The Internet’s Small Clues Have Become an Identity Map

Pseudonymity used to mean making the detective work annoying. AI has other plans.

By Ken MaconSeptember 30, 2026Share

More than half of 987 pseudonymous users of the news and discussion website Hacker News had their identities revealed in an experiment conducted by a team of six researchers, who used AI for the task. And the cost? A mere $2,000, between $1 and $4 per profile.

The deanonymization was done by matching what the users had written about themselves across the two platforms, one of which, LinkedIn, contains real names and other identifying information. The researchers were able to grade their own experiment because they only used accounts of people who had included a link to their LinkedIn profile in their Hacker News bio.

The 987 profiles were first stripped of personal website and blog links, social media handles, and GitHub names, and then put into a pool of 89,000 Hacker News users. The AI pipeline, trained on a large language model, was then able to match more than 55% of the profiles at a 90% precision, and 45.1% at 99%.

To put this into perspective, the best previous deanonymization method, a statistical attack that in 2008 broke the Netflix Prize dataset, managed 0.1% on the same data at both precision settings.

The researchers behind the paper, "Large-Scale Online Deanonymization with LLMs" - Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, and Florian Tramer - note that the data used in their study was publicly available and that the deanonymization was done without hacking into any database or stealing any data, the input was simply text that people had chosen to publish online.

The experiment worked by analyzing what users had disclosed about themselves across the two platforms, and it was done at a cost of a couple of thousand dollars.

"Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered," the paper states.

The rules the authors wrote to ensure their test was fair are a good starting point to understanding what can be done with this type of AI, and how it works. To avoid skewing the results in favor of their own success, the researchers decided to strip some data from each profile before running it through the language model.

The categories were to remove entirely, to generalize, or to keep as-is. In the first category were personal website and blog URLs, social media handles, and GitHub repository names and handles. The reason to remove them, the paper explains, is that these are "any identifier where searching online directly reveals the profile owner."

In the "generalize" category, the researchers decided to replace unique project names with more general ones, for example, "Founder of <specific programming community>" becomes "Founded a programming community." But it's the third category - the data that was left intact - that reveals how the AI model works, and why it can be so dangerous. The researchers decided to keep "colleague names (searching finds them, not the profile owner), local business names (searching finds the business, not its patrons), institution names, locations, demographics, interests, and technical skills."

The name of a local coffee shop, for example, is not in and of itself identifying, because searching for it will reveal the business, not its patrons. But add to that the name of a colleague, a location, a hobby, and a skill - and you may be looking at a unique person.

As the paper notes, this is not a new problem. For example, it references Sweeney's study that showed that 87 percent of the US population can be identified by combining their zip code, birth date, and gender. And it takes only four spatiotemporal points, the paper continues, to pinpoint 95 percent of individuals in mobile phone datasets. But there is a reason why this information has not been weaponized on a large scale until now. "Applying such attacks in practice has required structured data amenable to algorithmic matching or substantial manual effort by skilled investigators reserved for high-value targets," the paper said.

That is no longer the case. What has changed is the amount of manual labor required to put the pieces together. And AI models can now do it.

In short, something reads your comments, posts, and bio on Reddit, and writes a short biography of you. This is done by an AI, and the same is done to your LinkedIn profile, where your job titles and graduation dates are of interest. This is how you are turned into a short, AI-written biography, and this is how 89,000 other people are turned into the same.

All these biographies are then turned into numerical vectors. This is done to be able to compare them all at once. And they are compared to the vector of the query biography, in this case, the one built from a person's Reddit activity. The tool for this is called Gemini embeddings, and the index is built using FAISS, with the comparison done by cosine similarity. The result is a shortlist of the top 100 most similar candidates.

The search stage finds people who sound similar, and the reasoning stage decides which one is the same person. This is done by Grok 4.1 Fast, which picks the most likely match from the 100, or declines to do so. If a candidate is selected, GPT-5.2 examines that single pair closely. This is done to save on costs, as running the more expensive model on one instead of 100 candidates makes the whole process cheap enough to be practical.

This two-stage approach is there because the initial search is good at weeding out a large number of candidates, but not as good at ranking those that are left, so the correct match "will often not be ranked first." The example given in the paper is that of a movie: the selection stage looks only at reviews where the title appears in both profiles, and the verification stage reads both profiles in full. And when two halves of the same Reddit user were compared, they shared an average of 2.5 film titles.

The system is allowed to abstain from making a match, and this is what keeps its precision high. The operator can choose how often to be wrong by setting a threshold on the confidence score that the verifying model returns.

The study worked with a test group of 9,781 Reddit users who had posted in r/movies and at least one of five smaller film communities during 2024.

The posts in r/movies were treated as the "anonymous" side of each user, while those in the other communities - such as r/horror and r/MovieSuggestions - were seen as the "known" side.

The researchers then created a ladder of identification, depending on how many film titles a user had shared between their two halves.

At the 90% correct identification setting, 4,729 users who shared only one film between the two accounts were identified as the same person 3.1% of the time, while those who shared 10 or more titles were identified 48.1% of the time - and there were only 241 such users. But once you start posting more, your uniqueness and therefore identifiability increases, the study found. The data also showed that 48% of users shared only a single movie, and that on average, a user shared 2.5 film titles across both their "anonymous" and "known" accounts. And at the setting where the system was right 99% of the time, the ladder ran from 1.2% to 17.0%.

What is particularly striking is the difference in the number of users who shared only one film title, and those who shared ten or more - 4,729 versus 241 - and it is the latter group that gets identified.

What the study reveals is that the more you post, the more you are at risk of being "unmasked" - and all of this was achieved by looking at data as seemingly innocuous as people's opinions about films.

The candidate pool grows from 1,000 people to 89,000. And the reasoning pipeline the researchers used to identify people found on the web and matched with their Reddit accounts fell from 68.3% to 55.2% at the nine-in-ten setting.

The paper calls that "a loss of only 13 percentage points across nearly two orders of magnitude." Extrapolating that, it projects roughly 45% at a million candidates, and estimates the method "would still retain an estimated 27% recall" at a hundred million, a pool the size of a platform.

That same growth, from 1,000 to 89,000, breaks the older method: embedding search alone fell from 47.6% to 26.6%, and at the strictest setting it "collapses to 4.2%" while the reasoning pipeline still managed 33.0%. The other finding of the paper is that the pipeline was tested on the case where almost nobody in the pool is the person being looked for. The method can "achieve a recall of at least 9% at 90% precision-even if the probability of a query having any match is only one in 10,000."

A search that is mostly going to come up empty still finds nearly one in ten of the people it is looking for. Rarity is not cover.

An agent with a web search tool was pointed at 25 Reddit users posting in academic communities, and "it identifies 13 of 25 (52%) with 72% precision (5 incorrect, 7 abstentions)".

The idea of a large language model (LLM) safety filter that would protect users from having their identity revealed to the AI by cross referencing data from different sites is a weak one, according to a paper presented at the Privacy Enhancing Technologies Symposium (PETS).

One of the authors, Benedikt Lermen, said in a blog post that the team behind the paper was "pessimistic" that tech companies behind the AI models could actually prevent this from happening. The reason is that the "attack" is broken down into seemingly normal requests that individually look like regular usage and are therefore hard to detect.

Lermen explained that summarizing a profile is a normal request, as is comparing two documents. "However, when combined, these requests can reveal sensitive information about individuals," he wrote.

The framework, as he calls it, works by "splitting an attack into seemingly benign tasks - summarizing profiles, computing embeddings, ranking candidates - that individually look like normal usage, making misuse hard to detect."

Lermen also noted that the AI models can be instructed to refuse to help with certain tasks, but this can be bypassed by slightly rewording the prompt. And, "none of these mitigations apply to open-source models, where safety guardrails can be removed and there is no usage monitoring at all."

The only way to mitigate this type of attack, according to the paper, is for platforms like Reddit and Hacker News to limit access to their data.

Governments could link pseudonymous accounts to real identities for surveillance of dissidents, journalists, or activists. That's one of the conclusions of a new paper that studied the ability of large language models (LLMs) to de-anonymize users on the internet, and the ways in which they can do it.

The study's results are summed up: "Pseudonymity does not provide meaningful protection online." And users who post under persistent usernames "should assume that adversaries can link their accounts to real identities or to each other, and that the probability rises with each piece of micro-data they post."

The study's authors note that their findings are not surprising, but the scale at which this can be done is. And they stress that the accounts they used in their research "may still share more information than they would for truly pseudonymous accounts, even considering our anonymization step."

The authors withhold the means of replicating the study, saying, "We do not release our matching pipeline code or processed datasets."

That's because, as one of the researchers, Simon Lermen, explained, "each piece of specific information you share - your city, your job, a conference you attended, a niche hobby - narrows down who you could be. The combination is often a unique fingerprint."

The research has a significant implication for the current push to introduce digital ID and online age verification: every time these schemes are sold to the public, the promise is that identity will be verified once and then the user will be able to remain anonymous. But this study shows that if a person can be identified by the content they post, then digital ID and online age verification only add a confirmed name to the profile that can be built from what a person has already posted.

So, as Lermen put it, "ask yourself: could a team of smart investigators figure out who you are from your posts? If yes, LLM agents can likely do the same, and the cost of doing so is only going down."