Large-scale online deanonymization with LLMs

2026-03-28 20:02 UTC

Paper by, Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, Florian Tramèr It talks about deanonymizing those who writes under a pseudonym. Sites like reddit, lemmy would be that type. From the paper, Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives. Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered. They can match writing styles, interests, details to infer a job or city, or other unstructured information. That allows to match unrelated pseudonyms to the same person. Like, FooFighterGroupie and Yolanda43905 are the same human, despite they never said it. It can allow also, to match a pseudonym to a real identity across sites. Like someone posted on LinkedIn with a real name. It takes less info than most people expect, to figure out Julia Greenberg of Cedarville, NH is FooFighterGroupie. You can protect yourself by never giving away much info. But ofc sometimes that’s the whole point! Think talking about specific hobbies or w/e, gives away info. Also change up writing styles + vocab use, b/c it is a unique fingerprint. I doubt this technique is used in a dragnet way… YET! But no reason it can’t scale, if the cost of resources goes low eonugh. We could eventually see it become standard, analysis to link people across sites and identities.

Replies (8)

@corvus@lemmy.ml 2026-03-28 21:09

So it seems that letting LLMs to write sloppy posts for us can be useful after all. May be c/privacy should implement an automatic AI reformating XD

Open ##1284778
@PolarKraken@lemmy.dbzer0.com 2026-03-28 20:33

I've been expecting to hear of something like this, it's a natural evolution of LLM use cases and grimly inevitable.

Open ##1284779
@Zacryon@feddit.org 2026-03-29 01:47

As if we need more lessons in how cautious we should be with what we're putting on the internet. What has been true 20 years ago hasn't changed.

Open ##1284781
@Bloefz@lemmy.world 2026-03-29 10:28

Yes I've been worried about exactly this. I'm sure it's very much within the realm of possibility these days.

Open ##1284783
@The1TruePower@lemmy.myserv.one 2026-04-03 15:09

The corruption and rape of our digital freedom only sucks the life out of the internet. Eventually it will die. At some point the only way to avoid AI, algorithmic manipulation, and the like will be to live a life completely offline. That's what the powers that be will push people to. I have hope that these shitty evil practices aren't sustainable and the whole thing will collapse.

Open ##1284786
@racoon@lemmy.ml 2026-03-29 13:33

Do Throwaway accounts with no more than 6 months or 100 comments

Open ##1284790
@irmadlad@lemmy.world 2026-03-31 19:12

>You can protect yourself by never giving away much info. Which is why you should silo all online accounts and avoid linking them together.

Open ##1284791
@grey_maniac@lemmy.ca 2026-03-28 20:49

Definitely! I recall seeing you at the Lodge meetings.

Open ##1284792