LLMs and the cost of staying anonymous

There is a comforting assumption behind a lot of pseudonymous posting: nobody is going to read five years of your comments to work out who you are. The information might be there, scattered between technical answers and arguments about films, but assembling it would take effort. Surely somebody has better things to do.

That last part is becoming a weaker privacy control.

Large-scale online deanonymization with LLMs, by Simon Lermen and colleagues, studies how language models change the cost of connecting online identities. The authors evaluate both agents searching the web and a more controlled system for matching profiles across datasets. I read the linked arXiv version alongside the later USENIX Security 2026 paper.

My reading is that this is a serious result about the economics of privacy. It is much less useful as a claim that every anonymous account can now be identified. The experiments are specific, and some of their assumptions matter a great deal.

The information is in the ordinary details

A pseudonym replaces your name with another label. It does not necessarily remove the connections between what you write and the rest of your life.

Think of a hypothetical account that mentions a career change, an old university project, and a move between countries. Each detail could describe many people. Together, and compared with information elsewhere, they might narrow the possibilities considerably. No single comment needs to contain a name or an email address.

The paper calls these pieces of information micro-data. Its central move is to extract useful details from messy prose and compare them across profiles. That makes ordinary language part of the matching problem, rather than requiring everyone to have filled in the same structured form. Sections 3 and 4 describe this setup.

There are also two different privacy failures here. Linking an account to a real person exposes an identity. Linking two pseudonymous accounts can expose a connection between activities without finding a real name at all. I would care about both. A person can have good reasons to keep a professional discussion separate from a support community.

For developers, this means deleting the name field is an incomplete test. You also have to consider what the remaining content reveals when somebody reads it alongside other data.

A familiar software pipeline, with an uncomfortable purpose

The controlled framework has four stages: extract, search, reason, and calibrate. In broad terms, a model summarises relevant details, embeddings narrow the candidate pool, another model evaluates plausible matches, and a confidence threshold determines whether to return a match or abstain. The authors describe this in Section 3.2.

If you build retrieval systems, the architecture will look familiar. Expensive reasoning is applied after cheaper retrieval has reduced the amount of material to inspect. The privacy implication comes from what the system is trying to retrieve.

The distinction between retrieval and verification matters. Two profiles can be close in embedding space because they discuss the same subject. That is not enough to establish that they belong to the same person. The paper measures a substantial improvement from adding a reasoning stage to embedding search in the professional-profile experiment.

I would also be careful with the word "calibrate" here. The experiments use scores or rankings to control which guesses are accepted and then measure precision and recall. That does not make an arbitrary model-generated confidence value a trustworthy probability about an individual. A polished explanation of a match can still be wrong.

Read the denominator before the headline

Precision asks how many returned matches are correct. Recall asks how many of the matchable people the system successfully matches. Abstaining can improve precision while leaving many people unmatched.

The paper contains several different experiments, so there is no single percentage that means "how anonymous you are."

In the controlled LinkedIn-to-Hacker-News experiment, there are 987 query profiles and about 89,000 candidate HN accounts. Every query has a known match in the candidate pool. The ground truth comes from users who had linked their accounts publicly; direct identifiers are then removed for evaluation.

Here is a shortened version of Table 1. Every percentage in the two numeric columns is recall at the stated precision threshold.

Matching method	Recall at 90% precision	Recall at 99% precision
Adapted classical baseline	0.1%	0.1%
Embedding search	26.3%	4.4%
Search + low-effort reasoning	55.0%	36.0%
Search + high-effort reasoning	54.2%	45.1%

Source: Table 1 in the arXiv paper, also present in the conference PDF, page 1953. I have omitted the intermediate precision threshold and confidence intervals from this display; the source reports a 95% interval of 42.1%-48.2% for the final 45.1% result.

That 45.1% is striking: the system finds almost half of the known matches while keeping the returned set highly precise. But 99% precision does not mean it identifies 99% of users. It describes the correctness of the guesses it chooses to make in this evaluation.

The harder movie-discussion experiment gives a useful counterweight. Across 9,781 Reddit profiles split by community, high-effort reasoning reaches 8.5% recall at 90% precision and 2.8% at 99% precision. Profiles contain extracted movie preferences, and the dataset keeps users with at least one movie title shared across the splits. This is account linkage, not the discovery of thousands of real names. Section 5 and Appendix E give the details.

In a separate temporal experiment, the authors divide Reddit histories into earlier and later profiles with a one-year gap. The strongest method still matches roughly a third of matchable users at 99% precision. That shows persistence of identifying signals across time within this setup; it does not directly test people deliberately maintaining separate identities on unrelated services. See Section 6.

The web agent is a different experiment

The open-web agent starts from an edited profile and searches for the person behind it. In the HN experiment, the authors report correctly identifying 226 of 338 targets, approximately 67% recall, at approximately 90% precision. These targets also come from accounts with previously public identity links. The paper explicitly says the edited profiles are easier to identify than most pseudonymous accounts. Section 2 reports this experiment.

The reported agent run cost is $1-$4 per profile. That is an experimental operating cost, not an all-inclusive price for obtaining a correct identity. It excludes the idea that every attempt succeeds, and it should not quietly become a current API price quote. Still, a few dollars per attempt is a different constraint from paying somebody to spend hours investigating each account.

The Anthropic Interviewer example is more uncomfortable. The authors examine 33 scientist interviews selected from a collection of 125 because the participants discussed past research. They judge nine proposed identifications correct and two incorrect; the remaining 22 produce refusals or abstentions. Those matches rely on human assessment, and the authors acknowledge that the exact accuracy cannot be fully verified. The same section explains this limitation.

I would not turn that into a clean benchmark of all interview participants. I would take it seriously as a reason to review what a transcript reveals beyond the fields explicitly redacted.

Where I would resist the strongest claims

The biggest limitation is selection. Someone who already links a forum account to LinkedIn may write differently from someone actively protecting an identity. Removing the link afterwards does not recreate years of privacy-conscious behaviour. Likewise, splitting one person's history gives reliable labels, but it does not fully reproduce two deliberately separate accounts. The authors acknowledge both problems in their discussion.

Candidate pools matter too. Most of the controlled headline results assume the correct match exists somewhere in the supplied pool. In a real deployment, it might not. The paper separately studies missing matches and larger pools, but its million-user and hundred-million-user estimates are extrapolations beyond the measured pool sizes. A dotted line on a plot is not another experiment.

There is a related statistical trap: high precision in one population does not automatically transfer to a population where genuine matches are much rarer. Even a small rate of false identifications can dominate when most queries have no answer. I would want that deployment-specific evaluation before treating the output as evidence about anyone.

The baseline also deserves a precise description. The paper compares against adaptations of a classical deanonymization method, including hand-selected attributes and movie-rating features. Beating those baselines is informative. It is not a comprehensive tournament against every possible non-LLM identity-linkage system.

Finally, training-data contamination remains unresolved. The authors discuss whether the models may have memorised some public material. Better performance with additional reasoning is evidence that the processing matters, but I would not treat it as proof that memorisation contributes nothing. The privacy risk exists either way; the uncertainty affects how confidently we generalise to new data.

Those caveats narrow the claim. They do not make the observed matches disappear.

What I would change when publishing user data

For a team releasing interviews, support transcripts, or community data, I would make the unit of review the whole person's contribution. Checking each sentence independently can miss a combination of details that only becomes distinctive across several paragraphs.

I would start by asking what the recipient actually needs. If an analysis only needs broad themes, publishing raw individual narratives creates an extra exposure that needs its own justification. Where examples are necessary, I would examine whether a less specific description preserves the useful point. These are choices to evaluate, not a guarantee that editing makes a dataset anonymous.

I would also test the release against realistic outside information in an authorised privacy review. Names and email addresses are obvious checks. Whether the remaining narrative can be linked to an individual is a separate question. A redaction report with zero remaining email addresses does not answer it.

Platforms have a role here. The paper suggests restricting bulk access, detecting scraping, and monitoring misuse of model services as possible mitigations. It also notes that many components resemble ordinary summarisation and search, which makes enforcement difficult. I would treat those controls as ways to raise the cost of abuse, with effectiveness that needs measurement. Section 8 discusses the options.

For an individual, a separate username can still keep contexts apart in everyday use. I would simply stop treating the username alone as a promise about what a motivated reader can connect. That is a more useful conclusion than telling everyone to stop talking online.

A project worth building from this

The engineering direction that interests me is a defensive review tool for material its owner intends to publish. Give it an authorised draft or an opt-in collection of posts, and ask which passages create unnecessary disclosure. Keep the review local where possible; uploading the entire archive to another service should be an explicit design decision.

I would start with synthetic people and consenting contributors, compare several redaction approaches, and measure how much useful content survives alongside residual linkage risk in a controlled benchmark. The output should point to passages a human can revise, with reasons and uncertainty. A numerical "anonymity score" would be easy to put on the screen and much harder to justify.

This would be a proposed experiment, not a defence validated by the paper. The difficult question is whether it helps people share something useful with less exposure, without reassuring them beyond what the evaluation supports.

That is what stays with me after reading this work. We have spent a lot of time making software better at finding connections in text. Some of those connections are exactly what the person writing the text hoped would remain difficult to find.

Source: Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, and Florian Tramèr, Large-scale online deanonymization with LLMs, arXiv v2, available under CC BY 4.0. This article paraphrases and comments on the work; the table is a shortened presentation of reported results. The USENIX proceedings version provides a further source. I have not independently reproduced the experiments.