The rapid advancement of large language models (LLMs) has enabled powerful authorship inference capabilities, raising growing concerns about unintended deanonymization risks in textual data such as news articles. In this work, we introduce an LLM agent designed to evaluate and mitigate such risks through a structured, interpretable pipeline. Central to our framework is the proposed SALA (Stylometry-Assisted LLM Analysis) method, which integrates quantitative stylometric features with LLM reasoning for robust and transparent authorship attribution. Experiments on large-scale news datasets demonstrate that SALA, particularly when augmented with a database module, achieves high inference accuracy in various scenarios. Finally, we propose a guided recomposition strategy that leverages the agent's reasoning trace to generate rewriting prompts, effectively reducing authorship identifiability while preserving textual meaning. Our findings highlight both the deanonymization potential of LLM agents and the importance of interpretable, proactive defenses for safeguarding author privacy.
Figures & tables
Category
Feature
Description
Lexical
Unique word count
Total number of distinct words used in the text.
Average word length
Mean number of characters per word.
Type-token ratio
TTR: ratio of unique words to total words.
Hapax Legomenon ratio
Proportion of words that appear only once in the text.
Syntactic
Average sentence length
Mean number of words per sentence.
Stopword count
Number of common functional words (e.g., "the," "is") used.
Table 1: Stylometric features used in constructing our Stylometry-Assisted LLM Analysis (SALA).
Potential Candidates
Zero-Shot
DB-AUG
20
1.2%
78.1%
50
9.8%
89.5%
100
21.1%
93.1%
Table 2: Percentages of test cases with true authors in the selected potential candidate lists in zero-shot and database augmented (DB-AUG) setting.
No. Target
No. Sample
ES
LDA
SALA
1
5
0.500
0.500
0.619
10
0.513
0.500
0.645
3
5
0.167
0.168
0.244
10
0.172
0.166
0.291
Table 3: Zero-shot attack performance with different matching strategies in the targeted attack scenario with different numbers of samples per candidate and the number of targets. ES = Embeddings Similarity, LDA = LLM Direct Analysis, SALA = Stylometry-Assisted LLM Analysis, No.= Number of.
ES
LDA
SALA
Full
0.000
0.000
0.000
Filtered
0.053
0.058
0.068
Table 4: Zero-shot attack performance in an open-world setting.
No. Target
No. Sample
ES
LDA
SALA
1
10
0.500
0.654
0.674
200
0.500
0.699
0.801
500
0.500
0.681
0.827
3
10
0.167
0.243
0.312
200
0.167
0.223
0.551
500
0.167
0.198
0.595
Table 5: Authorship inference performance with different matching strategies in targeted attack scenario with different numbers of samples per candidate and the number of targets.
Figure 1: Authorship inference performance in targeted attack scenario with different numbers of samples per candidate and number of targets.
Number of Targets
1
3
10
Lexical
0.728
0.524
0.298
Syntactic
0.62
0.446
0.308
Readability
0.545
0.199
0.120
Semantic
0.579
0.245
0.089
Style
0.654
0.188
0.094
Full
0.827
0.595
0.363
Table 6: Authorship inference performance when using only one type of stylometric feature in SALA.
Top-1
Top-3
Full
Filtered
Full
Filtered
ES
0.035
0.051
0.077
0.112
LDA
0.042
0.056
0.092
0.123
SALA
0.078
0.125
0.156
0.224
Table 7: Percentage of correct inference with database module augmented in the open-world attack scenario.
Figure 2: Correct prediction rate of authorship inference (top-3) with database module augmented in the open-world scenario with different numbers of candidates selected during the search stage.
Targeted
Open-World
No Defense
0.827
0.156
Direct Paraphrase
0.762
0.035
Guided Recompose
0.561
0.012
Table 8: Authorship inference effectiveness with mitigation deployed.
Privacy leakage in language models concerns how models expose training data, infer sensitive traits, or transmit private context through outputs and internal channels.