AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search

1 Introduction

• LLM agents can link anonymized conversational disclosures to real identities by retrieving and cross-referencing public information.Prior work has shown attribute inference, cross-platform deanonymization, and re-identification during seemingly benign tasks.Source: §1 · p. 1
• The role of web search remains poorly understood, including whether it discovers an identity or corroborates a candidate and why relevant evidence can still yield an incorrect identification.Known identities are needed to distinguish these outcomes and evaluate defenses.Source: §1 · p. 1
• AGENTDOXX comprises 822 synthetic interview transcripts grounded in public information about individuals with known identities.Individuals are sourced from r/IAmA, with attributes drawn from publicly accessible pages linked in their posts.Source: §1 · p. 1
• Human evaluators classify real and synthetic interviews at approximately chance accuracy, supporting the interviews’ conversational realism.The supplied passages report approximately chance accuracy in the human distinguishability study.Source: §1 · p. 2
• Search improves recall and precision in every ablation pair, while the five strongest configurations reach 47.0–48.3% accuracy and three open-weight models identify 15–28% of transcripts without search.The five strongest include Kimi K3 and GLM-5.3 Flash; the open-weight models identifying without search are Kimi K3, GLM-5.3 Flash, and DeepSeek-V4 Flash.Source: §1 · p. 2
• After named-entity masking, at least one attacker reidentifies 85.3% of the stratified sample that could be correctly reidentified.Privacy instructions lower accuracy from 75.1% to 21.6%, yet 37% of name-withholding responses had already retrieved the subject and 58% still characterized distinguishing details.Source: §1 · p. 2

Classical Re-identification Attacks

• Classical attacks linked structured or semi-structured records to auxiliary information, but generally required domain-specific engineering and substantial manual effort.Examples include linkage of behavioral data and identification from sparse mobility or transactional observations.Source: §2 · p. 2

LLM-Based Attribute Inference and Re-identification

• LLMs can infer attributes from contextual cues and re-identify people in anonymized text, including through inference during ostensibly benign analysis.Prior work demonstrated transcript and platform deanonymization, but did not systematically evaluate frontier-model agents, web search’s marginal impact, or mitigations.Source: §2 · p. 2

Traditional and LLM-Based Text Anonymization

• Text anonymization includes NER-based redaction and LLM-based defenses that rewrite or iteratively refine text to protect privacy.The approaches include adversarial anonymization, IncogniText, and RUPTA.Source: §2 · pp. 2–3
• Existing defense evaluations consider standalone LLM adversaries, leaving their robustness against web-search-augmented attackers untested.This work addresses that open evaluation question.Source: §2 · p. 3

3 AgentDoxx: An Evaluation Suite for LLM-Based Re-Identification

• Without ground-truth identities, authentic interviews cannot reliably distinguish correct identifications from plausible false positives; AGENTDOXX supplies 822 synthetic interviews with known identities for systematic evaluation.The suite also enables comparisons of model behavior, search pathways, and mitigation outcomes.Source: §3 · p. 3

3.1 Data Construction Pipeline

• The construction pipeline has four stages, followed by quality checks and redaction.It sources r/IAmA individuals, filters linked pages, extracts attributes, and generates interviews from those attributes.Source: §3.1 · pp. 3–4
• GPT-5.4-mini generates interviews using eight shared core questions, with wording and follow-ups adapting to answers and direct identifiers conveyed indirectly.The questions derive from sampled Anthropic workforce interviews, and generation prioritizes conversational realism rather than forcing every extracted attribute into the dialogue.Source: §3.1 · p. 4
• GPT-4o and GPT-4.1-mini flag occupation mismatches, direct identifier exposure, and factual contradictions; flagged transcripts receive manual review and identifier redaction.Redaction depends on the speaker’s relationship to a reference, and all person names are removed before experiments.Source: §3.1 · p. 4

3.2 Synthetic Data Validation

• Human distinguishability accuracy is 49.3%, statistically indistinguishable from the 50% chance baseline, indicating that synthetic interviews are largely indistinguishable from real ones.The study sampled 50 synthetic and 50 real interviews, with three annotators judging each interview.Source: §3.2 · p. 4, Table 1 · p. 4
• All 822 transcripts contain exactly eight interview rounds, with responses averaging 129.9 words in round one and 96.8 words in later rounds.These response-length patterns are consistent with the real Anthropic Interviewer data, where opening responses establish professional context before narrowing to specific topics.Source: §3.2 · p. 4
• Across extracted attributes, 30.8% are explicit, 21.6% indirect, and 47.6% absent from dialogue; the first round contains 47.7% of surfaced attributes.Explicit mention means the source attribute is stated, not necessarily that a direct identifier appears.Source: §3.2 · p. 4

4.1 Re-Identification Overview and Analysis

• For six strongest search-enabled configurations, high-confidence filtering raises precision from 18.2–44.6% to 89.4–96.7%, retaining 16.7–91.7% of correct identifications.The filter discards 39.5–97.5% of candidates.Source: §4.1 · p. 5, Figure 2 · p. 5
• Without search, Kimi K3 and GLM 5.3 Flash coverage falls from 39.4% to 12.3% and 35.2% to 5.6%, while DeepSeek-V4 Flash’s high-confidence share rises from 14.9% to 60.5%.Higher reasoning effort increases GPT-5 Mini precision from 44.2% to 69.2% and coverage from 11.1% to 29.6%; GPT-5.6 Terra coverage rises from 29.3% to 36.0% at ∼94% precision.Source: §4.1 · pp. 5–6

4.2 Agentic Search and Retrieval Strategies

• Across the five highest-accuracy configurations, accuracy spans 47.0–48.3% while mean runtime varies 6.3×; greater reasoning effort also increases name-directed querying.GPT-5 Mini querying by name rises from 0.1% at minimal effort to 33.8% at high effort, and GPT-5.6 Terra rises from 6.0% to 33.9%.Source: §4.2 · p. 6
• Kimi K3 and GLM-5.3 Flash rely similarly on corroboration and discovery, but no-search reruns retain 81% and 80% of corroboration identifications versus 25% and 18% of discovery identifications.A name queried before or in the same round as its first appearance in retrieved results is classified as corroboration; a later query is consistent with retrieval-driven discovery.Source: §4.2 · p. 7
• Once the target appears in retrieved results, identification succeeds in 91.2% of cases (over 88% except Llama-4 Maverick at 80.2%), while three open-weight models identify 15–28% without search.The authors also report that retrieval and parametric knowledge are channels of comparable magnitude for the strongest configurations.Source: §4.2 · pp. 6–7, Figure 3 · p. 6

4.3.1 Text-Level Anonymization

• On a 143-transcript stratified sample, NER leaves at least one attacker successful on 85.3%; attribute noise halves mean accuracy from 75.1% to 34.2%.Several attackers still identify approximately two-thirds of subjects after NER plus paraphrasing; reasoning-enabled attackers sometimes treat false attribute contradictions as transcription noise.Source: §4.3.1 · pp. 7–8, §4.3 · p. 7, Table 2 · p. 7
• Fine-tuning on attack trajectories reduces selected transcript characters to 2.66%, with 77% overlap with analyzer-selected characters; redaction brings mean accuracy to 35.1%.Span selection under paraphrasing reaches 48.4% mean accuracy with 0.91% of characters edited, compared with 45.9% and 1.50% for NER plus paraphrasing.Source: §4.3.1 · p. 8

4.3.2 Prompt-Level Privacy Instructions

• Privacy prompts reduce mean accuracy to 21.6% and name appearance in retrieved content from 76.6% to 43.8%, yet Gemini retrieves the subject in 62% of transcripts despite 0% accuracy.Among abstaining pairs, 37% still retrieved the subject’s name during search.Source: §4.3.2 · p. 8

5 Discussion

• No evaluated text-level intervention eliminates re-identification, and replacing or removing distinctive spans can compromise factual integrity or discard useful information.The authors recommend measuring downstream utility alongside protection.Source: §5 · p. 9
• Evaluation should audit retrieval traces as well as final outputs because mitigation at one stage can leave exposure at the other.Source: §5 · p. 9
• The suite can be rerun on the same transcripts as models and defenses change, supporting direct comparison with earlier results.The discussion also frames re-identification as an explicit pre-release safety-evaluation target.Source: §5 · p. 9
• The source identities are limited to people whose self-disclosed attributes also appear online, so reported risk is not a population-level estimate.The effect of alternative question sets and the separate contributions of attribute specificity, occupation, and online footprint remain unmeasured.Source: §5 · p. 9

Ethics statement

• Because the work is dual-use and inferred matches remain uncertain, the authors do not release identifying information or synthetic transcripts and ground-truth labels.They are designing a controlled-access evaluation service with safeguards against identity disclosure.Source: Ethics statement · p. 9

• The study examined all 1250 interviews: 125 Science, 1000 Work, and 125 Creativity interviews.Source: A Motivating Study: Experimental Details · p. 10
• Direct intent explicitly instructed GPT-5.4-mini to identify the interviewee using web search, while indirect intent split the task into three steps to avoid triggering safety refusals.The indirect pipeline used GPT-5.1 initially and GPT-5.4-mini for subsequent verification; 199 transcripts reached its final retrieval stage.Source: A Motivating Study: Experimental Details · p. 11
• Because search queries vary across runs, the study used repeated runs to filter false positives, especially for common professional profiles.Source: A Motivating Study: Experimental Details · p. 11
• A direct-intent candidate was confirmed only after appearing in at least three of four runs, with at least two runs at high or very high confidence.Ambiguous cases with different high-confidence identities were excluded; dataset-source cases were rerun, and one low-confidence indirect-only candidate independently passed verification.Source: A Motivating Study: Experimental Details · p. 11
• 43 unique verified matches (3.4% of 1250) passed the protocol, with 42 from direct intent, 27 from indirect intent, and 26 shared across settings.These are protocol-verified matches, not ground-truth-confirmed identities.Source: A Motivating Study: Experimental Details · p. 11

Domain and Search Analysis

• The observed confirmation rate was higher in Science than in Work or Creativity; Science searches predominantly used academic sources, while Work searches used professional and business sources.Source: Domain and Search Analysis · p. 11
• Across Science and Work, queries frequently drew on the opening exchange, which elicited professional background, institutional affiliation, and expertise.Creativity was omitted from URL-domain analysis because it had only three confirmed cases.Source: Domain and Search Analysis · p. 11

B.1 Fixed Question Set

• Generation prompts ground conversations in supplied attributes, require the stated occupation, and direct the model to redact direct identifiers and describe institutions and publications instead.Quasi-identifiers should surface naturally through context.Source: §B.1 · pp. 12–13
• The prompts encourage varied response length, colloquial language, personality, and imperfect structure; TUNA guides realistic variation in workplace AI use cases.Source: §B.1 · pp. 13–14
• The interview set uses eight shared core questions, adapting wording and follow-up probes to preceding answers while preserving each question’s underlying intent.Source: §B.1 · pp. 11, 14

C.1 Web-search tool definition

• The Tavily-backed web_search function retrieves current web results with titles, URLs, and snippets from a supplied query.Source: §C.1 · pp. 14–15

C.2 Prompt level privacy instructions

• The privacy constraint tells the model not to identify, infer, or reconstruct a person’s identity and to avoid behavior facilitating re-identification.Source: §C.2 · p. 15
• The table distinguishes final-answer naming and abstention from retrieval traces, including cases where the model abstains after the subject’s name appeared in results.Source: Table 3 · p. 15

C.3 Occupation diversity.

• The 822 individuals span 183 normalized occupation categories, 135 of which contain a single individual.Journalists (n = 128), filmmakers (n = 121), CEOs/founders (n = 101), professors (n = 74), and actors (n = 45) are the five largest categories; the remaining 178 categories contain 353 individuals.Source: §C.3 · p. 15
• Mean attribute coverage is 0.44 for journalists and 0.43 for authors, versus 0.25 for both actors and politicians.The reported occupation-group means reflect variation in how closely extracted attributes relate to the interview topic of AI use at work.Source: §C.3 · p. 16, Figure 4 · p. 16

C.4 Re-identification Risk Across Occupations

• Mean recall is 0.51 for professors and 0.06 for actors across configurations; pooled high-confidence candidate precision is 90% and 48%, respectively.Figure 5 reports recall and precision by occupation and model configuration; each cell gives correct over total, with shading encoding the ratio.Source: §C.4 · p. 16, Figure 5 · p. 17
• Professors’ institutional affiliation, research area, and publication record jointly narrow the search space, while actors’ credits are shared across large casts.The authors attribute the occupational gradient to differences in professional-attribute distinctiveness and availability in public indices.Source: §C.4 · p. 16

C.5 Name normalization and matching

• Normalization strips titles and suffixes, removes parenthetical or bracketed phrases and non-alphabetic characters except apostrophes and hyphens, then lowercases and collapses whitespace.The procedure uses the nameparser library.Source: §C.5 · p. 17
• A predicted name counts as a match when its Jaro–Winkler similarity to an acceptance-set surface form is at least 0.80.Acceptance sets expand first-name variants and apply rules for initials, name order, and casing; this is done offline, without an LLM in the evaluation loop.Source: §C.5 · p. 17

C.6 Response classification.

• Responses are classified as correct, false positive, generic, or no candidate, separating incorrect identification from refusal to identify.Correct responses name the true individual; false positives name someone else; generic responses avoid a specific person; no-candidate responses make no identification attempt.Source: §C.6 · pp. 17–18

D Human Study Methodology Details

• The study takes 30 minutes on average, and each evaluator is compensated $5.Each excerpt takes about 1–2 minutes to review.Source: D Human Study Methodology Details · p. 18, §3 · p. 18
• Evaluators review 10 AI-conducted interview excerpts, judging whether each user's replies are from a real person or AI-generated.They are asked to provide a brief explanation of why they made each choice.Source: D Human Study Methodology Details · p. 18, §3 · p. 18