用大模型批量识别匿名文本作者，揭示学术评审等场景的隐私风险。
De-Anonymization at Scale via Tournament-Style Attribution
- 通过分组投票和迭代筛选，从数万篇文档中定位同一作者文本。
- 在匿名评审数据中准确率远超随机水平，实测可突破数万规模。
- 适合关注大模型隐私漏洞的研究者与平台安全设计人员。
随着大语言模型快速演进并进入实际应用，其隐私影响日益突出。本文研究作者身份去匿名化威胁：利用大模型将匿名文档与作者关联，可能危及双盲评审等场景。我们提出大规模去匿名化方法DAS，基于大模型实现对数万候选文本的作者归属。DAS采用序列推进策略：将候选语料随机划分为固定大小分组，调用大模型判断哪篇最可能与查询文本同作者，并持续对幸存文本重查，生成排名前k的结果列表。为实现大规模应用，DAS引入密集检索预过滤缩小搜索空间，并通过多次独立运行的多数投票聚合提升鲁棒性与排序精度。在匿名评审数据上的实验表明，DAS可在数万篇文档池中以远高于随机水平的准确率恢复同作者文本，揭示了匿名平台的真实隐私风险。在标准作者归属基准（Enron邮件与博客）上，DAS在准确率与可扩展性方面均优于以往方法，凸显出新型大模型驱动的去匿名化漏洞。
原文摘要 · Abstract (English)
As LLMs rapidly advance and enter real-world use, their privacy implications are increasingly important. We study an authorship de-anonymization threat: using LLMs to link anonymous documents to their authors, potentially compromising settings such as double-blind peer review. We propose De-Anonymization at Scale (DAS), a large language model-based method for attributing authorship among tens of thousands of candidate texts. DAS uses a sequential progression strategy: it randomly partitions the candidate corpus into fixed-size groups, prompts an LLM to select the text most likely written by the same author as a query text, and iteratively re-queries the surviving candidates to produce a ranked top-k list. To make this practical at scale, DAS adds a dense-retrieval prefilter to shrink the search space and a majority-voting style aggregation over multiple independent runs to improve robustness and ranking precision. Experiments on anonymized review data show DAS can recover same-author texts from pools of tens of thousands with accuracy well above chance, demonstrating a realistic privacy risk for anonymous platforms. On standard authorship benchmarks (Enron emails and blog posts), DAS also improves both accuracy and scalability over prior approaches, highlighting a new LLM-enabled de-anonymization vulnerability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。