When Pseudonymous Text Becomes an Identity Signal
This series examines a specific privacy problem: what happens when a large language model can connect a persistent pseudonymous online profile to a real identity, or connect two apparently separate profiles to the same person. The question is not whether a model possesses a magical store of hidden names. It is whether familiar clues—interests, institutions, timelines, habits, and ways of expressing ideas—can be gathered and compared cheaply enough to change what pseudonymity protects. Understanding that shift helps readers judge the difference between removing a name and reducing the risk of being recognized.
The New Threat Is Not Omniscience but Affordability
For years, pseudonymous participation on the internet has rested on an implicit bargain. A person may leave a trail under a username, but connecting that trail to an offline identity should require unusual effort: a patient investigator, substantial time, and a reason to pursue one particular target. The clues are public, yet scattered. They may appear on different sites, in different communities, or months apart. The cost of assembling them provides a kind of practical protection even when no technical barrier makes the task impossible.
The 2026 USENIX Security paper Large-scale online deanonymization with LLMs argues that this bargain is weakening. Its subject is large-scale online deanonymization: matching pseudonymous profiles or conversations to known identities, and matching two pseudonymous profiles that belong to one person. The paper’s important claim is economic. The models do not necessarily recognize a new category of evidence that a skilled investigator could never see. They make it less expensive to extract relevant clues from unstructured text, search through candidates, compare several plausible matches, and decide when a match is strong enough to return.
That distinction matters. “The model can identify everyone” is a much stronger claim than the evidence supports. A system may work well on profiles that contain unusually rich or repeated information and poorly on profiles that reveal little. A correct high-confidence match can nevertheless be consequential even if most accounts remain unmatched. Privacy is affected not only by the average chance of identification, but also by who becomes identifiable, what happens to them, and whether an adversary can repeat the process across thousands or millions of profiles.
The older mental model treats deanonymization as a rare investigation. The newer model treats it as a pipeline whose marginal cost can fall. Once the work is organized into reusable stages, the attacker no longer needs to make every judgment from scratch. A machine can summarize a profile, retrieve candidates, compare them, and abstain when evidence is weak. That is why the paper describes practical obscurity as an important part of online privacy: the obscurity comes from the expense and friction of investigation, not from a guarantee that the clues are technically unlinkable.
This series follows that change from the underlying signal to the institutional response. It first asks what remains after names and handles are removed. It then explains how LLM-assisted matching turns those remnants into candidates and how the reported experiments should be interpreted. Finally, it considers what a defensible release or platform policy looks like when the cost of matching meaning has fallen.
The diagram is deliberately modest. It does not say that every trace leads to an identity. It shows the relationship that matters: removing explicit identifiers changes the input, but it does not necessarily remove the information needed for a later comparison.
What the Words Promise
NIST SP 800-188 provides a vocabulary that is useful precisely because it avoids treating privacy labels as magic. De-identification is a general process for removing the association between identifying data and a data subject while retaining some useful analysis. Re-identification is the later process of attributing de-identified data to the individual to whom it relates. These definitions describe goals and actions; they do not promise that the association can never be recovered.
Pseudonymization is more specific. It removes the original association and adds an association between characteristics relating to the subject and one or more pseudonyms. That arrangement can be valuable: it allows observations from the same person to be linked over time, or allows an authorized party to reconnect a record under a policy. But the same continuity can increase risk through other means. A stable pseudonym makes a person easier to follow, and a long sequence of observations can become distinctive even when no observation contains a name.
This is why NIST recommends care with the word “anonymization.” In ordinary conversation, it often means that identity has been removed permanently. In technical practice, a data release may merely have had direct identifiers deleted, or a mapping key moved somewhere else. If an external dataset contains a distinctive combination of attributes, the association may be reconstructed without the original key. Calling that result anonymous can hide the central question: anonymous to whom, under what information assumptions, and for how long?
There is also a difference between identity inference and attribute inference. An identity match answers, “Which known person is behind this profile?” An attribute inference may answer, “What can be learned about the person represented by this record?” The two can occur separately. Someone may infer a location, occupation, or sensitive interest without knowing a legal name. Conversely, a profile may be linked to a likely identity before the matcher knows anything especially sensitive. Both matter because privacy loss is not limited to a dramatic public naming event.
NIST’s framing is broader than online forums. It was written for government datasets, where agencies balance transparency, research value, and confidentiality. Its definitions still clarify the online text problem. A pseudonym is a relationship, not a wall. De-identification is a risk-reduction process, not proof that no one can make a connection. Re-identification is not the only harm, because a release can also make an inference about a person more accurate even when the person is never named.
That precision changes how a reader should interpret the USENIX paper. The paper is not demonstrating that every account with a username is exposed, nor that every model output is true. It is testing whether a repeatable matching process can recover links under selected conditions. NIST supplies the language for describing what such a link means; the paper supplies evidence about how automation can make the link-finding work more scalable.
Meaning Leaves a Trail
The most important residue is not a hidden field labeled “identity.” It is the combination of small facts that becomes distinctive when viewed together. The USENIX paper calls these individual-level observations micro-data: a movie preference, a location, an occupation, a writing habit, or another fact about one person. A single observation may describe many people. A collection can be matched against a second collection that is tied to known identities.
Online writing contains this kind of material in a form that is harder to enumerate than a database column. A post may mention a research area, a previous city, a niche hobby, a particular work constraint, and a recurring way of describing an event. The clues may be ordinary in isolation. Their timing and combination may be less ordinary. A model can also extract relationships between clues: an institution connected to a field, an interest connected to a community, or a life event connected to a particular period. The identity signal is therefore partly semantic and partly relational.
This explains why deleting names and handles is necessary but incomplete. NIST calls information that can identify someone through association a quasi-identifier, or indirect identifier. In a text corpus, quasi-identification may be distributed across sentences rather than stored in one field. High-dimensional data can remain identifying after obvious identifiers and selected quasi-identifiers have been changed, especially when the pattern can be linked to another source. The more dimensions a profile preserves, the more opportunities an outside party may have to find a distinctive intersection.
Linkage also grows over time. A pseudonym can connect posts from the same account; a platform can connect activity through account or device relationships; an external dataset can supply a professional profile, a publication, or a public event. NIST notes that even data that appear non-identifying in isolation can become identifying when records are linked. It gives the broader examples of repeated measurements and time-location patterns: a sequence can form a constellation that is more distinctive than any point in the sequence.
Repeated releases create another problem. An aggregated report may hide a sensitive change when viewed alone, yet two versions can reveal what changed between them. A transformed text collection may seem acceptable today and become more revealing after a related dataset is published or breached. NIST calls attention to composition—the way multiple releases or data sources interact—because the privacy properties of one release do not automatically survive their combination with another.
The practical consequence is not that all meaningful text must be erased. It is that “safe” cannot be decided by checking only for names, email addresses, and account handles. A useful corpus often needs context; context is also what helps a matcher distinguish one person from another. The real design problem is to decide which forms of meaning are necessary for the intended use, which combinations create unacceptable risk, who can access them, and how the decision will be tested against plausible auxiliary information.
That is the unresolved dependency at the center of the subject. Once identity-relevant traces remain distributed across ordinary language, the challenge is no longer simply to remove an identifier. It is to understand the full path from meaning to linkage. The next step is to examine how LLM-enabled systems organize that path into extraction, search, reasoning, and calibrated abstention—without mistaking the existence of such a pipeline for proof that every proposed match is correct.