# Large-scale Online Deanonymization with LLMs > [!question] Lingering Questions > - What is the recall against genuinely privacy-conscious users? The authors name this as a selection-bias gap (the 67% flagship figure comes from users who publicly linked LinkedIn — plausibly the least privacy-conscious cohort) and nobody has filled it. > - What post-count threshold crosses into identifiability? That's the number affected users actually need, and the paper doesn't give it. > - Has anyone assessed WordPress community archives (mailing lists, forums, Slack exports) against this threat model? Nobody has, and the corpus is large and permanent. > [!tip] Article Ideas > - "Validation that inspects steps cannot see composition" — the paper's mechanism (an attack assembled from individually benign summarization/search/ranking steps that defeats step-level guardrail filtering) is the exact structural inverse of the WP2Shell chain elsewhere in this vault, where individually valid sub-requests were dispatched to unintended callbacks. Two independent domains, one shape — worth writing up. > [!link] Cross Reference > - [[AI Agent Safety MOC]] — the core finding: cost collapse, not capability increase, is what changed the threat model > - [[Commons & Community Governance MOC]] — public community archives (mailing lists, forums) are exactly the unstructured-text corpus this attack consumes, and no WordPress-adjacent community has assessed its own exposure > [!quote] Vocabulary > - **Practical obscurity** — protection that comes from an attack being too expensive to bother running broadly, rather than from any technical barrier; the paper's central finding is that this has collapsed for deanonymization > - **Micro-data** — individually non-identifying facts ("lives in Texas," "never capitalizes sentences") that identify a person only in combination ## Author's thesis LLM agents can perform end-to-end deanonymization of pseudonymous online accounts at scale using only public models and standard APIs, reaching up to 68% recall at 90% precision where the best non-LLM baseline is near 0%, at $1–4 per profile. The central claim is economic, not technical: LLMs don't exceed human investigator capability, they collapse the *cost* of running the attack broadly — and the authors argue provider-side blocking is unlikely to work, because the attack decomposes into individually benign steps. ## Key arguments (≤3) 1. **The framing is a cost argument**: deanonymization has been theoretically demonstrated for decades (Sweeney's zip/birthdate/gender result, the Netflix Prize attack); what protected pseudonymous accounts was that these attacks needed structured data or a skilled human's hours, reserving them for high-value targets. That constraint is now dissolved. 2. **The ablation isolates the actual mechanism**: at 99% precision, embedding search alone gets 4.4% recall on HN→LinkedIn; adding a reasoning step over candidates takes it to 45.1%. It's reasoning over candidates, not retrieval, doing the work — precisely what classical methods couldn't do. 3. **Defense is pessimistic for a structural reason**: the four-stage pipeline (Extract, Search, Reason, Calibrate) splits into individually benign-looking summarization, search, and ranking requests, so no single request looks like an attack — a claim about what filtering can see, not about current filter quality. ## Claim atoms ### Pseudonymity no longer provides meaningful protection > [!quote] ID:rw_01kytrs7ymzwe9ckzcj0mr4260 > Pseudonymity does not provide meaningful protection online. Users who post under persistent usernames should assume that adversaries can link their accounts to real identities or to each other **Where/why**: The conclusion, stated flatly. The finding that changes operating assumptions for anyone using a persistent handle — risk rises per post, so volume matters more than any single disclosure. ### Decomposition into benign steps defeats provider guardrails > [!quote] ID:rw_01kytrsky1wvqmgnx7bqxd07ze > we are pessimistic that this is possible as our deanonymization framework splits an attack into a combination of seemingly benign summarization, search and ranking tasks. **Where/why**: The conclusion's discussion of why defense is hard. A structural argument about what filtering can see, not a complaint about filter quality — generalizes well past privacy. ### End-to-end deanonymization requires no special tooling > [!quote] ID:rw_01kytrt189eejcxhe88cb2mns2 > these agents achieve 25–67% recall with 70–90% precision, replicating in minutes what could take hours for a dedicated human investigator… This capability comes for free **Where/why**: The introduction, describing the autonomous open-web setting. The cost collapse in one sentence — $1–4 per profile, no fine-tuning, no custom tooling. Note the selection-bias caveat the authors name themselves. ## Permanent candidates - **Practical obscurity is an economic property, not a technical one** — protection that rests on an attack being too expensive to bother with disappears the moment the cost falls, without anything about the attack itself having changed. Strong candidate. - **Validation that inspects steps cannot see composition** — a safeguard that evaluates each request in isolation is blind to attacks assembled from individually legitimate requests, so filtering must operate on the sequence rather than the item. Strong candidate — direct link to the WP2Shell finding already in the vault. ## Processing checklist - [ ] Raise the pseudonymous-contributor threat model with The WPOCC — community archives (mailing lists, forums, Slack exports) are unassessed against this attack - [x] Connect into the relevant MOC — [[3. Resources/MOCs/AI Agent Safety MOC]] ## Links - [[3. Resources/MOCs/AI Agent Safety MOC]] — cost collapse as the operative threat-model change for LLM-enabled attacks - [[3. Resources/MOCs/Commons & Community Governance MOC]] — public community archives as an unassessed deanonymization surface - [[3. Resources/Readwise/Articles/Large-scale Online Deanonymization with LLMs]] — source preprint (arXiv, ETH Zurich / MATS / Anthropic)