Adver-City-R: Adversarial Ad Integration in RAG

• Adver-City-R is an adversarial framework that jointly optimizes ad rewriting and detection in retrieval-augmented generation, blending promotional content seamlessly.
• It employs a modular pipeline with a QA system, ad rewriter, and classifier, leveraging synthetic data and curriculum learning to improve robustness and reduce detectability.
• Empirical findings show that classifier-guided rewriting lowers ad detection rates, raising important discussions on transparency, trust, and ethical ad integration in AI systems.

Searching arXiv for the target paper and closely related work on ad integration/detection in conversational search. Adver-City-R denotes an adversarial co-evolution framework for advertisement integration and detection in retrieval-augmented conversational search. In the formulation introduced by TeamCMU, it is not a separate named model or dataset, but a modular pipeline for jointly studying two coupled problems: generating responses that embed advertisements fluently and with low detectability, and training classifiers that remain effective against increasingly subtle ad insertions. The framework is situated in RAG-based conversational systems, where the boundary between informational content and promotional content can be blurred by generation, thereby making transparency and trust central technical and normative concerns (Kim et al., 1 Jul 2025).

1. Conceptual scope and task setting

Adver-City-R is designed for conversational search systems built on retrieval-augmented generation. In the Touché 2025 Ad-RAG shared task, the system receives an open-domain query together with retrieved passages, and must either generate an ordinary informative answer or generate an answer that embeds one or more provided advertisements. The central technical difficulty is that, unlike classical search interfaces where advertisements are clearly delineated, generative systems can blend promotional language into otherwise natural responses, making advertisement presence harder to identify (Kim et al., 1 Jul 2025).

The framework addresses both the generation and the detection side of this problem. On the generation side, the objective is to insert advertisements in a way that preserves fluency and coherence while reducing detectability. On the detection side, the objective is to determine whether a response contains an embedded advertisement. The paper treats these objectives as mutually shaping: stronger detectors pressure generators to become stealthier, while stealthier generators create harder data for detector training. This interaction is described as an adversarial co-evolution loop and, more broadly, as a minimax-like interaction between generation and detection (Kim et al., 1 Jul 2025).

A common misconception is to treat Adver-City-R as a single architecture. The paper explicitly frames it instead as a system-level methodology for co-optimizing an ad-rewriter and an ad-classifier within a RAG setting. Its contribution therefore lies in the organization of components, training data, and feedback mechanisms rather than in the introduction of one monolithic end-to-end model.

2. Modular architecture

The proposed system has three main components: a QA system, an ad-rewriter, and an ad-classifier. The QA system first produces a base response $r$ from a query $q$ and retrieved passages $z$. When an advertisement item $a$ is to be inserted, the ad-rewriter $G$ takes $(q,r,a)$ and rewrites the answer into a new response $y$ that includes the advertisement while preserving coherence. The ad-classifier $H$ estimates whether a response contains an advertisement (Kim et al., 1 Jul 2025).

This decomposition is technically significant because the classifier is not restricted to post hoc evaluation. It functions as feedback for the rewriting stage, so the system can use detection signals to optimize insertion behavior. The paper’s conceptual core is therefore not merely ad insertion, but feedback-driven refinement of ad insertion through a detector that is itself being strengthened over time.

The architecture can be summarized as follows:

Component	Input	Role
QA system	$(q, z)$	Produces the base answer $r$
Ad-rewriter $q$0	$q$1	Rewrites the answer into ad-integrated response $q$2
Ad-classifier $q$3	Response $q$4	Predicts whether an ad is embedded

This modularity also makes the framework operationally flexible. The same pipeline can support ordinary evaluation of ad detectability, supervised improvement of the rewriter, and inference-time selection among multiple generated candidates.

3. Synthetic data construction and classifier curriculum

Classifier training is a major part of Adver-City-R. The authors begin with the Webis-Ads dataset, but report that it is too easy: a DeBERTa classifier already achieves around 98% accuracy, which they interpret as evidence that the ad insertions in that dataset are naïve and easy to detect (Kim et al., 1 Jul 2025).

To produce harder supervision, the paper introduces two synthetic data sources. The first, NaiveSynthetic, uses multiple LLMs prompted to insert fictional advertisements into base answers in many styles. It employs 12 prompts spanning direct and indirect, explicit and implicit, and hard-sell and soft-sell variants. The second, StructuredSynthetic, is more grounded. It mines real product entities from Wikipedia infoboxes, verifies them with Wikidata properties, summarizes the pages, and then generates both hard positives, which promote the product without overtly appearing promotional, and hard negatives, which are factual product descriptions without advertising intent. The motivation for this second source is drawn from advertising literature on explicit versus implicit persuasion and soft versus hard selling (Kim et al., 1 Jul 2025).

The classifier is trained in a staged sequence from V0.0 to V0.5:

Version	Data or strategy	Distinguishing feature
V0.0	Webis-Ads only	Baseline
V0.1	Webis-Ads + NaiveSynthetic	Single generation prompt
V0.2	Webis-Ads + NaiveSynthetic	Mixture of 12 prompts
V0.3	Earlier data + StructuredSynthetic	Harder synthetic examples
V0.4	Curriculum learning	Difficulty ordered by V0.1 logits
V0.5	Curriculum learning + balanced synthetic data	StructuredSynthetic upsampled

The curriculum-learning stage is central to the framework’s robustness claims. Examples are ordered by difficulty estimated from an earlier classifier’s logits, specifically V0.1, so training proceeds from easier to harder cases. This suggests that the paper views subtle ad detection not merely as a matter of more data, but of carefully sequenced exposure to progressively more difficult ad manifestations.

4. Ad rewriting and classifier-guided optimization

The paper examines three forms of ad rewriting. The first is zero-shot rewriting, in which a prompt instructs the model to weave in an implicit advertisement. The second is supervised fine-tuning. For this approach, the system generates five candidate rewrites,

$q$5

scores each with the classifier $q$6, and selects the candidate with the lowest ad probability:

$q$7

The selected candidate becomes the training target, and the model is optimized with the standard negative log-likelihood loss,

$q$8

In this setup, the classifier acts as a reward-like selector during data construction (Kim et al., 1 Jul 2025).

The third strategy is best-of-$q$9 sampling at inference time. The rewriter generates $z$0 candidates at a nonzero temperature, the classifier scores each candidate, and the system returns the response with the lowest predicted ad probability. In the reported experiments, $z$1 (Kim et al., 1 Jul 2025).

Conceptually, these strategies instantiate the framework’s co-evolutionary logic in different ways. Supervised fine-tuning incorporates classifier feedback into the training signal indirectly through target selection. Best-of-$z$2 uses the classifier directly at inference time as a reranker over candidate rewrites. In both cases, detectability becomes an optimization target rather than a passive evaluation criterion.

5. Evaluation protocol and empirical findings

The experiments evaluate both detection and generation. For detection, the paper reports binary classification accuracy on responses produced by different ad-rewriting strategies; for the official shared-task evaluation, it also reports F1-score. For generation and ad integration, the key metric is ad detection recall under a hidden organizer classifier, where lower recall indicates that advertisements are harder to detect and therefore more stealthy (Kim et al., 1 Jul 2025).

Several findings structure the paper’s empirical argument. First, classifiers trained with synthetic data are substantially more robust than the baseline trained only on Webis-Ads. The authors highlight V0.1 and V0.4 as strong performers across diverse rewriting strategies, which they interpret as evidence that both synthetic augmentation and curriculum learning materially improve robustness (Kim et al., 1 Jul 2025).

Second, classifier-guided rewriting reduces detectability. Both the supervised fine-tuning rewriter and the best-of-$z$3 rewriter lower ad-detection accuracy relative to plain zero-shot rewriting, often reducing detection by robust classifiers to around chance levels. The paper reports that these methods can deceive strong classifiers in roughly 50% of cases, and that the improvements are statistically significant under a paired Wilcoxon signed-rank test (Kim et al., 1 Jul 2025).

Third, generation temperature affects detectability. Lower-temperature generations tend to be less detectable than higher-temperature generations, which the authors attribute to greater coherence and more natural blending. This does not establish a universal law of temperature control, but it does indicate that decoding strategy materially interacts with ad stealth.

On the shared task, TeamCMU submitted the Zero-Shot-BoN system for generation and the V0.4 classifier for detection. Their generation system ranked 3rd by recall in the ad-generation subtask, and their classifier ranked 3rd by F1 in the ad-detection subtask (Kim et al., 1 Jul 2025).

6. Transparency concerns, limitations, and broader significance

The paper’s broader significance lies in showing that ad integration in conversational RAG can be operationalized as a coupled optimization problem between a generator and a detector. This framing has immediate technical utility, since it yields a practical pipeline for either transparent ad-aware generation or stealthier native ad insertion, depending on deployment goals (Kim et al., 1 Jul 2025).

At the same time, the work foregrounds an ethical tension. If advertisements can be inserted so naturally that neither users nor classifiers reliably notice them, then the problem is not only one of generation quality but of disclosure, accountability, and trust. The authors explicitly note that real-world deployment would require explicit disclosure and safeguards. This is not an external critique added after the fact; it is integrated into the paper’s interpretation of the results.

The limitations are also clearly delineated. The framework relies heavily on synthetic data, so real-world validity remains uncertain. The classifier is binary, which may miss nuanced or context-dependent advertisements. Detectability is judged by classifier performance rather than by human perception. The authors further suggest future work on stronger validation of synthetic data, more realistic bidding and retrieval settings, and fairness-aware ad allocation in RAG systems (Kim et al., 1 Jul 2025).

Taken together, these features position Adver-City-R as a research framework for studying how native advertising emerges in generation-based search systems under adversarial pressure. Its central claim is not that advertisement insertion or advertisement detection can be solved independently, but that each must be evaluated against the adaptive evolution of the other.