Large-scale online deanonymization with LLMs

LLMs enable scalable, high-precision deanonymization of pseudonymous online accounts using unstructured text.

2026/02/18 by Simon Lermen, Daniel Paleka, Joshua Swanson +3 · 85 voices · 1 citation
#cs.CR #cs.AI #cs.LG

paper · pdf

Abstract

We show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at high precision, given pseudonymous online profiles and conversations alone, matching what would take hours for a dedicated human investigator. We then design attacks for the closed-world setting. Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives. Compared to classical deanonymization work (e.g., on the Netflix prize) that required structured data, our approach works directly on raw user content across arbitrary platforms. We construct three datasets with known ground-truth data to evaluate our attacks. The first links Hacker News to LinkedIn profiles, using cross-platform references that appear in the profiles. Our second dataset matches users across Reddit movie discussion communities; and the third splits a single user's Reddit history in time to create two pseudonymous profiles to be matched. In each setting, LLM-based methods substantially outperform classical baselines, achieving up to 68% recall at 90% precision compared to near 0% for the best non-LLM method. Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered.

Summary

The researchers developed a pipeline that uses LLMs to extract identity features from raw text, search for candidates via embeddings, and reason over the results to verify matches. Testing across Hacker News, LinkedIn, and Reddit showed that LLM-based methods substantially outperform classical baselines in re-identifying users.

machine-generated · gemma4:31b

In simple words

People often use fake names online to stay hidden. This paper shows that smart computer programs can now find out who these people really are by looking at what they write. The programs look for small clues in many posts and match them to real people's profiles. This makes it much easier and cheaper to uncover identities than it was before.

machine-generated · gemma4:31b

Outline

• Introduction — Discusses the shift from structured data attacks to unstructured text attacks enabled by LLMs.
• LLM agents can autonomously re-identify anonymous online profiles — Evaluates frontier LLM agents' ability to perform end-to-end deanonymization via web search.
• A framework for scalable deanonymization with LLMs — Introduces a modular four-stage pipeline: Extract, Search, Reason, and Calibrate.
• Linking profiles across platforms: Hacker News and LinkedIn — Tests the pipeline matching pseudonymous HN accounts to real LinkedIn identities.
• Linking users across Reddit communities — Evaluates matching users who post in different movie-related subreddits.
• Scaling LLM deanonymization on temporally split profiles — Studies the effect of candidate pool size and match probability on temporal Reddit splits.
• Related work — Compares this approach to prior statistical and stylometric deanonymization methods.
• Discussion — Analyzes implications for online privacy, potential mitigations, and generalizability.
• Conclusion — Summarizes findings and argues that pseudonymity no longer provides meaningful protection.

machine-generated · gemma4:31b

Argument

1. Pseudonymous accounts are protected by 'practical obscurity' because manual deanonymization is too costly.
   Assumption
2. LLMs can extract identity-relevant features from unstructured text and reason over them to verify matches.
   Data (experimental results in the pipeline stages)
3. A modular pipeline (Extract → Search → Reason → Calibrate) can automate this process at scale.
   Proof (empirical evaluation across three datasets)
4. LLM-based methods significantly outperform classical baselines that rely on structured data or handcrafted features.
   Data (precision-recall curves and recall @ 99% precision metrics)
5. The cost of deanonymization is now low enough that practical obscurity no longer protects users.
   Data (cost per profile estimated at 1-4; time reduced from hours to minutes)

machine-generated · gemma4:31b

Assumptions

• Users who explicitly link accounts in bios are representative enough for ground-truth evaluation, despite potential bias toward less privacy-conscious users. [stated]
• The performance of the attack on synthetically anonymized or split profiles transfers to real-world pseudonymous accounts. [unstated]
• LLM providers' safety guardrails can be bypassed because the pipeline breaks the attack into benign-looking sub-tasks. [stated]

machine-generated · gemma4:31b

Claims

• LLM agents can autonomously re-identify Hacker News users with 67% recall at 90% precision. [experiment]
• The 'Reason' step in the pipeline improves recall at 99% precision from 4.4% to 45.1% for HN-LinkedIn matching. [experiment]
• LLM-based deanonymization scales log-linearly with candidate pool size, remaining effective even at 1 million candidates. [experiment]
• High reasoning effort (test-time compute) significantly improves re-identification success rates. [experiment]

machine-generated · gemma4:31b

Methods

• n: 15000
• population: Reddit and Hacker News users
• study type: simulation
• effect size: Recall@90% precision: LLM methods (up to 68%) vs classical baselines (~0%)
• CI: HN-LinkedIn recall @ 90% prec: 54.2% (51.1–57.2) for high reasoning

machine-generated · gemma4:31b

Limitations

admitted by authors:

• Ground-truth datasets are small because they require verified identity links.
• The attack relies on opaque web search systems, making it difficult to isolate what the LLM agent contributes versus what the search engine embeddings contribute.
• Evaluation on ground truth settings might overestimate an attack’s recall due to distributional biases (users who link accounts may be less privacy-conscious).

noticed by the model, not admitted:

• The authors use synthetic anonymization for evaluation, which may not perfectly capture the behavior of the most privacy-conscious users.

machine-generated · gemma4:31b

Benchmarks

HN-LinkedIn matching

machine-generated · gemma4:31b

Open questions

• How do stylometric features (how someone writes) combine with semantic content (what they say) to improve deanonymization?
  The paper notes that current methods focus on semantics, but combining both could increase attack success.
• Can realistic synthetic datasets be constructed for deanonymization evaluation without using real user data?
  Current evaluations rely on real users who have already leaked their identity or split profiles, which may introduce bias.

machine-generated · gemma4:31b

Funding and conflicts

funded by:

• ETH Zurich

no conflicts declared

machine-generated · gemma4:31b

Citations

• Anonymity and Identity Online
• Large Language Models are Advanced Anonymizers
• Beyond Memorization: Violating Privacy Via Inference with Large Language Models
• RANK ANALYSIS OF INCOMPLETE BLOCK DESIGNS

Cited by

• Topics as Proxies for Sociodemographics: How Conversational Context Affects LLM Answers

Discussions

• Delete your socks, people. "We show that large language models can be used to perform at-scale deanonymization...at high precision, given pseudonymous online profiles and conversations alone, matching [bsky, 253 points, 12 comments]
• Large-scale online deanonymization with LLMs [lemmy, 194 points, 53 comments]
• AI allows hackers to identify anonymous social media accounts, study finds [lemmy, 142 points, 9 comments]
• Welp: “We show that large language models can be used to perform at-scale deanonymization... Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that [bsky, 111 points, 3 comments]
• And right on schedule: there goes pseudonymity on the Internet. arxiv.org/abs/2602.16800 [bsky, 98 points, 4 comments]
• Large-scale online deanonymization with LLMs [hn, 78 points, 2 comments]
• Oh dear. arxiv.org/abs/2602.16800 [bsky, 55 points, 3 comments]
• AI is improving its ability to deanonymize online accounts at scale. [lemmy, 37 points, 1 comments]
• This was inevitable. Something everyone should be aware of. arxiv.org/abs/2602.16800 [bsky, 27 points, 3 comments]
• Privacy online is fundamentally at odds with intelligence getting cheaper. Anonymity on the internet has always relied on practical obscurity. We publish in hopes that people can adapt to LLMs changin [bsky, 24 points, 1 comments]
• Mit Direktlink einfacher: arxiv.org/pdf/2602.16800 [bsky, 21 points, 0 comments]
• stuff like this is why i force myself to have typing characteristics like all lowercase and also constantly lying [bsky, 15 points, 2 comments]
• Large-scale online deanonymization with LLMs [lobsters, 15 points, 3 comments]
• Uhhhhhhh I'm sorry, *what*? "LLMs can't do mass surveillance" lmao yes they can. arxiv.org/abs/2602.16800 "LLMs can't control killbots" my dude, they can absolutely be the decisioning part of a killbo [bsky, 12 points, 1 comments]
• Link zur Studie (in englischer Sprache) arxiv.org/pdf/2602.16800 [bsky, 10 points, 0 comments]
• lol arxiv.org/pdf/2602.16800 [bsky, 9 points, 5 comments]
• bsky.app/profile/nire... TIL arxiv.org/abs/2602.16800 [bsky, 9 points, 0 comments]
• Larger scale deanonymization with LLMs 😬 arxiv.org/abs/2602.16800 [bsky, 8 points, 1 comments]
• For those who didn't follow, I'm talking about a super recent paper by very well established researchers in the field arxiv.org/abs/2602.16800 [bsky, 7 points, 3 comments]
• And in other news: "We show that [LLMs] can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants a [bsky, 7 points, 0 comments]
• Large-scale online deanonymization with LLMs arxiv.org/abs/2602.16800 [bsky, 6 points, 0 comments]
• Source: “Large-scale online deanonymization with LLMs” (arXiv, Feb 2026) [bsky, 6 points, 1 comments]
• Surveillance dystopia prompt, meet your brother from another mother: Large-scale online deanonymization with LLMs arxiv.org/abs/2602.16800 [bsky, 5 points, 0 comments]
• https://bsky.app/profile/ruoshuiresearch.bsky.social/post/3mmwfg4w47k2l [bsky, 4 points, 0 comments]
• I've worked with enough individual-level spatiotemporal data to know how easy it is to reidentify somebody in a "deidentified" dataset but this paper is next level scary: [bsky, 4 points, 1 comments]
• large-scale de-anonymization is fascinating (derogatory) to me bc I just got a spam email concerning an actual office I rented 13 years ago, along with two snail junk mail letters “addressed” to famil [bsky, 4 points, 1 comments]
• Large-scale online deanonymization with LLMs arxiv.org/pdf/2602.16800 Basicamente, IAs já conseguem ler textos anônimos postados em canais diferentes (linkedin, reddit, e outros) e identificar autores [bsky, 4 points, 1 comments]
• Large-scale online deanonymization with LLMs (including HN users) [hn, 3 points, 2 comments]
• Large-scale online deanonymization with LLMs [hn, 3 points, 0 comments]
• Direct link to the pre-print: arxiv.org/abs/2602.16800 [bsky, 3 points, 0 comments]
• L'anonymat en ligne n'existe plus, selon une étude des chercheurs de l'ETH Zurich et d'Anthropic. Selon leurs travaux, l'IA identifie les utilisateurs anonymes avec une précision redoutable : arxiv.or [bsky, 3 points, 1 comments]
• Arxiv link to paper: arxiv.org/pdf/2602.16800 [bsky, 3 points, 0 comments]
• Preprint: Large-Scale Online Deanonymization with LLMs (via arXiv) arxiv.org/abs/2602.16800 #privacy #infosec [bsky, 2 points, 1 comments]
• Using LLMs to re-identify anonymous online profiles: in this experiment, researchers have re-identified 67% of the targeted users with >90% precision for a cost of 1-4$ per user. GDPR needs to be stre [bsky, 2 points, 0 comments]
• Large-scale online Deanonymization with LLMs. With full Internet access, Agent can re-identify Hacker News users and Anthropic Interviewer Participants at high Precision, given pseudonymous online Pro [bsky, 2 points, 0 comments]
• 2 dazu auch (via @rawx.bsky.social ) arxiv.org/abs/2602.16800 [bsky, 2 points, 0 comments]
• Non, effacer les noms de vos documents avant de les soumettre à un LLM ne les anonymise pas (2e édition) : non seulement ça n'a aucune portée juridique, mais en plus ça n'a aucune efficacité... un LLM [bsky, 2 points, 1 comments]
• arxiv.org/abs/2602.16800 👀 [bsky, 2 points, 1 comments]
• El anonimato práctico en internet acaba de desaparecer. Full paper: ⁨arxiv.org/pdf/2602.16800⁩ ⁨Ciberseguridad⁩ ⁨#Seguridad⁩ ⁨#Privacidad⁩ 🔏 [bsky, 2 points, 0 comments]
• maybe to combat arxiv.org/abs/2602.16800 [bsky, 2 points, 1 comments]
• Pseudonymous Bash [bsky, 2 points, 0 comments]
• J'ai vu passer ça récemment : arxiv.org/abs/2602.16800 [bsky, 2 points, 1 comments]
• Large-scale online deanonymization with LLMs [bsky, 2 points, 0 comments]
• https://bsky.app/profile/gracekind.net/post/3mnfv67mnsj2s [bsky, 1 points, 1 comments]
• For our Open Research Journal Club last week, we discussed a recent study by Swanson et al. (2026) on how LLMs can perform large-scale deanonymisation at speed and relatively low cost, using micro-dat [bsky, 1 points, 0 comments]
• Eine brandneue, erschreckende Studie zeigt: Künstliche Intelligenz (KI) kann ab sofort fast jeden anonymen Nutzer im Netz enttarnen. Das Ende der digitalen Freiheit, wie wir sie kennen, ist da! report [bsky, 1 points, 0 comments]
• Dé-anonymisation de pseudos : les LM surpassent largement les méthodes classiques arxiv.org/pdf/2602.16800 www.numerama.com/cyberguerre/... [bsky, 1 points, 0 comments]
• Well this is a bit disturbing: your anonymous writing on the internet can be linked with your identified writing using LLMs. arxiv.org/abs/2602.16800 [bsky, 1 points, 0 comments]
• Link to the substack: simonlermen.substack.com/p/large-sca... And the paper: arxiv.org/abs/2602.16800 [bsky, 1 points, 0 comments]
• My second thought is wondering, why post a snapshot of the first page without posting a link? Also no alt-text is annoying but this site has really gone downhill since Link was banned, so not a surpri [bsky, 1 points, 0 comments]
• Uff. Das Ende der „Anonymität“ im Internet? Large-scale online deanonymization with LLMs arxiv.org/pdf/2602.16800 [bsky, 1 points, 0 comments]
• Why is the US government investing in huge AI data centers? What's the value even? This... https://arxiv.org/abs/2602.16800 [bsky, 1 points, 1 comments]
• saw this paper and it reminded me of this post. very worrying arxiv.org/abs/2602.16800 [bsky, 1 points, 0 comments]
• Large-scale online deanonymization with LLMs [hn, 1 points, 0 comments]
• Large-scale online deanonymization with LLMs (using HN posts) #HackerNews https://arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• Large-scale deanonymization now possible with the assistance of LLM’s. On unstructured text. arxiv.org/pdf/2602.16800 [bsky, 0 points, 1 comments]
• Large-scale online deanonymization with LLMs arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• "Large-scale online deanonymization with LLMs": https://arxiv.org/abs/2602.16800v1 [bsky, 0 points, 0 comments]
• In the prepirnt paper, researchers showed that LLMs can automatically identify who has posted online under assumed names. Read the preprint paper "Large-scale online deanonymization with LLMs" arxiv.o [bsky, 0 points, 1 comments]
• #cs.CR #cs.AI #cs.LG Origin | Interest | Match [bsky, 0 points, 0 comments]
• LLM “… large language models can be used to perform at-scale deanonymization … our agent can re-identify Hacker News users and Anthropic Interviewer participants … given pseudonymous online profiles a [bsky, 0 points, 0 comments]
• **Large-scale online deanonymization with LLMs** https://arxiv.org/abs/2602.16800 It's over, anons. [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs (using HN posts) https://arxiv.org/abs/2602.16800 (https://news.ycombinator.com/item?id=47154011) [bsky, 0 points, 0 comments]
• You probably saw this already arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• #surveillance "large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at h [bsky, 0 points, 0 comments]
• "ETH Zurich and Anthropic just dropped a paper called “Large-Scale Online Deanonymization with LLMs” and the results are the most alarming privacy research I’ve read this year." tl;dr: cheap deanonymi [bsky, 0 points, 0 comments]
• [2602.16800] Large-scale online deanonymization with LLMs — Interesting look at how LLMs can be used to deanonymize people at scale from online traces, and what that implies for privacy assumptions. W [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs https://lobste.rs/s/wxl81t #privacy [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs (using HN posts) https:// arxiv.org/abs/2602.16800 # arxiv # llm # llms [mastodon, 0 points, 0 comments]
• There's no way this ends badly, right? arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• Eine neue Studie zeigt: Künstliche Intelligenz kann pseudonyme Nutzer auf Social Media mit hoher Trefferquote identifizieren. Large-scale online deanonymization with LLMs arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• The average online user has long operated under an implicit threat model where they have assumed pseudonymity provides adequate protection because targeted deanonymization would require extensive effo [bsky, 0 points, 0 comments]
• Well this came about worryingly quickly? "Large-scale online deanonymization with LLMs" - a paper from MATS, ETH Zurich, and Anthropic researchers. arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• they do that so well in fact, given the absurd amount of data they were fed, that they can effectively de-anonymise people, purely from a few lines of unstructured text: arxiv.org/abs/2602.16800 [bsky, 0 points, 1 comments]
• Scary: using LLM text analysis do deanonymize Internet users. Linking Hacker News posts to LinkedIn profiles (albeit with <50% success rate) https://arxiv.org/abs/2602.16800?trk=public_post_comment-te [bsky, 0 points, 0 comments]
• “Pseudonymous” was a rate limit, not a shield. LLMs just turned deanonymization from a hobby for obsessed humans into a scalable primitive. The old internet deal is over: if you’ve written enough, you [bsky, 0 points, 0 comments]
• Curioso que el fin del anonimato en Internet pueda venir de los LLM y no de los gobiernos. Y más curioso que sea extensible al pasado, algunos pueden estar empezando a sudar. arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs #devopsish [bsky, 0 points, 0 comments]
• arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• To whom it may concern. #Privacy #KI #Pseudonymity "Large-scale online deanonymization with LLMs" arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]
• Large-scale online deanonymization with LLMs (using HN posts) https://arxiv.org/abs/2602.16800 [bsky, 0 points, 0 comments]
• 2/2 Large-scale online deanonymization with LLMs by Simon Lermen, Daniel Paleka, Daniel Paleka, Michael Aerni, Nicholas Carlini, Nicholas Carlini arxiv.org/pdf/2602.16800 [bsky, 0 points, 0 comments]

Related

• Automated Profile Inference with Language Model Agents
• When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs
• Large Language Models are Advanced Anonymizers
• Evaluating LLM-based Personal Information Extraction and Countermeasures
• Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Dataset