Large-scale online deanonymization with LLMs

Simon Lermen (MATS) and Daniel Paleka (ETH Zurich), equal first authors, with Joshua Swanson, Michael Aerni and Florian Tramèr (eth-zurich) and Nicholas Carlini (anthropic). arXiv:2602.16800, v1 18 Feb 2026, v2 25 Feb 2026; published at USENIX Security '26 (pp. 1947–1966). Read from the arXiv HTML of v2. T1: peer-reviewed, with a stated ground truth, error counts and a list of limitations.

Paged as the research-pass answer to growth edge 2a in synthesis. It is the first source this wiki holds that scores an agent collecting on its own against a subject whose footprint was deliberately thinned, with the right answer known in advance. vibesearchbench scored gathering too, but with a simulated user steering the session and nothing hidden on purpose.

What was measured

The paper has two parts: an open-world agent and a closed-world matching pipeline.

Open world: an agent with web search. A user's posts are summarised into a profile. Names, handles, personal URLs and GitHub repos are stripped by an LLM; institutions, demographics, interests and names of connected people stay. The redacted profile becomes a prompt to a frontier agent with search tools, which searches, cross-references and decides alone. No human steers the run.

Cost was $1–$4 per profile; all agent runs together cost under $2,000. The agent model, prompts and tool configuration are withheld to limit misuse.

Closed world: matching two text corpora. 987 LinkedIn profiles linked to 995 HN accounts, searched against a pool of ~89,000 active HN users, each query with a true match in the pool. The pipeline extracts features with an LLM, retrieves 100 candidates with Gemini embeddings and FAISS, and has Grok 4.1 Fast pick or abstain, with GPT-5.2 verifying. Recall at 90% precision: 0.1% for a Netflix-Prize style baseline, 26.3% for embeddings alone, ~55% with LLM reasoning. Recall falls as the pool grows, from 68.3% at 1,000 candidates to 55.2% at 89,000, and the authors extrapolate ~45% at a million and ~27% at 100 million, with wide error bars. One inconsistency: at 99% precision the table gives 45.1% for high-effort reasoning, while the scaling section gives 33.0% for the same pool. The paper does not reconcile them.

Why it moves edge 2a, and how far

Edge 2a asked for three things: item-level ground truth, an agent running unattended, and a subject with a sparse or misleading footprint. This paper has the first two cleanly and half of the third.

• Unattended: yes. The agent gets a profile and returns an answer or abstains.
• Ground truth: yes, and the subject supplied it. For HN, the LinkedIn link the user put in their own bio. For the interviews, a human checked the matches, so that set "cannot be fully verified."
• Sparse footprint: yes, made sparse on purpose by redaction.
• Misleading footprint: no. No subject planted false trails. The authors also name the selection bias against them: people who link their own accounts care little about anonymity, so recall is probably inflated. They argue the false-positive rate should still carry over.

So the result is a half close. The residue is written as edge 2b in synthesis: a subject who resists, and a dossier rather than a single identity. Here the "item" is one fact: who is this. Collection in the osint sense gathers many facts per subject, and that is what vibesearchbench scored, with a helpful user.

What it says about the field

• The "practical obscurity" defence is gone at this cost: the authors' own conclusion: a pseudonymous account is protected by effort, not by secrecy, and the effort now costs a few dollars. This is the attacker's side of what self-osint and data-broker describe from the subject's side.
• Abstention is the safety valve, and it is measured: 86 of 338 HN runs and 22 of 33 interview runs ended in abstain or refusal. A collector that says "not found" is what the llm-osint-reliability-study asked for: forced answers are where the errors were.
• Nobody can re-run it: the code, the processed data, the prompts and the agent are all withheld, for stated safety reasons, after ETH Zurich ethics review. That is a defensible choice. It also means this is one more number in the corpus that only its authors can check (hub quality-log.md → Outstanding, "Nobody re-runs anybody's numbers"). The search engine is a further hidden variable: the authors say they cannot separate the model's part from the search engine's.
• Contamination is possible: HN and Reddit are in training data. The authors note that higher reasoning effort helped, which suggests memory is not the whole story.

Dual-use note

Per this spoke's osint ethics stance: the page records what was measured and what it costs, not how to repeat it. The paper itself withholds the pipeline, and so does this page.

Related

vibesearchbench · llm-osint · llm-osint-reliability-study · self-osint · username-reconnaissance · data-broker · osint