharing websites, we reveal the omission of numerous actors involved in redirect chains.
This work introduces a novel construct we call dream that enables deletable content in otherwise immutable, decentralised storage systems such as Swarm. As an equitable and feasible response to the challenge of data destruction, our solution reconciles the inherent persistence of content-addressed storage with the practical needs, user preferences, and legal requirements of permanent revocation of access. The paper contributes a new deletion model based on access revocation, and presents a mechanism that allows data-sharing users to grant — and later rescind — access to specific data for specific consumers. The solution leverages Swarm’s distributed storage architecture to introduce a procedural way to retrieve decryption keys, realised through a network protocol. The resulting system achieves the desired properties of deniability, revocability, expirability, addressability, and malleability without requiring trusted intermediaries or complex cryptographic primitives. The approach preserves the censorship resistance of decentralised systems allowing for sovereign control over data access by the original uploader, but not by any other party, thus avoiding re-centralisation in order to achieve deletion. Security analysis shows that revocation remains effective even under pervasive adversarial control.
The widespread use of online social media has increased the urgency of detecting and mitigating harmful language, such as cyberbullying. Traditional detection systems often struggle with semantically ambiguous and context-dependent expressions, leading to frequent misclassifications. This paper presents CyDeBoost, a mistake-driven boosting framework for cyberbullying detection. The core idea of CyDeBoost is to identify and learn from misclassified instances by leveraging SHAP (SHapley Additive exPlanations) to uncover key lexical features responsible for prediction errors. Based on these insights, the framework uses large language models to generate semantically contrastive augmented samples, which are then used to fine-tune the model through a modular continual learning strategy. Specifically, lightweight adapter modules are stacked iteratively to simulate the boosting process while mitigating catastrophic forgetting. Experimental results demonstrate that CyDeBoost improves classification robustness across multiple cyberbullying categories and maintains generalization under low-resource settings. This framework aligns with the goals of content moderation on dynamic web platforms by offering interpretable, adaptive, and resource-efficient language safety solutions.
Digital identity verification is central to trust management on the evolving decentralized web. Traditional web-based identity models, which are heavily centralized and dependent on trusted intermediaries, pose significant challenges related to user privacy, data security, and regulatory compliance, especially in sensitive contexts such as Know Your Customer (KYC) processes. This paper introduces a novel privacy-preserving KYC verification framework leveraging Zero-Knowledge Proofs (ZKPs), Self-Sovereign Identity (SSI), Decentralized Identifiers (DIDs), and smart contracts, explicitly designed as a decentralized trust infrastructure for web-based interoperable payments. Our approach enables users to verify their identities across multiple platforms without revealing sensitive personal information, thereby significantly reducing long-term reliance on centralized authorities and enhancing user control and privacy. Furthermore, our system achieves cross-chain interoperability, ensuring that identity verification credentials can be securely and efficiently recognized across diverse Web3 ecosystems. We present a detailed prototype implementation of our DID framework, highlighting its ability to meet regulatory requirements while ensuring seamless interoperability across platforms. Comprehensive performance evaluations, including metrics on proof generation time, gas consumption, and transaction costs, demonstrate that the framework achieves low-latency verification and efficient execution, making it suitable for high-throughput, web-scale deployment.
Occurring approximately once or twice in each block, sandwich attacks threaten Ethereum’s ecosystem by manipulating prices through strategically placed buy and sell transactions around pending user trades. Existing detection methods primarily rely on rigid heuristic rules, limiting their ability to detect increasingly sophisticated and dynamic attack variants, particularly those residing only in the mempool or spanning multiple blocks. In this paper, we propose SandWatch , a novel Ethereum sandwich attack detection framework that integrates a dual-task graph neural network (Dual-GNN) with heuristic methods. The framework comprises three main components. (1) An order-independent heuristic that captures fundamental token transfer patterns, reducing transaction volume by over 94% for subsequent graph analysis. (2) A Dual-GNN that simultaneously classifies sandwich attack transactions and DEX nodes, dynamically updating an address label pool to enhance accuracy and generalizability. (3) A positive-unlabeled learning strategy to leverage large-scale unlabeled data effectively. We first evaluate Dual-GNN on a benchmark dataset derived from publicly available Ethereum sandwich attack data, achieving an F1-score of 99.78%, outperforming the single-task baseline by 0.93 percentage points. We then deploy SandWatch on Ethereum transactions collected through blockchain interfaces and mempool pre-execution from January to May 2024. SandWatch detects 563,453 sandwich attacks, including 24,404 multi-attack, 4,902 cross-block, and 1,057 pool-failure variants, achieving an overall recall of 98.63% compared to the state-of-the-art benchmark platform. These results demonstrate the robustness of SandWatch in detecting sophisticated sandwich attacks within the real-world Ethereum ecosystem.
The traditional protected web services rely on a user authentication process. The combination of an identifier (e.g. username, email address and so on) and credential (e.g. password) still remains the most widely deployed user authentication process, even though such a process is one of the major sources of security breaches. Moreover, in this traditional setting, the management and sharing of user identity information is cumbersome. The consequence of this is that users increasingly find it difficult to manage their identity data scattered across multiple sites and they have limited controls over their own identity data. In recent times, Self-sovereign Identity (SSI) has emerged as a new mechanism for managing and exchanging identity information in a more user-centric and privacy-friendly way. There are many explorations of SSI in different application domains, however, its utility for passwordless authentication for the web mostly remains unexplored. In this article, we present SSI4Web , a framework which can facilitate a passwordless authentication mechanism for the web by employing a state-of-the-art SSI technology for providing web services with much more user control and greater flexibility. We present its architecture which is based on a threat model and requirement analysis, discuss its implementation details and sketch out its use-cases along with protocol flows. In addition, we analyse its performance, evaluate its security using ProVerif , a state-of-the-art protocol verifier and discuss its advantages and limitations.
The 2016 United States presidential election was marked by the abuse of targeted advertising on Facebook. Concerned with the risk of the same kind of abuse to happen in the 2018 Brazilian elections, we designed and deployed an independent auditing system to monitor political ads on Meta in Brazil. To do that we first adapted a browser plugin to gather ads from the timeline of volunteers using Facebook. We managed to convince more than 2,000 volunteers to help our project and install our tool. Then, we use a Convolution Neural Network (CNN) to detect political Meta ads using word embeddings. To evaluate our approach, we manually label a data collection of 10k ads as political or non-political and then we provide an in-depth evaluation of proposed approach for identifying political ads by comparing it with classic supervised machine learning methods. Finally, we deployed a real system that shows the ads identified as related to politics during the 2018 National Brazilian elections. We also investigated early electoral advertisement before the 2020 local Brazilian elections using our model on unsponsored content (regular posts in groups and pages). We noticed that not all political ads we detected were present in the Meta Ad Library for political ads on 2018. Additionally, we found possible early electoral advertisements in 2020, which is forbidden in Brazil. Our results emphasize the importance of enforcement mechanisms for declaring political ads and the need for independent auditing platforms.
The counting algorithm is a classic approach to incremental view maintenance for queries on relational data. We adapt this algorithm to SPARQL queries on RDF (Resource Description Framework) datasets. In the decentralized Web, data are customarily stored in RDF, which is linked data that can be queried using SPARQL. The efficiency of retrieval of query results can be improved through maintaining views on the data incrementally as the underlying data change. SPARQL operators give rise to heterogeneous sets of solution mappings and involve multi-set semantics. We develop a theory of SPARQL algebra on annotated sets of solution mappings and show how to handle operators traditionally perceived as difficult, including LeftJoin, Diff, and Minus. We discuss the implementation of our methods—based on the counting algorithm—and assess the feasibility using data and queries from the Berlin SPARQL Benchmark. Performant incremental view maintenance will be instrumental when querying the decentralized web at scale.
The history-based content of Wikipedia has long served as a valuable resource for a wide range of research efforts in Natural Language Processing (NLP). However, due to Wikipedia’s dynamic and ever-evolving nature, conducting large-scale temporal analyses requires the efficient retrieval and processing of historical article versions. One of the major challenges in this domain arises from the lack of robust and scalable tools capable of managing the vast volume of revision data that Wikipedia provides. This limitation often acts as a significant bottleneck in both data management and downstream applications. In this work, we present a comprehensive analysis of online algorithms designed to enable efficient compression and retrieval of Wikipedia’s revision history. Our methods are supported by theoretical guarantees, demonstrating their ability to achieve high compression rates while maintaining favorable time–space trade-offs. The analysis emphasizes the practicality and scalability of our approach, particularly in environments constrained by memory or processing time. To operationalize these theoretical findings, we develop and release WikECD (Wikipedia Efficient Compression and Decompression), an open-source Python library that implements our proposed algorithms for large-scale Wikipedia revision compression, retrieval, and analysis. Experimental evaluations on sampled Wikipedia articles show that the method can reduce dataset size to as little as 6% of its original volume, achieving up to 94% compression while preserving reconstructive accuracy. To the best of our knowledge, this work constitutes the first detailed and rigorous study to analyze and quantify the compression of Wikipedia’s complete revision history dataset, paving the way for scalable and reproducible NLP research based on historical web data.
Online Social Networks (OSNs) have become essential behavioural data sources psychology, sociology, marketing and computer science. In the study of Information Propagation (IP) on OSNs, previous research has often focused on message content or network structures, neglecting users’ cognitive and emotional processes. This article proposes a human-centred profiling approach that holistically integrates user profile features, network position, activity patterns, and emotional dynamics to better model user roles in IP. Capturing internal decision-making and emotional resilience is critical to understanding information diffusion beyond traditional structural or semantic analyses. To our knowledge, no prior work has integrated these multidimensional user features to infer interpretable roles within IP processes. To operationalise this perspective, we constructed a feature-rich dataset based on Twitter (X) interactions, combining profile, network, activity, emotional and sentiment features. Using unsupervised learning techniques, specifically K-Means clustering and Principal Component Analysis (PCA), we identified four emergent user profiles: High-Credibility Informants, Emotionally-Driven Amplifiers, Mobilisation-Oriented Catalysts and Emotionally Exposed Participants. Our findings reveal that users are not passive conduits but active agents whose discernment, emotional regulation, and digital literacy shape propagation dynamics. This human-centred approach improves the interpretability of user profiles and offers new insights for ethical applications in recommendation systems, misinformation control, and digital literacy development, thus contributing to more resilient and ethically grounded information ecosystems.
Template engines play a pivotal role in modern web application development by enabling the dynamic rendering of content, products, and user interfaces. Today, they are essential for any website that handles dynamic data, from e-commerce to social media. However, their widespread adoption also makes them attractive targets for attackers seeking to exploit vulnerabilities and gain unauthorized access to web servers. This paper presents a comprehensive assessment of the risks associated with template engines, with a particular focus on the consequences of Server-Side Template Injection (SSTI) and the ease with which such vulnerabilities can escalate to Remote Code Execution (RCE), a critical security concern in web application development.
While large language models (LLMs) have captured global attention for their linguistic abilities, our work harnesses their power to overcome traditional barriers in querying Linked Data (LD) and Resource Description Framework (RDF) triplestores. This paper presents an innovative framework that integrates LLMs into conversational user interfaces (UIs), enabling the dynamic generation of precise SPARQL queries without the necessity for constant retraining. Most conversational UI models struggle with adaptability as they require frequent retraining whenever datasets are updated or expanded. This limitation impedes their effectiveness as general-purpose extraction tools. To address this challenge, our approach 1 seamlessly incorporates LLMs into the conversational UI process, fostering a more sophisticated understanding and interpretation of user queries and enhancing overall responsiveness. By leveraging the advanced natural language processing capabilities of LLMs, our method improves RDF entity extraction in web systems that utilise conventional chatbots. Furthermore, it extends the functionality of these chatbots, allowing them to respond directly to queries based on the RDF schema while providing an assistive interface that deepens understanding of the dataset and its underlying domain. This facilitates the extraction of more meaningful information. By adopting this approach, interactions become more refined and context-sensitive, a crucial advancement for managing the intricate query structures commonly found in RDF datasets and Linked Open Data (LOD) endpoints. We have evaluated our approach in practical settings by assessing the tool’s ability to address complex queries and to answer general ecological queries, with the outputs evaluated by human experts. The results demonstrate a notable improvement in system expressiveness and response accuracy, showcasing the potential of LLMs to transform information retrieval. The findings not only confirm their adaptability in enhancing existing systems but also open up exciting possibilities for their deployment in specialised web information domains, paving the way for future research in this evolving field.
The spread of misinformation poses unprecedented challenges to democratic societies, underscoring the need for scientific inquiry across multiple disciplinary perspectives. This paper presents a comprehensive scoping review on the topic, analyzing 410 studies published between 1933 and 2022. We provide an in-depth examination of how misinformation is conceptualized and measured, while addressing the limitations and challenges inherent in its empirical study. Our analysis encompasses subject areas, terminology, conceptual and operational definitions, research purposes, methods, datasets, timespan, and geographical scope, offering valuable insights into recurring themes and gaps in the literature. Notably, a significant portion of the studies (39%) fail to provide a clear definition of misinformation, and nearly 45% do not specify their geographical or temporal scope, resulting in inconsistencies that undermine the comparability and practical application of research findings. We discuss the implications of these findings for future research and offer recommendations to inform both scholarly inquiry and policy development.
