You Thought You Were Anonymous: That’s a Puzzle AI Can Now Solve in Seconds

It turns out that for years we’ve been living in a fool’s paradise: using a pseudonym was more or less equivalent to being safe. Not because what we published was invisible, but because connecting scattered pieces of information required time, patience, skill, and, above all, a clear incentive. Not anymore.

This layer of protection has been called “practical darkness” by the literature: it’s not about nobody knowing who you are, it’s that finding out is expensive and time-consuming. The problem is that when a technology comes along that makes it cheap and quick, that obscurity is exposed. And that is precisely what Simon Lermen and Daniel Paleka show in their recent work on large-scale deanonymization with LLMs.

The central idea of their study is as simple as it is disturbing: with access to the internet, an LLM-based agent can take a pseudonymous profile, read what they have written, extract identity signals (places, hobbies, professional jargon, events, life and career events), look for plausible candidates and through a process of elimination arrive at a probable identity. Essentially, it automates what a human researcher used to do, but on an industrial scale and at a ridiculously low cost. The summary of the work makes the paradigm shift clear: there is no need for structured data or artisanal engineering of attributes, just normal text written by normal people in forums and networks.

To measure something like this without falling into the ethical trap of doxxing half the internet, Lerman and Paleka construct several scenarios with “controlled truth”. For one, they link Hacker News users to LinkedIn profiles using cross-references that appear on the profiles (and then remove those references so the system doesn’t cheat). They then test the pairing between film discussion communities on Reddit, and also a particularly interesting experiment: dividing the history of the same Reddit user into two “identities” separated in time to see if the system is able to conclude that, in fact, it is the same person. In such environments, LLM-based methods far outperform “classical” approaches, reaching figures that, while not perfect, are more than enough to cause harm: the paper itself reports results of up to 68% recall, with 90% accuracy in some of the scenarios.

What should keep us up at night about this extrapolation. In his informative explanation, Lermen insists that performance “degrades gracefully” when the pool of candidates grows to tens of thousands and that, with enough computation, the target scale could be “full platform.” They even show scaling analyses and extrapolations to huge population sizes. And, as is always the case, the cost tends to go down while the quality of the models tends to go up. It’s the perfect combination for a technique to go from “interesting” to “inevitable”.

Anybody who thinks that this is just about “getting your online nickname discovered”, should also think about the consequences. The first is obvious: doxxing is no longer the reserve of a few obsessives, and instead becomes an automatable workflow. The second is more dangerous: social engineering becomes surgical. As soon as someone can link your pseudonymous account to your real identity, they can build attacks that rely on contextual trust, your links, and your habits. Deanonymization isn’t the end of the attack, it’s the reconnaissance phase of phishing, extortion, harassment and manipulation. The study itself explicitly connects it to malicious use in spear-phishing campaigns, and journalistic coverage lands it in scenarios of surveillance of dissidents and activists.

The third consequence is perhaps the most toxic: the “chill effect”. If publishing under a pseudonym is no longer a reasonable option, the public conversation is impoverished. We are not talking about trolls: we are talking about whistleblowers, victims of violence, persecuted minorities, professionals who need to separate work identity from personal identity, or simple citizens who do not want every opinion to become ammunition for the future. And here an uncomfortable tension intersects: many of the typical defenses against large-scale manipulation (reinforced verification, more traceability, less friction to identify) are the exact opposite of what those who depend on the pseudonym need to survive. Just look at the growing debate about swarms of agents that could flood social media to influence and harass, and how mitigation proposals often clash with the legitimate need for anonymity in political contexts.

However, it is important not to fall into naïve technological determinism: these systems are also wrong. And that detail matters, because error in this context is not “a sympathetic failure,” but a potentially devastating accusation. The Guardian’s coverage reflects precisely the concern about false positives: models that link badly and end up misidentifying. In a polarized world, where reputation is destroyed faster than it is repaired, that possibility should set off all the alarms.

What can be done? The most honest answer is that there is no silver bullet, and part of the problem is structural. Lermen himself expresses it clearly: the most effective mitigation in the short term is to restrict access to data, impose rate limits, detect automated scraping, and limit mass exports. And, above all, to assume that pseudonym is linkable and to design policies as if that linkability were the norm, not the exception. But even that has cracks. Model vendors may try to put security measures in place and monitor usages, yes, but the study describes a fundamental problem: the attack breaks down into “innocent” tasks (summarizing, vectorizing, ordering candidates, reasoning about options) that are indistinguishable from legitimate uses. And, of course, the elephant in the room: open source models without monitoring, without controls, without limits. The moment the workflow is described, anyone with motivation can replicate it where no one is watching.

In addition, there is an angle that we tend to ignore until it is too late: deanonymization does not need to violate systems, only to correlate signals. It is an attack that feeds on excessive exposure and perverse platform incentives. And that brings us back to a discussion we’ve been putting off for too long: what “anonymous data” actually means in 2026. If a seemingly inoffensive text can be as powerful an identifier as an ID card, then a good part of our publication, research, transparency and open data practices need a thorough overhaul. Not from fear, but from the evidence that the technological context has changed.

On an individual level, the recommendation is not to “disappear from the internet”, an impracticable fantasy, and instead to understand that identity is a puzzle, and that each specific piece, from the city to the company, through the conference, the strange hobby, the recognizable routine or the writing style, reduces the space of possibilities until it becomes a single point. If before that point was difficult to calculate, now there are machines that calculate it by default. And the awkward question posed by the author himself is the right one: if a team of clever researchers could deduce who you are from your posts, an agent with LLM probably could too, only cheaper and faster.

The most provocative consequence of all this is that online anonymity, as we understand it, is now perhaps a technical privilege, not a practical right. And before we say “great, because it shouldn’t exist”, let’s think about the wider implications. I truly believe anonymity is and should be a fundamental right. A right I never use, but that I believe is important to always have as an option. But now, exercising it is going to require constant discipline, almost paranoid compartmentalization; and luck. And when a basic condition for safe participation online becomes a specialized skill, what is at stake is no longer individual privacy: it is the quality of democracy, freedom of expression, and the need for dissent. If we don’t react, it’s not just the performance of the attack that is going to be degraded “gracefully”: it’s the public conversation.

—

This post was previously published on Enrique Dans’ blog.

***