Invest2 publishers3 min readPublished
LLM researchers put the price of unmasking a Hacker News pseudonym at $1 to $4
Researchers from ETH Zurich, MATS and Anthropic matched 226 of 338 pseudonymous Hacker News users to LinkedIn profiles at 90% precision for $1 to $4 each. The price holds up better than the hit rate, since every test subject had already linked a real profile.
The Investor · Invest desk
What happened
- The agent got 25 identifications wrong and declined to answer on 86, so about nine in ten of the names it did give were right.
- Four stages, Extract, Search, Reason and Calibrate, narrow up to 89,000 candidates to a shortlist before a reasoning model picks a match or abstains.
- On transcripts of Anthropic's interviews with 125 scientists, the approach identified at least 9 people from how they described their work.
- Code, prompts and every real identity found were withheld by the authors, and ETH Zurich's ethics board reviewed the study before release.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost A correct name on the Hacker News test costs an attacker between $1.50 and about $6, and Lermen expects that price to keep falling.
- contradiction The two-in-three hit rate applies to posters who had already published a real profile; on Anthropic's interview transcripts the rate was about 7%, so exposure depends heavily on the population.
- constraint Model providers cannot stop the attack by switching off one capability, the researchers argue, because it chains ordinary search, summary and reasoning tasks.
- exposure Pseudonymous posters who mention a job, a place or a habit of phrasing become reachable by the actors the authors name: governments pursuing journalists and scammers building dossiers.
On the source's own counts, 226 correct calls against 25 wrong ones is 226 out of 251 answers, or 90.0% [1]. Against the full 338 it is 66.9% [2], and the difference is the 86 accounts the pipeline declined to name [3]. The Calibrate stage is built to abstain when the model is not certain, to keep false positives down [5]. (The three outcomes Cryptopolitan reported sum to 337, one short of the test group [3].)
At the top of the quoted price range, running all 338 profiles would cost $1,352, and at the bottom $338 [4]. Both fit within the under-$2,000 total the researchers reported for all their experiments [2]. Spread across 226 correct names, that is between $1.50 and about $6 a name [5]. The inputs are web search, embeddings and a reasoning model such as GPT-5.2, with no breached data involved [6]. "The combination is often a unique fingerprint," Lermen wrote in a February 24 blog post [11]. He added, according to Cryptopolitan, that the cost is only going down [12].
The hit rate is less solid than the price. The paper says its results show "the practical obscurity protecting pseudonymous users online no longer holds" [13]. Every one of the 338, though, had a bio pointing to a LinkedIn page, and the researchers stripped the identifying details before the agent searched, according to Decrypt [4]. The published tests do not show a two-in-three rate on accounts whose owners never tied a handle to a real profile. On transcripts from Anthropic's interviews with 125 scientists, the agent identified at least 9 [7], or about 7% [6].
There are three ways to read the distance between 67% and 7%. One is that the Hacker News figure is near a ceiling, set by people who keep a LinkedIn page and post about their work. Another is that any rate belongs to the authors' own build, since they withheld code and prompts [8], and a copycat starts from a written description. The third, or rather the one that matters to anyone pricing the risk, is that at $1 to $4 an attempt even the interview test's rate puts a correct name at roughly $14 to $56 [7].
I think the third reading holds. The authors name governments targeting journalists and activists, and scammers building dossiers for social-engineering pitches, among the likely users [16]. For either, $56 a name is small. The researchers also argue there is no single switch a model provider can disable, only a chain of individually harmless-looking tasks [15]. Classical non-LLM baselines came close to zero in the larger matching tests [14], and the 2008 Netflix re-identification needed structured ratings data [17]. This pipeline works from comments.
I would be wrong if a replication on accounts with no self-link finds hit rates near zero. At a 1% rate and $4 an attempt, a correct name costs $400 [8].
What to watch
- A replication on pseudonymous accounts with no self-linked profile, and the hit rate and per-attempt cost it reports.
- A public reimplementation built from the paper's description, given that the authors withheld code and prompts.
- Any move by model providers to detect or refuse chained identification tasks at the matching and reasoning steps.