Large-scale online deanonymization with LLMs

Simon Lermen; Daniel Paleka; Joshua Swanson; Michael Aerni; Nicholas Carlini; Florian Tramèr

Source-linked AI summary

Large-scale online deanonymization with LLMs

Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr

arXiv:2602.16800v2Feb 18, 2026cs.CRcs.AIcs.LG

TL;DR

The paper asks whether LLMs make end-to-end deanonymization of pseudonymous online accounts practical. It builds LLM-based attacks that extract identity signals, search candidate profiles, and reason over matches, finding that these methods outperform classical approaches and undermine practical obscurity. The evaluation is constrained because ground-truth datasets may overestimate real-world success.

Problem
Prior deanonymization attacks were limited by the need for structured data or substantial manual effort, leaving the practicality of deanonymizing unstructured online text uncertain.
Method
The paper evaluates autonomous open-web agents and a scalable pipeline that extracts features, searches embeddings, reasons over candidates, and calibrates matches.
Results
LLM-based attacks substantially outperform classical methods, with open-web agents achieving 25–67% recall at 70–90% precision across Hacker News and Reddit profiles.
Takeaways & Limitations
The findings indicate that practical obscurity no longer protects pseudonymous users reliably and that online privacy expectations and policies require reconsideration.
Takeaways & Limitations
The ground-truth datasets may overestimate real-world success because users who reveal identity links may share more information than truly pseudonymous users.

Abstract

from arXiv · show

We show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at high precision, given pseudonymous online profiles and conversations alone, matching what would take hours for a dedicated human investigator. We then design attacks for the closed-world setting. Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives. Compared to classical deanonymization work (e.g., on the Netflix prize) that required structured data, our approach works directly on raw user content across arbitrary platforms. We construct three datasets with known ground-truth data to evaluate our attacks. The first links Hacker News to LinkedIn profiles, using cross-platform references that appear in the profiles. Our second dataset matches users across Reddit movie discussion communities; and the third splits a single user's Reddit history in time to create two pseudonymous profiles to be matched. In each setting, LLM-based methods substantially outperform classical baselines, achieving up to 68% recall at 90% precision compared to near 0% for the best non-LLM method. Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered.

1 Introduction

The paper shows that LLMs can automate deanonymization from unstructured online text, both on the open web and when matching pseudonymous profiles. Across several settings, these attacks outperform classical methods and challenge the assumption that pseudonymity provides practical protection.

Contributions: LLMs can perform end-to-end deanonymization by extracting identity signals, searching candidate profiles, and reasoning over evidence.The paper frames deanonymization as a matching problem spanning arbitrary text and multiple threat models.
Open-web deanonymization: 25–67% recall at 70–90% precision was achieved when agents autonomously searched the open web using anonymous profiles.The agents replicated in minutes work that could take hours for a dedicated human investigator.
Closed-world attacks: 45.1% recall at 99% precision improved from 0.1% for classical methods when linking Hacker News accounts to LinkedIn profiles.On Reddit movie-subcommunity matching, recall improved from 0% to 2.8% at the same precision threshold.
Evaluation: The evaluation framework creates scalable ground truth by anonymizing linked profiles or splitting one user’s activity across communities or time.These designs enable comparison across methods while preserving verifiable identity matches, but may not represent the most privacy-conscious users.
Implications: The findings suggest that pseudonymity no longer reliably provides practical obscurity because LLMs reduce the cost of deanonymization.The authors argue that privacy expectations, platform policies, and social norms for pseudonymous participation require reconsideration.
Open-web deanonymization: 67% of 338 Hacker News targets were correctly identified at 90% precision in the Hacker News-to-LinkedIn evaluation.The dataset used publicly linked profiles as verified ground truth, though those profiles were easier to identify than most pseudonymous accounts.

3 A framework for scalable deanonymization with LLMs

The paper frames deanonymization as matching profiles across candidate sets and extends classical attacks with LLM-based extraction, search, reasoning, and calibration for unstructured text.

The attacker matches a query profile to a candidate set, returning a best guess or abstaining when appropriate.
The framework augments classical deanonymization with four stages: Extract, Search, Reason, and Calibrate.
Extract: LLMs extract semi-structured micro-data from unstructured posts and comments, enabling the attack to use more information than structured-input methods.
Search: Nearest-neighbor search over LLM embeddings retrieves likely matches from thousands or millions of candidate profiles.
Reason: LLM reasoning selects among shortlisted candidates and can use a cheaper model for selection followed by a more capable model for verification.
Evaluation: Ground-truth evaluation uses linked profiles, sanitized identities, and semantic splits, while acknowledging distributional bias and possible recall overestimation.

4 Linking profiles across platforms: Hacker News and LinkedIn

The Hacker News–LinkedIn study evaluates cross-platform matching at scale and finds that LLM embeddings and reasoning outperform the classical baseline, with reasoning remaining more robust as candidate pools grow.

The cross-platform task models an adversary who knows a person’s identity and seeks that person’s pseudonymous Hacker News account.
Dataset: The dataset contains 987 LinkedIn profiles linked to 995 Hacker News accounts, with approximately 89,000 active HN users in the candidate pool.
Embedding search: LLM-based embeddings substantially outperform the Netflix Prize attack, whose top-1 ranking is correct for only 5.1% of candidates.
Reasoning: Adding LLM reasoning improves both precision and recall over pure embedding search by selecting among top candidates using contextual evidence.
Reasoning effort: At 99% precision, high reasoning reaches 45.1% recall versus 36.0% for low reasoning, while the modes perform comparably at lower thresholds.
Scaling: At 90% precision, Reason retains 55.2% recall at 89k candidates, compared with 26.6% for Search.
Calibration: LLM confidence scores substantially outperform the top-2 embedding-similarity gap as a calibration method.

6 Scaling LLM deanonymization on temporally split profiles

The study evaluates LLM deanonymization on temporally split Reddit profiles, where a one-year gap separates query and candidate comments. Across increasingly difficult matching settings, LLM-based extraction, search, reasoning, and calibration outperform classical attacks, though large-scale results are based partly on coarse extrapolation.

Dataset construction: The dataset splits each user’s comments into before and after profiles separated by one year, then adds candidate and query distractors to test matchable and non-matchable settings.The core task contains 5,000 query and 10,000 candidate profiles; additional query-only distractors create cases without a true match.
Attack pipeline: The attack extracts semi-structured micro-data from comments, embeds the summaries, and uses LLM reasoning to overcome embedding similarity’s weak single-match ranking and confidence calibration.The pipeline filters comments, summarizes relevant content, searches candidate embeddings, reasons over top candidates, and sorts proposed matches with pairwise comparisons.
Results: At 90% precision, the classical attack fails to achieve non-trivial recall, whereas even the simplest LLM attack achieves non-trivial recall across precision levels.Adding reasoning and calibration further improves recall, with the full attack deanonymizing a third of users at 99% precision.
Attack pipeline: About 80% of true matches rank among the top 15 embedding candidates, and LLM selection from that shortlist recovers many missed matches at high precision.The result motivates combining efficient embedding search with a reasoning stage rather than returning the highest-similarity candidate directly.
Scaling difficulty: A coarse extrapolation estimates about 35% recall at 90% precision for one million candidates, while LLM attacks retain about 9% recall when only one in 10,000 queries has a possible match.The authors characterize the million-candidate estimate as having large margins of error and frame the scaling conclusion as a conjecture.

7 Related work

Related work established deanonymization from structured auxiliary data and studied attribute inference, web-search agents, and stylometry. This paper extends that context by examining deployment-time LLM risks and semantic matching of unstructured text at larger scale.

Classical deanonymization: Earlier attacks linked sparse structured data across platforms, including Netflix ratings to IMDb profiles and spatiotemporal points to mobile-phone identities.These studies established that seemingly innocuous structured data can identify individuals when matched with auxiliary datasets.
LLM profiling: Prior LLM research showed that models can infer attributes such as location, occupation, and income from online text, motivating deployment-time privacy concerns.The paper positions its Extract step within this line of work on profiling and inference from unstructured online content.
Broader security context: More broadly, the paper situates deanonymization among LLM-enabled deployment-time threats involving automated profiling and tailored attacks.Related work reports that autonomous agents can crawl public information to construct comprehensive profiles for many targets.
Agentic deanonymization: Agentic LLMs have also been shown to deanonymize interview participants through web search and cross-referencing, recovering 6 of 24 scientist identities in one study.That work demonstrates the low-effort nature of re-identification using natural-language prompts and off-the-shelf search tools.
Authorship attribution: Stylometric authorship attribution focuses on writing style, whereas this paper uses semantic content and evaluates temporal linking at a 10,000-user scale.The paper identifies combining stylometric and semantic approaches as a future direction.

8 Discussion

LLMs make large-scale deanonymization practical from unstructured online text, creating privacy risks that existing defenses may not adequately address. The discussion highlights both concrete harms and limits on evaluating and mitigating these attacks.

Implications: LLMs can scale deanonymization attacks that were previously manual and expensive, increasing the imbalance between attack and defense costs.The paper frames deanonymization as an example of LLMs acting as an “information microscope.”
Implications: Potential harms include surveillance, doxxing, targeted advertising, personalized social engineering, and identification of important employees or decision makers.These risks affect governments, corporations, attackers, and hostile groups.
Mitigations: Rate limits, automated-scraping detection, restricted bulk exports, and provider monitoring may reduce attack severity.Model refusal guardrails may help, but the pipeline can resemble benign summarization, embedding, and search tasks.
Mitigations: Classical anonymization frameworks target structured databases and do not account for these unstructured-text attacks.Targeted text anonymization may help, but residual semantic signals remain.
Limitations: The evaluation datasets may overestimate real-world success because they rely on users who publicly revealed identifying links and because profile splitting may not reflect behavior across truly separate platforms.Ground truth is necessary for verification, but it cannot be obtained for users who have not revealed their identities.
Implications: Users should not assume that pseudonymous posting provides meaningful protection from linking across accounts or to real identities.The paper recommends that platforms account for this risk in data-access policies.
Limitations: Training-data memorization may contribute to performance, but the authors argue that reasoning gains and likely exclusion of LinkedIn profiles from training weaken memorization as a complete explanation.The paper notes that its privacy implications would remain for platforms included in model training data.

9 Conclusion

The paper concludes that LLMs enable scalable deanonymization of pseudonymous accounts using accessible models and APIs. It argues that pseudonymity no longer provides meaningful protection, while prevention and responsible reproducibility remain difficult.

Findings: LLMs enable large-scale deanonymization and outperform classical methods, including attacks previously hindered by a lack of structured data.The conclusion presents this as the paper’s central finding.
Accessibility: The attacks use publicly available models, standard APIs, embedding models, and agent scaffolding, making them accessible to moderately resourced adversaries.The pipeline does not require specialized infrastructure described beyond these components.
Implications: Users with persistent pseudonyms should assume adversaries can link accounts to identities or to one another, with risk increasing as they post more micro-data.The paper states that pseudonymity does not provide meaningful online protection.
Challenges: Preventing attacks is difficult because the framework decomposes deanonymization into seemingly benign summarization, search, and ranking tasks.The paper is pessimistic that provider misuse detection can reliably block this combination.
Implications: The authors connect LLM-enabled deanonymization to a broader need to rethink privacy and computer security in response to LLM-driven offensive capabilities.The conclusion frames privacy as facing a challenge analogous to recent cybersecurity concerns.
Stakeholders: The paper identifies social-media users, vulnerable populations, platforms, researchers, malicious actors, and society as stakeholders affected by these risks.Vulnerable groups include activists, abuse survivors, and whistleblowers.
Harms: Potential harms include stalking, harassment, doxxing, surveillance, targeted manipulation, suppression of dissent, and chilling effects on speech.The paper states that these capabilities already exist in deployed LLMs.
Responsible release: The study uses synthetic anonymization and profile splitting, avoids publishing identities, and withholds its matching code and processed datasets.These choices are presented as measures to avoid directly harming individuals.

A Profile anonymization procedure

The baseline procedures anonymize profiles by removing direct identifiers, generalizing unique project names, and retaining contextual information that does not directly reveal ownership. Matching then uses weighted feature or content similarities, with task-specific handling for professional, temporal, and movie data.

Anonymization: The anonymization procedure removes identifiers whose online search would directly reveal the profile owner.Examples include personal websites, social-media handles, and GitHub repository names or handles.
Anonymization: Unique project names are generalized, while colleague names, local businesses, institutions, locations, demographics, interests, and technical skills are retained.The rule preserves semantic content while reducing trivial identification through unique identifiers.
Evaluation examples: The Reddit agent identifies 13 of 25 academic users at 72% precision and 9 of 36 career-discussion users at 90% precision.Career discussions yield lower recall because anonymized comments often contain generic software-engineering content.
Professional matching: For LinkedIn-to-Hacker-News matching, profiles use 332-dimensional binary attribute vectors and weighted Jaccard similarity.Attributes include features such as skills and companies; HN attributes are extracted from unstructured text by an LLM.
Movie matching: For Reddit movie matching, similarity combines agreement in inferred ratings with temporal proximity, using a smooth kernel because the LLM estimates noisy ratings and dates.Popular movies are downweighted, with σ_r = 1.0, σ_t = 40.0 days, and β = 0.5.
Temporal matching: For Reddit temporal matching, users are represented by binary subreddit vectors and candidates receive a weighted intersection score.Rare subreddits receive greater weight because they provide stronger matching evidence.
Temporal matching: The temporal baseline uses rarity weights of 1/log|U_s|, favoring users who share many rare subreddits over normalized similarity measures.The score is unbounded and follows the original Netflix Prize attack formulation.

D LinkedIn to HN matching: additional details

Scaling experiments show that recall declines with candidate-pool size, but the Reason stage degrades more gracefully than Search. High reasoning effort and direct confidence scoring outperform the tested pairwise-sorting alternative on movie matching.

Scaling: Recall at 90% precision decreases log-linearly as the candidate pool grows for both Search and Reason.The study evaluates this relationship by subsampling from an 89k Hacker News user pool.
Scaling: Reason has fitted slope a = −8.88 and intercept b = 98.35, while Search has a = −13.94 and b = 95.73 in the log-linear model.The fitted model uses candidate-pool size N as its independent variable.
Scaling: At 100M candidates, Reason is estimated to retain 27% recall at 90% precision, while Search falls to zero.This extrapolation illustrates Reason’s more graceful degradation.
Shared evidence: Users who discussed more shared movies are substantially easier to identify.Table 4 reports recall across precision thresholds and shared-movie counts for 9,781 queries.
Reasoning effort: High reasoning effort roughly doubles recall at 99% precision, reaching 2.8% versus 1.4% with low reasoning effort.The comparison uses GPT-5.2 on the Reddit movie-matching task.
Calibration: The framework can calibrate matches through direct confidence scores or pairwise sorting, with sorting using cross-query comparisons.Direct scoring evaluates each query-candidate pair independently, whereas sorting compares proposed matches side by side.
Calibration: At 99% precision, pairwise sorting achieves 0.7% recall versus 3.1% for confidence ranking on Reddit movie matching.Sorting also underperforms at 90% and 80% precision in the reported experiment.
Calibration: Sorting provides limited additional benefit when Reason already uses a strong high-reasoning model, while its O(nlogn) LLM calls make it costly for larger workloads.The comparison is confounded by sorting using GPT-5-mini and verification using GPT-5.2 with high reasoning effort.

G Linking temporally split Reddit profiles: additional details

The temporally split Reddit dataset separates each author’s history into difficult, time-disjoint query and candidate profiles, then uses LLM filtering, summarization, embeddings, and record selection to match them.

Dataset construction: A 365-day gap is placed around the split time, and comments within that interval are discarded to make matching more difficult and realistic.The split maximizes the smaller half’s comment count subject to the 100-comment minimum on both sides.
Dataset construction: 15,000 authors form the primary dataset after requiring at least three years of activity, 200 comments, and at least 100 comments on each side of the split.Authors are also excluded when their average activity exceeds 24 comments per day or their usernames and curated records indicate bot activity.
Comment filtering: Comments undergo deduplication, heuristic removal of deleted, ultra-short, and URL-only content, and LLM filtering of generic or non-personal material.Only comments judged relevant are retained for summarization.
Profile summarization: The summarization prompt prioritizes distinctive, persistent traits such as city-level location, profession, identity, deep hobbies, values, fandoms, and life circumstances.It excludes generic style traits, country-level locations, and temporary states such as job hunting or having just moved.
Candidate verification: The record-selection prompt compares a query profile with top-k candidate profiles and determines which candidate, if any, is the same person.The filtering prompts also remove redundant information, retaining new author-relevant traits while avoiding repeated disclosures.

G.3 Recall@Precision as a function of the fraction of matchable queries π

The evaluation separates matchable and non-matchable queries, defining rates for correct matches and false positives so precision can be analyzed as the matchable fraction π changes.

Rate definitions: True Positive Rate (TPR) counts correct attacker guesses among matchable queries.TP is the number of true positives, while M is the number of matchable queries.
Rate definitions: False Positive Identification Rate (FPIR) counts non-matchable queries for which the attacker makes a guess instead of abstaining.FPN denotes false positives among non-matchable queries, and N is their total number.
Precision analysis: Precision is expressed using π, TPR, the false-match rate, and FPIR, linking precision to the fraction of queries that have true matches.The three rates can be estimated independently of π because each depends on either matchable or non-matchable queries, not both.

G.4 Justifying Reasoning and Calibration for temporally split Reddit profiles

Embedding similarity is useful for narrowing Reddit matching candidates but is insufficient for reliable ranking or calibration, motivating LLM reasoning and calibration.

Justifying reasoning: Over 80% of true matches appear within the top 15 embedding-similarity candidates, although rank-1 accuracy is only around 60%.This makes a small candidate pool available for LLM-based reasoning without consistently identifying the correct match directly.
Justifying calibration: The maximum embedding similarity barely improves on random ordering when ranking users by whether they have a true match.This poor calibration motivates using LLMs to improve match verification and abstention decisions.

G.5 Results

The results section reports Reddit split-profile matching through figures and a recall-at-precision table, while the accompanying similarity figure shows candidate narrowing without reliable plausibility ranking.

Similarity analysis: Figure 8 reports that similarity narrows the candidate set but does not rank matches by plausibility effectively.The figure distinguishes candidate-set reduction from reliable final ordering.
Results: Figures 9 and 10 provide the full results underlying Figures 7a and 7b.These passages identify the figures as expanded result displays without stating additional numerical outcomes.
Results: Table 6 reports recall at precision thresholds for Reddit split-profile matching with 5,000 queries and 10,000 candidates.The table is the stated results source for this matching setting.