Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr
11 min
Abstract
We show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at high precision, given pseudonymous online profiles and conversations alone, matching what would take hours for a dedicated human investigator. We then design attacks for the closed-world setting. Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives. Compared to prior deanonymization work (e.g., on the Netflix prize) that required structured data or manual feature engineering, our approach works directly on raw user content across arbitrary platforms. We construct three datasets with known ground-truth data to evaluate our attacks. The first links Hacker News to LinkedIn profiles, using cross-platform references that appear in the profiles. Our second dataset matches users across Reddit movie discussion communities; and the third splits a single user's Reddit history in time to create two pseudonymous profiles to be matched. In each setting, LLM-based methods substantially outperform classical baselines, achieving up to 68% recall at 90% precision compared to near 0% for the best non-LLM method. Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered.
Alex: That sounds efficient for big lists of people. But with so many close matches, how does it pick the right one without mistakes?
Sam: That's the reasoning stage. It takes the top few candidates—say, the best few dozen—and has a smarter AI check them one by one, comparing details like school matches or pet names, spotting alignments or contradictions. A cheaper AI might pick a frontrunner first, then a more powerful one verifies deeply. This step lets the system think like a detective narrowing suspects.
Alex: Huh. So it's not just matching numbers—it's double-checking the story lines up. And the last part?
Sam: Finally, calibration scores how sure it is, using things like the gap between top matches or the AI's own confidence rating, to decide if it guesses a link or stays silent. On a dataset linking Hacker News comments to LinkedIn profiles, this full process found about twice as many true matches as older methods while keeping errors low—one in ten guesses wrong at best. The paper notes this might overestimate on super-careful anonymous users, since test data came from less-private profiles.
Alex: Right, so even with cautions, it shows pseudonyms aren't the shield they used to be. How did they create realistic tests using actual Reddit data, like those movie discussions?
Sam: To get reliable tests, they built special datasets by splitting real users' Reddit activity into two parts: one as the hidden query profile, the other as a candidate to match against. For movies, they took users posting in a big general subreddit like r/movies, and separated their posts from smaller niche ones like horror or suggestions—creating thousands of pairs where they knew the true match. This mimics someone using fake names in different online spots talking about the same hobbies, with ground truth because it's the same person split apart. They only included users sharing at least one movie mention.
Alex: So it's like dividing a kid's gaming history between two accounts on similar servers, but ensuring some shared game titles to test matching. What changed for movie posts specifically?
Sam: For extraction, the AI read messy discussions or recommendations and pulled out structured lists: movie titles, guessed ratings from tone, and dates—like turning "I loved that rooftop fight scene" into "Neon Horizon, 7/10." Search stayed the same, using meaning-based codes to find top similar profiles. Reasoning split into two steps: first pick from top candidates by matching shared movie titles and details; then verify the best one deeply with full text, checking alignments like sentiment or specifics.
Alex: Okay, so layering checks on shared interests narrows it down. Did that extra thinking pay off in the results?
Sam: Yes—the paper shows higher reasoning effort notably boosted matches: at careful settings, it found about 60% more true links than lighter checks. Users sharing more movies succeeded over four times better than single-movie ones. This held even against old methods using hand-made number scores for tastes, as the AI handled fuzzy text better. The paper cautions these splits might be easier than super-private users.
Alex: Huh, so more details shared means easier links, even across time or topics. That really undercuts assuming fake names hide you if you're chatty about niches.
Sam: Exactly. They also tested time-split Reddit comments—a year gap between parts—to mimic old abandoned accounts versus new ones, filtering for steady traits like style or interests. Overall, these tests suggest practical obscurity is fading: what took costly manual hunts now scales cheaply, so platforms and users need updated privacy views.
Alex: So those split tests show the method holds up across time gaps. But what makes the reason and calibrate steps pull ahead of just searching?
Sam: The search step uses numerical codes from summaries to find top similar profiles—about 80% of true matches land in the top 15 for any query. But those codes measure overall likeness well for narrowing, not for picking one winner; sometimes two or three look equally good. So the reason step hands those top 15 to a large language model, which reads them side-by-side and picks the single best match by checking details like shared interests or contradictions. This boosts correct picks because the AI reasons over nuances the numbers miss.
Alex: Okay, so it's like handing a shortlist of suspects to a detective for a final lineup check. And calibrate—how does that decide which guesses to trust without overclaiming?
Sam: Calibration sorts all proposed matches from most to least likely using a tournament setup. Picture pairing up match guesses—like contestant A versus B—and having the AI judge head-to-head which seems more plausible, say by better aligning pet names or locations; winners advance or get higher scores in rounds, much like sports rankings from repeated games. This gives a reliable confidence order: top-ranked guesses are far more often correct.
Alex: Huh, that tournament weeds out close calls smartly. How much does adding those steps improve over plain search?
Sam: On split Reddit profiles with 10,000 candidates, plain search gets some matches but falters at high accuracy; adding reason recovers many more from the top 15, and calibration doubles recall at very careful settings—like a third of users at one-in-a-hundred error rates. Classical methods mimicking movie-rating matches fail near zero there, as they need tidy lists, not messy text.
Alex: Right, so the extras make it reliable even when picks are tough. Does it hold for bigger real-world messes, like millions of profiles?
Sam: Yes—they tested varying pool sizes up to 10,000 and extrapolated: at a million candidates, it suggests around 35% recall at careful accuracy, while old methods drop off sooner. Even if true matches are rare—one in 10,000 queries—the method still finds about 9% of them confidently. This scaling challenges the old view that deanonymizing at web scale is too hard or costly.
Alex: So practical obscurity crumbles under cheap, automated checks. Platforms treating pseudonyms as private might need real changes. What kinds of shifts does the paper suggest for users and sites?
Sam: The paper points out that what once protected people—making it too expensive to unmask fake names—no longer holds, since these methods use public tools and run quickly. Platforms could add limits on data access, like slowing down bulk pulls or spotting automated scrapes, and AI makers might watch for misuse patterns. Users should know posting details raises risks, even under names that seem hidden.
Alex: Right, so defenses like rate limits make sense to raise the effort again. But the paper mentions tests might overestimate for careful posters—how big a caution is that?
Sam: That's a key limit: the datasets used real profiles made anonymous by removing direct clues, or splits from the same users, so they might share more hints than truly guarded accounts would. Behavior could differ across sites or time, and without perfect ground truth for private users, real success might be lower. Still, results across setups suggest the approach generalizes meaningfully.
Alex: Huh. So while not perfect, it challenges old privacy ideas enough to act. Governments or companies linking posts for surveillance or ads—that feels like a real shift.
Sam: Yes, the discussion notes risks like linking accounts for tracking activists, targeted ads from forum posts, or building scam profiles cheaply. Classical privacy tools for neat data don't cover messy text attacks like this, so new ones considering AI threats are needed. Overall, it urges treating all pseudonymous text as potentially connectable.
Alex: Okay, so the takeaway is pseudonymity offers less shield now, pushing platforms, users, and rules toward better protections. It's a call to rethink without assuming it's all doom.
Sam: Precisely—this work shows scalable unmasking with off-the-shelf tools, but highlights awareness and mitigations as paths forward. The evidence suggests online privacy norms must evolve.
Alex: That's a clear picture of how these methods change the landscape. Thanks for breaking it down, Sam. Thanks for listening to ResearchPod.