Thousands of deceptive ads on Google exposed using Google’s own free AI tools

Fake virus or tracking warnings, bogus photo-recovery apps, and false “storage almost full” notices are among thousands of deceptive ads running on Google, according to researchers at NYU and Radboud University. They analyzed 188,000 ad creatives using Google’s own open-source AI models, reported some scam ads to Google, but most stayed running.

Many deceptive ads slip through Google’s ad review system. Researchers have demonstrated just how many using a pipeline built with Google’s Gemma and Qwen open weights large language models.

The modular detection system, dubbed AdLens, identified hundreds of deceptive software ads, which received millions of impressions.

It was built by researchers at New York University (NYU) and Radboud University – Ritik Roongta, Marwan Darwish, Masoud Aghdam, Rachel Greenstadt, and Gunes Acar.

“We analyzed 188k ad creatives and found hundreds of scareware ads with over 16 million EEA (European Economic Area) impressions and thousands of deceptive claim ads with 89.9 million impressions, still active,” said the lead author, Roongta.

Some of the identified ads directly link to known malware campaigns, such as TamperedChef, distributing trojanized PDF editors, or IPIDEA, the world’s largest illicit residential proxy network that routes internet traffic through everyday consumer devices without owners’ knowledge.

The researchers pulled data directly from Google’s own Ads Transparency Center in EEA, where Google provides impression counts, topic labels, and broad targeting information.

Their crawler checked 90,000 advertiser IDs evenly sampled across three categories: Software, Mobile App Utilities, and Computer and Consumer Electronics.

These IDs had a total of 188,000 ad variants (creatives), averaging roughly 2 ads per ID. OCR-text deduplication reduced the total count to 112,000.

From this sample, AdLens flagged nearly 4,000 total violators (IDs):

• 238 published scareware ads: using fabricated threats or warnings to induce urgency, such as claims of device compromise, account suspension, data exposure, etc.
• 3,346 published deceptive ads: presenting a plausible but false claim to induce clicks or installs. Researchers identified 3 recurring themes: photo/data recovery bait, people tracking/surveillance, and social-curiosity bait, i.,e “You deleted 100 photos 3 years ago,” or “Track anyone’s location by entering their phone number.”
• 258 published misleading ad designs: mimicking system dialogs or using low-information call-to-action (CTA) interfaces that obscure advertiser identity or intent, i.e., prompts such as “Continue,” “Access Now,” or “Click here.”

“We then reported a sample of them back to Google to see how their moderation actually responds. The results were surprising, and they point to some real gaps in how Google handles this,” said Roongta.

Of the 24 reported ads, Google confirmed only 6 as violations, 3 came back as “unable to review,” and the remaining 15 were ruled non-violating.

One of the non-violating ads directed users to a malware-serving domain, which was flagged by VirusTotal.

“In one case, we reported 1 of 42 ads linking to pdfscraper[.]com, a domain tied to TamperedChef. Google removed that single ad but left the other 41 linking to the same domain live,” said Roongta.

The researchers noted that there was no way to report deceptive ads at scale – Google’s flow only lets users flag one ad at a time. Even if a violation is confirmed, it isn’t linked to other ads doing the exact same thing.

Researchers used Gemma to detect deceptive ads running on Google

At every stage of the AdLens analysis, researchers relied on open-weight models. They hope that their tool, shared in an anonymized code repository, will be useful to a broad audience free of constraints, such as per-token costs. AdLens can run efficiently on a mid-tier GPU.

“Our study brings transparency to the otherwise opaque advertising ecosystem by providing tools, datasets, and methods to researchers, regulators, and civil society organizations.”

Small Google-built Gemma models carried much of the heavy lifting. The researchers used the Gemma3-12B and Qwen3.5:9B for classification. When the 2 models disagreed, the larger Gemma4-26B stepped in as a judge to resolve ambiguous cases.

The entire pipeline looks like this:

1. A crawler: (Puppeteer-based) extracts ad creatives and metadata from the Ad Transparency Center.
2. OCR: PaddleOCRv5 extracts text
3. Translation: TranslateGemma 4B is used to translate all text into English
4. Embedding and ranking: EmbeddingGemma (300M) ranks ads by similarity to known scam patterns, narrowing down the dataset.
5. Classification: The top-ranked ads are passed to “LLM Ensemble” – two models, Gemma3-12B and Qwen3.5-9B, independently classify each ad
6. Judging: Gemma4-26B model makes the final call in disagreements

“Our results show that deceptive advertisers continue to misuse the immense reach provided by advertisement networks. While Google takes down hundreds of millions of ads for violating their policies, we show that many deceptive and malicious ads remain online and reach millions of unsuspecting users,” the preprint concludes.

Researchers see potential to expand AdLens to additional ad categories beyond software and mobile app ads. The tool can be easily adapted to analyze ads on other platforms, such as Meta or TikTok.

The paper also warns that attackers might attempt to bypass this type of analysis using prompt injection or jailbreaking attacks.