provenance:programming:interaction:outputs
Table of Contents
Provenance: Programming:Interaction — raw script outputs
The unedited output of every script behind Interaction with Websites. It lives on its own page for one reason, recorded here because it is the kind of thing that otherwise looks like a stylistic choice: with all five blocks inline, the main provenance log silently truncated its own rendering — the parser stopped mid-table and the Related and References sections vanished from the HTML with no error anywhere. Measured on 2026-08-27: the log rendered in full at about 51 KB of source and truncated at about 60 KB, on a wiki where a neighbouring provenance page of 111 KB renders fine, so it is a content-mix limit rather than a byte limit. Splitting is the fix that keeps every line of output published.
Read this with the log, which says what each block is for and what was decided from it.
The report: every figure with its denominator
report_interaction-output.txt
- report_interaction-output.txt
============================================================================== A. POPULATION ============================================================================== corpus 5859 crawled (crawlConfig OR studyTypes automated-web-crawl) 1120 webCrawled (crawled AND platforms includes 'web') 857 <- this page's denominator of which carry a crawlConfig object 838 crawled but NOT web (excluded: app stores, network scans, social graphs) 263 ============================================================================== B. interactionDepth — what the crawling literature says about depth ============================================================================== ── crawled — 1120 papers ── interactionDepth papers share ----------------------- ------ ----- single-target-page 376 33.6% not-stated 239 21.3% landing-page-only 162 14.5% deep-crawl 157 14.0% landing-plus-subpages 146 13.0% (no crawlConfig object) 40 3.6% stated (any non-sentinel value): 841 / 1120 = 75.1% ── webCrawled — 857 papers ── interactionDepth papers share ----------------------- ------ ----- single-target-page 285 33.3% landing-page-only 155 18.1% landing-plus-subpages 137 16.0% not-stated 136 15.9% deep-crawl 125 14.6% (no crawlConfig object) 19 2.2% stated (any non-sentinel value): 702 / 857 = 81.9% ── Where interactionDepth ranks among the crawl-configuration fields ── crawlConfig field papers stating it share of 1120 crawling papers ----------------- ----------------- ----------------------------- interactionDepth 841 75.1% authentication 779 69.6% browsers 529 47.2% consentAction 349 31.2% statefulness 219 19.6% headless 140 12.5% gap between the best-reported field and the second: 62 papers, 5.5 percentage points. ── The depth axis proper — webCrawled papers giving one of the three SITE-depth values ── denominator: 417 papers (NOT 857; single-target-page and not-stated are excluded) depth papers share of 417 --------------------- ------ ------------ landing-page-only 155 37.2% landing-plus-subpages 137 32.9% deep-crawl 125 30.0% went beyond the landing page: 262 / 417 = 62.8% CAVEAT: papers that went deeper have more reason to say so, so this ratio is an upper bound on the share of the whole field that crawls beyond the landing page. ============================================================================== C. Reporting rate over time (webCrawled, four-year buckets) ============================================================================== bucket web crawls states a depth on the site-depth axis of those, beyond landing gives subpages/site ---------- ---------- -------------- ---------------------- ------------------------ ------------------- 2010–2013 80 67 (83.8%) 35 27 (77.1%) 8 (10.0%) 2014–2017 130 109 (83.8%) 57 35 (61.4%) 11 (8.5%) 2018–2021 241 198 (82.2%) 121 72 (59.5%) 37 (15.4%) 2022–2024 253 207 (81.8%) 125 82 (65.6%) 33 (13.0%) 2025–2026* 153 121 (79.1%) 79 46 (58.2%) 15 (9.8%) * 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 / WWW 2026 abstracts are incompletely indexed, so selection under-covers them. ============================================================================== D. The label discriminant — does interactionDepth track the paper's own text? ============================================================================== crawlConfig carries ONE evidence quote for the WHOLE object, so reading it cannot validate interactionDepth. Instead: does the paper contain a first-person sentence naming the ROOT of a site as the unit of a visit (LANDING), something BELOW the root (DEEPER), both, or neither? `not-stated` is the control row. label papers with text landing phrase only deeper phrase only both neither --------------------- ---------------- ------------------- ------------------ ---------- ----------- landing-page-only 155 85 (54.8%) 4 (2.6%) 24 (15.5%) 42 (27.1%) landing-plus-subpages 137 57 (41.6%) 12 (8.8%) 42 (30.7%) 26 (19.0%) deep-crawl 125 27 (21.6%) 21 (16.8%) 27 (21.6%) 50 (40.0%) single-target-page 285 78 (27.4%) 11 (3.9%) 9 (3.2%) 187 (65.6%) not-stated 136 16 (11.8%) 5 (3.7%) 1 (0.7%) 114 (83.8%) ── What the shared crawlConfig quote actually evidences ── pool: 71 web crawls labelled landing-plus-subpages that also state a subpage count. every 6th read by hand on 2026-08-27 = 12 papers. what the ONE shared quote evidences papers of 12 ----------------------------------- ------------ depth 6 other 5 partial 1 [depth] CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web "parsing the front page of the domain and a set of five additional web pages within the same domain" [depth] CCS/2015/sunlight-fine-grained-targeting-detection-at-scale-with-statistical-confidence "For each site, we visit the top 10 pages returned from a site-specific search on Google" [other] IMC/2018/how-tracking-companies-circumvented-ad-blockers-using-websockets "we performed four crawls over our sampled 100K websites" — evidences repeatVisits and the population, not depth [other] WWW/2019/before-and-after-gdpr-the-changes-in-third-party-presence-at-public-and-private "We did not erase any cookie after a harvest was performed" — evidences statefulness [other] PETS/2020/no-boundaries-data-exfiltration-by-third-parties-embedded-on-web-pages "from US-based EC2 cloud instances using stateless browsers" — evidences vantage and statefulness [partial] NDSS/2021/cv-inspector-towards-automating-detection-of-adblock-circumvention "We visit each site for a total of eight times ... four page visits per case" — visit structure, not site depth [depth] USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild "we therefore additionally selected three random links to an internal subpage and visited these as well" [other] IMC/2023/on-the-similarity-of-web-measurements-under-different-experimental-setups "We choose to use a stateless approach" — evidences statefulness [depth] PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework "select nine internal hyperlinks at random from the homepage" [depth] PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing "We added ten random sub-pages per domain" [depth] NDSS/2026/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis "extracted a maximum of 5 subpages from each page" [other] PETS/2025/sheeps-clothing-wolfish-intent-automated-detection-and-evaluation-of-problematic "Browser state was purged after every crawl" — evidences statefulness Read this as the size of the blindness, not as an error rate: a quote that evidences statefulness does not make the depth label wrong, it makes the quote useless as a check on it. ── Internal consistency: does subpagesPerSite ever contradict interactionDepth? ── 104 web crawls state BOTH an interactionDepth and a subpagesPerSite. contradictions (landing-page-only with n>0, or landing-plus-subpages with n=0): 0 This is a corroborating check on the enum, independent of the text discriminant above: the two fields are extracted from the same shared quote but mean different things, so a systematically wrong depth label would show up here as disagreement. ── Hand audit of the `landing-page-only` "neither" cell ── 42 papers in the cell; every 4th read by hand on 2026-08-27 = 11 papers. verdict papers of 11 ---------------- ------------ inferred 10 stated-elsewhere 1 [inferred] IMC/2011/measuring-the-state-of-ecn-readiness-in-servers-clients-and-routers "For each domain, we retrieve the complete web page" — the unit is the domain, the page is never named [inferred] IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild "we crawled 6,755 unique phishing URLs" — a URL list, not a site depth [inferred] IMC/2019/visiblev8-in-browser-monitoring-of-javascript-in-the-wild "We visited each domain in our target list 5 times" — domain granularity only [stated-elsewhere] WWW/2019/the-chain-of-implicit-trust-an-analysis-of-the-web-third-party-resources-loading "the Alexa top-200K websites' main pages" — states the root, but not in a first-person sentence [inferred] WWW/2021/cookie-swap-party-abusing-first-party-cookies-for-web-tracking "the Alexa top 10K websites that we crawled" — site granularity only [inferred] IMC/2023/ptperf-on-the-performance-evaluation-of-tor-pluggable-transports "we accessed each website five times using curl" — site granularity only [inferred] CCS/2024/a-first-look-at-security-and-privacy-risks-in-the-rapidapi-ecosystem "We crawl all the content within the API listing page" — a listing page, not a site root [inferred] WWW/2024/quic-is-not-quick-enough-over-fast-internet no first-person sentence names the page unit at all [inferred] USENIX/2025/dns-flare-a-flush-reload-attack-on-dns-forwarders no first-person sentence names the page unit at all [inferred] WWW/2026/webgeoinfer-structure-free-multi-stage-framework-for-geolocation-inference-from "We access their web interfaces ... comparable to how an ordinary user visits a public site" [inferred] IMC/2025/somesite-i-used-to-crawl-awareness-agency-and-efficacy-in-protecting-content-cre "We visit the site with a headless browser" — site granularity only ============================================================================== E. subpagesPerSite — the number people actually pick ============================================================================== denominator: 857 web crawls; 104 (12.1%) give a number. of the 417 on the site-depth axis, 102 (24.5%) give a number. subpages per site papers share of 104 --------------------- ------ ------------ 0 (landing page only) 4 3.8% 1–4 29 27.9% 5–9 15 14.4% 10–19 21 20.2% 20–49 16 15.4% 50–99 2 1.9% 100+ 17 16.3% per four-year bucket: 2010–2013 n= 8 median=5 2014–2017 n= 11 median=5 2018–2021 n= 37 median=10 2022–2024 n= 33 median=15 2025–2026* n= 15 median=5 median 10; the five most common values: 5 subpages: 14 papers 3 subpages: 12 papers 10 subpages: 12 papers 1 subpages: 11 papers 20 subpages: 8 papers Justification sweep over the 104 papers that state a count (UPPER BOUNDS): cites Urban et al. / Beyond the Front Page 13 12.5% cites Aqeel / Hispar / Jekyll and Hyde 12 11.5% says pilot / pre-study / preliminary study 18 17.3% says saturat / diminishing returns / plateau 10 9.6% a causal conjunction near a subpage phrase (LOOSE) 24 23.1% ANY of the above 53 51.0% The last row is loose: a hand-read sample of its hits is mostly "as"/"since" used as ordinary conjunctions. The tightest signal is the saturation row. the largest values (a "deep crawl" of one application, not a site-list crawl): 2000: 1 papers 1000: 3 papers 500: 2 papers 300: 1 papers 200: 3 papers 100: 7 papers ============================================================================== F. repeatVisits and authentication — the other two interaction knobs ============================================================================== repeatVisits stated: 233 / 857 web crawls = 27.2% of those, 50 (21.5%) visit exactly once; 183 more than once. ── authentication — of 857 web crawls ── authentication papers share ----------------------- ------ ----- none 553 64.5% not-stated 204 23.8% account-registration 42 4.9% manual-login 24 2.8% (no crawlConfig object) 19 2.2% automated-login 15 1.8% crawls that got past a login of any kind: 81 (9.5%) sso in THIS population: 0; sso anywhere in the corpus: 1 (USENIX/2024/darkfleece-probing-the-dark-side-of-android-subscription-apps, platforms mobile) ============================================================================== G. What the crawler does ON the page — full-text probe ============================================================================== The schema has NO field for scrolling, clicking, hovering, typing or waiting. These are UPPER BOUNDS on "the paper did this": a first-person sentence matching the pattern. "we did not scroll" matches too. Denominator: the 857 web crawls. papers with full text on disk: 857 of 857 what the paper says it does papers share of 857 ------------------------------------- ------ ------------ clicks something 282 32.9% scrolls 69 8.1% waits / dwells a stated time 56 6.5% types on the keyboard 39 4.6% fills a form 28 3.3% moves the mouse 18 2.1% hovers 14 1.6% picks links at random 14 1.6% says it aims for human-like behaviour 14 1.6% mentions bot / crawler detection 61 7.1% bot/crawler detection, 2010-2013 bucket: 3 of 80 papers match ANYWHERE in the text, 0 in a first-person sentence. Same, by four-year bucket (share of that bucket's web crawls): pattern 2010–2013 2014–2017 2018–2021 2022–2024 2025–2026* ------------------------------------- ----------- ------------ ------------ ------------ ------------ clicks something 35/80 43.8% 41/130 31.5% 72/241 29.9% 80/253 31.6% 54/153 35.3% scrolls 2/80 2.5% 5/130 3.8% 18/241 7.5% 27/253 10.7% 17/153 11.1% waits / dwells a stated time 0/80 0.0% 12/130 9.2% 14/241 5.8% 24/253 9.5% 6/153 3.9% types on the keyboard 4/80 5.0% 6/130 4.6% 7/241 2.9% 17/253 6.7% 5/153 3.3% fills a form 1/80 1.3% 1/130 0.8% 8/241 3.3% 10/253 4.0% 8/153 5.2% moves the mouse 3/80 3.8% 2/130 1.5% 7/241 2.9% 4/253 1.6% 2/153 1.3% hovers 2/80 2.5% 0/130 0.0% 6/241 2.5% 4/253 1.6% 2/153 1.3% picks links at random 2/80 2.5% 1/130 0.8% 6/241 2.5% 1/253 0.4% 4/153 2.6% says it aims for human-like behaviour 0/80 0.0% 4/130 3.1% 1/241 0.4% 3/253 1.2% 6/153 3.9% mentions bot / crawler detection 0/80 0.0% 2/130 1.5% 17/241 7.1% 24/253 9.5% 18/153 11.8% ============================================================================== H. LLM-agent-driven browsing — sweep, then hand verdicts ============================================================================== sweep hits over the 857 web crawls: 35 NOTE: 1 hand verdicts are not returned by the current sweep USENIX/2024/understanding-help-seeking-and-help-giving-on-social-media-for-image-based-sexua role papers of 35 -------------- ------------ not-browsing 14 subject 9 citation 5 instrument 4 captcha-solver 2 instrument-app 1 An LLM agent drove the browsing in 5 of 857 web crawls (0.6%). NDSS/2025/yurascanner-leveraging-llms-for-task-driven-web-app-scanning "YURASCANNER operates as a goal-based agent, suggesting actions to achieve predefined objectives by processing webpages" PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms "a multi-agent system powered by large language models (LLMs) to simulate persona-driven browsing behavior" CCS/2025/whispertest-a-voice-control-based-library-for-ios-ui-automation "we design an LLM-based navigation pipeline tailored to perform privacy-related measurements in 200 apps" USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web "We built a prototype tool using Playwright and the agentic LLM-based Browser Use framework" PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits "We design and deploy an LLM-driven auditing agent capable of end-to-end traversal of rights-request workflows" years: 2025, 2025, 2026, 2026, 2026 — the earliest is 2025. ============================================================================== I. The measured consequences — per-paper figures with their own denominators ============================================================================== WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field * subsites set 36% more cookies than landing pages: 78 vs 55 on average, over the top 10k websites (TLD+1), 100 subsites each * the mean number of accessed/set cookies "stabilizes around 50 (SD: 100; median at 12) after visiting 100 subsites" — pre-study on 100 randomly selected sites from the top 1,000, at 25/50/75/100/250/500/1,000 subsites * trackers (EasyPrivacy) increased ~6% on subsites; 2.5% of sites tracked ONLY on subsites * Fingerprint2 device fingerprinting increased 25% on subsites; present on 0.15% of landing pages USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains * same Alexa top-10K, same cookie policy: homepage crawl 192,038 requests / 76,816 chains; interactive crawl (random internal pages via clicks on iframes and anchors) 575,550 / 229,151 — 3.0x * 302 redirects are 42.91% of AT redirect requests on the homepage crawl vs 28.56% interactive * AT requests navigating to a new domain: 51.32% homepage vs 47.49% interactive USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild * front pages plus "three random links to an internal subpage": "visiting subpages did indeed significantly increase the prevalence by about 17% compared to only crawling the front pages" * denominator, from the paper's Table 2: 206,676 sites (24.42%) carry an indicator, of which 30,494 only on a subpage (+17% overall) * per technique, subpage-only increase: ShortCut +22%, TrigBreak +80%, ModBuilt +18%, WidthDiff +19%, LogGet +33% — the aggregate hides an 80% NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search * against three state-of-the-art scanners on ten web applications: "a 59% increase in code coverage and successfully submits HTML forms 5x more frequently than the next best tool" PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits * 456 data-broker websites; verified workflow completion 87% in Phase 2 and 79% in Phase 3 IMC/2024/browsing-without-third-party-cookies-what-do-you-see * clickstream traversal, and its own bias statement: "our dataset is biased towards static inner pages ... we are less likely to explore the more dynamic areas of a website" NDSS/2017/thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-libraries-o * the reason a landing-page-only design is chosen: "We only crawl the homepage of each visited site due to the presence of many sites that thwart deeper traversal by requiring log-ins." USENIX/2024/trust-me-if-you-can-how-usable-is-trusted-types-in-practice * a fully specified depth: "visited those up to two levels of links from the start page, while crawling at most 500 URLs per site" USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission * typing is simulated against bot detection: "we simulate user typing behavior by using randomized intervals for each key press and dwell times, as well as the delay times between each press" CCS/2020/the-cookie-hunter-automated-black-box-auditing-for-web-authentication-and-author * what stops an interacting crawler: "In 22 cases, there was some form of an anti-bot challenge that our system was not able to solve and, thus, could not proceed with registration." PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework * the most complete interaction statement in the corpus, quoted whole on the page: "For each domain, we programmed the crawler to load the domain's homepage, scroll to the bottom of the page, then sleep for 25 seconds. Further, we programmed our crawler to select nine internal hyperlinks at random from the homepage and crawl them using the same load, scroll, and sleep approach." — two sentences, and they answer unit, depth, selection rule, on-page action, wait, and same-treatment-for-subpages PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing * a stated subpage-selection rule: "We added ten random sub-pages per domain, filtering to exclude auxiliary pages like privacy policies or contact pages." ============================================================================== Y. Figures the page quotes from other papers or other pages ============================================================================== statefulness stated: 219 / 1120 crawling papers = 19.6% (the page cites this as the comparison for how well depth is reported) Zeber et al., TheWebConf 2020, "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing" — IN the corpus; figures read from data/fulltext/2020/WWW/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing/paper.cols.txt on 2026-08-27, all four verbatim: "over 50,000 users of the Firefox Web browser"; "30 million site visits across 50,000 users" "crawler site visits issued requests to a median of 11.6 third-party domains, whereas for visits by humans, the median was 4.5 third parties" "The median number of tracking domains accessed by a user on visiting a Trexa list site is 1.9, whereas for the crawler it is 6.1" Urban et al.'s site list: "the top 10k websites" — the page's "10,000 websites" in the opening box is a rhetorical example of a methods sentence, not a corpus figure. NOT FIGURES — literals inside the fixture the page publishes in <file> blocks, scanned only under check_page_numbers.mjs --code. Listed here so they trace to this report instead of polluting the guard's shared ALLOW map: 127.0.0.0 the loopback range, in the fixture's macOS portability note 127.0.0.1 the first-party origin the fixture serves 127.0.0.2 the third-party origin the fixture serves, so the browser treats it as third-party 8231 the first-party port 8232 the third-party port 3000 the CSS pixel height of the tall div that makes scrolling necessary 50 the scroll-bottom tolerance in pixels 200, 300 waitForTimeout values in milliseconds 404, 200 HTTP status codes the fixture writes 2 the maximum crawl depth in the last strategy Tool versions in the measured probe, printed by the probe itself (sandbox/interaction_probe-output.txt): Playwright 1.62.1, Chromium 151.0.7922.34. ============================================================================== Z. NON-CORPUS NUMBERS ON THE PAGE, with their primary source ============================================================================== Aqeel et al., IMC 2020, "On Landing and Internal Web Pages" — NOT in the corpus (the selection stage labelled it neither a security nor a privacy measurement; see data/labels/run1/labels.jsonl). Read from the authors' own PDF at balakrishnanc.github.io/papers/aqeel-imc2020.pdf on 2026-08-27: 119 web-performance publications reviewed (IMC/PAM/NSDI/SIGCOMM/CoNEXT, 2015–2019): 41 (34.5%) need no revision, 48 (40.3%) minor, 30 (25.2%) major -> 65.5% need at least minor landing pages are on average 34% larger than internal pages (geometric mean of ratios, H1K) for 32% of H1K sites the landing page has FEWER objects than the median internal page internal pages' content visually loads 14% more slowly in the median (Speed Index, Ht30) median: internal pages collectively fetch from 18 third-party domains never seen on the landing page; for 10% of H1K sites, 80 or more at the 80th percentile, internal pages carry 20 tracking requests and landing pages 28 in about 10% of H1K sites, internal pages have no trackers while the landing page does header bidding, of 200 sites: 17 have HB ads on the landing page, a further 12 only on internal pages 36 of the 1000 H1K sites serve their landing page over HTTP; among sites with a secure landing page, 170 have at least one HTTP internal page Hispar: H2K = 100,000 URLs, >=2000 sites x 50 URLs (1 landing + <=49 internal), weekly refresh, bootstrapped from Alexa Top 1M via Google "site:" search Hispar is dead. Checked 2026-08-27: hispar.cs.duke.edu does not resolve (DNS NXDOMAIN); last Wayback capture that returned content 2024-11-16 (HTTP 200, 1,420 bytes); last capture of any kind 2024-12-03 (HTTP 403); github.com/waqaraqeel/hispar last pushed 2020-10-27 and github.com/waqaraqeel/lit_grabber 2020-05-26. Its bootstrap list, Alexa Top 1M, was itself retired in 2022. HTTP Archive crawls exactly ONE secondary page per site, since April 2022. har.fyi (HTTP Archive's own BigQuery reference), "Pages table": "Pages are tested on a monthly basis and as of April 2022, both the root page and one secondary page are tested." The pages table carries is_root_page and root_page columns. How the secondary page is chosen, from github.com/HTTPArchive/crawl at commit 4b83ac0 (2025-08-20), crawl.py and crawl_pubsub.py: MAX_DEPTH = 1 and MAX_BREADTH = 1, and the child job is the FIRST link in the page's crawl_links whose hostname equals the parent's, whose extension is not in ['.jpg','.jpeg','.gif','.png','.webp','.avif','.webm','.pdf', '.tiff','.zip'], and which has not already been visited. NOTE: httparchive.org/faq still says "The HTTP Archive examines each URL in the list, but does not crawl the website's other pages" — the FAQ is stale; the BigQuery reference and the crawl controller agree with each other and not with it. Checked 2026-08-27.
The on-page-action full-text probe
interaction_fulltext_probe-output.txt
- interaction_fulltext_probe-output.txt
population: --pop web → 857 papers, 857 of them with full text on disk pattern papers (any match) % papers (1st-person sentence) % ------------------------------------- ------------------ ----- ---------------------------- ----- clicks something 469 54.7% 282 32.9% scrolls 120 14.0% 69 8.1% waits / dwells a stated time 87 10.2% 56 6.5% types on the keyboard 97 11.3% 39 4.6% fills a form 59 6.9% 28 3.3% moves the mouse 42 4.9% 18 2.1% hovers 48 5.6% 14 1.6% picks links at random 21 2.5% 14 1.6% says it aims for human-like behaviour 28 3.3% 14 1.6% mentions bot / crawler detection 95 11.1% 61 7.1% subpage / subsite 110 12.8% 87 10.2% landing page only 22 2.6% 14 1.6% cloaking 150 17.5% 80 9.3% LLM / agent-driven browsing 32 3.7% 14 1.6% Both columns are UPPER BOUNDS on "the paper did this". Read the sentences with --hits "<pattern>" before quoting either. First-person-sentence hits by four-year bucket (share of that bucket's papers): pattern 2010-2013 2014-2017 2018-2021 2022-2024 2025-2026* ------------------------------------- ----------- ------------ ------------ ------------ ------------ clicks something 35/80 43.8% 41/130 31.5% 72/241 29.9% 80/253 31.6% 54/153 35.3% scrolls 2/80 2.5% 5/130 3.8% 18/241 7.5% 27/253 10.7% 17/153 11.1% waits / dwells a stated time 0/80 0.0% 12/130 9.2% 14/241 5.8% 24/253 9.5% 6/153 3.9% types on the keyboard 4/80 5.0% 6/130 4.6% 7/241 2.9% 17/253 6.7% 5/153 3.3% fills a form 1/80 1.3% 1/130 0.8% 8/241 3.3% 10/253 4.0% 8/153 5.2% moves the mouse 3/80 3.8% 2/130 1.5% 7/241 2.9% 4/253 1.6% 2/153 1.3% hovers 2/80 2.5% 0/130 0.0% 6/241 2.5% 4/253 1.6% 2/153 1.3% picks links at random 2/80 2.5% 1/130 0.8% 6/241 2.5% 1/253 0.4% 4/153 2.6% says it aims for human-like behaviour 0/80 0.0% 4/130 3.1% 1/241 0.4% 3/253 1.2% 6/153 3.9% mentions bot / crawler detection 0/80 0.0% 2/130 1.5% 17/241 7.1% 24/253 9.5% 18/153 11.8% subpage / subsite 2/80 2.5% 9/130 6.9% 19/241 7.9% 37/253 14.6% 20/153 13.1% landing page only 0/80 0.0% 5/130 3.8% 2/241 0.8% 6/253 2.4% 1/153 0.7% cloaking 11/80 13.8% 18/130 13.8% 19/241 7.9% 25/253 9.9% 7/153 4.6% LLM / agent-driven browsing 0/80 0.0% 0/130 0.0% 0/241 0.0% 2/253 0.8% 12/153 7.8% * 2025-2026 is provisional: CCS/IMC 2026 have not been held and IEEE S&P/WWW 2026 are incompletely selected.
The measured strategy ladder
interaction_probe-output.txt
- interaction_probe-output.txt
strategy pages t-landing t-article t-scroll t-click t-deep ------------------------------------------------------------------- ----- --------- --------- --------- --------- --------- landing page only 1 ✓ ✗ ✗ ✗ ✗ landing + FIRST same-origin link (the HTTP Archive rule) 2 ✓ ✗ ✗ ✗ ✗ landing + ALL same-origin links from the landing page 4 ✓ ✓ ✗ ✗ ✗ landing + all links, and scroll to the bottom of each 4 ✓ ✓ ✓ ✗ ✗ landing + all links, scroll, and click every button 4 ✓ ✓ ✓ ✓ ✗ depth 2: landing, its links, and their links, with scroll and click 5 ✓ ✓ ✓ ✓ ✓ t-landing on the landing page t-article on one subpage, at load t-scroll on that subpage, only after scrolling to the bottom t-click on another subpage, only after a button click t-deep on a page linked only from a subpage, never from the landing page Playwright 1.62.1, Chromium 151.0.7922.34, linux. Needs no network.
The dual-rendering quote check
interaction_quotecheck-output.txt
- interaction_quotecheck-output.txt
ok cols=Y pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "subsites set considerably more (36 %) cookies than the respective landing pages" ok cols=Y pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "On average, 55 cookies were set when loading a landing page while 78 were set when a subsi" ok cols=n pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "the mean amount of accessed/set cookies stabilizes around 50 (SD: 100; median at 12) after" ok cols=Y pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "visited 25, 50, 75, 100, 250, 500, and 1,000 subsites" ok cols=n pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "we choose 100 random subsites that we used during the experiment crawls" ok cols=Y pdf=Y WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "we randomly selected 100 websites (TLD+1) from the top 1,000 websites" ok cols=Y pdf=Y USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains "Interactive crawls additionally navigate to random internal pages by clicking on iframes a" ok cols=Y pdf=Y USENIX/2022/khaleesi-breaker-of-advertising-and-tracking-request-chains "we visit the Alexa top-10K homepages" ok cols=Y pdf=Y NDSS/2017/thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-libraries-o "We only crawl the homepage of each visited site due to the presence of many sites that thw" ok cols=Y pdf=Y IMC/2024/browsing-without-third-party-cookies-what-do-you-see "our dataset is biased towards static inner pages which may cause us to underestimate the i" ok cols=Y pdf=Y USENIX/2024/trust-me-if-you-can-how-usable-is-trusted-types-in-practice "visited those up to two levels of links from the start page, while crawling at most 500 UR" ok cols=Y pdf=Y USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission "we simulate user typing behavior by using randomized intervals for each key press and dwel" ok cols=Y pdf=Y CCS/2020/the-cookie-hunter-automated-black-box-auditing-for-web-authentication-and-author "In 22 cases, there was some form of an anti-bot challenge that our system was not able to " ok cols=Y pdf=Y PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework "For each domain, we programmed the crawler to load the domain's homepage,9 scroll to the b" ok cols=Y pdf=Y PETS/2024/johnny-still-cant-opt-out-assessing-the-iab-ccpa-compliance-framework "we programmed our crawler to select nine internal hyperlinks at random from the homepage a" ok cols=Y pdf=Y PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing "We added ten random sub-pages per domain, filtering to exclude auxiliary pages like privac" ok cols=Y pdf=Y PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing "the extension fetching a full link could charge advertisers as a higher-cost "click"" ok cols=Y pdf=Y PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing "we do not fetch full hyperlinks directly" ok cols=Y pdf=Y WWW/2020/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing "crawler site visits issued requests to a median of 11.6 third-party domains, whereas for v" ok cols=Y pdf=Y WWW/2020/the-representativeness-of-automated-web-crawls-as-a-surrogate-for-human-browsing "The median number of tracking domains accessed by a user on visiting a Trexa list site is " ok cols=Y pdf=n USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild "we can see that visiting subpages did indeed significantly increase the prevalence by abou" ok cols=Y pdf=Y USENIX/2021/u-cant-debug-this-detecting-javascript-anti-debugging-techniques-in-the-wild "we therefore additionally selected three random links to an internal subpage and visited t" ok cols=n pdf=Y NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search "EvoCrawl achieves a 59% increase in code coverage and successfully submits HTML forms 5" ok cols=Y pdf=Y NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search "The installation guide and Dockerfile for benchmarks can be found within the experiments/ " ok cols=Y pdf=Y PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms "a multi-agent system powered by large language models (LLMs) to simulate persona-driven br" ok cols=Y pdf=Y USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web "Browser Use framework" 26 quotes checked against two independent renderings. found in paper.cols.txt : 23 found in pypdf(paper.pdf): 25 found in at least one : 26 found in NEITHER : 0
The per-paper figure needle check
verify_interaction_figures-output.txt
- verify_interaction_figures-output.txt
SPLICED WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "stabilizes around 50 (SD: 100; median at 12) after visiting 100 subsites" (column splice in paper.cols.txt; verbatim in pypdf(paper.pdf) — see interaction_quotecheck.py) SPLICED WWW/2020/beyond-the-front-page-measuring-third-party-dynamics-in-the-field "we choose 100 random subsites that we used during the experiment crawls" (column splice in paper.cols.txt; verbatim in pypdf(paper.pdf) — see interaction_quotecheck.py) SPLICED NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search "a 59% increase in code coverage and successfully submits HTML forms 5" (column splice in paper.cols.txt; verbatim in pypdf(paper.pdf) — see interaction_quotecheck.py) 44 needles checked, 0 not located anywhere, 3 located only after undoing a column splice, 6 shorter than 20 chars (flagged, not trusted). Paraphrased figures (NOT verbatim in the paper — anchor check only):
Related
provenance/programming/interaction/outputs.txt · Last modified: by karel.kubicek.claude