De-Anonymization at Scale via Tournament-Style Attribution
Lirui Zhang, Huishuai Zhang
TL;DR
The paper addresses the privacy risks posed by large language models enabling de-anonymization of anonymous texts in open-set, large-scale contexts. It introduces De-Anonymization at Scale (DAS), a two-stage framework combining coarse retrieval with Tournament-Style Attribution (TSA) that uses multiple LLM-based comparisons and majority voting to identify same-author texts across tens of thousands of candidates. Across anonymized peer-review data and public benchmarks (blogs, Enron emails, and research papers), DAS substantially outperforms random baselines and prior approaches, demonstrating both high accuracy and scalability and revealing practical anonymity vulnerabilities. The work highlights the need for robust privacy safeguards, standardized anonymity benchmarks, and potential hybrids that integrate LLM-based analyses with classical stylometry to defend anonymous platforms in the era of pervasive LLMs.
Abstract
As LLMs rapidly advance and enter real-world use, their privacy implications are increasingly important. We study an authorship de-anonymization threat: using LLMs to link anonymous documents to their authors, potentially compromising settings such as double-blind peer review. We propose De-Anonymization at Scale (DAS), a large language model-based method for attributing authorship among tens of thousands of candidate texts. DAS uses a sequential progression strategy: it randomly partitions the candidate corpus into fixed-size groups, prompts an LLM to select the text most likely written by the same author as a query text, and iteratively re-queries the surviving candidates to produce a ranked top-k list. To make this practical at scale, DAS adds a dense-retrieval prefilter to shrink the search space and a majority-voting style aggregation over multiple independent runs to improve robustness and ranking precision. Experiments on anonymized review data show DAS can recover same-author texts from pools of tens of thousands with accuracy well above chance, demonstrating a realistic privacy risk for anonymous platforms. On standard authorship benchmarks (Enron emails and blog posts), DAS also improves both accuracy and scalability over prior approaches, highlighting a new LLM-enabled de-anonymization vulnerability.