Inside the Match: Extract, Search, Reason, Calibrate
The LLM-enabled deanonymization studied here is best understood as a system of cooperating functions, not as one mysterious act of recognition. The specific question is how raw posts and comments become a candidate identity decision: what is extracted, how candidates are found, how competing explanations are compared, and when the system should abstain. That model lets readers judge both the capability and the points where an error or a safeguard can enter.
Four Functions, Four Different Jobs
A person investigating a pseudonymous profile might read hundreds of posts, remember distinctive details, search for related material, and decide whether one candidate is a plausible match. The USENIX paper turns that broad activity into a framework called ESRC: Extract, Search, Reason, and Calibrate. The separation is important because each function solves a different problem, and success in one does not guarantee success in the next.
Extract converts unstructured writing into identity-relevant micro-data. The input can include posts, comments, biographies, or an interview transcript rather than a table of known fields. An LLM can summarize stated and inferred facts about demographics, career history, interests, writing-related signals, and other context. The output is not an identity. It is a more compact representation of what the profile reveals and what might be useful for comparison.
This conversion changes the shape of the problem. Raw prose is rich but difficult to compare at scale. A semi-structured profile makes it possible to ask whether two people mention related institutions, work in similar areas, share interests, or reveal compatible timelines. It can also expose details that a simple keyword search would miss because they are expressed with different words. A person who says they moved for graduate school and a profile that lists a university in a new region may be semantically related even when the wording does not match.
Extraction is also a source of uncertainty. The model may confuse an author’s statement with a quotation, treat speculation as fact, infer a demographic attribute too confidently, or omit a detail that matters. A summary can compress away contradictions and context. The paper therefore treats extraction as a stage that supplies features for later matching, not as an oracle. A feature that was inferred from text should not silently acquire the status of a verified biographical fact.
The distinction between stated and inferred information affects the downstream meaning of a match. If two profiles explicitly mention the same institution, that is one kind of alignment. If a model infers that both writers are at a similar career stage from indirect language, the alignment is weaker and more dependent on the model’s assumptions. Several weak inferences may appear mutually reinforcing simply because they came from the same original clue. A system that carries them forward as independent facts can overstate the strength of the case.
Extraction also decides what disappears. Summarization favors what seems salient to the prompt or the model, not necessarily what a later investigator would need. A temporary interest may be retained while a rare biographical detail is omitted; a quotation may be attributed to the author; a contradiction may be smoothed into a single description. These choices influence both false negatives and false positives. A privacy review should therefore consider the transformation itself as part of the threat surface: an LLM summary can create a more searchable profile even while shortening the original text.
Search uses the extracted representations to narrow a large candidate universe. In the paper’s scalable framework, dense embeddings support nearest-neighbor retrieval: profiles with related meaning are placed close enough in a mathematical representation that a search can return a shortlist. This is the first point where the cost structure changes sharply. Comparing one profile with every possible profile by hand is expensive; retrieving a manageable set of candidates makes later judgment feasible.
Search is a filter, not a verdict. Semantic similarity can find a useful neighborhood while failing to put the true match first. Two people may discuss the same popular subject in similar language. A candidate may look close because of shared topic rather than shared identity. Conversely, the correct match may use different vocabulary or discuss different aspects of a common experience. The retrieval stage is valuable precisely because it reduces the universe, but its output should be treated as a set of possibilities rather than a ranked list of proven identities.
The interface between extraction and search is therefore consequential. If extraction preserves only broad interests, the candidate set may be large and ambiguous. If it retains many specific details, retrieval may become more discriminating but also more privacy-invasive. A system designed to protect privacy might deliberately remove or generalize features before they reach a search index. A system designed to match identities has the opposite incentive. The same representation decision affects both utility and risk.
Search quality has two different failure directions. If the correct candidate never enters the shortlist, later reasoning cannot recover it; the system produces a false negative even if the final comparison is excellent. If the shortlist is broad and semantically noisy, reasoning must compare more alternatives and may be drawn toward a vivid but incorrect overlap. Enlarging the candidate universe can make both problems harder. A search method that looks strong in a small experiment may lose recall as more people share the same broad topics, while a method that retrieves many candidates may preserve possibilities at a higher cost.
The representation is also an interface across populations. Words, interests, and institutions do not have identical meanings for every community or language. A profile may be semantically close to another because both use a common professional vocabulary, not because they belong to the same person. Conversely, translation, code-switching, or specialized local references may hide a true relationship. These are not reasons to reject semantic retrieval; they are reasons to treat the candidate shortlist as a population-dependent instrument whose behavior must be measured in the setting where it will be used.
Reason operates on the shortlist. The paper’s framework uses LLM reasoning to select among multiple candidates and verify the proposed match using the available context. Reasoning can notice that several details align in a specific way, that one candidate explains a timeline better than another, or that an apparent match contains a contradiction. This stage addresses a weakness of pure similarity search: the closest representation is not always the most plausible person.
Reasoning is not an escape from uncertainty. It can turn a vague similarity into a coherent story, but a coherent story can still be wrong. A model may favor a candidate because the explanation is easy to narrate, overlook an alternative that is less obvious, or treat correlated details as independent evidence. The value of the stage is comparative: it gives the system a way to weigh several candidates and inspect agreements and contradictions, rather than relying on one distance score.
A useful comparison asks not only what fits, but what should fit and does not. If a candidate’s public history conflicts with the timing, profession, or location implied by the query profile, that contradiction can lower confidence. Yet absence of evidence is not automatically evidence of a contradiction: the candidate may have an incomplete public record, may have used another account, or may not have disclosed the relevant fact. The reasoning stage must therefore combine positive alignment with an understanding of missingness. A polished explanation that ignores the difference between “not found” and “not true” can make false matches look more convincing.
The stage also changes the economics of human review. A person may be asked to inspect only the candidates that earlier stages consider plausible, rather than search the entire universe. That can make a high-quality judgment available for many more queries, but it can also make the human reviewer dependent on the system’s shortlist and summary. If the candidate was omitted or a crucial context was compressed away, later scrutiny may validate the wrong question. System-level performance thus depends on the handoff between components, not only on the apparent intelligence of the reasoning step.
The paper describes a staged design in which a less expensive model can select a promising candidate and a more capable reasoning step can verify that selection. The details of the models and prompts are intentionally not published. The defensible lesson does not depend on reproducing them. It is that a matching system can allocate more reasoning to a small shortlist after cheaper retrieval, making the total process more affordable than applying expensive analysis to every possible candidate.
The arrows describe information moving between responsibilities, not a claim that each component is a separate product or model. In a real system, the boundaries may be implemented in different ways. Their analytical value is to make failure visible: extraction can distort the signal, search can omit the right candidate, reasoning can overinterpret a plausible story, and calibration can decide to guess when it should have remained silent.
Confidence Is a Decision About When to Guess
Calibrate determines how the system trades precision against recall. Precision asks how many returned matches are correct. Recall asks how many true matches are found. A system can increase precision by returning fewer guesses and abstaining on ambiguous cases; it can increase recall by taking more chances, usually at the cost of more false matches. Calibration is therefore not a cosmetic score attached to an answer. It controls the threshold at which the system changes from “there may be a match” to “return this identity.”
The paper describes several possible confidence signals, including embedding similarity, the gap between top candidates, and an LLM-produced confidence score after reasoning. These signals are not automatically probabilities. A similarity score of 0.9 does not mean a 90 percent chance of identity unless it has been evaluated and calibrated for the relevant population and candidate construction. A narrow gap between two candidates may mean uncertainty, but it may also reflect a population in which many people share the same interests.
Calibration is consequently a property of a relationship between a score and an outcome. To know whether a threshold is meaningful, an evaluator needs examples where the true relationship is known, a definition of what counts as a correct match, and a way to account for queries with no match. Changing the candidate pool, the proportion of matchable users, the kinds of profiles, or the cost of a false attribution can change the threshold that is appropriate. A confidence value copied from one setting should not be treated as portable simply because the model and numeric scale look the same.
There is a practical tension here. A low threshold may surface more true matches but expose more people to false identification. A high threshold may protect precision while systematically missing users whose writing is less distinctive, whose public traces are sparse, or whose language differs from the evaluation population. Calibration is therefore not neutral optimization. It expresses which errors the operator is willing to tolerate and which people bear the cost of a wrong guess or a missed match.
Abstention makes the distinction concrete. Suppose an identity search returns a single best candidate for every query. The system may appear decisive while making many wrong guesses, especially when some queries have no corresponding person in the candidate set. A calibrated system can refuse to identify a profile when evidence does not meet the chosen threshold. That protects precision, but it does not make the search harmless: the system may still identify a subset of people whose profiles contain unusually rich or stable signals.
This is where candidate prevalence enters. In a closed-world experiment, the evaluator may guarantee that every query has a matching candidate. In a real setting, most profiles in a large candidate universe may have no match. The meaning of a returned guess depends on both the quality of the matching process and the prior chance that a match exists. The paper separates recall and false-match rate among matchable queries from the false-positive identification rate among non-matchable queries for this reason. A confidence threshold that works in one candidate universe may not preserve precision in another.
The open-web agent setting differs from the closed-world framework. In the open-world case, an agent receives an anonymized description and searches public sources, cross-references findings, and reasons about possible identities. The candidate universe is not a fixed table prepared by the evaluator. It is shaped by what the search system retrieves and by what public information happens to be available. That makes the experiment closer to a human investigation, but it also makes the contribution of the web search system and the LLM harder to isolate.
The closed-world setting is more controlled. The evaluator can create query and candidate profiles with known relationships, vary the candidate pool, trace precision–recall curves, and compare LLM-based components with classical baselines. Its cost is realism. Constructing ground truth often requires profiles that publicly reveal links or artificially splitting one person’s activity into two profiles. Those choices make measurement possible but can make the matching task easier or more regular than genuinely separate pseudonymous accounts.
The paper reports that the open-web task can be performed in minutes rather than the hours expected of a dedicated investigator, and it reports per-profile agent costs of roughly one to four dollars in that experiment. Those figures illustrate an economic shift, not a permanent price or a universal operating cost. They depend on the models, search access, task design, and degree of human checking. The broader point survives changes in price: once the workflow is modular, an attacker can distribute effort across many low-cost subtasks.
That modularity also creates a defensive complication. A provider may block an explicit request to identify a person while allowing summarization, semantic search, ranking, or evidence comparison as apparently benign tasks. The paper notes that its high-level attack description omits exact prompts and tool configurations and argues that guardrails face a composition problem: a harmful objective can be assembled from ordinary-looking operations. This is not proof that model refusals are useless. It is a reason not to treat a single refusal layer as the entire defense.
A useful way to read the four-stage model is to ask what each stage knows and what it is allowed to do. Extraction sees the source text and may create new sensitive summaries. Search determines which alternatives are visible to later reasoning. Reasoning can elevate a candidate by connecting details that were separate in the original text. Calibration determines whether the accumulated case is strong enough to act. A platform that restricts only the final identity output may still expose much of the intermediate signal through bulk exports or unrestricted search access.
The system model also clarifies why the next question must be empirical. It is possible to describe a pipeline that sounds powerful without knowing how often it works, how its errors change with candidate size, or whether the tested profiles resemble real privacy-conscious users. Conversely, a low recall number in a difficult setting does not mean that the capability is irrelevant if the correct matches are high-confidence and the process can be repeated at scale. The experiments provide the evidence needed to make those distinctions, but only if each result remains attached to the stage, dataset, and uncertainty that produced it.