LLM and Generative AI Security in Advertising

LLM and Generative AI Security in Advertising

Introduction

Modern advertising platforms use LLMs (large language models), VLMs (vision-language models), and generative endpoints on the live serving path for publisher-page contextual review, ad-creative policy review, autonomous campaign management, generative ad copy, and multimodal deep-fake detection. This guide covers the controls specific to that generative surface. Read the companion guide, AI-Powered Advertising Systems Security, first for the ad-serving primer (buyer/DSP, seller/SSP, publisher, auction, outcome-event boundary) and the classical-ML controls that gate consent, protect training corpora, defend inference, and secure outcome events. The five numbered sections here follow the same threat, defense, evidence, and runtime structure.

LLM touchpoints on the ad-serving path:

Four properties make LLM security in ad-tech different from the classical-ML surface. The attacker’s payload is text, so every text field on the ad-serving path (publisher HTML, landing page, brief, creative) is a prompt injection vector. The system prompt is both product logic and security boundary, so leaking it exposes both. Retrieval is a training corpus consulted at inference, so poisoning the RAG index poisons every downstream decision. Agents can spend money and change state without a human in the loop, so a prompt injection that used to produce a wrong label now moves budget. The three properties from the companion guide (adversary is a paying customer, training data is adversary-writable, every decision moves money on the live path) still apply.

The Appendix at the end lists terms and acronyms that are not glossed inline.

1. LLM Input Boundary

30-second takeaway: every attacker-controlled text or media input reaching an LLM, VLM, or audio-LM on the ad-serving path is a prompt injection vector. Run a dual-LLM handoff on text, ensemble two VLMs on images, run a clone detector plus AI-content detector on audio, and treat the browser’s on-device LLM as origin-scoped, not iframe-scoped.

The OWASP LLM Prompt Injection Prevention Cheat Sheet covers the generic constrained-decoding baseline. This section owns the ad-tech-specific shapes of the OWASP LLM01:2025 Prompt Injection control point (MITRE ATLAS AML.T0051, indirect variant AML.T0051.001).

Input surfaces and example payloads:

Controls:

• Run a dual-LLM handoff on every attacker-controlled text input. A quarantined LLM reads untrusted markup and emits a fixed JSON schema; a privileged LLM reads only the schema and never touches raw markup. Concrete shape:

# Quarantined LLM reads untrusted text, emits schema only
raw = llm_quarantined.complete(
    QUARANTINED_SYSTEM_PROMPT + f"Page HTML:\n{untrusted_html}",
    schema={
        "content_summary": "string",
        "entities": "list[string]",
        "prohibited_terms_detected": "list[string]",
    },
)
# Privileged LLM reads the schema only, decides monetization
verdict = llm_privileged.complete(
    PRIVILEGED_SYSTEM_PROMPT + f"Summary: {raw['content_summary']}",
    schema={"brand_safe": "bool", "reason": "string"},
)

• Cross-check every monetization-changing boolean verdict against a non-LLM rules baseline. Disagreement above threshold routes to human review. One flipped LLM verdict monetizes unsafe inventory at safe-inventory CPMs.
• Strip payload classes at ingestion before the quarantined LLM sees them: HTML comments, zero-width Unicode, display:none DOM, hidden alt and aria-* text, off-viewport positioning.
• Treat brief fields as data, not instructions. Apply a deny-list of targeting-changing verbs and protected-audience terms; positive hits require advertiser HITL (human-in-the-loop) approval. COPPA (16 CFR Part 312), California CPRA section 1798.120(c), and DSA Art. 28 all apply here.
• Re-quarantine on every retrieval hop. A stored brief pasted into a later prompt is second-order injection.
• Refuse policy-affecting memory writes from user turns; wipe memory on any tool-authority scope change.
• Ensemble two differently trained VLMs on submitted images and video-frame sets; disagreement above threshold routes to human review. Physically realizable patches survive digital preprocessing per NIST AI 100-2e2025 Section 2.2.4; Qi et al. 2023 (arXiv:2306.13213) show one visual adversarial example can universally jailbreak an aligned model.
• Run a voice-cloning detector plus an AI-content detector as two separate gates on submitted audio. Require voice-usage authorization on file before accepting audio that asserts a named real person.
• Treat on-device LLMs as origin-scoped. Chrome’s Prompt API is available to top-level windows and same-origin iframes by default; a cross-origin ad iframe reaches it only if the publisher explicitly delegates allow="language-model". Never assume the grant. Treat every on-device LLM output as untrusted at the DOM boundary; CSP does not inherit into a cross-origin ad iframe.

2. Retrieval Trust and Fine-Tune Supply Chain

30-second takeaway: the retrieval corpus and the fine-tune adapter are the highest-value write targets in the ad-tech LLM stack. Sign every RAG chunk, verify at retrieval, feed provenance as an input feature; refuse to load an unsigned adapter and gate promotion on a held-out trigger corpus the platform (not the vendor) controls.

The OWASP RAG Security Cheat Sheet covers generic vector-DB hardening; OWASP Secure AI/ML Model Ops covers generic artifact signing and ML-BOM.

Corpus and adapter surfaces:

Controls:

• Sign every RAG chunk with an offline key at index time; verify at retrieval; feed the verdict into the reviewer prompt as a first-class input feature so a downgrade to unsigned or wrong-signer status appears in the classifier’s decision string rather than being silently dropped. OpenSSF Model Signing (OMS) scopes to model artifacts; its underlying primitives, a sigstore bundle (signature package), a DSSE envelope (Dead Simple Signing Envelope, attestation container), and an in-toto statement (structured claim about an artifact), extend to per-chunk manifests. Treat this as applying the OMS primitives, not as an OMS-scoped guarantee.
• Key per-tenant RAG-index write ACLs off tenant identity, never off prompt or retrieved content. Prompts collide across tenants on shared taxonomy; tenant IDs do not.
• Verify retrieved chunks k-of-n against a signed manifest of canonical policy anchors for the query cluster (a set of semantically related queries that share the same policy anchors, for example every alcohol-creative query must return at least k of n prohibited-terms anchors). Retrieval that returns on-topic chunks without the anchors fails closed to the rules baseline.
• Default to MMR (maximal-marginal-relevance) or diversity-sampled retrieval, not similarity top-k alone. An author-access attacker who seeds benign-looking paragraphs that embed close to prohibited-terms queries can drown the guardrail anchor out of top-k. Hu et al. 2024 (arXiv:2402.07179, GGPP) show adversarial prefixes steer RAG outputs and can override “ignore irrelevant context” instructions.
• Alert on any retrieval whose top-k excludes canonical policy anchors for the cluster. Missing anchors on an approving verdict route to HITL.
• Sign the fine-tuned adapter with OMS; sign the fine-tune dataset with in-toto attestation bound to the adapter’s ML-BOM entry. Refuse to load an adapter whose signature does not chain to an advertiser-registered signing identity. When a compromise is discovered, use the scoped-rollback query primitive from the Protect the Training Corpus section of the companion guide (the participant-provenance tag lets you exclude a compromised advertiser’s rows and adapter versions on the next retrain without re-hashing the corpus) to remove tainted training material.
• Run a promotion-gate behavioral test on a held-out trigger corpus the platform builds from the advertiser’s own claims taxonomy and forbidden-completion list. Hubinger et al. 2024 (arXiv:2401.05566, “Sleeper Agents”) show supervised fine-tuning, reinforcement learning (RL), and adversarial training do not remove trigger-conditioned backdoors, and that adversarial training “can teach models to better recognize their backdoor triggers, effectively hiding the unsafe behavior.” Safety-eval score alone is not evidence of trust.
• Refuse to load any unsigned adapter into the serving path. An unsigned artifact is a failed load, not a warning.

3. Cross-Tenant Isolation and System-Prompt Leakage

30-second takeaway: the same LLM endpoint that answers advertiser A’s reporting query holds advertiser B’s brief tokens in its cache. Key every cache off tenant ID (not prompt content), enforce hard ACLs on RAG and plan caches, unload adapters per session, and treat the system prompt as not-a-secret.

The leaked artifact is competitive spend intelligence (a rival’s targeting assumption, custom-audience hash, or campaign ID). Generic multi-tenant primitives (microVM, gVisor, dedicated node) live in OWASP Secure AI/ML Model Ops Cheat Sheet Section 6.

Isolation surfaces:

Controls:

• Key every cache off tenant ID, never off prompt content. Applies to KV, RAG, plan, and adapter pool.
• KV cache isolation is a deployment property, not a session-scope side effect. Any hosted-inference SKU without a documented per-tenant KV boundary lets the reviewer LLM exfiltrate competitive data.
• RAG index uses a per-tenant namespace with a hard ACL. On empty result, return empty; do not fall back to a neighbor namespace.
• Plan cache never reuses a plan across advertisers, even on identical query text. A plan encodes A’s competitor-exclusion list, bid-shading assumption, and audience-overlap heuristic.
• Load fine-tune adapters per session, unload on session end. A shared warm pool that keeps advertiser A’s brand-voice adapter resident for latency is the leak vector.
• Scope the reporting-assistant data-access credential to the authenticated session’s advertiser account. A shared service-account credential with cross-account read is the OWASP LLM02:2025 Sensitive Information Disclosure root cause on this surface.
• Maintain a per-tenant asset-fingerprint registry so a downstream generator call that recombines two tenants’ assets is refused, not laundered into a novel deep fake.
• Run cross-tenant identifier DLP on model output. Match account ID, campaign ID, custom-audience hash, and creative ID against the session’s tenant registry; block any identifier that does not resolve to the caller. This is ad-platform identifier taxonomy, not generic PII scanning.
• System-prompt secrecy is not a policy boundary. Enforce every brand-safety threshold and per-vertical exception in a separate deterministic post-processor keyed off the LLM’s structured output. The LLM proposes a verdict; the rule layer decides whether the exception applies.
• Refuse instruction-recitation queries at the guard layer, not by asking the model to keep a secret. Regex output-monitoring for known ad-tech system-prompt markers blocks accidental echo. On any observed extraction, rotate thresholds and exception lists, then correlate against the next 24 hours of creative-approval flips.

4. Agentic Ad Management

30-second takeaway: in an agentic ad-manager, an injected string in a publisher page can become an argument to campaign.update_budget. Bind HITL approvals to a six-tuple, keep the spend cap outside the prompt, and keep a warm rules-based bidder ready as the kill-switch fallback.

The agent’s authority is denominated in advertiser spend. Every control below assumes the prompt is untrusted (Section 1) and every gate lives outside the LLM session. Generic SecureAgentBus primitives (signed inter-agent messages with freshness bounds, defined in the OWASP AI Agent Security Cheat Sheet) apply here.

The controls below rely on HITL (human-in-the-loop) approval: a required human sign-off in which the approver sees a full action preview before the tool call executes. HITL is the last line of defense on tools that move advertiser spend or change brand-safety scope.

Tool risk tiers:

Controls:

• HITL approvals bind a six-tuple. Concrete shape:

{
  "actor": "user_id or agent_id",
  "tool": "campaign.update_budget",
  "target": "campaign_id=42",
  "normalized_parameters": {"daily_cap_usd": 500},
  "timestamp": "2026-08-30T14:22:11Z",
  "expiry":    "2026-08-30T14:32:11Z"
}

An approval for daily_cap_usd=500 does not authorize 5000; a different campaign ID does not survive the tuple. Any parameter drift after the model regenerates the call revokes approval and forces re-preview.

• The policy service canonicalizes parameters server-side (currency, unit, target-ID resolution) so a re-worded injection that resolves to the same target does not evade an already-consumed approval.
• Bind the per-agent tool allowlist to the agent’s issued identity, not to the LLM session or conversation. Session compromise cannot expand the allowlist.
• The policy service enforces the per-session dollar cap; the agent has no policy.raise_cap tool. Never write the cap into the system prompt.
• Circuit breakers trip on anomalous tool-call rate per session, per agent identity, and per advertiser tenant. A burst of campaign.pause calls against competitor-facing campaigns trips before any single call looks malformed.
• Fail closed on risk-classification, approval-validation, policy-lookup, and audit-log-write failure. If the audit log cannot record the action, the action does not execute.
• Kill-switch fallback is a pre-deployed rules-based bidder, compiled and kept warm. A single control-plane flip diverts campaign traffic while the agent is quarantined; the kill-switch also freezes the agent’s tool allowlist to reporting-only.
• Quarantine reward events past the fraud-adjudication lag. Reinforcement-learning and bandit policy updates ingest outcome events only after the invalid traffic (IVT) and fraud-adjudication verdict has landed (the Protect the Training Corpus section of the companion guide sets the quarantine window against each mode’s adjudication lag). Cap the maximum policy shift per epoch.
• Rate-limit the platform’s generative-creative endpoint per client and per campaign, independent of serving-path limits.
• Freeze the generation model version from the control plane during an incident. Every generated asset re-enters the full ingestion pipeline; no fast path from generation to serving.

5. Generative Provenance and Runtime

30-second takeaway: a platform that runs its own generative endpoint is a provider under EU AI Act Art. 50(2) and must mark AI-generated output at egress; the advertiser is the deployer under Art. 50(4) and must disclose the deep fake when it meets Art. 3(60). Sign with C2PA at egress, re-sign per rendition, refuse boolean LLM verdicts as terminal, and budget partner spend in dollars per minute (not requests per minute).

AI Act Art. 50 role mapping:

The Art. 50(4) editorial-responsibility carveout attaches only to AI-generated text published to inform on matters of public interest; it does not lift the deep-fake disclosure duty for image, audio, or video ads. Art. 50(2)’s assistive function exception does not cover an endpoint that materially generates the creative. DSA Art. 26 paid-ad transparency is not AI-specific and lives in the companion guide.

Controls:

• Emit the C2PA manifest with a hard binding over the generator output bytes on the same call that returns the asset, signed by the platform’s generator claim signer (not a downstream ad-server key). Attach an action assertion naming the model version and brief-hash so the ingestion verifier can cross-check against the deployment-lock catalog.
• Re-sign per rendition, carrying the generator’s original manifest as an ingredient (C2PA 2.1 Section 18.13). Hard bindings are byte-exact and do not survive re-encoding; re-sign at every image resize (Section 9.2.2 method / Section 18.7 assertion), video adaptive-bitrate ladder step (Section 9.2.3 method / Section 18.6 assertion), and audio SSAI stitch. Severing that chain strips the Art. 50(2) mark from the paid-media asset.
• Do not rely on soft binding for the Art. 50(2) mark. C2PA 2.1 Section 9.3.1 lists no approved and no deprecated soft-binding algorithm, naming ISCC as a candidate under evaluation only. Perceptual audio watermarks (AudioSeal, SynthID-Audio) fragment across SSAI stitching, loudness normalization, and codec change.
• Require a likeness or voice-use authorization artifact on file, signed by the named real person or their rights holder, before the generator accepts a brief that asserts a real person. Embed the authorization ID in the manifest’s action assertion; reject at ingestion any recombining creative without it.
• Set the deep-fake flag at generation time when a brief recombines advertiser-supplied stills or voice into a scene never staged. The Art. 3(60) trigger is a person’s perception of authenticity, not the platform’s judgment of resemblance sufficiency.
• Never accept a boolean LLM verdict as terminal. Join every safety call to a deterministic signal (URL blocklist, category classifier, publisher-tier allowlist) for the same decision. Emit {verdict: safe|unsafe|unknown, confidence, evidence_ids[]}. Below-threshold confidence returns unknown. Reject any verdict whose evidence_ids[] do not resolve to indexed RAG chunks. This is the OWASP LLM09:2025 Misinformation control on brand safety.
• Budget per-partner spend in dollars per unit time on paid LLM calls, not requests per minute (RPM alone does not catch prompt-length or decode-depth inflation). Trip a cost circuit breaker when spend-per-minute for a partner exceeds its budget. Cap prompt and response tokens per call; refuse tool-loops beyond a fixed depth. Log cost_per_bid as a first-class SLO metric.
• Deployment-lock the generation model version. Pin serving-time model ID so an incident freeze does not require a serving redeploy.
• Monitor same-tenant same-landing-page headline drift toward a prohibited category (the fingerprint of landing-page injection on the advertiser’s own page, Section 1). Re-ingest every generated asset.

References

LLM security standards:

• OWASP LLM Top 10 (2025): LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM04 Data and Model Poisoning, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption
• MITRE ATLAS: technique-page URLs return HTTP 404 to non-browser fetchers; the resolvable source of truth is the YAML at mitre-atlas/atlas-data
• NIST AI 100-2e2025 (final 2025-03-24): Adversarial Machine Learning Taxonomy, Section 2.2.4 Evasion attacks in the real world

Academic anchors:

• Qi et al. 2023, arXiv:2306.13213: Visual Adversarial Examples Jailbreak Aligned Large Language Models
• Hubinger et al. 2024, arXiv:2401.05566: Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
• Hu, Wang, Shu, Paik, Zhu 2024, arXiv:2402.07179: Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models (GGPP)
• Hu et al. 2021, arXiv:2106.09685: LoRA: Low-Rank Adaptation of Large Language Models
• Shumailov et al. 2021, arXiv:2006.03463: Sponge Examples: Energy-Latency Attacks on Neural Networks

Provenance and signing:

• C2PA 2.1 Specifications: asset rendition, soft-binding status (Section 9.3.1), general-box hash method (Section 9.2.2), general-box assertion (Section 18.7), BMFF hash method (Section 9.2.3), BMFF assertion (Section 18.6), embedding (Section 11.3), ingredient assertion (Section 18.13)
• OpenSSF Model Signing: implementation at sigstore/model-transparency
• DSSE (Dead Simple Signing Envelope): attestation envelope format
• in-toto Attestation Framework: structured claims about artifacts
• CycloneDX 1.7 ML-BOM (ECMA-424 2nd Edition)

Regulatory:

• EU AI Act (Regulation 2024/1689): Art. 3(60), Art. 50 including 50(2) and 50(4)
• DSA (Regulation 2022/2065): Art. 26 paid-ad transparency, Art. 28 minor protection
• 16 CFR Part 312 COPPA: under-13
• 16 CFR Part 255 FTC Endorsement Guides
• 15 U.S.C. section 45 (FTC Act section 5)
• California CPRA section 1798.120(c): under-16 opt-in for sale/sharing, actual-knowledge trigger
• ASA/CAP Code: section 3 on misleading advertising

Platform documentation:

• Chrome Prompt API: built-in on-device LLM. Experimental origin-trial territory; the API surface and the allow="language-model" Permission Policy semantics may change.
• MRC Invalid Traffic Detection and Filtration Guidelines

Companion pages:

• AI-Powered Advertising Systems Security, the companion guide on this wiki, covering consent gating, training-corpus protection, inference hardening, outcome-event integrity, and the AI supply chain
• AI-Powered Advertising Systems Security Cheat Sheet, the concise checklist covering both guides, in the OWASP Cheat Sheet Series

Related OWASP cheat sheets:

• LLM Prompt Injection Prevention Cheat Sheet
• AI Agent Security Cheat Sheet
• Secure AI/ML Model Ops Cheat Sheet
• RAG Security Cheat Sheet
• Software Supply Chain Security Cheat Sheet
• Denial of Service Cheat Sheet
• Input Validation Cheat Sheet

Appendix: Terminology Quick Reference

Compact reference for terms not glossed inline. See body for links to primary sources.