Researchers from ETH Zurich, the AI safety research organization MATS, and Anthropic have developed an automated LLM pipeline that can link anonymous posts to real-world identities. The pipeline identified the real identities of hundreds of Hacker News users at a cost as low as $1 per person and with 90% precision.
This paper, published in February, went viral again this week on X and Reddit.
The paper is titled "Large-scale online deanonymization with LLMs" and was first published on arXiv on February 18, then included in the proceedings of the 35th USENIX Security Symposium.
The authors are Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, and Florian Tramèr. Carlini works at Anthropic, the developer of Claude, and the remaining authors are affiliated with ETH Zurich and MATS, respectively.
Four stages: narrowing 89,000 candidates down to a shortlist
The entire process involves no data theft or server intrusion. The agent reads public content that anyone can already see, then works like an extremely patient investigator—only cheaper and faster.
The researchers broke the attack down into four stages, named Extract, Search, Reason, and Calibrate. First, the language model extracts identity clues from raw posts, such as traces of a profession, location, or some distinctive phrasing habit.
Then, semantic embeddings reduce a large pool of up to 89,000 candidates to a shortlist. The reasoning model scores the best matches and determines whether two accounts belong to the same person.
The Calibrate step lets the entire pipeline choose to abstain when uncertain, thereby reducing false positives.
The pipeline runs on off-the-shelf tools: web search, embedding models, and large models such as GPT-5.2. Previous deanonymization attacks, such as the 2008 re-identification of Netflix's anonymous rating data, relied on structured data.
Identifying 226 of 338 Hacker News users with 90% precision
To evaluate the method without endangering real individuals, the team selected 338 Hacker News users whose profiles pointed to LinkedIn pages, each with a known real identity as the answer.
Given only comments and post content, the agent correctly identified 226 people, a hit rate of about 67% at 90% precision. It made 25 incorrect identifications and chose to abstain on 86 accounts.
In the paper's larger-scale matching tests, traditional non-LLM baseline methods had accuracy close to zero. The total cost of all experiments was less than $2,000, which works out to only $1 to $4 per profile.
Two other datasets were used for validation: one matching Reddit users across two different movie communities, and another splitting a single Reddit user's history into two time periods and then attempting to stitch it back together. In every test, the LLM method beat older techniques by a wide margin.
The authors list risk scenarios for this kind of capability: governments targeting journalists or activists; companies building increasingly precise advertising profiles; scammers fabricating personal profiles for social engineering scripts.
"The combination of this information often constitutes a unique fingerprint," Lermen wrote in a blog post on February 24. He added that if a team of clever investigators could identify someone from posts alone, then LLM agents can likely do it too, and the cost will only keep falling.
The researchers did not release the code, the prompts, or disclose any of the real identities the system uncovered. The study was reviewed by the ETH Zurich ethics committee before publication.
The paper concludes: "The 'practical obscurity' that protects anonymous users online no longer exists."
A day before the paper reignited discussion, SEC Commissioner Hester Peirce had just warned against large-scale collection of KYC data. Peirce said this practice amounts to "building ever-larger haystacks of data."
Recent data breaches at Revolut and at a supplier related to hardware wallet maker Trezor have intensified concerns about "wrench attacks"—in which someone learns who holds cryptocurrency and then shows up in person to make physical threats.
