Thank you for your thoughtful review. We are grateful that you recognized our work as "quite original", our PVM mechanism as "simple and optimal", and that its DSIC property addresses the cold-start problem. We are especially grateful for your crucial question regarding practical feasibility, which has helped us realize the need to better clarify the modern industry context for this problem. We also emphasize that our work is not just a theoretical issue. As a leading company in the industry, we have direct insights from our proprietary data. Our responses to this are summarized in the table below, with detailed explanations to follow.

Summary of Responses and Planned Revisions

Q1 Major Question: The Practical Context and Platform Examples

In some scenarios—for instance, a brand like Nike directing ad traffic to its own brand site—verification via external links is straightforward.

Our work, however, focuses on the more complex and increasingly prevalent scenario where advertisers do not control the landing page. A key example is a game developer advertising on TikTok whose landing page is the Apple App Store. In our model, the "platforms" are the major ad networks where these advertisers place their ads, primarily Facebook, Instagram, Google Ads, and TikTok Ads.

The critical feature of this scenario is that the advertiser does not control the final landing page—key examples being app developers linking to the App Store or e-commerce merchants to a marketplace like Amazon. This is precisely why the external-link verification method you described is not viable for them: they cannot deploy their own tracking pixels on these third-party platforms and thus have no independent way to verify the true click timestamp.

Historically, this verification gap for uncontrolled landing pages was filled by third-party Mobile Measurement Partners (MMPs), such as AppsFlyer. These services track user interactions through redirection. When a user clicks on an ad, he/she are first directed through a MMP's URL, which logs the timestamp and metadata, before being redirected to the final landing page. This process allows the MMP to track the click and provide click data to the advertiser.

However, recent changes in platform policies and evolving advertiser priorities have made redirect-based verification increasingly difficult to implement.

(1) Platform-Side Prohibition of Third-Party Redirection

Before 2020, MMPs like AppsFlyer and Adjust commonly used redirection to track ad clicks, capturing important data (e.g., the IDFA) before redirecting users to their landing pages. However, this practice has become increasingly restricted due to growing privacy concerns. Regulations such as the General Data Protection Regulation (GDPR, 2018), China's Personal Information Protection Law (PIPL, 2021), and Apple's App Tracking Transparency (ATT, 2021) have significantly limited redirection paths. These regulations primarily aim to protect user privacy and prevent third-party services from redirecting users to potentially unsafe websites. As a result, platforms like the Apple App Store, along with ad platforms such as Meta and Google Ads, now require users to be directed directly to the landing page, eliminating the ability to route user data through third-party servers. Consequently, advertisers can no longer rely on MMPs for click tracking.

(2) Advertiser-Side Constraints

Even in cases where redirects are not explicitly banned, advertisers are increasingly moving away from them due to several key factors:

• Protection of Proprietary Data: Many advertisers are highly protective of their user data and reluctant to share it with external parties, even when such third-party solutions are not explicitly prohibited.
• Impact of Redirects on Conversion Rates: Even when redirects are permitted, the growing prevalence of disruptive pop-up warnings has become a major concern. Many platforms, though not completely banning redirects, now display confirmation prompts (e.g., "Are you sure you want to visit this link?") that create friction in the user experience, thereby discouraging users from completing their intended actions.
• High Costs of Redirect Solutions: Whether using third-party MMPs or developing an in-house solution, implementing redirects incurs significant costs, making these solutions less attractive to advertisers.

As a result of these developments, the ability to use external links for verification has been severely diminished. Consequently, a large number of advertisers are left increasingly reliant on unverified, platform-reported data, making the strategic delay of timestamps a meaningful and urgent issue. Based on our unpublished research, this method of attribution through platform-reported click data is the dominant approach for app download ads, accounting for at least 70% of cases.

Furthermore, even if third-party verification were still possible, the traditional approach becomes a costly "cat-and-mouse game" between detection and fraud, as it does not address the platforms' inherent incentive to misreport data. In contrast, PVM tackles the problem at its core by using mechanism design (DSIC), ensuring that honesty becomes the most profitable strategy for all involved parties.

Q2 Real-Life Examples

Two common examples of this scenario are app downloads and e-commerce platforms:

• App Downloads: When a user clicks on an ad for an app, he/she is sent directly to the App Store (e.g., Google Play or Apple’s App Store). Since platforms no longer allow redirects and the app store page is not controlled by the advertiser, the advertiser cannot use a MMP to track the exact timing of the click. This creates a situation where the advertiser cannot verify the attribution independently, and the platform can manipulate the timing of click reporting to affect attribution.
• E-commerce Platforms: Similarly, when users click on ads for products on advertising platform (e.g., Facebook), they are sent directly to an e-commerce platform (e.g., Amazon). Just like in the app download scenario, since redirects are not allowed by Facebook or Amazon, MMPs cannot track clicks for advertiser.

Q3 Ad Click Declaration and Verification Mechanisms

When a user clicks an ad on a platform like Facebook or TikTok, the ad platform instantly captures a detailed Device Fingerprint. This includes key information such as the Device Advertising ID (e.g., IDFA or GAID, if permitted), IP address, and a User-Agent string. The platform then sends this data packet directly to the advertiser's server (maybe with some strategic delay).

Later, if the user converts (e.g., by opening the newly downloaded app for the first time), the advertiser's SDK in the app collects the same type of Device Fingerprint from the device. By matching the fingerprint from this new conversion to the previously received click reports, the advertiser can then attribute the installation.

However, while this matching process can verify that a specific user clicked, it provides the advertiser with no way to independently verify when that click truly occurred. This information asymmetry, and the resulting potential for strategic timestamp manipulation, is precisely the problem we address in our paper.

Q4 Adapting the Mechanism for Multiple Clicks or Conversions per Platform

PVM can be straightforwardly adapted to handle both scenarios. The key principle is that PVM operates on a per-conversion basis, considering the last click from each platform.

• Multiple Clicks: When a single platform serves multiple ads to a user before one conversion, the standard last-click attribution principle is applied before PVM is invoked. Specifically, for each platform, only the timestamp of its final click prior to the conversion is considered a candidate for attribution. PVM then operates on this set of candidate last clicks (one from each participating platform).
• Multiple Conversions: In scenarios where a platform contributes to multiple conversions, we apply PVM to each conversion independently. This ensures that each conversion event is attributed correctly.

Thank you for your detailed review. We sincerely appreciate your recognition of our novel perspective, well-executed theoretical analysis, and the elegant proof. We will address the typos you mentioned in Weakness 1 and have summarized our overall responses to the other concerns below, with detailed replies provided further on. Apologies for the brevity, but due to space limitations, a more detailed rebuttal on strategic feasibility can be found in our responses to Reviewer Fr9B and Tb4U, while the discussion on the independence of $F_i$ is addressed in our response to Reviewer nsc8.

Summary of Responses and Planned Revisions

W2: Problem Formulation

This is not just a theoretical issue. As a leading company in the industry, we have direct insights from our proprietary data.

(W2.1) Strategic Delayed Feasibility

The user conversion process could be classified into 2 scenarios based on the landing page:

• Advertiser-controlled landing pages: For example, when a company runs ads on Facebook and directs users to its own website. In this case, the advertiser can easily record the true click timestamp. However, this is not the focus of our paper.
• Advertiser-uncontrolled landing pages: This includes cases like app developers advertising their apps (with the landing page being an app store) or merchants promoting products on third-party platforms (e.g., Amazon). Here, advertisers cannot record click timestamps by themselves because they don’t control the landing page.

In cases with advertiser-uncontrolled landing pages, advertisers often use Mobile Measurement Partners (MMPs), like AppsFlyer, to track user interactions. The process involves redirecting users through a MMP's URL before reaching the landing page. When a user clicks on an ad, he/she first goes to the MMP's URL, which logs the timestamp and metadata, then is redirected to the final landing page. This allows the MMP to independently track the click and provide the data to the advertiser.

However, recent changes in platform policies and advertiser priorities have made redirect-based verification harder to implement:

• Platform-Side Prohibition on Third-Party Redirection: Regulations like GDPR (2018), China’s PIPL (2021), and Apple’s ATT (2021) limit redirection paths to protect user privacy and prevent unsafe redirects. As a result, many app stores and ad platforms now require users to go directly to landing pages, cutting out third-party servers.
• Advertiser-Side Constraints: (Data Privacy) Many advertisers are increasingly protective of their proprietary user data and are unwilling to share it with external parties like MMPs. (Redirect Impact on UX) Even when redirects are allowed and data privacy is not a concern, many platforms display warning messages—like “Are you sure you want to visit this link?”—that disrupt the user experience and hurt conversion. (Cost of Redirect Solutions) Implementing redirects, whether through MMPs or in-house systems, is costly, making it less attractive.

Due to these changes, external-link-based verification is no longer viable for many advertisers, leaving them dependent on unverified platform-reported data. Based on our unpublished research, this method of attribution through platform-reported click data is the dominant approach for app download ads, accounting for at least 70% of cases.

Furthermore, using third-party verification becomes a costly "cat-and-mouse game" of detection versus fraud, as it doesn’t address the underlying platform incentive to misreport. In contrast, PVM addresses the root cause by using mechanism design (DSIC) to make honesty the most profitable strategy.

(W2.2) Other Click Attacks

PVM resists click spamming for the same reason as the normalization issue. In LCM, platforms are incentivized to spam by being rewarded for the last reported click. However, under PVM, platforms have no such incentive, as their reward depends on peer reports, not their own. Therefore, spamming has no impact on their payoff, regardless of how much they spam.

W3: Normalization Issue

(W3.1) Expectation Constraint

The expectation-based normalization ($E[\sum x_i]\leq 1$) was a deliberate one, motivated by the practical objective of ensuring the advertiser's budget is respected on average over many conversions. This approach provides the necessary long-term budget control that advertisers require, while allowing for the flexibility needed to design a powerful incentive-compatible mechanism.

(W3.2) DSIC Claim

PVM is DSIC under our standard utility model ($u_i = x_i$), where agents are rational and self-interested, meaning their utility depends only on their own payoff. In this model, platforms are indifferent to the payoffs of their peers.

The idea of a fixed advertiser budget is insightful, as it leads to a new research direction: a repeated game with externalities. In this setting, platforms would be incentivized to hurt their peers’ performance to capture a larger share of the fixed budget. This is a sophisticated challenge, as such externalities can compromise the incentive properties of even canonical truthful mechanisms like VCG. However, we believe it is a compelling direction for future research, and it further convinces us that strategic behavior in ad attribution is a rich field with significant value.

W4: Click Time Distribution Issues

(W4.1) Knowledge of Prior

The "unknowable prior" is exactly why DSIC is important. PVM's DSIC property solves the 'cold-start' problem by allowing platforms to start with arbitrary priors. Since DSIC ensures truthful reporting, the data collected (from platforms) over time is honest, allowing advertisers to learn the correct distribution and improve their priors.

(W4.2) Independence Assumption

Our PVM framework can be extended to settings with correlated click-time distributions:

• Mechanism Modification: Instead of a single threshold ($\alpha_i$), the mechanism defines a multi-dimensional "acceptance region" $D_i$ based on peer reports $t_{-i}$. This region is constructed by a greedy algorithm that adds the peer-report outcomes with the highest probability that platform $i$ was the true last click. A platform receives credit if its peers' reports fall within this region.
• Impact on Results: Our conclusions in the homogeneous setting remain unchanged, as the proof is based on the symmetric structure. In the heterogeneous setting, LCM's performance remains unchanged, as its accuracy is already near zero. The main change is PVM's accuracy guarantee, which becomes a weaker $1/n$ lower bound.

Although we can extend PVM to correlated settings, the focus of this paper is on introducing the peer-validation framework and presenting two key contributions: the first theoretical model for strategic misreporting in the "no-redirect" paradigm, and a peer-validated mechanism as a robust solution. The independence assumption is sufficiently to fully characterize the problem, while also making PVM’s superiority clearer through a simpler mechanism and stronger analytical bounds. We will discuss this choice in the Conclusion to strengthen the paper.

(W4.3) Possible Prior-Only Mechanism

A prior-only mechanism is DSIC but suboptimal for our objective (Equation 4). In contrast, PVM is the optimal DSIC mechanism in the homogeneous setting and superior to LCM, as shown both theoretically and experimentally.

Thank you for the positive feedback and constructive suggestions. We appreciate that you found the rigor and well-structured theoretical results valuable, as well as the experiments using real-world data that demonstrated PVM's superiority in accuracy and fairness. For the concerns you raised, we have summarized our overall responses below, with detailed replies provided further on.

Summary of Responses and Planned Revisions

Q1: Strategic Feasibility in Practice

This issue is not only feasible but increasingly prevalent, particularly in common advertising funnels where advertisers, lacking third-party audit capabilities, must rely on the self-reported data from the platforms. As a leading platform in the industry, we have direct insights into this challenge.

A Prime Scenario: Direct-to-App-Store Advertising

A prime and highly common example is the direct-to-app-store advertising funnel. In this scenario:

• A user clicks an ad on a major platform (e.g., Meta, Google, TikTok).
• The user is taken directly to the Apple App Store or Google Play Store, with no intermediate redirection.
• The user installs the app. The advertiser (e.g., a game developer) receives a notification of the install from Apple/Google, but has no independent way to know which specific ad click led to it.

According to unpublished research data from our company, this method of attribution through platform-reported click data is the dominant approach, accounting for at least 70% of app download ads.

In these cases, the platform becomes the sole source of truth for the click timestamp. This dependency creates a clear and widespread opportunity for the strategic manipulation our paper addresses.

Why Traditional Audits Are Becoming Infeasible?

The prevalence of these "blind-reliance" scenarios has been exacerbated by the very industry shifts, which have dismantled traditional verification methods:

(1) The Decline of Third-Party Redirection: Prior to 2020, Mobile Measurement Partners (MMPs) could use redirects for verification. However, this is now heavily restricted. New privacy regulations (e.g., China's Personal Information Protection Law (PIPL) and Apple's App Tracking Transparency (ATT) ) prohibit or penalize such redirects to protect user data and experience. Major app stores and ad platforms now require a direct path to landing page, eliminating the crucial touchpoint for independent, real-time auditing.

(2) Advertiser-Side Constraints Even when technically possible, advertisers themselves are moving away from complex tracking for key business reasons:

• Protection of Proprietary Data: Advertisers are increasingly reluctant to share their user data with external parties.
• Degraded User Experience: Redirects often introduce disruptive pop-up warnings (e.g., "Are you sure you want to visit this link?"), increasing user drop-off.
• High Cost: Implementing and maintaining robust redirect solutions is expensive.

These changes have created a widespread environment where platforms have the unilateral ability to report timestamps without facing easy, real-time detection from advertisers. The willingness to exploit this reporting ability is driven by the powerful financial incentives of the LCM.

Therefore, while some forms of historical or sample-based auditing might exist, they represent a costly and imperfect "cat-and-mouse game". Our work proposes a more fundamental solution. By introducing the PVM, we leverage mechanism design to create an incentive-compatible system where truthful reporting becomes the dominant, most profitable strategy. This obviates the need for external audits by fixing the problem at its source.

Q2: Learning Dynamics

For LCM, adaptive learning dynamics would not improve its performance. While learning processes, such as regret minimization, are known to converge to an equilibrium (Reference: Regret Minimization in Games with Incomplete Information. NeurIPS 2007), our analysis proves that the Nash Equilibrium in the LCM setting yields poor performance. Thus, learning provides no escape from this inefficient outcome.

In contrast, PVM is inherently robust in a repeated-game setting. Its DSIC property makes truthful reporting a dominant strategy—the optimal action for any platform regardless of other platforms' strategies. Since this strategy is unconditionally optimal in each round, its optimality extends directly to the repeated game, eliminating any incentive for long-term strategic deviation.

Q3: PVM Threshold Implementation

The PVM mechanism is designed to be highly efficient, with threshold computation handled offline to ensure low-latency online performance.

(1) Offline Precomputation: While a general implementation could theoretically require precomputing an exponential number of thresholds ( $O(2^n)$ ), the equilibrium analysis central to our paper simplifies this significantly. For our use case, only $n$ thresholds are needed---one for each platform. This makes the offline precomputation step fast and practical for any realistic number of advertising platforms.

(2) Online Runtime Complexity: The online attribution process is also very efficient. To make a decision for a single conversion, the mechanism performs a check for each of the $n$ platforms. Each individual check requires finding the maximum timestamp among the other $n-1$ platforms (an $\mathcal{O}(n)$ operation) and a single comparison. Therefore, the total online runtime complexity per conversion event is $\mathcal{O}(n^2)$.

But ad attribution is typically an offline batch process without stringent latency requirement.

Q4: Advertiser Utility

Our current objective is to maximize accuracy and fairness, assuming that a truthful signal is the most valuable input for an advertiser's downstream goal of optimizing ROI. Our work focuses on creating this foundational layer of truthful reporting.

We agree that the idea of a multi-level game involving strategic interplay—such as strategic time reporting by platforms and strategic attribution by advertisers—is fascinating. A full, joint-optimization game that models both advertiser and platform utilities while integrating the attribution and budget allocation processes represents a compelling direction for future research. This convinces us that the field of ad attribution is rich with open questions, and we hope our foundational work can serve as a catalyst for such studies.

Q5: Noise Robustness

PVM provides a robust foundation upon which engineering solutions can be built to address these issues:

• Jittered Impressions: Under a mechanism like LCM, platforms introduce large, minute-scale strategic delays to alter the click sequence. PVM’s DSIC property eliminates these strategic errors. The only remaining temporal noise is millisecond-level “jitter” from network latency. This minor, random noise is highly unlikely to change which platform was the true last click, making PVM's outcome robust to this issue.
• Delayed Reports: We interpret this concern as the risk that operational delays could corrupt data and lead to inaccurate estimates of the click-time distributions that PVM relies on. This, in fact, highlights a key advantage of our design. PVM’s DSIC property incentivizes platforms to eliminate strategic delays, ensuring the collected data is fundamentally honest. This provides a clean baseline. Over time, an advertiser can statistically model and filter out these non-strategic latencies to better estimate the true distributions. This creates a positive feedback loop: better $F_i$ estimates lead to more precise PVM thresholds. Such a learning process is impossible under LCM, where strategic and operational delays are indistinguishable.
• Soft Conversions: This is an excellent point and a standard challenge in practical attribution. We view it as an issue of business logic that must be defined before the mechanism is applied. An advertiser must first establish a clear, consistent rule for what event constitutes the conversion $t_0$. PVM's logic can be readily applied to any consistently defined conversion event.

We sincerely thank you for the active feedback throughout the review process! As members of the industry, we have encountered the challenges discussed here in practice. The concerns we raise are not hypothetical, but based on issues we have observed in real-world deployment. To support this, we have gathered relevant academic papers, technical documentation, and reports from leading MMPs to provide empirical grounding for our model.

1. References for Empirical Context

1.1 References for The Drawbacks of Redirection-Based Tracking

• User Experience:
  • Netravali, R., et al., Vesper: Measuring Time-to-Interactivity for Web Pages, NSDI ’18
  • Bocchi, E., et al., Measuring the Quality of Experience of Web Users, ACM SIGCOMM
• Security Vulnerabilities:
  • Somé, D. F., 2019, Tracking the Trackers: A Large-Scale Analysis of Web Tracking, WWW ’19

1.2 References for Industry-wide non-redirect tracking

The technical foundation for our model is the "Parallel Tracking" architecture, now a standard across the industry. As Google's official documentation describes,

"With parallel tracking, customers are delivered directly to your landing page while click measurement happens in the background. Here’s what parallel tracking looks like: (1)Customer clicks your ad. (2)Customer sees your landing page. (3)At the same time, in the background: Google Ads click tracker loads; tracking URL loads; if you use more than one click tracker, additional redirects may load.”

Leading platforms have since mandated this approach:

• Google Ads required Parallel Tracking for Search, Shopping, and Display campaigns as of October 30, 2018, and extended to Video campaigns on April 30, 2021. [Google Apps Help: About Parallel Tracking]
• Microsoft Ad mandated it for all new accounts created after May 31, 2020, and completed a forced migration of existing accounts by mid Jan 2021. [Microsoft Advertising: AccountProperty Data Object - Campaign Management]

Parallel Tracking decouples click measurement from navigation by eliminating the user-facing redirect chain. This allows a platform to postpone its background reporting call, meaning the timestamp recorded by a third-party tracker is no longer independent but is instead determined by the platform’s reporting delay—all without any perceptible impact on the user’s experience.

1.3. References for advertiser-uncontrolled landing page

To conservatively estimate the scale of ads ending on uncontrollable landing pages, we look at just two app stores. According to 2024 data from Business of Apps, Google Play and iOS saw 137.8 billion downloads. With ASO Mobile reporting that 16% are ad-driven, this suggests over 22 billion conversions happened on app store pages. And this is still an underestimate, as it excludes major platforms like Amazon and TikTok Shop.

2. Why server-side logs, MMPs, and SKAdNetwork don’t solve the gap?

• Server-side logs: It is viable only when the advertiser controls the landing page—impossible for App Store, Amazon, etc.
• MMPs ：The shift to redirectless tracking and privacy policies has undermined MMPs’ ability to independently verify user-level attribution. Leading MMPs like Adjust are now learning to work with aggregate data instead of tracking users directly. [Adjust:What is the identifier for advertisers (IDFA)?]
• SKAdNetwork: SKAdNetwork introduces a random delay and returns only aggregated post-backs . Thus most iOS advertisers still rely on platform-reported click to optimise spend.[ Economic Impact of Opt-in versus Opt-out Requirementsfor Personal Data Usage:The Case of Apple’s App Tracking Transparency (ATT)Lennart Kraft et al.]

3. Regulatory and Reputational Risks for Major Platforms?

First, we’d like to highlight a key point: while legal rules and after-the-fact remedies can help, any existing vulnerability may still be exploited. We believe a better solution is mechanism design, which removes the incentive to cheat from the start.

Ad attribution has long been a target for fraud, as shown in academic and industry reports[Click Fraud in Digital Advertising: A Comprehensive Survey, Computers 2021; Appsflyer: Glossary/Mobile Ad Fraud].

For example, as Reviewer nsc8 noted, click spamming in redirect-based tracking involved sending many fake clicks after one real one—something MMPs could often detect. In redirect-free settings, fraudsters can just delay a real click, leaving no pattern and making detection much harder. This turns detection into an expensive arms race. Our PVM avoids that: as rewards depend on peer reports rather than its own, spamming or delaying has no benefit.

While regulation and reputation may limit manipulation in some markets, this can‘t be assumed globally. In regions with weaker enforcement—such as parts of Asia or Latin America—platforms often face fewer constraints, making such tactics more likely. [Anura: Surprising Ad Fraud Statistics]

Apologies for the additional message, but we wanted to follow up since we haven't received specific feedback on our further clarifications yet, and we are unsure if we fully addressed your concerns.

To further clarify the generalizability of our model’s time-delay strategy, the assumption that 'Advertisers interact with a small number of platforms', and the potential impact of reputational concerns on large platforms, we are providing these additional clarifications.

Our intention is solely to address any remaining doubts, not to pressure you into adjusting your initial positive rating, which we fully understand and appreciate. Thank you!

(1) Generalizability of Our Model’s Time-delay Strategy

While direct academic papers on time-delay manipulation are scarce, as we have stated before, the technical feasibility is grounded in industry-wide practices such as parallel tracking, which allows platforms like Google to emit measurement timestamps decoupled from user navigation ([Google Ads Help, 2021][1]; [Microsoft Advertising Docs, 2021][2]). This gives platforms the ability to control the click report timing. Additionally, click spamming and click hijacking—both prevalent fraud techniques—are analogous to time-delay manipulation([3][4][5]).

• Click spamming involves generating real clicks followed by fraudulent ones to inflate recorded clicks and steal attribution. Studies show this is common in fraud schemes.
• Click hijacking allows manipulation without a real click by intercepting user data (via cookies or scripts) and sending fake click signals. This tactic has been widely observed in mobile ad networks.

While obtaining the necessary user data for click hijacking has become increasingly difficult due to privacy regulations and security protections, this only highlights that platforms still have the technical capability and incentive to engage in such behavior when they have access to this data. When combined with real click data, the ability to manufacture fraudulent clicks equates to the manipulation described in our model.

(2) Reference for "Advertisers interact with a small number of platforms"

AppsFlyer's 2015 case study shows that multi-touch installs typically involve an average of 2.7 sources ([AppsFlyer, 2015][6]). In practice, markets such as the US and China are dominated by a small number of major platforms:

• US: Google Ads, Meta Ads (Facebook/Instagram), Amazon Ads, TikTok Ads
• China: Tencent Ads, ByteDance Ads, Alibaba Ads, Baidu Ads

This supports the assumption that n ≤ 5 is realistic.

(3) Reputational Concerns on Large Platforms

We fully agree that regulatory and reputational pressures are strong deterrents, especially for major platforms. However, as highlighted by the Nash equilibrium, only equilibrium strategies are stable in the long run.

This means that once a platform—whether a smaller player or one exploiting a regulatory loophole—starts misreporting, others may follow, not out of desire, but to avoid severe performance losses or competitive disadvantages. In such a scenario, truthful reporting becomes unsustainable, despite initial preferences for honesty.

We’ve even seen reputable platforms express frustration, asking: “What can I do when others are stealing my credit?” Unfortunately, in this competitive environment, misreporting becomes the only rational choice to remain competitive.

Furthermore, studies show that even large platforms are not immune to fraud. For example, the Anura Fraud Statistics (2024) report highlights that affiliate marketing and programmatic advertising experience fraud rates of 45% and 50%, respectively, with even major platforms like Google and Facebook facing fraud rates of 5%-10% ([Anura, 2024][7]).

References

[1] Google Ads Help. (2021). About Parallel Tracking.

[2] Microsoft Advertising Docs. (2021). Parallel Tracking for Campaigns.

[3] Sadeghpour, S., & Vlajic, N. (2021). Click fraud in digital advertising: A comprehensive survey. Computers, 10(12), 164.

[4] DataDome. (2024). Click spamming: What it is & how to prevent it.

[5] O'Neill, M., & Jang, J. (2012). Clickjacking: Attacks and defenses. Proceedings of the USENIX Security Symposium, 1-15.

[6] AppsFlyer. (2015). Case Study: Retail.

[7] Anura. (2024). Ad Fraud Statistics.

Finally, we would like to express our gratitude for your suggestions and questions, which have been extremely helpful to us!

We sincerely thank you for your constructive feedback! We are grateful that you recognized our work's significant technical novelty and the "surprising" accuracy optimality of our PVM mechanism. For the concerns you raised about our model's assumptions, our responses are summarized below, with detailed replies provided further on.

Summary of Responses and Planned Revisions

Q1: The Need for Independence Assumption

We apologize if the statement of our independence assumption was not sufficiently prominent. We do state it on line 117, but we will ensure it is highlighted more explicitly.

Our PVM framework can be extended to settings with correlated click-time distributions. The core peer-validation principle is preserved, ensuring the mechanism remains DSIC, but the validation rule is generalized:

• Mechanism Modification: Instead of using a single threshold ($\alpha_i$), the mechanism would define a multi-dimensional "acceptance region" $D_i$ for the vector of peer reports $t_{-i}$. To maximize accuracy, this region $D_i$ is constructed by a greedy algorithm: we iteratively add the peer-report outcomes $t_{-i}$ that yield the highest posterior probability that platform i was the true last click (i.e., $P(t_i > \max\{t_{-i}\} | t_{-i})$ is highest). This process continues until the total probability of $t_{-i}$ falling within this region equals the prior probability that i is the last click ($\beta_i$). A platform $i$ receives credit if and only if its peers' reports $r_{-i}$ fall within this precomputed region $D_i$.

• Impact on Results: Under this modification, our conclusions in the homogeneous setting remain unchanged, as the proof is based on the symmetric structure. In the heterogeneous setting, the conclusions for LCM also remain unchanged, as its accuracy and fairness have already approached zero and thus cannot degrade further. The primary change is PVM's performance in the heterogeneous setting, where the accuracy guarantee becomes a weaker (but still valuable) $1/n$ lower bound. While this is still strictly superior to LCM's worst-case accuracy of 0, it lacks the tighter bound derived under the independence assumption.

While our PVM framework can be extended to the correlated case, our primary goal with this paper was to introduce our peer-validation framework in the clearest possible setting. We believe our paper makes a twofold contribution: providing the first theoretical model for strategic misreporting under the new "no-redirect" paradigm, and introducing our novel peer-validated mechanism as a robust solution. The independence assumption provides an ideal setting to demonstrate these contributions, as it is sufficient to fully characterize the strategic problem while showcasing PVM's superiority with a simpler mechanism, more elegant proofs, and stronger analytical bounds. Intuitively, this can be viewed from a backward-looking perspective: given a conversion, the advertiser forms an estimate for each platform's time lag, and the uncertainties in these separate estimates are modeled as independent. We sincerely thank the reviewer for raising this point, as it has helped us realize the importance of making this reasoning explicit. We will add a discussion on this methodological choice to the Conclusion to make the paper stronger.

Q2: The Existence and Uniqueness of PVM Thresholds

Thank you for this excellent question regarding the technical conditions for our thresholds. The thresholds $\alpha_i$ exist and are unique under standard regularity conditions, and the mechanism can be straightforwardly adapted for edge cases.

As defined in our paper, the threshold $\alpha_i$ is the solution to $G_i(\alpha_i) = \beta_i$, where $G_i(t) = \Pi _{j\neq i} F_j(t)$ is the cumulative distribution function (CDF) of the maximum click time among platform $i$'s peers, and $\beta_i$ is the prior probability that $i$ is the true last click.

• Standard Case (Existence and Uniqueness): If $G_i(t)$ is continuous and strictly increasing. In this standard case, for any $\beta_i$ in $(0,1)$, a unique solution $\alpha_i$ is guaranteed to exist by the Intermediate Value Theorem.

• Special Case 1 (Flat CDF): If $G_i(t)$ has a flat region, and $\beta_i$ falls within this flat range, the threshold $\alpha_i$ would not be unique. However, a flat region in $G_i(t)$ implies that the probability of the maximum peer click time occurring within that specific interval is zero ($P(\max\{t_{-i\}} \in [a,b]) = 0$). Therefore, any threshold $\alpha_i$ chosen within this flat interval will yield the exact same attribution outcome. The choice is arbitrary and has no impact on the mechanism's performance. We acknowledge this possibility in our proof sketch for Lemma 1.

• Special Case 2 (Discontinuous CDF): In the rare event that $G_i(t)$ could have a jump discontinuity at a point $\theta$ such that $G_i(\theta-) < \beta_i < G_i(\theta)$, a single threshold $\alpha_i$ would not exist. This scenario implies a non-zero probability that $\max\{t_{-i}\} = \theta$. The mechanism can be modified to handle this by using a probabilistic assignment: if $\max\{\boldsymbol{t}_{-i}\} = \theta$, we assign credit to platform $i$ with a specific probability $p$ such that the expected attribution remains $\beta_i$. However, we consider this case to be of limited practical relevance, as click times are typically modeled as continuous random variables.

Q3: Settings Without Priors or with Inaccurate Priors

We see the settings without priors or with inaccurate priors as a cold-start problem. This is precisely why we pursued a DSIC mechanism--- Learning Priors via a Virtuous Cycle.

Even if an advertiser starts with inaccurate priors (or no priors at all), PVM's DSIC property solves the ''cold-start'' problem by allowing platforms to start with arbitrary priors. Since DSIC ensures truthful reporting, the data collected (from platforms) over time is honest, allowing advertisers to learn the correct distribution and improve their priors. This allows them to iteratively learn and refine their estimates of the true click-time distributions over time.

This creates a powerful virtuous cycle: truthful data leads to more accurate priors, which in turn makes the PVM mechanism more precise and effective. In contrast, a non-DSIC mechanism like LCM offers no such path; it consistently provides biased data, making it impossible for the advertiser to ever learn the true distributions. Under LCM, platforms are instead incentivized to continuously develop new ways to game the system, leading to a negative spiral.

Concern: Practical Value of Our Theoretical Work

In response to the question of practical application, we believe our theoretical work offers value on two distinct levels: (1) providing a foundational diagnosis of the root cause of strategic misreporting in the new "no-redirect" conversion paradigm, and (2) offering a concrete design principle ("peer-validation") for future systems.

First, our work frames the issue of misreporting. We show it is not a simple monitoring problem to be solved with better detection, but rather a fundamental incentive flaw in the widely-used Last-Click Mechanism. This shifts the focus of any practical solution away from a costly "cat-and-mouse game" of enforcement and towards the core need for incentive-compatible design.

This diagnosis leads to our second insight: a concrete and transferable design principle of "peer-validation." This principle is highly practical. For instance, in a modern system using a neural network for attribution, our key engineering guideline to ensure truthfulness (DSIC) is that a platform's credit must be calculated without using its own reported timestamp as an input feature. This is a clear, actionable takeaway for practitioners developing the next generation of robust, ML-based models.

We believe this work serves as a valuable starting point for designing trustworthy attribution mechanisms in the new "no-redirect" paradigm, and we hope it will inspire more research in this critical and evolving area.

Dear Reviewer jUsn,

Thank you again for your effort reviewing our paper, providing positive assessment and valuable feedback. Since the discussion period is ending soon, we would like to follow up to see if our rebuttal has addressed your concerns and if there are any other questions. We would be happy to provide any further clarification. Thank you very much.

Sincerely,

Authors