Large-scale online deanonymization with LLMs
Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr
cs.CR, cs.AI, cs.LG
2026-02-19
A web-search agent re-identifies 67% of 338 HN users at 90% precision. Closed-world matching reaches 68% recall at 90% precision; classical methods stay near 0%.
Pseudonymous accounts survived because deanonymization was expensive, not because it was theoretically hard. Narayanan and Shmatikov matched anonymous Netflix ratings to public IMDb profiles from a handful of movie tastes. Sweeney showed zip code, birth date, and gender uniquely identified 87% of the U.S. population. Those attacks needed structured micro-data or a skilled investigator sitting on one high-value target for hours. Reddit throwaways and anonymous forum posts were not worth doing at scale.
This paper asks a narrower, operational question: given unstructured text, can an LLM extract identity signals, search a large candidate pool, and reason about a match. If yes, and if the cost is a few dollars per profile, the implicit threat model of "nobody will bother" no longer holds.
The open-web setting is an existence proof. User posts are summarized into a profile, then names, personal URLs, and GitHub repos are stripped. Institutions, interests, and demographics stay, because searching any one of them does not uniquely identify the owner. A web-enabled agent is then asked to find the person. The authors do not release the agent, prompts, or tool setup.
The closed-world setting is the part you can measure. They split the attack into four stages (ESRC):
The classical baseline is the Netflix Prize attack, ported to each domain: a 332-dimensional rarity-weighted Jaccard over professional attributes, a rating-and-time kernel over movies, and a rarity-weighted subreddit intersection for temporal splits.
On the open web, the agent correctly names 226 of 338 Hacker News users who had once linked LinkedIn, at 90% precision (25 wrong, 86 abstentions). Reddit academics: 13 of 25, 52% recall at 72% precision. Career posters: 9 of 36, 25% recall at 90% precision. On 33 Anthropic Interviewer scientist transcripts it names 9 people at 82% precision; Li previously recovered 6 of 24 with task decomposition. Cost is $1 to $4 per profile.
Closed-world Hacker News to LinkedIn, 987 queries against about 89,000 candidates:
| Method | Recall @ 90% prec. | Recall @ 99% prec. |
| Narayanan baseline | 0.1% | 0.1% |
| Search only | 26.3% | 4.4% |
| Reason (GPT-5.2 high) | 54.2% | 45.1% |
At a 1k-candidate pool, Reason hits 68.3% recall at 90% precision, which is the "up to 68%" in the abstract. At 89k it still holds 55.2%. A log-linear fit projects about 45% at 1 million candidates and 27% at 100 million.
Cross-community Reddit movie matching is harder. With 9,781 queries and 2.5 shared titles on average, high-reasoning GPT-5.2 gets 8.5% recall at 90% precision and 2.8% at 99%. One shared movie: 3.1%. Ten or more: 48.1%. The cleanest large-scale number is a temporal split of Reddit (5,000 queries, 10,000 candidates, a one-year gap): the full pipeline reaches 67.3% recall at 90% precision and 38.4% at 99%, against 0.4% and 0.2% for the classical baseline. Extrapolated to a million candidates, recall at 90% precision is still about 35%. Even if only one in 10,000 queries has a true match, recall stays near 9%.
Anyone posting under a persistent handle should treat each extra scrap of micro-data as linkable. Platforms that dump public archives or leave APIs wide open are now exposing an automated matching surface, not only search-indexable text. Safety refusals on "deanonymize this user" do little, because the pipeline is summarization, retrieval, and ranking.
This is a cost shift, not a new class of signal. A human investigator would use the same tells. The model just does it for a few dollars.
Ground truth comes from users who already linked accounts, then had identifiers stripped. Recall is likely optimistic; those people were not trying to stay anonymous. Community and time splits are not the same as a real alt account. The million- and hundred-million-scale numbers are a log-linear fit; the paper flags large error bars. The 9-of-33 Interviewer figure is human-judged, and two of the agent's 11 claims contradicted the transcript. Hacker News and Reddit almost certainly sat in pretraining, so memorization may help; raising reasoning effort still lifts results, which argues it is not all memorization, but the two cannot be separated. Code and processed data are withheld.