Large language models (LLMs) are capable of identifying at scale people behind pseudonymous online accounts. A new paper titled “Large-scale online deanonymization with LLMs,” published by researchers from Anthropic, ETH Zurich and the Machine Learning Alignment & Theory Scholars (MATS) programme shows that modern AI systems can re-identify anonymous or pseudonymous users at scale using only the text they write online.

While the findings raise concerns about online anonymity, researchers say the same capability could help fact-checkers and investigators track misinformation campaigns and coordinated influence operations.

Why this research matters for misinformation investigations

Investigations into online misinformation often rely on painstaking manual analysis of writing patterns, digital footprints and scattered clues across social media platforms. Analysts typically try to determine whether multiple accounts belong to the same person or organisation, or whether seemingly independent posts are part of a coordinated campaign.

The new research suggests that AI could automate much of that process.

According to the researchers, LLM-based systems can extract identity-relevant signals from unstructured text — such as interests, career details, writing style or geographic hints — and then search large datasets of potential profiles to find likely matches. The system can also reason over evidence to confirm whether two profiles likely belong to the same person.

This approach could help identify:

• 
  Coordinated propaganda accounts
• 
  Bot networks operated by a single actor
• 
  Influence operations running multiple identities
• 
  Individuals operating several pseudonymous accounts across platforms

Such capabilities could be particularly useful in investigating misinformation campaigns, where actors often rely on anonymous or pseudonymous accounts to spread false narratives.

Existing tools that use similar techniques

Although the use of LLMs is new, investigators and researchers have long used a variety of tools to analyse online identities and detect coordinated activity.

One such approach is stylometry, which attempts to identify authors based on their writing style. Stylometric systems analyse patterns such as sentence length, punctuation, vocabulary and grammatical structures. Tools such as JStylo and Writeprints, along with academic authorship-attribution systems, have been used to link texts written by the same individual.

However, these methods typically focus on stylistic patterns rather than the meaning of the text itself.

LLMs expand this approach by analysing semantic content — the topics people discuss, the personal details they reveal and the contextual clues embedded in their posts. This allows the system to combine both writing style and contextual information when trying to link identities.

Investigators also rely on open-source intelligence (OSINT) tools to uncover digital identities. Platforms such as Maltego, SpiderFoot and Social Links help analysts map relationships between accounts, websites and digital traces. Techniques developed by investigative groups such as Bellingcat often involve manually connecting small clues from different sources to identify individuals behind anonymous activity.

LLMs could significantly accelerate these processes by automatically extracting and analysing clues from large volumes of text.

In addition, several platforms already track coordinated disinformation campaigns by analysing social networks and posting behaviour. Services such as Graphika, Hoaxy and Botometer examine patterns in social media activity to identify bots or organised influence networks.

AI systems capable of analysing textual signals and identity clues could complement these tools, helping analysts identify when different accounts may actually belong to the same individual or group.

Privacy concern

Despite the potential benefits for misinformation research, the findings also raise broader concerns about online privacy.

Pseudonymous identities allow people to participate in discussions without revealing their real-world identities. The researchers said that this protection has relied on what they describe as “practical obscurity” — the idea that identifying someone from scattered online clues requires too much effort to be done at scale. LLMs could change that balance by dramatically lowering the cost of analysing and linking online information.

This means the same technology that could help journalists trace misinformation networks could also be misused for harassment, surveillance or doxxing.