Working notes behind requests — every query with its population and denominator, the scripts and their unedited output, the folds and their residue, the figures checked against the source papers, the external sources and how each was verified, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

The page extends an existing page rather than creating or replacing one. privacy:requests already existed at 9,970 bytes with three <wrap todo> boxes (link decorators, cookie-notice classification, “Use in Publications”). All three are now filled. Everything that was already on the page was kept unless it was measurably wrong; the three sentences that were are recorded in §9.

No field in the extraction means “classifies requests as advertising or tracking”. The population is therefore a judgement built from two proxies, both stated here in full so a reader can disagree with either.

taskText(p) is title + summary + every detection.phenomenon + every detection.technique + the resourceName of every web-request classification tuple, joined. It is a deliberately wide net, because the task fold's job is to exclude, and excluding on thin evidence is the failure mode.

classification.target == “web-request” with used/produced fires on 258 papers, and 94 of them are not about advertising or tracking. Excluded families, each printed by the report script:

A paper can match several families, so these do not sum to 94. The 14 that matched nothing were read by hand — every one is off-topic (mass redirect-script injection, cloud-repository abuse, malicious CAPTCHA, Chrome certificate errors, malicious-content exposure prediction, phishing-intent vision models, zero-day web-attack meta-learning, a rendering-dependency poster, cloud IAM risk, local research-agent prompt leakage, Rozzle malware de-cloaking, IPV spyware, social-network abuse RL, Play Store account deletion) and all 14 are excluded.

The candidate regex LIST_CANDIDATE_RX has to be wide enough to catch “nine crowd-sourced filter lists”, which means it also catches every other kind of blocklist. Those are folded into explicitly named kind: offtopic families and excluded from S1 rather than silently dropped:

35 distinct papers, not 36: a paper can use several kinds of blocklist, so the rows do not sum. The content page quotes the union; the report script prints both.

These belong on website_classification and ip_classification, not here.

cd /workspace/artifacts/wiki
 
# every figure on the page, with its denominator
node scripts/report_requests.mjs               > out/report_requests.txt
node scripts/report_requests.mjs --list        > out/report_requests_list.txt
node scripts/report_requests.mjs --wiki                       # DokuWiki tables
node scripts/report_requests.mjs --quotes 'easylist'          # evidence behind a list family
 
# every literal per-paper figure, checked against paper.cols.txt
node scripts/verify_requests_figures.mjs       > out/requests_figures.txt
 
# every external fact, re-checked against its primary source (needs network)
sh scripts/external_checks_requests.sh         > out/requests_external.txt 2>&1
 
# the runnable script the page publishes
python3 pages/filterlist_provenance.py > out/filterlists.json 2> out/filterlist_run.txt
 
# stale-number guard, whole page AND windowed, AND including <file> blocks
cat out/report_requests_list.txt out/requests_external.txt out/requests_github_1626.txt \
    out/requests_figures.txt out/filterlist_run.txt > out/requests_all_evidence.txt
node scripts/check_page_numbers.mjs pages/privacy_requests.txt out/requests_all_evidence.txt --code
node scripts/check_page_numbers.mjs pages/privacy_requests.txt out/requests_all_evidence.txt \
  '===== Use in Publications =====' '===== What to Report ====='

Both guard runs report OK as of 2026-08-12. Getting there took three iterations and each one found something — see §9.

report_requests.txt

corpus: 5859 papers, 7 venues, 2010–2026
 
==========================================================================
1. POPULATION
==========================================================================
Membership signal                                                 Papers
----------------------------------------------------------------  ------
S1 — used or produced an ad-or-tracker filter list                197
S2 — classified web requests for an advertising/tracking purpose  164
both                                                              107
S1 only                                                           90
S2 only                                                           57
**page population = S1 ∪ S2**                                     254
 
── S2 narrowing: classification.target == "web-request", used/produced = 258 papers ──
Excluded task family                                              Papers
----------------------------------------------------------------  ------
infrastructure / CDN / protocol measurement                       34
web-application security (XSS, CSRF, WAF, HTTP parsing)           28
spam, scam and social-network abuse                               18
bot, crawler and automation detection                             14
censorship / network interference                                 11
browser extensions (security or privacy of the extension itself)  3
no task family matched (excluded, all inspected by hand): 14
    2014 IEEE-SP | Hunting the Red Fox Online: Understanding and Detection of Mass Redirect-Script Injections.
    2016 CCS | Lurking Malice in the Cloud: Understanding and Detecting Cloud Repository as a Malicious Service.
    2016 WWW | Tell Me About Yourself: The Malicious CAPTCHA Attack.
    2017 CCS | Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors.
    2018 CCS | Predicting Impending Exposure to Malicious Content from User Behavior.
    2022 USENIX | Inferring Phishing Intention via Webpage Appearance and Dynamics: A Deep Vision Based Approach
    2023 CCS | Learning from Limited Heterogeneous Training Data: Meta-Learning for Unsupervised Zero-Day Web Attack Detection across Web Domains.
    2024 IMC | Poster: Web Dependency Analyzer to Identify Resource Dependencies and their Impact on Rendering.
    2025 PETS | Uncovering the App Cloud Access Risks under Recommended IAM Security Practices
    2026 USENIX | Network-Level Prompt and Trait Leakage in Local Research Agents
    2012 IEEE-SP | Rozzle: De-cloaking Internet Malware.
    2018 IEEE-SP | The Spyware Used in Intimate Partner Violence.
    2025 USENIX | Predictive Response Optimization: Using Reinforcement Learning to Fight Online Social Network Abuse
    2025 USENIX | No Way to Sign Out? Unpacking Non-Compliance with Google Play's App Account Deletion Requirements
 
NOTE a paper can match several excluded families, so the exclusion rows do not sum to 94.
 
── Off-topic blocklists caught by the same regex and excluded from S1 ──
  35 DISTINCT papers across these families — a paper can use several, so the rows below do not sum.
Off-topic family                                       Papers
-----------------------------------------------------  ------
off-topic: malware / phishing / fraud blocklist        10
off-topic: spam / email blocklist                      8
off-topic: IP / ASN / network reputation blocklist     7
off-topic: content-category blocklist (adult, piracy)  6
off-topic: censorship blocklist                        3
off-topic: certificate / key revocation blocklist      2
 
── Venue shape of the population ──
Venue    Corpus papers  Population papers  Share of venue
-------  -------------  -----------------  --------------
PETS     510            65                 12.7%
IMC      638            44                 6.9%
WWW      843            41                 4.9%
USENIX   1410           33                 2.3%
CCS      990            31                 3.1%
IEEE-SP  767            27                 3.5%
NDSS     701            13                 1.9%
 
── Year shape of the population ──
Period      Corpus papers  Population papers  Per 1,000 corpus papers
----------  -------------  -----------------  -----------------------
2010–2013   511            11                 21.5
2014–2017   769            33                 42.9
2018–2021   1439           81                 56.3
2022–2024   1955           79                 40.4
2025–2026*  1185           50                 42.2
 
==========================================================================
2. WHY usedOrMentioned MUST BE FILTERED
==========================================================================
Papers naming an ad-or-tracker filter list         Papers
-------------------------------------------------  ------
any field, any usedOrMentioned value               215
used or produced (the defensible "used it" claim)  197
difference — would be miscounted as adoption       18
share of raw hits that do NOT support "used it"    8.4%
 
── by usedOrMentioned value (papers, so rows overlap) ──
usedOrMentioned       Papers
--------------------  ------
used                  196
mentioned-only-field  13
compared              11
mentioned             2
produced              2
 
==========================================================================
3. WHICH LISTS THE FIELD ACTUALLY USES (folded, paper-counted)
==========================================================================
Denominator: 197 papers that used or produced an ad-or-tracker filter list.
A paper naming several lists is counted under each, so shares do not sum to 100%.
Filter list (folded family)                                     Papers  Share of 197  Spellings folded
--------------------------------------------------------------  ------  ------------  ----------------
EasyList                                                        110     55.8%         32
EasyPrivacy                                                     71      36.0%         26
Disconnect                                                      48      24.4%         28
Ghostery / WhoTracks.me                                         34      17.3%         12
hosts-file lists (hpHosts, AdAway, MoaAB, Pi-hole, NoTrack, …)  27      13.7%         35
Adblock Plus (lists shipped with it)                            26      13.2%         12
uBlock Origin (lists)                                           17      8.6%          11
DuckDuckGo Tracker Radar (list)                                 15      7.6%          9
unnamed / aggregated filter lists                               10      5.1%          10
AdGuard                                                         8       4.1%          13
EasyList annoyance / anti-adblock variants                      7       3.6%          8
Privacy Badger (heuristic, not a list)                          4       2.0%          2
anti-adblock scripts and services                               3       1.5%          4
cryptomining lists (NoCoin, CoinBlockerLists, MinerBlock)       3       1.5%          4
Acceptable Ads exception list                                   1       0.5%          1
 
── Engines and parsers, not lists (the tooling section of the page) ──
Engine / parser                                Papers  Spellings folded
---------------------------------------------  ------  ----------------
tracker-radar-collector (crawler, not a list)  10      4
adblockparser (Python)                         9       2
adblock-rust (Brave engine)                    7       5
uBlock Origin Core (engine)                    2       2
abp-blocklist-parser / BlockListParser         1       1
Adblock Plus library (Android)                 1       1
 
── Exact-string vs folded, for the four lists the page names ──
  EasyList                 exact-string  90  folded 110  undercount 18.2%
  EasyPrivacy              exact-string  57  folded  71  undercount 19.7%
  Disconnect               exact-string  26  folded  48  undercount 45.8%
  Ghostery / WhoTracks.me  exact-string  30  folded  34  undercount 11.8%
 
── Unmapped residue of the list fold: 34 distinct strings, 35 tuples ──
   2  Host BlackList
   1  set of eight blacklisting services
   1  five public and one commercial blacklist
   1  30 additional IP blacklists
   1  external URL blacklists
   1  blacklisted URLs from bit.ly and tinyurl
   1  Google blacklist
   1  mobile blacklist (MBL)
   1  12 domain blacklists
   1  custom blacklist-reconstruction heuristics
   1  custom anonymization-service IP blacklist
   1  12 IP reputation blacklists
   1  custom ad-blocker name search lists
   1  combined domain blacklists
   1  eCrimeX blacklist
   1  VirusTotal blacklists
   1  combined public blacklists
   1  38 IP and domain reputation blacklists
   1  38 public and commercial IP and domain reputation blacklists
   1  custom IPV spyware and dual-use app blacklists
   1  custom manual blacklist
   1  publicly available adblocker lists
   1  union of four DNS blocklists
   1  aggregated domain and IP blacklists
   1  Custom blocklist filter
   1  authoritative blacklists
   1  eight public domain blacklists
   1  PassphraseGPT-generated blocklist
   1  adblockparser with nine crowd-sourced filter lists
   1  manually curated website-domain blocklists
   1  five blacklists
   1  regular expression blacklists (custom)
   1  Meituan fraudster blacklist and whitelist
   1  Google Safe Browsing blacklist
 
==========================================================================
4. HOW THE POPULATION CLASSIFIES REQUESTS
==========================================================================
Of the 254 population papers, 172 carry at least one web-request classification tuple (used/produced). Denominator for this section: 172.
classification.method  Papers  Share of 172
---------------------  ------  ------------
blocklist              98      57.0%
heuristic-rules        62      36.0%
regex-or-signature     18      10.5%
third-party-service    12      7.0%
supervised-ml          12      7.0%
manual-labelling       11      6.4%
curated-database       8       4.7%
dynamic-analysis       4       2.3%
unsupervised-ml        1       0.6%
llm                    1       0.6%
 
CAVEAT classification.method agrees run-to-run on 58% of papers (README.md,
stability table). Read this as a ranking, not as precise shares.
 
── Method mix over time (papers with a web-request tuple, per bucket) ──
Period      Papers  blocklist   heuristic-rules  supervised-ml  curated-database  llm
----------  ------  ----------  ---------------  -------------  ----------------  --------
2010–2013   8       3 (37.5%)   3 (37.5%)        0 (0.0%)       0 (0.0%)          0 (0.0%)
2014–2017   21      11 (52.4%)  8 (38.1%)        0 (0.0%)       0 (0.0%)          0 (0.0%)
2018–2021   58      33 (56.9%)  23 (39.7%)       3 (5.2%)       3 (5.2%)          0 (0.0%)
2022–2024   53      38 (71.7%)  14 (26.4%)       6 (11.3%)      2 (3.8%)          0 (0.0%)
2025–2026*  32      13 (40.6%)  14 (43.8%)       3 (9.4%)       3 (9.4%)          1 (3.1%)
 
── Every LLM-classified web-request tuple in the corpus ──
  2026 WWW/tgnn-enhancing-pixel-tracking-detection-via-llm-driven-annotation-and-gat-powere
     Qwen3-Plus | gt=human expert annotations | val=held-out-test-set | used
 
==========================================================================
5. GROUND TRUTH FOR A LEARNED REQUEST CLASSIFIER
==========================================================================
Denominator: 14 papers with a LEARNED web-request classification tuple (method in {supervised-ml, unsupervised-ml, llm}; usedOrMentioned in {used, produced}).
NOTE "produced" alone gives only 14 papers, because the extractor scores a paper's own
classifier as "used" about as often as "produced" — AdGraph's random forest is tagged
"used". Filtering to "produced" here would drop the field's reference baselines.
Ground-truth source       Papers  Share of 14
------------------------  ------  -----------
a filter list             8       57.1%
manual / human labelling  4       28.6%
other stated source       2       14.3%
none stated               0       0.0%
 
── Validation of web-request classifications ──
  of 58 papers with a not-applicable web-request tuple, 45 (77.6%) have that tuple as method=blocklist
  of 60 papers with a none-reported tuple, 30 (50.0%) likewise
classification.validation   Papers  Share of 172  Sentinel?
--------------------------  ------  ------------  ---------
manual-validation           61      35.5%
none-reported               60      34.9%
not-applicable              58      33.7%         sentinel
comparison-to-other-method  10      5.8%
cross-validation            7       4.1%
held-out-test-set           5       2.9%
 
==========================================================================
6. LIST VERSIONING — THE REPORTING GAP
==========================================================================
Papers naming a filter list in tools[] (used/produced)  Papers
------------------------------------------------------  ------
total                                                   177
with a non-null tools[].version                         52
share stating a version                                 29.4%
 
This is an UPPER BOUND on unreported versions and a LOWER BOUND on reporting:
the extractor fills tools[].version only when the paper puts a version next to
the name. A paper that says "EasyList, downloaded 3 May 2021" in the crawl
section may not be credited here. Treat it as an order of magnitude.
 
The versions that WERE stated:
  2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class: Ghostery = 5.4.1
  2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class: Adblock Plus = 2.6.7
  2017 PETS/towards-seamless-tracking-free-web-improved-detection-of-trackers-via-one-class: Disconnect = 3.14.0
  2018 CCS/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea: EasyList = 2018
  2018 WWW/the-cost-of-digital-advertisement-comparing-user-and-advertiser-views: Disconnect = 2018
  2019 CCS/oh-the-places-youve-been-user-reactions-to-longitudinal-transparency-about-third: Disconnect's list of known trackers = accessed November 2018
  2019 CCS/un-informed-consent-studying-gdpr-consent-notices-in-the-field: BlockAdBlock 3.2.1 = 3.2.1
  2019 IMC/tales-from-the-porn-a-comprehensive-privacy-analysis-of-the-web-porn-ecosystem: EasyList and EasyPrivacy = downloaded January 29, 2019
  2020 PETS/inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u: EasyList = 2018
  2020 PETS/inferring-tracker-advertiser-relationships-in-the-online-advertising-ecosystem-u: EasyPrivacy = 2018
  2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix: Adblock = 3.33.0
  2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix: Ghostery = 8.3.4
  2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix: Disconnect = 5.19.3
  2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking: The Big Blocklist Collection (Firebog) = 2019
  2020 PETS/the-tv-is-smart-and-full-of-trackers-measuring-smart-tv-advertising-and-tracking: StopAd smart TV blocklist = 2019
  2020 USENIX/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime: Ghostery = 5.4.10
  2020 USENIX/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime: Ad-Block Plus = 2.6.13
  2020 USENIX/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime: uBlock Origin = 1.10.4
  2020 WWW/beyond-the-front-page-measuring-third-party-dynamics-in-the-field: WhoTracks.me = 2018
  2020 WWW/beyond-the-front-page-measuring-third-party-dynamics-in-the-field: EasyPrivacy = 2019
  2020 WWW/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa: Disconnect.me = 2019
  2020 WWW/stop-tracking-me-bro-differential-tracking-of-user-demographics-on-hyper-partisa: whotracks.me = 2019-09-25
  2020 WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing: Disconnect Tracking Protection List = 2019
  2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention: Adblock Plus (ABP) = 3.7
  2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention: EasyList (EL) = March 13, 2020
  2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention: EasyPrivacy = June 2020
  2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention: uBlock Origin GetAdmiral = March 2020
  2021 PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion: uBlock Origin = 1.26
  2020 IEEE-SP/do-cookie-banners-respect-my-choice-measuring-legal-compliance-of-banners-from-i: Disconnect list = commit eb817fb1 (2019-12-10)
  2022 USENIX/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission: DuckDuckGo Tracker Blocklist = v2.1
  2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr: Pi-hole's Default List = 2021
  2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr: Mother of All Adblocking = 2019
  2022 USENIX/ovrseen-auditing-network-traffic-and-privacy-policies-in-oculus-vr: Disconnect Me = 2021
  2022 WWW/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps: EasyList = 2020
  2022 WWW/et-tu-brute-privacy-analysis-of-government-websites-and-mobile-apps: EasyPrivacy = 2020
  2022 WWW/reproducibility-and-replicability-of-web-measurement-studies: EasyList = 2021-07-05
  2023 IMC/on-the-similarity-of-web-measurements-under-different-experimental-setups: EasyList = 202203300945
  2023 PETS/not-your-average-app-a-large-scale-privacy-analysis-of-android-browsers: EasyList = 202105250854
  2023 PETS/not-your-average-app-a-large-scale-privacy-analysis-of-android-browsers: EasyPrivacy = 202105250854
  2023 USENIX/a-study-of-multi-factor-and-risk-based-authentication-availability: Disconnect.me = 2022
  2023 IMC/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web: justdomains blocklist = 2022
  2023 PETS/comparing-large-scale-privacy-and-security-notifications: WhoTracks.me = 2022
  2023 PETS/comparing-large-scale-privacy-and-security-notifications: EasyList Cookie List = 2022
  2024 IMC/browsing-without-third-party-cookies-what-do-you-see: EasyList = 2024
  2024 IMC/diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc: DuckDuckGo Tracker Radar = 2023
  2024 CCS/blocking-tracking-javascript-at-the-function-granularity: EasyList = 2022
  2024 CCS/blocking-tracking-javascript-at-the-function-granularity: EasyPrivacy = 2022
  2023 USENIX/rods-with-laser-beams-understanding-browser-fingerprinting-on-phishing-pages: EasyPrivacy = 2021
  2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines: EasyList = 2021
  2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines: uBlock Origin = 2021
  2023 WWW/who-funds-misinformation-a-systematic-analysis-of-the-ad-related-profit-routines: Disconnect = 2022
  2024 PETS/generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo: Disconnect Tracker Protection lists = 2023
  2024 PETS/the-devil-is-in-the-details-detection-measurement-and-lawfulness-of-server-side: Disconnect = 2023
  2024 IMC/darkdns-revisiting-the-value-of-rapid-zone-update: QuidsUp NoTrack Block List = 2024
  2024 PETS/client-side-and-server-side-tracking-on-meta-effectiveness-and-accuracy: EasyList = 2023
  2024 WWW/detecting-and-understanding-self-deleting-javascript-code: EasyList = 202306271740 with EasyPrivacy
  2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers: EasyList = 2024-08-17
  2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers: EasyPrivacy = 2024-08-17
  2025 CCS/local-frames-exploiting-inherited-origins-to-bypass-content-blockers: Disconnect entity list = 2025-04-25
  2025 IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th: EasyList = 2025
  2025 IMC/canvassing-the-fingerprinters-characterizing-canvas-fingerprinting-use-across-th: EasyPrivacy = 2025
  2025 IMC/cookieguard-characterizing-and-isolating-the-first-party-cookie-jar: DuckDuckGo Tracker Radar = 2022
  2025 PETS/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and: justdomains = February 2025
  2025 PETS/empirically-measuring-data-localization-in-the-eu: EasyList = 2022
  2025 PETS/empirically-measuring-data-localization-in-the-eu: WhoTracks.Me = 2024
  2025 USENIX/websites-global-privacy-control-compliance-at-scale-and-over-time: Disconnect list = September 15, 2023
  2025 WWW/before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation: DuckDuckGo Tracker Radar = 2024
  2026 USENIX/network-level-prompt-and-trait-leakage-in-local-research-agents: EasyList = 2025
  2025 CCS/whispertest-a-voice-control-based-library-for-ios-ui-automation: DuckDuckGo Tracker Radar = 2020
  2025 CCS/layered-overlapping-and-inconsistent-a-large-scale-analysis-of-the-multiple-priv: EasyList = 2025
  2025 PETS/unmasking-the-shadows-a-cross-country-study-of-online-tracking-in-illegal-movie: justdomains = updated August 2024
  2025 IMC/fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasi: uBlock Origin = 1.59.0
  2025 IMC/fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasi: AdBlockPlus = 4.5.1
  2025 PETS/understanding-regional-filter-lists-efficacy-and-impact: JustDomains = 2024
  2026 PETS/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr: Disconnect = 2026
  2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government: EasyList = June 2025
  2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government: EasyPrivacy = June 2025
  2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government: Affiliated Filter Lists = June 2025
  2026 PETS/the-empire-strikes-back-at-your-privacy-an-archaeology-of-tracking-on-government: DuckDuckGo Tracker Radar = 2025
  2021 IEEE-SP/detecting-filter-list-evasion-with-event-loop-turn-granularity-javascript-signat: EasyList = 2019-11-02
  2021 IEEE-SP/detecting-filter-list-evasion-with-event-loop-turn-granularity-javascript-signat: EasyPrivacy = 2019-11-02
  2023 IEEE-SP/detection-of-inconsistencies-in-privacy-practices-of-browser-extensions: AdGuard Ad Filters = 2022
 
==========================================================================
7. CRAWL CONFIGURATION OF THE POPULATION
==========================================================================
Of the 254 population papers, 201 ran an automated web crawl.
  crawlConfig.statefulness      stated by  91 of 197 papers with a crawlConfig object (46.2%)
  crawlConfig.consentAction     stated by 103 of 197 papers with a crawlConfig object (52.3%)
  crawlConfig.interactionDepth  stated by 188 of 197 papers with a crawlConfig object (95.4%)
  crawlConfig.headless          stated by  46 of 197 papers with a crawlConfig object (23.4%)
 
==========================================================================
8. THE POPULATION, MOST RECENT FIRST
==========================================================================
(--list to print all 254; L = filter-list signal, R = web-request signal)
 
==========================================================================
10. PER-PAPER FIGURES THE PAGE QUOTES
==========================================================================
 
2024 USENIX/purl-safe-and-effective-sanitization-of-link-decoration  —  PURL: Safe and Effective Sanitization of Link Decoration
   tracking link decorations [site prevalence and average ATS decorations]
     73.02% of tested sites contained at least one ATS link decoration; average 10.75 per site
   tracking link decorations [classifier accuracy, precision, recall]
     98.74% accuracy, 98.62% precision, and 98.87% recall
   website breakage [sites with minor or major breakage]
     PURL caused minor breakage on 5 sites and major breakage on 1 site
 
2025 NDSS/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector  —  Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector
   non-mixed tracker identification [accuracy]
     97.44% adjusted accuracy on 53,217 requests
   mixed request trackers [lower-bound accuracy]
     74.19%
   mixed tracker prevalence [instances and unique trackers]
     83 occurrences of confirmed mixed request trackers
   mixed response trackers [accuracy]
     95.39% on 4,734 initiated requests
   filter-list-caused breakage [reconstructability]
     2,308 reconstructed breakages from 13,921 exception rules
   previously unreported trackers [confirmed trackers]
     22 new trackers with 175 occurrences
 
2026 PETS/from-syntactic-matching-to-taint-tracking-and-back-a-comparative-study-of-web-tr  —  From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques
   stateful tracking requests [number of tracking requests]
     40,605 total; 33,584 detected by syntactic matching
   stateful tracking requests [number of tracking requests]
     23,109 detected by taint tracking
   syntactic-matching false positives [false-positive rate]
     16%-19% overall; 27%-30% for syntactic-only requests
   syntactic-matching false negatives [share of dataset]
     7,021 requests, around 17%, detected by taint tracking alone
 
2025 PETS/understanding-regional-filter-lists-efficacy-and-impact  —  Understanding Regional Filter Lists: Efficacy and Impact
   tracking requests [number and fraction of HTTP requests identified as trackers]
     EasyList identified 47,817,273 trackers, 23% of requests
   unused filter-list rules [share of rules used]
     93.3% of rules did not identify any tracking request
   cookie setting [distinct cookies and cookie-setting requests]
     20,526,074 distinct cookies; 22% of all cookies
   potential site breakage [blocked first-party requests and affected domains]
     72 first-party requests and 31 potentially wrong domains
   filter-list runtime [runtime and memory usage over 300 rounds]
     Full 143,654-rule set averaged 14.94 seconds and 8.115 GB
   website categories [classified-site share]
     48,106 sites, or 42%, classified into 24 categories
 
2024 WWW/adflush-a-real-world-deployable-machine-learning-solution-for-effective-advertis  —  AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevention.
   advertisement and tracker requests [F1 score]
     F1 score of 0.98 on 830,160 requests
   advertisement and tracker requests [share of all requests detected]
     AdFlush detected 39.27% of all requests; filter lists detected 39.92%
   longitudinal detection stability [F1 score over time]
     F1 score remained above 0.9789 from April 2 to September 17, 2023
   filter-list false negatives [verified URLs and domains]
     642 URLs across 108 unique domains
   URL manipulation robustness [F1 score and attack success rate]
     AdFlush F1 0.97 and ASR 0.02
   JavaScript obfuscation robustness [F1 score and attack success rate]
     AdFlush F1 scores ranged from 0.89 to 0.94
   HTTP request-type coverage [F1 score]
     F1 exceeded 0.93 for all 14 request types
 
2026 WWW/tgnn-enhancing-pixel-tracking-detection-via-llm-driven-annotation-and-gat-powere  —  TGNN: Enhancing Pixel Tracking Detection via LLM-driven Annotation and GAT-powered Structural Representation.
   pixel tracking [share of distinct domains interacting with third-party tracking services]
     at least 16.74% of distinct domains
   tracking requests [F1-score]
     92.24% for connected requests and 84.49% for isolated requests
   category-level tracking [tracking-request proportion]
     54.7% arts, 54.5% recreation, and 48.0% sports
   tracking by child-oriented websites [share of traffic records containing tracking requests]
     167 of 357 records (46.78%)
   third-party service tracking [traffic and distinct-domain share]
     Google Analytics 1.87% of traffic and 14.19% of domains; Magnite 1.12% and 2.55%
   LLM traffic annotation [F1-score]
     98.17% against the expert-labeled ground truth
 
2020 PETS/missed-by-filter-lists-detecting-unknown-third-party-trackers-with-invisible-pix  —  Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels
   invisible pixels [share of images, domains, and pages]
     35.66% of collected images; 94.51% of successfully crawled domains
   identifier cookies [share of cookie instances]
     5,295 cookie instances (0.87%) had an identifier cookie as key
   tracking behaviors [share of third-party requests and domains]
     Tracking detected in 64.60% of full-dataset requests and 91.92% of domains
   first-to-third-party cookie syncing [share of visited domains]
     67.96% of visited domains
   filter-list misses [share of detected trackers missed]
     EL&EP missed 25.22%; Disconnect missed 30.34%
   combined filter-list misses [share of websites and third-party requests]
     379,245 requests remained tracking on 68.70% of websites
   browser-extension misses [share of BehaviorTrack tracking requests not blocked]
     Every studied extension missed at least 24.38%
 
2021 IMC/trackersift-untangling-mixed-tracking-and-functional-web-resources  —  TrackerSift: untangling mixed tracking and functional web resources.
   Mixed tracking and functional web resources [percentage of observed resources classified as mixed]
     17% of domains, 48% of hostnames, 6% of scripts, and 9% of methods
   Script-initiated request attribution [percentage attributed to tracking or functional resources]
     98% at method-level granularity
   Functionality breakage from blocking mixed scripts [breakage category across 10 websites]
     Major or minor breakage in 9 of 10 websites
 
2024 CCS/blocking-tracking-javascript-at-the-function-granularity  —  Blocking Tracking JavaScript at the Function Granularity.
   Tracking JavaScript functions [precision and recall]
     32.1% of 2,088K JavaScript functions
   Mixed JavaScript scripts [share of scripts and websites]
     13.4% of scripts; 62.3% of websites
   Third-party mixed scripts [share of mixed scripts]
     70.6% served from third-party domains
   Surrogate neutralization [share of classified tracking functions neutralized]
     84.4% per webpage
   First-party tracking cookies [tracking-cookie count]
     150 of 14,867 ghost first-party cookies
   Website breakage [percentage of webpages with minor or major breakage]
     NoT.js caused minor breakage on 8% and no major breakage
 
2024 USENIX/automated-large-scale-analysis-of-cookie-notice-compliance  —  Automated Large-Scale Analysis of Cookie Notice Compliance
   Cookie notice detection [precision and recall]
     100.0% precision and 86.9% recall
   Cookie consent violations [share of crawled websites with violations]
     72.2% of successfully crawled websites contained at least one privacy violation
   Ignored rejection [share of websites with reject buttons]
     65.4% of 16,231 websites
   Implicit consent before interaction [share of websites with cookie notices]
     73.4% of 48,843 websites
   Undeclared cookie purposes [share of websites with cookie notices]
     26.1% of 48,843 websites
   Interface interference [share of websites with both options]
     67.8% of 16,122 websites
   Forced action [share of websites with cookie notices]
     46.4% of 48,843 websites
   Modelled violation detection [precision and recall]
     Average false-positive rates of 9.4% for privacy violations and 0.0% for dark patterns
 
2023 USENIX/automated-cookie-notice-analysis-and-enforcement  —  Automated Cookie Notice Analysis and Enforcement
   cookie notice detection [accuracy]
     986 of 2000 domains identified as having cookie notices; 16 false negatives and 2 false positives
   end-to-end cookie enforcement [exact end-to-end accuracy]
     93.7% (937/1000 websites)
   cookie notices at scale [share of websites with notices]
     52.7% of 85,473 analyzed websites
   multiple-view cookie notices [share of websites with notices]
     35.4% had multiple views; 64.6% had a single-view notice
   one-click opt-out [share of websites with cookie notices]
     21.5% provided a one-click opt-out mechanism
   instruction temporal stability [failure rate over one month]
     Less than 1% of websites
 
2024 PETS/a-large-scale-study-of-cookie-banner-interaction-tools-and-their-impact-on-users  —  A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy
   Cookie setting and persistence [cookies per page, site, and profile]
     415k cookies per profile on average
   Cookie-purpose categories [share of cookies classified]
     57% of all cookies classified; 38% of distinct cookies
   Tracking requests [tracking requests per page]
     Accepting all cookies increased tracking requests by up to 60%
   Local-storage usage [objects or keys per site]
     122k objects identified on average across profiles
   Cookie-banner interaction [interaction success rate]
     Extensions interacted with 12 banners on average, or 65%
 
2023 IMC/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web  —  Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web.
   cookiewall prevalence [share of queried websites]
     280 of 45,222 websites (0.6%)
   cookiewall detection [precision and recall]
     98.2% precision; 100% precision and recall on 1,000 sampled websites
   tracking cookies [median cookies per website]
     Cookiewalls sent 43 versus 1 tracking cookie; 42 times more
   subscription privacy effect [median tracking cookies]
     0 with subscription versus 16 when accepting contentpass cookiewalls
   uBlock Origin bypass [share of websites without cookiewalls]
     196 of 280 websites (70%)
 
2023 USENIX/autofr-automated-filter-rule-generation-for-adblocking  —  AutoFR: Automated Filter Rule Generation for Adblocking
   ad blocking [fraction of ads blocked]
     AutoFR blocked 86% of all ads versus 87% for EasyList within the breakage threshold.
   visual breakage [fraction of sites within 1 − B ≥ 0.9]
     86% of sites were within the w = 0.9 breakage threshold.
   cross-site generalization [fraction of ads blocked]
     Rules generated from the Top-5K blocked 80% of ads on Top-5K–10K sites.
   rule longevity [sites requiring rerun]
     6% of Top-5K sites needed rerunning after six months.
 
2021 NDSS/cv-inspector-towards-automating-detection-of-adblock-circumvention  —  CV-Inspector: Towards Automating Detection of Adblock Circumvention
   Successful adblock circumvention [accuracy]
     93% accuracy
   Circumvention in popular sites [detected sites]
     91 sites classified as CV among 29,248 pages with sub-pages
   Circumvention surviving ACVL [share of monitored ground-truth sites]
     more than one-third of sites with relevant ACVL rules still circumvented
   Human-labeling reduction [saved labeling effort]
     up to 98%
 
2026 PETS/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc  —  Privacy vs. Profit: The Impact of Google's Manifest Version 3 (MV3) Update on Ad Blocker Effectiveness
   ad blocking [number of blocked ads per website]
     MV3 and MV2 means were 1.42 and 1.46 blocked ads.
   tracker blocking [number of blocked trackers per website]
     MV3 blocked about 1.8 more trackers per website than MV2.
   third-party-domain blocking [number of blocked third-party domains]
     MV3 blocked more domains for Adblock Plus and Stands, with no significant difference for AdGuard and uBlock.
   ad flickering [share of audited screenshot comparisons]
     No substantial MV3-specific ad-flickering discrepancies; 4 missed ads for each evaluator.
   website breakage [share of audited screenshot comparisons]
     No major breakage differences; MV3-only and MV2-only cases were comparable.
   cosmetic placeholders [share of visual comparisons]
     MV3 placeholders appeared in 21% (22%) of cases versus 0% (0%) under MV2.
 
2021 IEEE-SP/detecting-filter-list-evasion-with-event-loop-turn-granularity-javascript-signat  —  Detecting Filter List Evasion with Event-Loop-Turn Granularity JavaScript Signatures.
   privacy-harming JavaScript behavior [number of signatures and matched scripts]
     1,995,444 raw signatures from 11,212 blocked scripts
   filter-list evasion [share of measured websites]
     3,589 unique scripts affecting 12.48% of websites
   moving-code evasion [unique scripts and instances]
     720 unique scripts and 7,924 instances
   inlining evasion [instances]
     498 cases
   code-combining evasion [unique scripts and instances]
     85 unique scripts and 117 instances
   included-library evasion [unique scripts and instances]
     2,286 unique scripts and 3,505 instances
 
2017 IMC/the-ad-wars-retrospective-measurement-and-analysis-of-anti-adblock-filter-lists  —  The ad wars: retrospective measurement and analysis of anti-adblock filter lists.
   Anti-adblock filter-list coverage [share of Alexa top-5K websites]
     Anti-Adblock Killer List triggered on 8.7% and Combined EasyList on 0.4% of websites currently.
   Live anti-adblock prevalence [share of websites triggering filter rules]
     Anti-Adblock Killer List triggered on 5.0%; Combined EasyList triggered on 0.2%.
   Anti-adblock script detection [true-positive and false-positive rates]
     Up to 99.7% detection rate and 3.2% false-positive rate.
   Anti-adblock script generalization [true-positive rate]
     92.5% TP rate on scripts excluded from training.
 
2022 USENIX/webgraph-capturing-advertising-and-tracking-information-flows-for-robust-blockin  —  WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking
   ad and tracker classification [accuracy, precision, and recall]
     94.32 ± 0.27% accuracy, 92.24 ± 0.67% precision, and 94.14 ± 0.30% recall
   URL-mutation evasion [adversarial success rate]
     8.34 ± 0.66% against WebGraph
   URL-mutation evasion with first-party collusion [adversarial success rate]
     96.62 ± 0.37% against AdGraph
   graph-structure evasion [mean success rate at 20% graph growth]
     52.48 ± 33.4
   website breakage [reviewer agreement and breakage counts]
     Major breakage on 3 and minor breakage on 2 of 21 pages
 
2020 IEEE-SP/adgraph-a-graph-based-approach-to-ad-and-tracker-blocking  —  AdGraph: A Graph-Based Approach to Ad and Tracker Blocking.
   ad and tracking resources [accuracy, precision, recall]
     95.33% accuracy, 89.1% precision, and 86.6% recall
   website functionality breakage [share of evaluated sites by breakage level]
     AdGraph caused no breakage on 85.0% of sites and major breakage on 5.9%.
   page-load performance [percentage of websites faster]
     Faster than stock Chromium on 42% and Adblock Plus on 78% of websites.
 
2022 USENIX/khaleesi-breaker-of-advertising-and-tracking-request-chains  —  Khaleesi: Breaker of Advertising and Tracking Request Chains
   advertising and tracking request chains [accuracy, recall, and precision]
     Request chains accounted for approximately one-third of requests in the crawls.
   bounce tracking [number of domains]
     14 domains across cookie-blocked configurations
   cookie syncing [share of request chains and domains]
     More than half of request chains in most configurations participated in cookie syncing.
   information sharing between domains [graph connectivity metrics]
     The largest strongly connected component decreased from 865 nodes without blocking to 52 with K HALEESI.
   classifier performance over time [accuracy, recall, and precision]
     94.07% accuracy on the April 2021 dataset
   evasion attacks [classification switch success rate]
     K HALEESI evasion rates ranged from 1.31% to 13.85%.
   website breakage [percentage of sites with major, minor, or no breakage]
     K HALEESI caused no breakage on 93.8% of tested sites.
   page-load performance [page-load time]
     Improved load time on 91.26% versus stock Firefox and 59.82% versus Adblock Plus.
 
2022 IEEE-SP/wtagraph-web-tracking-and-advertising-detection-using-graph-neural-networks  —  WTAGRAPH: Web Tracking and Advertising Detection using Graph Neural Networks.
   web tracking and advertising requests [accuracy, precision, recall, and F1]
     1,559,602 requests; 614,001 (39%) labeled WTA by filter lists
   web tracking and advertising requests [accuracy]
     97.90% in transductive learning
   web tracking and advertising requests [accuracy]
     97.82% on the Random-7K setting
   evasion of WTA detection [evasion success rate]
     0.22% to 3.11% against WTA-GRAPH
   real-time WTA detection [prediction time and classification performance]
     266 ms per webpage; 92.80% accuracy over 2,002,026 requests
 
2025 PETS/beyond-the-request-harnessing-http-response-headers-for-cross-browser-web-tracke  —  Beyond the Request: Harnessing HTTP Response Headers for Cross-Browser Web Tracker Detection in an Imbalanced Setting
   Tracker versus non-tracker responses [share of HTTP responses]
     Chrome22 ≈0.3 tracker; Firefox22 ≈0.37; Brave22 ≈0.5%; Chrome23 ≈0.26%
   Cross-browser tracker classification [F1-score, AUPRC, MCC, and related metrics]
     Strong Chrome/Firefox performance but substantial degradation on Brave
   Longitudinal classifier degradation [cross-dataset performance change]
     Slight decline from Chrome22 to Chrome23
   HTTP response-header discrimination [ROC-AUC, AUPRC, and F1-score]
     Best classifier achieved ROC-AUC, AUPRC, and F1-score above 0.93
 
2023 WWW/net-track-generic-web-tracking-detection-using-packet-metadata  —  Net-track: Generic Web Tracking Detection Using Packet Metadata.
   Tracker versus benign traffic [accuracy, precision, recall, and F1-score]
     Random Forest achieved 94.02% accuracy and 95.12% precision.
   New trackers missed by filter lists [share of 200 manually examined traces]
     34.5% of the detection errors were trackers missed by existing filter lists.
   Partial-trace tracker detection [accuracy]
     Accuracy remained above 93% except when using the first five packets.
 
2020 WWW/filter-list-generation-for-underserved-regions  —  Filter List Generation for Underserved Regions.
   Advertisement images and iframes [classifier precision and recall]
     1,497 ad images and 47 ad frames missed by existing filter lists
   Upstream advertising resources [additional advertising resources identified]
     1,771 additional advertising URLs; 27.1% improvement
   Generated regional filter rules [number of new filter rules]
     1,310 new filter rules
 
2021 CCS/sugarcoat-programmatically-generating-privacy-preserving-web-compatible-resource  —  SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking.
   Privacy-relevant API access [share of pages with accessed privacy-relevant APIs]
     902 of 999 pages (90%)
   Storage and network API calls [total API calls]
     130,494 storage calls and 9,095 network calls reduced to zero
   Privacy-preserving script rewriting [unique target scripts]
     231 unique target scripts
   Web compatibility breakage [mean compatibility rating]
     2.86 when blocked versus 1.03 with SugarCoat
   Core functionality behavior changes [p-value]
     DOM operations p=0.732 and event registration p=0.517 for rewritten versus default
   Resource replacement performance [median page-load and memory metrics]
     rewritten condition improved standard metrics by 1–9% versus default

classification.resourceName and tools[].name are free text and agree run-to-run on roughly a fifth of exact strings. This field is worse than the corpus average because every list has an official name, an abbreviation, a “+ the other one” form and a possessive form. Measured undercount from counting exact strings instead of folded families:

Disconnect is the worst case on this page and the reason the fold exists at all: Disconnect list, Disconnect.me, Disconnect.Me, Disconnect Me, Disconnect blacklist, Disconnect Entity List, Disconnect entity list, Disconnect tracker list, Disconnect tracker lists, Disconnect's list of known trackers, Disconnect browser extension blacklist, Disconnect privacy icons extension, Disconnect tracking protection list, Disconnect Tracker Protection List(s), Ghostery and Disconnect intersection and more.

Three distinctions the fold makes that a naive regex does not:

1. Engines are not lists. adblockparser, adblock-rust, BlockListParser, uBlock Origin Core and the Adblock Plus Android library are tagged kind: engine and are counted in a separate table. Without this, adblockparser would land in the EasyList family.
2. tracker-radar-collector is a crawler, not a list. It is tagged engine and has its own family, ordered before the DuckDuckGo Tracker Radar list family whose regex would otherwise swallow it. 10 papers; they belong to tracker_radar_collector.
3. Privacy Badger is a heuristic, not a list. Tagged kind: heuristic, counted in S1 (it is a tracker classifier), flagged as such in the page's table.

Unmapped residue: 34 distinct strings, 35 tuples. Printed in full by the report script and reproduced here, because a residue that only exists in a local file is a residue nobody looks at:

  2  Host BlackList
  1  set of eight blacklisting services
  1  five public and one commercial blacklist
  1  30 additional IP blacklists
  1  external URL blacklists
  1  blacklisted URLs from bit.ly and tinyurl
  1  Google blacklist
  1  mobile blacklist (MBL)
  1  12 domain blacklists
  1  custom blacklist-reconstruction heuristics
  1  custom anonymization-service IP blacklist
  1  12 IP reputation blacklists
  1  custom ad-blocker name search lists
  1  combined domain blacklists
  1  eCrimeX blacklist
  1  VirusTotal blacklists
  1  combined public blacklists
  1  38 IP and domain reputation blacklists
  1  38 public and commercial IP and domain reputation blacklists
  1  custom IPV spyware and dual-use app blacklists
  1  custom manual blacklist
  1  publicly available adblocker lists
  1  union of four DNS blocklists
  1  aggregated domain and IP blacklists
  1  Custom blocklist filter
  1  authoritative blacklists
  1  eight public domain blacklists
  1  PassphraseGPT-generated blocklist
  1  adblockparser with nine crowd-sourced filter lists
  1  manually curated website-domain blocklists
  1  five blacklists
  1  regular expression blacklists (custom)
  1  Meituan fraudster blacklist and whitelist
  1  Google Safe Browsing blacklist

Reading it: almost all of it is off-topic reputation blocklists that the off-topic families did not name specifically enough, plus three genuinely ambiguous strings (Host BlackList, publicly available adblocker lists, adblockparser with nine crowd-sourced filter lists). The last two arguably belong in S1; including them would move S1 from 197 to at most 199 and no figure on the page by more than a point. They were left in the residue rather than hand-assigned, so that the fold is a rule and not a rule plus exceptions.

Two families were added to the fold specifically to shrink this residue after inspecting it: certificate/key revocation blocklists (Mozilla OneCRL, CRLSets, SSL Blacklist) and Anudeep's blacklist, which is an ad-blocking hosts list and was initially unmapped.

Twelve ordered families, six onTopic: true and six onTopic: false, matched against taskText. The rule and every regex is in scripts/req_fold.mjs. §2.1 gives the exclusion counts.

Known imprecision, stated rather than hidden. The on-topic family tracking measurement (prevalence, ecosystem, third parties) has the widest regex on the list (it includes \bads?\b, tracking, third[- ]part), so it is the family most likely to admit a paper on thin evidence. The families that would over-claim most are ordered before it: bot/crawler detection, browser-extension security and infrastructure measurement all fire first and are off-topic. A paper matching both an on-topic and an off-topic family is kept, because a censorship paper that also classifies tracking requests is legitimately in scope; that asymmetry is deliberate and is why the exclusion counts do not sum.

detection[].prevalence is a model summary of a result, not a quote, so checking the attached evidence.quote is not enough — the number has to be found in the paper. verify_requests_figures.mjs takes every literal figure the page prints and greps for it in data/fulltext/<year>/<venue>/<slug>/paper.cols.txt with whitespace collapsed.

The two variants are Matte et al., who write 1 426 and 22 949 with a thin space.

It caught one real error. The extraction's prevalence for Rasaii et al. [1Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] reads “280 of 45,222 websites (0.6%)”. 45,222 does not appear anywhere in the paper, which says: “Using this tool we crawled 45k websites and found cookiewalls on 280 of them” and “an overall cookiewall rate of 0.6%”. The page says ~45k. A page that had trusted the tuple would have published a fabricated denominator with three significant figures.

And a second, worse one, caught by reading the paper rather than by any script. The page as first drafted said Duumviri [2Shuang, He; Zhao, Lianying; Lie, David (2025): "Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] “reproduces filter-list labels at 97.44% while needing no labels at all” and called it “the way out of the circularity”. That is wrong, and it contradicted the page's own opening box, which correctly counted Duumviri among the eight papers that take their labels from a filter list. The paper says: “Using EasyList and EasyPrivacy as ground truth, we have 12,936 (46.66%) cases of trackers and 14,785 (53.34%) cases of non-trackers”. What is independent in Duumviri is its differential features and its breakage detector, whose positive samples are reconstructed from exception rules and user reports — not its labels. Four passages were rewritten, and the page's open-questions section now says plainly that nothing in this corpus trains a request classifier without a filter list in the loop. The general lesson: a table cell that flatters a paper is the one to re-read, and an internal contradiction between two sections is the cheapest signal that one of them is wrong.

Also corrected, presentationally: Bouhoula et al. write 2353 with no thousands separator (the page follows the paper), and Snyder et al. is a SIGMETRICS/POMACS paper with no corpus record at all, so its figures were verified directly against arXiv:1810.09160 instead (§7).

Every non-corpus fact on the page, its primary source, and the date. out/requests_external.txt and out/requests_github_1626.txt hold the unedited output.

scripts/external_checks_requests.sh re-runs most of it — repository status, the EasyList scale figures, every package version, the live filter lists, Peter Lowe's list, hpHosts, the declarativeNetRequest limits, the Firefox query-stripping collection, Snyder et al.'s abstract, the two Crossref records and the AdGuard post's publication date, and which arXiv versions of the SoK exist. It does not cover the IEEE S&P 2026 poster PDF or the arXiv author-count glitch; those were checked by hand and are recorded only here. An earlier version of this sentence claimed the script re-runs everything, which was wrong, and the script's own EasyList-scale block silently printed blank lines when it hit the anonymous GitHub rate limit — both were found by review and fixed: the block now carries the token and prints FAILED rather than nothing.

These were offered by research passes and are not on the page. They matter more than the accepted ones: they are what stops the next run re-adding them.

• “uBlock Origin 1.72.2, ~12M users in the Chrome Web Store.” Press-sourced only. The Chrome Web Store listing redirects to consent.google.com and could not be fetched, so no version or user count from the store is on the page.
• “Chrome removes MV2 extensions from the store on 2026-08-31” and “Chrome 138 disabled MV2”. Kept, but explicitly attributed in a footnote to Google's published deprecation timeline and press coverage rather than to a docs page we read. 138 is flagged in verify_requests_figures.mjs as not verified against a Chrome docs page.
• “Edge phases out MV2 by default in August 2026”, “Brave will keep supporting MV2”. Press-sourced, not load-bearing, dropped entirely.
• “Vekaria et al. accepted to USENIX Security 2026.” A search summariser asserted this unprompted. It is contradicted by the paper's own IEEE S&P 2026 poster, which says “Preprint”, and could not be found on any USENIX programme. Rejected; the page says preprint.
• “Vekaria et al. has 37 authors.” The arXiv listing page contains a hidden and 36 other authors string. It is a metadata glitch — the paper and the poster both list 14. The page says fourteen.
• “Mozilla's cookie-banner rules moved into mozilla-central.” Plausible but unverified; the page states only that the standalone repository is archived.
• “ClearURLs is unmaintained; use Linkumori.” The Rules repository is still being updated (last push 2026-03-25); it is the extension that is stale (2025-07-27). The claim that Linkumori is the maintained successor comes from Linkumori's own marketing. The page reports both dates and tells the reader to check the extension's status themselves rather than endorsing a fork.
• “~30% of raw filter-list name hits do not support a 'used it' claim.” This is the figure in the task brief, computed on the older corpus with a cruder query. Re-measured properly — papers not tuples, ad/tracker lists only, after folding — it is 8.4% (215 papers name a list anywhere, 197 with used/produced). The page publishes 8.4% and this discrepancy is recorded here rather than silently reconciled.
• “classification target web-request = 193 papers.” Also from the brief and also pre-refresh. It is 262 on the current corpus, 258 after the used/produced filter.

• How wrong filter-list labels are, in general. The page leans on Calzavara et al.'s 16%–19% false-positive figure in several places, and it is one study, one taint-tracking browser, 7,614 sites. No second data point exists. This is the single largest thing the page asserts on the thinnest evidence, and it is flagged on the page as an open question.
• Whether any of the parameter-stripping lists is any good. No independent audit exists. PURL's own ground truth is a union of them.
• Which rules the shipped MV3 blockers drop to fit the 30,000-rule static cap. Not published by anyone; the cap itself is documented, the selection is not.
• Firefox's current query-stripping list. Delivered by Remote Settings; we did not dump the collection, so the page says what a researcher would have to do rather than giving a URL.
• WhoTracks.me's exact last data-release date. The Ghostery landing page carries no date; the repository's last push (2026-08-04) is a proxy for it, and that is what the page reports.
• Whether abp-blocklist-parser actually fails on current EasyList syntax. We established it has not been touched since 2020, which predates $removeparam; we did not run it against a current list to demonstrate a concrete failure. The page says “predates $removeparam and most modern rule options”, which is a claim about its history, not a measured failure. TODO: run all four Python options against the same EasyList snapshot and publish the disagreement rate. That would turn the strongest recommendation on the page from an inference into a measurement.
• Why classifiers transfer badly to Brave (Beyond the Request). Flagged as an open question.
• Whether the blocklist drop in the 2025–2026 bucket is real. It sits on 32 papers and two incomplete venue-years. The page says explicitly not to read a trend into it.

1. Extend, do not fork. The obvious alternative was a separate page for link decoration and another for cookie-notice detection. Both were rejected: link decoration is the same measurement with a different unit (the page's own unit table makes that argument), and cookie-notice detection shares its whole toolchain — a CSS-selector list, then a DOM heuristic, then a small language model — with request classification. Splitting them would have produced three pages that each had to re-explain filter lists.
2. Cookie notices are shared with consent, and the split is by question. privacy:consent is a stub whose own brainstorm already lists “Detection of cookie notices: EasyCookie list, z-index, NLP, heuristics” and both Khandelwal et al. and Bouhoula et al. The section here covers only the classification mechanics and their measured performance; what a notice means legally, and what to do about consent, stays on privacy:consent, which is linked from the section's first sentence. If the two pages drift, this section is the one to cut.
3. The two TODO headings were promoted from H3 to H2. They were subsections of ML Classification, which is wrong: link decoration is not an ML method and notice detection is not either. They are now top-level sections.
4. The population is the union, not the intersection. Using S1 ∧ S2 (107 papers) would have given a cleaner story and thrown away 90 papers that use a filter list as their third-party labelling instrument, which is the single most interesting thing the query found. The union is reported with its composition so a reader can take the intersection if they prefer.
5. used and produced both count. A paper that produced a classifier classified with it. compared does not: a paper that beats EasyList did not adopt it, and that distinction is the whole point of §2's usedOrMentioned table.
6. supervised-ml is reported for the population, not corpus-wide. An earlier draft of §5 of the report computed the learned-classifier ground-truth table over all 5,859 papers, which pulled in spam filtering, censorship response classification and ReDoS detection and made the “filter lists as ground truth” share look like 32% instead of 57%. Scoping it to the population is what makes it a claim about this literature.
7. Filtering to usedOrMentioned == “produced” was rejected for the ground-truth table. It gives 14 papers corpus-wide and drops AdGraph, whose own random forest the extractor tagged used. The report prints both numbers and says why.
8. Methods are a ranking, percentages are not. classification.method agrees with an independent extraction run on 58% of papers, so the method table carries that caveat inline. classification.validation is an enum in the stable band and is published as percentages.
9. The 2025–2026 bucket is starred everywhere it appears. CCS and IMC 2026 have not been held; IEEE S&P and WWW 2026 are incompletely selected. AdVersa at TheWebConf 2026 is the concrete cost of that: squarely in scope, absent from every corpus figure. The page names it for exactly this reason.
10. The page dates methods and says which are superseded. The dating rests on the corpus for what was done and on §7's external checks for what is current. The two calls a reasonable person might make differently: URL-and-content-feature classifiers are called superseded on the strength of WebGraph's evasion experiment alone, and perceptual ad blocking is called superseded on Tramèr et al. alone. Neither has been re-tested since.
11. No ~~DISCUSSION~~ on provenance pages. Comments belong on the content page. This follows the convention set by the first provenance page on this site.

check_page_numbers.mjs was run whole-page, windowed on the corpus section, and with –code. It took three iterations:

check_page_numbers.mjs is not run against this provenance page: its numbers are meta (section numbers, DOIs, the size of the old page, figures quoted precisely because they were rejected), so the guard's whole premise does not apply. Running it anyway reports 13 unaccounted values, all of that kind.

The embedded <file python filterlist_provenance.py> block and the <code> output block were compared line-by-line against pages/filterlist_provenance.py and a fresh run: 122 of 122 lines identical, output block identical.

Four reviewers, each given the page text, the scripts, their output and these notes, and each told explicitly that the author's context might not be exhaustive. The three focused passes ran in parallel first; the generic pass ran after their findings were applied. Every finding is recorded below with whether it was accepted, because a rejection is the only record of whether a reviewer earned its slot.

No checklist; asked only for what the other three were not looking for. It produced the largest number of accepted findings of any pass.

What the generic pass changed about how the rest of the review should be read. Its finding 5 — that the review order was freeze, review, apply and we ran review-while-applying — is the process lesson of this run, and it is why two of the three focused reviewers reported items that had already been fixed. It also means this page's own §11.1–§11.3 verdicts are recorded against a page that kept moving while they were written.

[1]

Rasaii, Ali; Gosain, Devashish; Gasser, Oliver (2023): "Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Shuang, He; Zhao, Lianying; Lie, David (2025): "Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector", in: Proceedings of the Network and Distributed System Security Symposium. (Link)