A Reddit user wrote about getting stuck while waiting for a “hook turn” on the way to work. They did not name their city. GPT-4 inferred Melbourne, where the maneuver is common. The example appears in a 2024 study of what language models could infer from ordinary posts (ICLR paper).
The clue supplied a location to test against other records. A second study, published at USENIX Security in 2026, measured how well an AI agent could match pseudonymous profiles. Together, the papers trace how a researcher can infer a useful detail and test whether it links one account to another (USENIX study).
ICLR measures attribute inference; USENIX measures account matching. The full sequence from one public clue to a linked identity is an interpretation across the studies.
A clue carries more than its literal meaning
The Reddit example comes from Beyond Memorization, published at ICLR in 2024. Researchers used 520 public Reddit profiles containing 5,814 comments written between 2012 and early 2016. They asked several language models to infer attributes such as location, education, occupation and income from the users' writing.
The team evaluated 1,066 attribute labels across the 520 profiles. They selected labels the annotators considered at least somewhat certain and asked the models for up to three guesses per attribute. GPT-4's first guess matched 85.5% of those labels; the correct answer appeared among its first three guesses for 95.2%. Human annotators could see subreddit names, while model prompts used post text without that metadata. For the hardest labels, annotators could also search the web. The authors report that the model's predictions cost about 100 times less and took about 240 times less time than human labeling for this task. Separately, the researchers spent roughly 112 hours creating the human-labeled ground truth used to score the predictions (ICLR paper).
The overall rate varies by attribute. GPT-4 reached 86.2% accuracy on location labels and 62.5% on income (ICLR paper). A location field and an income field therefore carry different levels of support in this sample. A joined profile that presents them with equal confidence would erase that difference.
The top-three score reveals another data-design issue. The first guess was right for 85.5% of labels; allowing up to three guesses raised coverage to 95.2%. That is a 9.7-point gain in the study, with more candidate answers entering the workflow. Rank, source text and confidence help explain why one guess appears ahead of another. A single final value hides whether it came from a direct clue or a weaker alternative (ICLR paper).
Researchers selected the Reddit profiles from 381 communities likely to contain personal information; the comments date from 2012 to early 2016. They chose attributes that could be labeled and compared with the model's guesses. The findings describe this sample of Reddit comments. Other platforms, languages, communities and kinds of personal detail need their own tests (ICLR paper).
Those dates matter when the model's guesses become profile fields. A location inferred from a comment written years ago belongs to that period; the person's current address may differ. When a newer account gets linked to the old one, missing timestamps can make a historical clue read like a current fact. An inference and an identity match can each be plausible while the joined profile still gives a misleading picture of the present.
The cost comparison changes the unit of work. A person reading one comment can notice “hook turn”; a model can apply the same inference to a collection and return likely locations as fields that can be compared. Returned locations still need verification. A researcher can sort the candidate records, look for shared places and decide which ones deserve a closer check. The sentence written for a conversation enters a search as a data point, with its confidence and source attached.
That change starts before an identity match. A commute, work schedule or local event may narrow down a person's likely location or occupation. One clue can fit many people; a second record can reduce the candidate set. A professional profile might supply a city and employer, while an older forum post supplies a local phrase. When the join drops each detail's origin, a plausible inference can quietly become a field that later searches treat as fact.
The linked record contains several kinds of claim. A source may state a person's employer; a model may infer a location; an agent may propose that two accounts belong together. The studies test these operations separately. A combined profile can hold them in one place, but each conclusion still has a different basis and confidence. Once a candidate is linked, an uncertain detail can look like a confirmed biographical fact without gaining new evidence.
From an inference to an identity match
At USENIX Security in 2026, researchers tested agents that could identify people behind pseudonymous online profiles and conversations. With full internet access, their agent re-identified Hacker News users and participants in Anthropic's Interviewer project at high precision, at a level the authors compare to hours of work by a dedicated human investigator.
That open-internet demonstration and the 55% benchmark result describe different tests. In the first, the agent searched the web for real profiles and the authors compared its work with an investigator's. In the controlled datasets, the researchers knew which profiles belonged together, so they could calculate recall and precision. The first shows what a search agent can do with broad access; the second lets readers inspect performance against a defined set of known matches (USENIX study).
For a controlled matching test, the team prepared pairs of profiles with known identities. One set linked Hacker News accounts with LinkedIn profiles, another paired users across Reddit movie communities, and a third split Reddit histories into two periods. The first could include a cross-platform reference; shared interests or writing over time supplied clues in the Reddit tests. This lets the researchers compare candidate links against known identity pairs.
In the strongest evaluated setting, the LLM method recovered up to 55% of known matches at 90% precision. The best non-LLM method came close to zero on those tests. At that threshold, the system found just over half of the known matches, and roughly one in ten proposed links was wrong. A missed match leaves a useful clue undiscovered; a false link can place one person's post beside someone else's name. These scores apply to the study's prepared profile pairs and platforms; the researchers measured matching performance, while consequences of a wrong attribution remain outside the test (USENIX study).
That comparison marks the leverage in this benchmark. Semantic features produced a usable candidate set where the strongest non-LLM method found almost no matches. The 45% of known pairs left unrecovered also shows the system's limit as a map of identities (USENIX study).
The agent extracts identity-relevant details from text, turns them into semantic features, retrieves profiles with similar meaning and asks a language model to check the strongest candidates against their writing and context. A conventional database joins records through a shared ID; this pipeline derives a provisional key from the text itself. That is the structural change. Conversations, biographies and comments written for different reasons become comparable records, regardless of username.
The agent reduces the researcher's first pass to a shortlist. That saves the manual work of noticing a clue, searching for candidates and holding their context in memory. Two people can write about the same film, city or profession, so semantic similarity can produce a false lead. The system narrows the search; a person still has to decide whether the evidence supports an identity match. The benchmark measures recovery of known pairs under controlled conditions.
The time-split Reddit dataset tested whether posts written years apart could still be matched to the same user. An old account can keep its identifying clues after its owner stops using it; a newer profile can supply the comparison point that brings those clues back into view. Years of writing become one searchable history when older posts are matched to a newer profile.
Once a likely match exists, the result can be reused as a connected record. A work history can date old comments; a pseudonymous post can add interests or routines to a professional account. A later search can compare those details without repeating the identity-resolution work. This reuse is where the join becomes a research asset, and also where an early mistake can travel. An inferred location without a date or source can enter later queries as a confirmed profile field. The USENIX evaluation ends at the matching result; subsequent uses of the assembled record remain unmeasured.
The boundary between contexts is where the picture forms
People publish for particular audiences. A professional biography helps a client understand someone's work; a forum account can hold a hobby discussion; a conference page can preserve an old talk. A photograph posted by a friend can add a location or association. Each item may make sense where it first appeared. The assembled profile can travel much further. It may join a name and employer from one page, a city from an old comment, and a project or schedule from another account.
AI lowers the effort needed to test these relationships. Researchers, journalists and fraud investigators can use that speed to examine public records. Someone profiling or targeting a person can use it too. The search becomes cheaper for whoever assembles the record.
A 2026 CHI study gives a sense of why the inferences can be hard to anticipate. Researchers asked 240 people in the United States to judge whether short text snippets might reveal personal information, then asked them to rewrite the snippets to block those inferences. Participants were only a little better than chance at predicting the risks. Their rewrites blocked the tested inference in 28% of cases. Paraphrasing was common but least effective; adding ambiguity or abstracting a detail worked better in the test (Google Research study). The results suggest that readers judge the words they chose, while a model can also use the surrounding context that made those words informative.
The CHI exercise measured people's predictions about short snippets and their attempts to block a particular inference. USENIX measured a system searching across profiles for links. Read together, the studies show the distance between judging one post and analyzing a history assembled from many posts. They trace separate stages of a path from a public clue to a larger profile.
I want the internet to serve clear purposes. A public profile can help someone find your work; an old account can stay visible in the setting where you used it. An outside researcher can combine those pages with a local phrase, a photograph or a work history and read them as one account. That assembled picture may include years of activity no single page was meant to represent. The question is who gets to make that combination, and what evidence they use.