Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy

Technical Summary: Agentic AI-Powered Re-Identification

Problem Statement
The widespread collection of fine-grained mobility data by commercial data brokers creates a significant, yet under-recognized, re-identification risk. While prior research has established that mobility traces are highly unique—often requiring only a handful of spatio-temporal points to distinguish individuals—practical large-scale re-identification has historically been limited by the high human effort required to link raw coordinate sequences to real-world identities. Current statistical disclosure control (SDC) practices often rely on "de facto anonymity," assuming that the manual labor required to re-identify individuals acts as a sufficient barrier. This paper argues that the emergence of agentic AI fundamentally alters this threat model by automating the investigative process, thereby lowering the cost and expertise barriers to re-identification to a point where "de facto anonymity" is no longer a viable defense under standards like GDPR Recital 26.

Methodology
The authors developed and evaluated an end-to-end agentic re-identification pipeline designed to operate autonomously without human intervention. The system utilizes Large Language Model (LLM) agents to search the open web, cross-reference public records, and resolve raw coordinate sequences to candidate identities.

• Pipeline Architecture: The system is orchestrated by a central agent that manages a team of seven specialist agents across three conceptual phases:
  1. Spatial Analysis: A "GPS Analyst" agent extracts home and work anchors from raw GPS pings using grid-based mode-finding. A "Location Enricher" reverse-geocodes these anchors to generate address candidates.
  2. Location Attribution: A "Building Analyst" queries public building registers (specifically the Swiss Federal Register of Buildings and Dwellings) to determine the residential specificity of the home anchor. This stage acts as a quality gate; if the building is a large multi-unit block without unique identifiers, the pipeline may halt to prevent false attribution.
  3. Identity Attribution: A "Candidate Scorer" ranks individuals from public directories based on home and work evidence. An "Identity Verifier" seeks independent corroboration via social media and public registers. Finally, a "Final Synthesizer" aggregates evidence to render a verdict.
• Threat Model: The adversary possesses raw GPS mobility data (simulated) and access to freely available public web sources (search engines, directories, social media). The model explicitly excludes social engineering, fake profiles, or deception.
• Study Design: To balance methodological rigor with privacy, the authors used a consent-based sample of 43 participants in Switzerland. Instead of using real broker data, they simulated GPS traces around the participants' actual home and work addresses, adding realistic noise (jitter, dropouts, out-of-order timestamps). The pipeline was developed on a separate set of six traces and evaluated on the 43 participant traces without further parameter tuning.

Key Contributions

1. Agentic Pipeline Development: The authors present a novel pipeline that automates the entire re-identification workflow, replacing manual OSINT (Open-Source Intelligence) analysis with autonomous agent reasoning and tool use.
2. Feasibility Demonstration: The study provides empirical evidence that agentic AI can successfully re-identify individuals from spatio-temporal data and public sources alone, achieving a high success rate with minimal human oversight.
3. Cost and Scalability Analysis: The paper quantifies the economic and temporal efficiency of the attack, demonstrating that re-identification can be performed at a marginal cost of approximately $2.24 and 17 minutes per target, with the ability to parallelize across many targets.
4. Implications for SDC: The work challenges the current reliance on de facto anonymity in SDC, arguing that regulators and data custodians must anticipate a future where re-identification is "reasonably likely" by any means due to the scalability of AI agents.

Results
The pipeline was evaluated against 43 simulated traces with known ground truth:

• Success Rate: The system successfully re-identified 18 of the 25 cases where full re-identification was theoretically possible (72% recall).
• Overall Performance: Across all 43 cases, the pipeline correctly named 18 individuals (41.9% overall accuracy).
• Precision: Among the 19 cases where the pipeline returned a named candidate, 18 were correct (94.7% precision).
• Failure Modes: In cases where the pipeline failed to re-identify a re-identifiable individual, it was often due to insufficient evidence for workplace verification or the home address being located in a multi-unit building where the specific unit could not be distinguished.
• Cost and Time: The average cost per run was $2.24 (API charges), and the average runtime was 17 minutes. The system successfully processed all 43 cases in a single day using a concurrency of four.

Significance and Claims
The paper claims that agentic AI represents a decisive inflection point in mobility privacy. By automating the linkage of spatio-temporal data to public records, AI agents remove the "human bottleneck" that has historically limited the scale of re-identification attacks.

• Shift in Anonymity: The authors argue that the definition of anonymity must shift from abstract impossibility to the "reasonably likely" standard of GDPR Recital 26. Since AI agents can perform these attacks at low cost and high speed, the threshold for "reasonably likely" is now met for many datasets previously considered safe.
• Escalation: The paper outlines near-future escalation vectors, including agents that can autonomously perform outreach (email/phone) to confirm candidates and the use of locally executed open-weight models to bypass API audit trails.
• Call to Action: The authors urge the SDC community to move away from reliance on de facto anonymity and toward techniques with formal guarantees, acknowledging that the cost and effort required to breach privacy have dropped by orders of magnitude.

The study concludes that while the current implementation relies on specific national registers (Swiss GWR) and simulated data, the underlying paradigm demonstrates that the combination of LLM agents and public data creates a scalable, low-cost threat to mobility microdata privacy that data custodians must immediately address.