The internet offers a double-edged sword: it’s a powerful tool for connection and expression, yet it also provides a cloak of anonymity. From niche hobbyist forums on Reddit to private “finstas” on Instagram, many of us take online privacy for granted. However, a recent study suggests that the anonymity we cherish might not be as secure as we believe. Scientists in Switzerland have developed artificial intelligence (AI) tools capable of unmasking anonymous online accounts at scale, linking them to their public counterparts.
The researchers behind this groundbreaking study have highlighted its “significant implications” for online privacy. They warn that without proactive measures, the degree of anonymity currently enjoyed online could be rapidly diminished. The individuals most vulnerable to this technology are those who consistently share personal details, even over extended periods. Typically, these individuals tend to be older or less digitally savvy, often unaware of the best practices for online security.
Daniel Paleka, the lead author of the study from ETH Zurich, explained that their findings make it unequivocally clear: “if you keep posting under a pseudonym, keep quoting information about yourself,” AI tools will be able to reveal your identity quickly and affordably.
The research team constructed a sophisticated system employing large language models (LLMs). This system scoured the internet, treating information gathering as a complex “matching” exercise. By analysing and cross-referencing publicly available snippets of information with public accounts, the AI could deduce the true identity behind pseudonymous profiles.
To conduct their experiment, the researchers utilised datasets compiled from publicly accessible posts. These included content from platforms like Hacker News and LinkedIn, transcripts of interviews with scientists discussing AI usage from the company Anthropic, and Reddit accounts that were intentionally divided into two anonymised segments for the study.
Across these varied scenarios, the LLM system demonstrated remarkable accuracy, successfully identifying up to 68 percent of matching accounts with an impressive 90 percent precision. The study’s authors noted that this performance “substantially outperforms” traditional, non-LLM deanonymisation methods, including those conducted by human investigators.
The Shifting Landscape of Online Privacy
This newfound AI capability “fundamentally changes” the existing paradigm of online privacy, according to the study’s authors. They articulated several concerning potential applications in their paper, which is currently awaiting peer review:
- Government Surveillance: Governments could leverage these tools to link pseudonymous accounts to real identities, enabling surveillance of dissidents, journalists, or activists.
- Hyper-Targeted Advertising: Corporations could connect seemingly anonymous forum posts to existing customer profiles, facilitating highly personalised advertising campaigns.
- Sophisticated Scams: Malicious actors could build detailed profiles of targets at scale to launch highly customised social engineering scams.
- Hostile Group Operations: Adversarial groups could identify key employees and decision-makers within organisations and cultivate online relationships with them for future exploitation.
The authors concluded that “users, platforms, and policymakers must recognise that the privacy assumptions underlying much of today’s internet no longer hold.”
Mr. Paleka clarified that these AI tools are not “superhuman investigators” capable of discovering information beyond human reach. Instead, their power lies in their cost-effectiveness and speed compared to human-led investigations. For instance, if an individual shared details about their location in one post and their workplace in another, separated by years, both humans and AI could theoretically find this information. However, LLMs can achieve this far more rapidly and at a fraction of the cost.
Currently, the AI’s capabilities are limited to matching factual information such as employment history, residential locations, and hobbies. It cannot yet effectively discern patterns in writing style or tone. Mr. Paleka anticipates that while replicating this study currently requires significant expertise in LLMs, the barrier to entry will dramatically lower within a few years if no “guardrails” are implemented.
“The fundamentals of the technology are there,” he stated. “If there are no guards, I fully expect someone to be able to misuse it.”
He suggested that AI companies might proactively police the use of their tools to prevent misuse. However, the primary objective of this study is to raise public awareness of the issue while the risk to most anonymous internet users remains relatively low.
“If you care about something being anonymous, if you have something to protect, if you want to post opinions about things that you would not post under your real name, be mindful of this,” Mr. Paleka advised.
Protecting Your Online Anonymity
So, how can individuals best safeguard their online privacy in light of these developments? Mr. Paleka offered a straightforward solution to mitigate the majority of these risks: “Use a throwaway account.”
A throwaway account is specifically created for a single post or a limited purpose, ensuring no other personal information is linked to it from existing online activity.
“If you’re posting something genuinely sensitive, don’t use the account you also use to post about whatever else for years,” he reiterated. “That would be my advice.”
