From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents

Anonymization is often assumed to protect privacy once explicit identifiers are removed, because re-identification has historically required specialized expertise, tailored algorithms, and manual corroboration. We show that LLM-based agents weaken this barrier: by combining scattered, individually non-identifying cues with public evidence, they reconstruct real-world identities, sometimes even during benign tasks. We evaluate this risk across three settings---classical linkage incidents, a controlled benchmark (\emph{InferLink}) that varies fingerprint type, task framing, and attacker knowledge, and open-ended human--AI interaction traces. In the sparsest regime of the Netflix Prize deanonymization setting, agents reconstruct 79.2\% of identities, against 56.0\% for a classical matching baseline; on \emph{InferLink}, they link individuals even without an explicit re-identification request, and more often once one is given. In redacted human--AI interaction traces, agents further resolve anonymized profiles to specific individuals by corroborating contextual cues with public evidence. These findings suggest that privacy evaluations for agentic systems should measure not only what information is accessed or disclosed, but also what identities can be inferred.

When we use chatbots and AI assistants, we share a lot of context about ourselves, even without thinking about it. Companies and researchers often release records of such interactions after removing names, assuming the rest is no longer tied to any person. We tested whether modern AI agents can undo this. Given an anonymized record—an old search log, a redacted interview, or a chat session—and only information that is public on the web, we asked AI agents to figure out who the person was. Across three settings, the agents often combined many small, individually harmless clues into a specific real-world identity, sometimes even when no one asked them to. Adding a safety instruction reduced this but also made the AI refuse legitimate work. Removing names is no longer enough once capable AI agents are involved. Privacy evaluations should ask not only what an AI system reveals, but also what identities it can piece together.