cs.CRFeb 18, 2026

Large-scale online deanonymization with LLMs

Authors: Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr

Organizations: MATS · Anthropic

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

We show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at high precision, given pseudonymous online profiles and conversations alone, matching what would take hours for a dedicated human investigator. We then design attacks for the closed-world setting. Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives. Compared to classical deanonymization work (e.g., on the Netflix prize) that required structured data, our approach works directly on raw user content across arbitrary platforms. We construct three datasets with known ground-truth data to evaluate our attacks. The first links Hacker News to LinkedIn profiles, using cross-platform references that appear in the profiles. Our second dataset matches users across Reddit movie discussion communities; and the third splits a single user's Reddit history in time to create two pseudonymous profiles to be matched. In each setting, LLM-based methods substantially outperform classical baselines, achieving up to 68% recall at 90% precision compared to near 0% for the best non-LLM method. Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered.

Figures & tables

Figure 1: End-to-end deanonymization from a single interview transcript from [ 2 ] ( details altered to protect the subject’s identity ). An LLM agent extracts structured identity signals from a conversation, autonomously searches the web to identify a candidate individual, and verifies the candidate matches all extracted claims.
Figure 2: Overview of our framework for large-scale deanonymization. Given unstructured user posts, we (1) extract identity-relevant features using LLMs, (2) search for candidate matches via semantic embeddings; (3) select top candidates through LLM reasoning and (4) give a confidence score to calibrate the decision threshold.
Figure 3: LinkedIn to Hacker News matching. (a) Precision-recall curves comparing methods: LLM-based embeddings outperform the Netflix Prize attack baseline, and LLM selection from the top-100 candidates further improves performance. (b) Matching recall @90%precision by candidate pool size. Dashed lines show log-linear extrapolation to larger pools.
Method90% Prec98% Prec99% Prec
Narayanan baseline0.1%0.1%0.1%
 (0.0–0.6)(0.0–0.6)(0.0–0.6)
Search (embedding)26.3%16.1%4.4%
 (23.7–29.2)(13.9–18.5)(3.3–5.9)
Reason (low)55.0%44.8%36.0%
 (51.9–58.0)(41.8–47.9)(33.1–39.0)
Table 1: Recall at different precision thresholds for HN-LinkedIn cross-dataset user matching (987 queries). Reason uses GPT-5.2 with low or high reasoning effort. 95% Wilson confidence intervals shown.
Figure 4: (a) Precision-recall curves comparing methods for Reddit movie matching. LLM reasoning outperforms both the embedding gap baseline and the Netflix Prize attack. (b) Recall at precision thresholds by number of shared movies, using GPT-5.2 high reasoning. Users who share more movies are substantially easier to identify. See Table 4 for detailed breakdown.
Figure 5: Two-stage matching of movie reviews with simplified synthetic user profiles. The first LLM selects from top-K embedding similarity candidates; the second LLM verifies the selected match using full profile text. Bold text highlights profile details used by the LLM.
Figure 6: Classical attacks fail to deanonymize split Reddit profiles, while LLM-based attacks are highly effective. We compare a classical baseline that mimics the Netflix Prize attack to LLM deanonymization. (a) The precision of classical attacks drops very fast, explaining its low recall. In contrast, the precision of LLM-based attacks decays more gracefully as the attacker makes more guesses. (b) The classical attack almost fails completely even at moderately low precision. In contrast, even the simplest LLM attack (Search) achieves non-trivial recall at low precision, and extending it with Reason and Calibrate steps doubles Recall@99% Precision.
Figure 7: LLM deanonymization scales to more challenging attack models, while classical methods fail. (a) The strongest LLM-based attack (Search + Reason + Calibrate) might remain effective for very large candidate pools, while the classical baseline fails to deanonymize any users given much smaller candidate pools. We log-linearly extrapolate the recall from sizes 100, 1k, and 10k. (b) LLM-based attacks gracefully degrade as matchable users become more rare, converging to around 9% recall even if only one in 10k queries has a possible match. In contrast, the classical baseline fails to deanonymize users even if all of them are matchable ( π=1\pi=1 ). See Section G.5 for more precision levels.
Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

CategoryExampleSearch ResultAction
Personal URLknuth.stanford.eduFinds Donald KnuthRemove
Blog URLkarpathy.bearblog.devFinds Andrej KarpathyRemove
Social handleu/spezFinds Steve HuffmanRemove
GitHub repoflaskFinds Armin RonacherRemove
GitHub handletorvaldsFinds Linus TorvaldsRemove
Named bootcamp“F*****”Finds creatorGeneralize
Appendix
Table 2: Anonymization rules for profile data, closely matching our actual implementation. We remove direct identifiers, generalize unique project names, and keep information that does not uniquely identify the profile owner.
Candidate poolReason (high)Search (embeddings)
1090.0%80.0%
10082.0%74.0%
1k68.3%47.6%
10k63.2%40.3%
30k59.0%35.1%
89k55.2%26.6%
Appendix
Table 3: Recall @ 90% precision by candidate pool size. Starred rows show log-linear extrapolated values.
#Sharedn90% Prec99% Prec
14,7293.1%1.2%
  (2.6–3.6)(0.9–1.6)
2–43,6938.4%2.5%
  (7.6–9.4)(2.0–3.0)
5–91,11823.2%7.1%
  (20.8–25.7)(5.7–8.7)
Appendix
Table 4: Recall at precision thresholds by number of shared movies (total queries: 9,781). 95% Wilson CIs shown.
Method90% Prec98% Prec99% Prec
Reason (low)5.2%2.0%1.4%
 (4.8–5.7)(1.7–2.3)(1.1–1.6)
Reason (high)8.5%3.8%2.8%
 (8.0–9.1)(3.4–4.2)(2.4–3.1)
Appendix
Table 5: Recall at different precision thresholds for Reddit movies matching (9,781 queries) by reasoning effort. Reason uses GPT-5.2. 95% Wilson CIs shown.
Figure 8: Similarity score is good at narrowing down the candidate set (a) but not at ranking matches in terms of plausibility (b).
Method90% Prec98% Prec99% Prec
Baseline (Narayanan)0.4%0.2%0.2%
LLM38.3%20.2%16.0%
LLM + Selection47.8%28.2%20.3%
LLM + Selection + Sorting67.3%47.6%38.4%
Appendix
Table 6: Recall at precision thresholds for Reddit split-profile matching (5k queries, 10k candidates).
Figure 9: Full results for Figure 7(a) .
Figure 10: Full results for Figure 7(b) .
More in this topic

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Explore similar work

CardsList
Mar 19, 2026

From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents

Anonymization is often assumed to protect privacy once explicit identifiers are removed, because re-identification has historically required specialized expertise, tailored algorithms, and manual corroboration. We show that LLM-based agents weaken this barrier: by combining scattered, individually non-identifying cues with public evidence, they reconstruct real-world identities, sometimes even during benign tasks. We evaluate this risk across three settings -- classical linkage incidents, a controlled benchmark (InferLink) that varies fingerprint type, task framing, and attacker knowledge, and open-ended human--AI interaction traces. In the sparsest regime of the Netflix Prize deanonymization setting, agents reconstruct 79.2% of identities, against 56.0% for a classical matching baseline; on InferLink, they link individuals even without an explicit re-identification request, and more often once one is given. In redacted human--AI interaction traces, agents further resolve anonymized profiles to specific individuals by corroborating contextual cues with public evidence. These findings suggest that privacy evaluations for agentic systems should measure not only what information is accessed or disclosed, but also what identities can be inferred.

Myeongseob Ko, Jihyun Jeong, Sumiran Singh Thakur +2

Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA, USA · Center for Advanced AI, Accenture

Privacy Leakage in Language ModelsLLM Agent SecurityAI Agent Security Benchmarks
AskPDF
Oct 4, 2026

AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search

As Large Language Models (LLMs) gain tool use capabilities such as web search, they can retrieve and cross-reference public information, creating privacy risks beyond memorization. One manifestation is re-identification: linking an anonymized interview transcript to a named individual. Yet without ground-truth identities, the coverage of such attacks and the protection offered by a defense cannot be reliably measured. We introduce AgentDOXX, an evaluation suite of 822 synthetic interview transcripts grounded in public information about real individuals with known identities. We evaluate fifteen configurations of open-weight and proprietary models, isolating the effect of web search, and analyze their search trajectories to distinguish retrieval-driven from parametric identifications. Ground-truth identities reveal that re-identification risk is distributed across an agent's execution: retrieval and parametric recall both contribute, with open-weight models identifying 15-28% of transcripts without search; identification succeeds in over 88% of cases once the target appears in a retrieved result; entity masking leaves at least one attacker successful on 85.3% of a stratified sample; and privacy instructions suppress naming but not retrieval, with configurations scoring 0% accuracy yet retrieving the subject in up to 62% of transcripts. We further show that observed attack trajectories can provide supervision for localizing identifying spans, offering a path toward attack-informed anonymization.

Jianing Wen, Tianshi Li

Khoury College of Computer Sciences Northeastern University Boston, MA

Privacy Leakage in Language ModelsAI Agent Security Benchmarks
AskPDF
May 29, 2026

LLM Anonymization Against Agentic Re-Identification

Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (Anonymization with Utility-Retention Adaptation), an LLM-powered mask-reconstruct framework that decouples privacy localization from utility-preserving reconstruction and selects candidates with adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that AURA improves the privacy-utility frontier by using adaptive privacy scope to strengthen resistance to agentic re-identification and using a mask-reconstruct anonymization method to better preserve contextual utility under fixed privacy scope.

Ziwen Li, Jianing Wen, Tianshi Li

Khoury College of Computer Sciences Northeastern University Boston, MA

Privacy-Preserving Language ModelsPrivacy-Utility Tradeoff
AskPDF