What the Experiments Show—and What They Do Not
The USENIX study provides evidence that LLM-enabled deanonymization can work under selected conditions, but its percentages are measurements of particular datasets and matching tasks, not a universal identification rate for pseudonymous users. The useful question is therefore twofold: what did the experiments actually test, and which parts of the result are likely to change when the candidate pool, profile richness, or chance of a true match changes? Reading the study this way preserves both its warning about falling attack cost and its limits as evidence.
Capability in Selected Settings
The paper begins with an open-web setting that resembles a motivated investigation more than a clean laboratory match. An agent receives an anonymized description derived from an online profile, searches public sources, cross-references findings, and reasons about possible identities. Across the Hacker News and Reddit study settings, the paper reports 25–67% recall at 70–90% precision. It also reports identifying 9 of 33 scientists in the Anthropic Interviewer dataset at 82% precision after manual verification.
Those figures establish something important: a system can carry out more than attribute extraction. It can move from a pseudonymous description to a candidate identity by combining search and reasoning. The paper says the process can reproduce work that would take a dedicated human investigator hours in minutes, and reports per-profile agent costs of roughly one to four dollars in that experiment. Together, the results support a change in economics. They do not show that a random profile is equally easy to identify, that every returned match is correct, or that the process is independent of the quality of public search data.
The interview result also illustrates why denominators and verification rules matter. The 9 identified participants are not 9 out of every interview participant in an unrestricted population; they are 9 of the 33 scientists selected for that experiment. The paper notes uncertainty in manually verifying the matches and says the exact true deanonymization rate cannot be fully established. A responsible reading keeps the numerator, denominator, selection process, and verification method together.
The closed-world cross-platform experiment offers more controlled comparisons. The researchers collected 987 LinkedIn profiles linked to 995 Hacker News accounts, with a candidate pool of approximately 89,000 active Hacker News users. The links were established because users had posted their LinkedIn URLs in their Hacker News biographies. For evaluation, names, URLs, and other direct identifiers were removed from the Hacker News side. The task was then to match a known professional profile to the corresponding anonymized account.
The construction creates ground truth, which is essential for measuring whether a match is correct. It also creates selection bias. People who publicly connected their accounts were not trying to maintain complete separation in the first place. Even after direct links are removed, their profiles may contain more identity-relevant information than an average privacy-conscious account. The experiment therefore answers a comparative question—how do the methods perform on this constructed task?—rather than a population question about all pseudonymous users.
The results show why the pipeline’s Reason stage matters. The paper reports that the LLM-based Reason method reaches 55.0% recall at 90% precision with low reasoning effort and 54.2% at that threshold with high reasoning effort. At the stricter 99% precision threshold, high reasoning reaches 45.1% recall, compared with 4.4% for embedding Search and 0.1% for the classical baseline.