LLMs Enable Large-Scale Deanonymization of Online Users, New Research Warns
Key Takeaways
- ▸LLMs can deanonymize online users with 67% accuracy at 90% precision, automating what previously required extensive manual investigation
- ▸The technique works across multiple platforms including Hacker News, Reddit, and LinkedIn by extracting identity signals from unstructured text
- ▸This represents a fundamental shift in online privacy threats, making large-scale deanonymization practical and affordable
Summary
Researchers at MATS Research have published a pre-press paper demonstrating that large language models can effectively automate the deanonymization of internet users, even those using pseudonyms. Led by AI engineer Simon Lermen, the study shows that LLMs can identify individuals from anonymous online posts with unprecedented efficiency and scale. In testing across platforms like Hacker News, Reddit, and LinkedIn, the researchers' LLM-based method correctly identified 226 of 338 targets—a 67 percent success rate at 90 percent precision.
The research builds on Latanya Sweeney's landmark 2002 work on k-Anonymity, which showed that 87 percent of the US population could be identified using just three data points: ZIP code, gender, and date of birth. While such identification has long been theoretically possible, it required significant manual effort to connect unstructured data points. LLMs fundamentally change this equation by automating the extraction of identity-relevant signals from arbitrary text, efficiently searching millions of candidate profiles, and reasoning about whether accounts belong to the same person.
The researchers emphasize that while their technique isn't universally successful, it works often enough to represent a serious privacy threat. The method requires no predefined feature schemas or manual verification—the AI agent can operate autonomously on unstructured text at scale. This represents a qualitative shift in the privacy landscape, as what was once impractical for human investigators becomes routine and affordable through automation. The findings suggest that individuals posting under pseudonymous accounts should not assume their identities will remain protected.
- Pseudonymous posting no longer provides reliable protection against identity discovery when LLMs are employed
Editorial Opinion
This research represents a watershed moment for online privacy, demonstrating that LLMs have fundamentally altered the threat landscape. While deanonymization has always been theoretically possible, the automation and scale enabled by LLMs transforms it from an impractical academic concern into a practical tool that could be deployed by anyone with access to these models. The implications extend far beyond individual privacy to whistleblowers, activists, and anyone relying on pseudonymity for safety—suggesting urgent need for new privacy frameworks designed for the AI era.
