01
Paper Club Hyderabad · arXiv:2602.16800v2 · 12-minute talk

Can an AI identify you
from anonymous posts?

“I study CS at Stanford, moved from Portland, and walk my dog Biscuit in San Francisco.”

Each detail seems harmless. Together, they may identify one person.

Deanonymization — matching an anonymous account to a real person, or to another account of the same person.

Presented by Sriram KidambiLermen et al.MATS · ETH Zürich · Anthropic9 slides · 12 minutes
Based on: Simon Lermen et al., Large-scale online deanonymization with LLMs, arXiv:2602.16800v2.
02
Foundations · 1 of 3

Deanonymization is a matching problem

Query profile

The account to link

For example, a pseudonymous profile built from a person’s posts.

Candidate pool

Possible matches

A large list of profiles that may — or may not — contain the same person.

Decision

Match or abstain

Return a candidate only if the evidence is strong enough; otherwise say “no decision.”

Precision — “When it names someone, how often is it right?”
Recall — “Out of all matchable people, how many does it find?”
Paper §3.1–3.3. Abstention is central: a system that never says “no decision” can look useful while producing harmful false identifications.
03
Foundations · 2 of 3

Why LLMs change the game — and why now

Earlier approaches

Structured data or human labor

Classical attacks matched tidy records — ratings, ZIP codes, dates. Rich text demanded a skilled investigator and hours per target.

Example: the Netflix Prize ↔ IMDb linkage attack.

With LLMs

Messy text becomes matchable

Models can read arbitrary, messy forum text, collect the clues, and compare profiles automatically — for many targets at once.

The authors estimate $1–$4 per open-web agent run in their experiment.

The discontinuity is economics and scale, more than superhuman inference.
Paper §§1–2. “Practical obscurity” — public but too costly to combine — is the barrier LLMs are eroding.
04
Foundations · 3 of 3

From posts to “micro-data”

Unstructured text

“Struggling with CS224N at Stanford this quarter. Senior year is brutal 😫”

Illustrative example, inspired by the paper’s running example.

“Walking Biscuit through Dolores Park missing Portland rain today 🌧”

Micro-data extracted from it

• approximate location history — Stanford, SF

• occupation and education — CS senior, ~22

• recurring interests — dog named “Biscuit”

• writing style or incidental details — Portland roots

A single trace may be common. A collection of traces can become distinctive enough to match.
“Micro-data” follows the terminology of Narayanan and Shmatikov; paper §§1 and 3.1.
05
The research question

What question does the paper ask?

“Can LLMs re-identify pseudonymous people online, accurately and at scale?”
1

Anonymous account → real-world identity

“Who is the person behind this pseudonym?”

2

Known identity → their anonymous account

“Does this person secretly post under another name?”

3

Anonymous account → another account

“Are these two pseudonyms the same person?”

Why three cases? They capture distinct threats — doxxing an account, a stalker targeting a person, consolidating one user’s activity — and pose different technical challenges.
Paper §1; each setting is evaluated separately in §§2–5.
06
The core idea

The ESRC pipeline: posts → clues → possible people → checked match

The paper’s method — each stage done automatically by an LLM.

Posts
raw online text
→
Clues
location, job, hobbies, writing style
→
Possible people
a shortlist from a huge pool
→
Checked match
… or “I don’t know”
Extract
The LLM turns posts into clues — location, job, hobbies, writing details.
Search
Finds the most similar profiles from a very large list.
Reason
Checks whether the clues truly fit together before trusting them.
Calibrate
Only makes a guess when confidence is high; otherwise it abstains.
Search, in plain terms: like finding the most similar description in a very large digital filing cabinet — no embedding math needed to get the idea.
Paper Fig. 2 and §3.2. ESRC = Extract, Search, Reason, Calibrate.
07
How they tested it

Tests with known ground truth — with a realism trade-off

Precision–recall curve: Search + Reason far outperforms Search and the classical baseline
Paper Fig. 3a: the HN ↔ LinkedIn precision–recall curve. Baseline (red) collapses; Search (green) helps; Search + Reason (blue) holds near-100% precision far longer.

Three settings, known answers

Hacker News ↔ LinkedIn: profiles that publicly link both accounts, matched across platforms.

Reddit movie communities: 9,781 users matched across r/movies and five specialist communities.

Reddit split in time: one user’s history split into “earlier” and “later” halves, treated as two pseudonymous profiles.

Trade-off: they removed obvious identifiers before testing, then checked whether the system recovered the correct link. Safe and measurable — but these users may share more identifying information than a genuinely privacy-conscious person.
Paper §3.1–3.3 and §5. Ground truth comes from self-linked accounts or from splitting one user’s activity.
08
Results

What the full pipeline achieves

68%
recall at 90% precision — the best LLM-pipeline result across all settings. Many true matches, most guesses correct.
0.1% → 45.1%
recall at 99% precision on HN ↔ LinkedIn — after the full LLM pipeline, vs 0.1% for the classical baseline.
8.5%
recall at 90% precision on Reddit movie communities — thin content, much harder than professional profiles.
Bar chart: recall rises sharply with the number of shared movies
Paper Fig. 4b: recall rises sharply with shared content — 3.1% at one shared movie → 48.1% at 10+.
What the curve says: the more a user’s two accounts overlap — movies, interests, activity — the more linkable they become. Even mundane preferences accumulate into a fingerprint. Precision and recall are reported together because a wrong identification is not a benign failure.
Paper abstract, §2.1, Table 1, Fig. 4b. Recall is always reported at a fixed, very high precision target.
09
Limits, ethics, and the point

A balanced view — and the one clear point

Limits of the evaluation

  • The test datasets can make the task easier than real-world anonymity — these users may have shared more identifying information than most.
  • It is hard to know how much LLM training-data memorization contributed.
  • Measured on a constructed setting; may not generalize to genuinely privacy-conscious users.

Why the stakes are high

  • Wrong matches can seriously harm people — a confident but incorrect identification is not a benign failure.
  • Risks are especially high for activists, journalists, abuse survivors, and whistleblowers.
  • Lowered cost means the risk scales with automation, not just intent.
LLMs can turn the small clues in normal online posts into identity matches — at a much lower cost than before.
Paper §§2.1, 6.4, 8. The paper is a measurement of a privacy risk, not a how-to; the authors deliberately withhold operational details. Discussion: if anyone can run this pipeline, what should platforms, researchers, and users change?