Agentic language models can identify anonymized interview subjects online
AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search
Cryptography and SecurityArtificial IntelligenceComputers and Society
Summary
This paper shows that advanced language models using web search can often figure out who is behind anonymized interview transcripts by looking up public information. The authors created a collection of fake interviews linked to real people to test how well different models can do this re-identification. They found that even without searching the web, some models could guess identities from memory, and searching greatly increased success. Efforts to hide identities or give privacy warnings helped less with web searches than expected. Their work suggests that tracking the search process could help highlight sensitive information that puts identities at risk.
What this means in practice
- •For data privacy teams: Evaluate and improve anonymization methods by testing vulnerability against web-enabled language model re-identification attacks.
- •For software security engineers: Use search trajectory analysis to detect and redact text spans that leak identities during automated de-identification processes.
Authors
Jianing Wen, Tianshi Li
Abstract
As Large Language Models (LLMs) gain tool use capabilities such as web search, they can retrieve and cross-reference public information, creating privacy risks beyond memorization. One manifestation is re-identification: linking an anonymized interview transcript to a named individual. Yet without ground-truth identities, the coverage of such attacks and the protection offered by a defense cannot be reliably measured. We introduce AgentDOXX, an evaluation suite of 822 synthetic interview transcripts grounded in public information about real individuals with known identities. We evaluate fifteen configurations of open-weight and proprietary models, isolating the effect of web search, and analyze their search trajectories to distinguish retrieval-driven from parametric identifications. Ground-truth identities reveal that re-identification risk is distributed across an agent's execution: retrieval and parametric recall both contribute, with open-weight models identifying 15-28% of transcripts without search; identification succeeds in over 88% of cases once the target appears in a retrieved result; entity masking leaves at least one attacker successful on 85.3% of a stratified sample; and privacy instructions suppress naming but not retrieval, with configurations scoring 0% accuracy yet retrieving the subject in up to 62% of transcripts. We further show that observed attack trajectories can provide supervision for localizing identifying spans, offering a path toward attack-informed anonymization.