Paper club · 10–12 minutes · two whiteboards
Can AI identify people from anonymous posts?
A short outline of the paper: what changed, how the ESRC system works, what it found, and why it matters.
Anonymous post + many small clues = possible identity match
What is deanonymization?
It means either finding the person behind an anonymous account, or linking two anonymous accounts that belong to the same person.
Account → person
Who is behind this username?
Person → account
Does this known person use an anonymous account?
Account → account
Are these two usernames the same person?
Identity micro-data: small facts about one person
Micro-data is any small piece of information about a person: where they live, what they study, a movie they rated, a dog’s name, or a habit in their writing. One fact is often common. A combination can be rare enough to identify someone.
Life details
Place, age range, school, job, family, or a past move.
Behaviour and taste
Movies, hobbies, communities, posting times, or repeated interests.
Writing traces
Spelling, phrasing, language, or other small habits in how someone writes.
Query profile
The anonymous account to link. Its posts are turned into micro-data.
Candidate pool
A large group of possible people or accounts. The system returns a match only when the evidence is strong enough; otherwise it abstains.
The Netflix Prize attack: the old version
In the famous Netflix Prize attack, researchers linked anonymous Netflix ratings to public IMDb ratings. A few unusual movie ratings, plus their dates, could be enough to match a person.
What it needed
Structured data: neat records that computers can compare easily, such as star ratings, dates, and ZIP codes.
What LLMs change
Raw text: ordinary posts and comments can now be turned into comparable clues. The main change is cost and scale, not magic.
ESRC: Extract, Search, Reason, Calibrate
The paper extends the old matching idea to messy online text. This is the main technical contribution.
Extract
Use an LLM to turn posts into a short profile of useful clues: location, school, work, interests, age hints, or writing habits.
Search
Use those profiles to find a small set of likely matches from a large candidate group.
Reason
Ask an LLM to compare the shortlist carefully: which details match, and which details disagree?
Calibrate
Use a confidence score. Make a guess only above a chosen bar; otherwise abstain.
Two numbers: correct guesses and links found
Precision
When it makes a match, how often is it right? 90% precision means about 90 correct matches for every 100 guesses.
Recall
Out of all real matches in the test, how many did it find? 68% recall means it found 68 out of 100 real links.
Three tests with known answers
Hacker News ↔ LinkedIn
Accounts that people had publicly connected across the two sites.
Reddit movie groups
The same people, matched across r/movies and specialist movie communities.
Earlier ↔ later Reddit
One user’s post history split into two time periods and treated as separate accounts.
Important limit: known-answer test sets may be easier than the hardest real-world cases. These users may have shared more identifying information than people who actively protect their privacy.
LLM-based matching did much better than the old baseline
Best result: recall at 90% precision. At roughly 90 correct guesses out of 100, the system found up to 68 out of 100 real links.
Hacker News ↔ LinkedIn
At 99% precision, recall rose from 0.1% for the Netflix-style baseline to 45.1% with the full LLM pipeline.
Reddit movie groups
Harder because the content was thinner: 8.5% recall at 90% precision.
The pattern is simple: the more overlap two accounts have — shared interests, places, or life details — the easier they are to link.
Why this is a privacy problem
False matches hurt
A confident but wrong identification is not a small mistake.
Some people need anonymity
Journalists, activists, whistleblowers, and abuse survivors may need it for safety.
Automation changes reach
Work that once took a skilled person hours can be repeated much more cheaply.
Takeaway: an anonymous username is not a full shield. The risk is often not one secret detail; it is many normal details joined together.