Large-scale online deanonymization with LLMs

This paper demonstrates that large language models can perform large-scale deanonymization of pseudonymous online users by analyzing unstructured text across platforms, achieving significantly higher precision and recall than classical methods and challenging the assumption that online anonymity provides practical obscurity.

The Gist

Imagine you are wearing a mask at a massive, noisy costume party. You think you are safe because no one knows your real name. In the past, if someone wanted to figure out who you were, they would have to be a super-sleuth: they'd need to spend hours manually reading your posts, cross-referencing clues, and hoping to find a tiny mistake you made. It was like finding a needle in a haystack by hand.

This paper says: "The needle-finding robot has arrived, and it's terrifyingly good at its job."

Here is the breakdown of the research in simple terms:

1. The Old Way vs. The New Way

• The Old Way (Human Detective): In the past, de-anonymizing someone (finding out who they really are) required structured data (like a list of movie ratings) or a very skilled human investigator spending hours on a single target. It was expensive and slow.
• The New Way (The AI Robot): The researchers built an AI agent that acts like a super-powered detective. You give it a pseudonymous profile (like a Reddit username or a Hacker News handle), and the AI:
  1. Reads everything the person ever wrote.
  2. Extracts tiny details: "Oh, they live in Portland, they have a dog named Biscuit, they study NLP at Stanford, and they use a specific coding library."
  3. Searches the entire internet (millions of profiles) in seconds to find a match.
  4. Reasons like a human: "Wait, this LinkedIn profile mentions a dog named Biscuit and a Stanford degree. That's a match!"

2. The Three "Games" They Played

To prove their point, the researchers set up three different scenarios to see how well their AI could play "Who Am I?":

• Game 1: The "Open Web" Hunt.
  • The Setup: They gave the AI a transcript of an interview with a scientist (where the name was hidden) and asked, "Who is this?"
  • The Result: The AI autonomously searched the web, found the scientist's university profile and GitHub code, and correctly identified 9 out of 33 scientists. It did in minutes what might take a human days.
• Game 2: The "Cross-Platform" Link.
  • The Setup: They took real people who had a LinkedIn profile (real identity) and a Hacker News account (pseudonym). They hid the names on the Hacker News side and asked the AI to link them.
  • The Result: The AI correctly matched 67% of the people with 90% accuracy. The old "human-style" math methods failed almost completely (near 0% success).
• Game 3: The "Split Personality" Test.
  • The Setup: They took one person's Reddit history and split it in half: "Before 2023" and "After 2023." They asked the AI to prove these two different accounts belonged to the same person, even though they discussed different topics.
  • The Result: The AI was incredibly good at spotting the subtle "writing fingerprint" (style, interests, quirks) that remained the same, even when the topics changed.

3. The "Magic" Ingredients

Why is the AI so much better than the old methods? The researchers broke the process down into four steps, like a factory assembly line:

1. Extract: The AI reads messy, unstructured text (like a rant about a movie) and turns it into a neat list of facts (e.g., "Likes horror movies," "Writes in British English").
2. Search: It uses a "fuzzy search" (like a super-smart Google) to find millions of potential matches based on those facts.
3. Reason: This is the secret sauce. Instead of just picking the top match, the AI looks at the top 100 candidates and thinks: "Candidate A has a dog named Biscuit, but Candidate B also mentions a specific park in Portland. Candidate B is a better fit."
4. Calibrate: The AI gives itself a confidence score. If it's only 50% sure, it stays quiet. If it's 95% sure, it makes the match. This keeps the "false alarms" low.

4. The Big Takeaway: The "Practical Obscurity" is Dead

For years, we relied on "Practical Obscurity." This is the idea that even if your data could theoretically be linked to your real name, it's too much work for anyone to do it, so you are safe.

This paper proves that safety is an illusion.
The AI has made the "work" cost drop from "hours of human labor" to "a few dollars of computer time."

• The Analogy: Imagine you thought you were safe in a crowd because the crowd was too big to scan. Now, someone has given every person in the crowd a pair of X-ray glasses that can instantly recognize your face, your voice, and your history. The crowd size no longer matters.

5. What Does This Mean for You?

• Pseudonyms aren't a shield: If you post under a fake name on Reddit, Twitter, or forums, you are not anonymous. If you share enough details (even small ones like your dog's name or your job), an AI can likely link you to your real identity.
• The "Micro-Data" Leak: You don't need to post your address to be found. Posting that you "love the movie Neon Horizon" and "use Python" creates a unique fingerprint. When combined with millions of other data points, it's like a puzzle that the AI solves instantly.
• The Future: The authors warn that governments, corporations, or bad actors could use this to stalk activists, target ads, or harass people. The rules of online privacy need to be rewritten because the technology has changed the game.

In short: The paper shows that Large Language Models have turned online anonymity from a "fortress" into a "glass house." The walls are still there, but the AI can see right through them.

Technical Summary

1. Problem Statement

The paper addresses the vulnerability of pseudonymous online accounts (e.g., Reddit throwaways, Hacker News users, anonymous forum posters) to deanonymization.

• Historical Context: Previous deanonymization attacks (e.g., the Netflix Prize attack by Narayanan and Shmatikov) relied on structured micro-data (e.g., movie ratings, zip codes) and required significant manual effort or specific algorithmic matching. They were generally ineffective against unstructured text.
• The Shift: The authors argue that Large Language Models (LLMs) have fundamentally changed the threat landscape. LLMs can now infer personal attributes from unstructured text and perform autonomous web searches, potentially making the "practical obscurity" that protected pseudonymous users obsolete.
• Core Question: Can LLMs perform fully automated, scalable deanonymization on unstructured text data, linking anonymous profiles to real-world identities or linking different pseudonymous accounts of the same person?

2. Methodology

The authors propose a modular, four-stage framework for scalable deanonymization, which they term the ESRC framework (Extract, Search, Reason, Calibrate). They evaluate this framework across three distinct threat models:

1. Cross-Platform Identity Linking: Linking an anonymous account to a known real-world identity (e.g., Hacker News $\to$ LinkedIn).
2. Cross-Community Linking: Linking two pseudonymous accounts of the same user across different communities (e.g., Reddit movie subreddits).
3. Temporal Linking: Linking two pseudonymous accounts of the same user split by time (e.g., a user's Reddit history from 2023 vs. 2024).

The ESRC Pipeline

1. Extract: LLMs process unstructured text (posts, comments, bios) to extract semi-structured identity-relevant features (micro-data). This includes demographics, writing style, interests, specific tools used, and incidental disclosures.
2. Search: Extracted features are converted into dense vector embeddings. The system performs a nearest-neighbor search (using FAISS) against a large candidate pool (thousands to millions of profiles) to retrieve top-$k$ candidates.
3. Reason: An LLM (often with "high reasoning" capabilities) analyzes the top candidates from the search step. It verifies consistency across all extracted features, checks for contradictions, and selects the most likely match. This step moves beyond simple vector similarity to semantic verification.
4. Calibrate: The system generates confidence scores (either via the Reasoning LLM or via pairwise tournament sorting of matches) to control the trade-off between Precision (accuracy of guesses) and Recall (fraction of true identities found).

Evaluation Datasets

To ensure rigorous evaluation without compromising real user privacy, the authors constructed three datasets with known ground truth:

• HN-LinkedIn: 338 Hacker News users who publicly linked their LinkedIn profiles. The LinkedIn data serves as the "known identity," and the HN data is sanitized (removing direct identifiers) to simulate a pseudonymous target.
• Reddit Movie Communities: Users active in both a general movie subreddit ($r/movies$) and niche subreddits. Profiles are split by community to create query/candidate pairs.
• Temporal Reddit Split: 5,000 users whose activity is split into "before" and "after" one-year periods to simulate linking an old account to a new one.

3. Key Contributions

• Autonomous End-to-End Deanonymization: Demonstrated that frontier LLM agents can autonomously search the web, cross-reference data, and identify real-world identities from anonymous profiles with high precision, replicating hours of human investigation in minutes.
• Scalable Attack Pipeline: Developed a pipeline that works directly on unstructured text, overcoming the limitations of classical methods that required structured data.
• New Evaluation Framework: Introduced a robust methodology for evaluating deanonymization at scale using synthetically anonymized ground-truth data and profile splitting, addressing the difficulty of obtaining verified labels for anonymous users.
• Quantitative Superiority: Provided empirical evidence that LLM-based methods vastly outperform classical baselines (like the Netflix Prize attack) across all settings.

4. Key Results

The paper presents quantitative results showing LLMs achieve high recall at high precision thresholds where classical methods fail (near 0% recall).

• HN to LinkedIn (Cross-Platform):
  • Classical Baseline (Netflix-style): ~0.1% recall at 99% precision.
  • LLM (Search + Reason): 45.1% recall at 99% precision.
  • Autonomous Agent: Identified 226/338 targets (67% recall) at 90% precision.
• Reddit Movie Communities (Cross-Community):
  • Classical Baseline: 0% recall at 99% precision.
  • LLM (Search + Reason): 2.8% recall at 99% precision (a massive relative improvement, as the baseline was zero).
  • Impact of Reasoning: High reasoning effort improved recall from 1.4% to 2.8% at 99% precision.
• Temporal Split (Time-based):
  • Classical Baseline: Failed to achieve non-trivial recall.
  • LLM (Full Pipeline): Achieved ~33% recall at 99% precision.
  • Scaling: Extrapolations suggest the LLM attack remains effective (approx. 35% recall at 90% precision) even with candidate pools of 1 million users.
• Robustness: The attack remains effective even when the prior probability of a match existing is extremely low (e.g., 1 in 10,000), maintaining ~9% recall.

5. Significance and Implications

• Collapse of Practical Obscurity: The paper concludes that the assumption that pseudonymity offers protection because deanonymization is too costly or difficult is no longer valid. LLMs have democratized these attacks, making them accessible to moderately resourced adversaries.
• Threat Model Reconsideration: Current privacy frameworks (like $k$-anonymity and differential privacy) are designed for structured data and do not account for semantic inference from unstructured text. These frameworks are insufficient for protecting online users.
• Real-World Risks:
  • Doxxing: Activists, journalists, and vulnerable populations relying on anonymity are at higher risk.
  • Surveillance: Governments and corporations can link anonymous forum activity to real identities for targeted manipulation or suppression.
  • Social Engineering: Attackers can build detailed profiles for highly personalized spear-phishing campaigns.
• Mitigation Challenges: The authors argue that simple content sanitization is insufficient because LLMs can infer sensitive attributes from context. They suggest that platform policies, data access restrictions, and a re-evaluation of what constitutes "private" online behavior are necessary.

Conclusion

The paper establishes that LLMs enable scalable, high-precision deanonymization of pseudonymous users using only publicly available unstructured text. The gap between theoretical privacy and practical security has narrowed significantly, necessitating an urgent re-evaluation of online privacy norms, platform design, and regulatory frameworks.