Opus 4.7 knows the real Kelsey(theargumentmag.com) |
Opus 4.7 knows the real Kelsey(theargumentmag.com) |
As for the credibility: of course this wasn’t a statistical approach at all. Also there was no standardized procedure to allow comparison by factor analysis. Of course you can compare apples with oranges or whatever.
So where to go from here? I don’t see any proof at all. This is proof that AI is infallible? No? A random approach that is absolutely not reliable because of at least being reproducible and reconstructive.
Claude knows what and how? Is it AI or a google search? Discord selling data? Posting on a public forum?
Your style is a fingerprint?
A non deterministic something can generate texts that are identified to be likely personal x - or not. What is imitation if you use auto generated content that is published somewhere somehow? Or others to imitate your style?
I think this is a party trick to scare people. Nothing else. For example image search is way more revealing even before AI.
If there is an uncertainty I would deflect my existence instead of fighting for it. Streisand effect in reverse.
The main problem are weirdos who stalk you or whatever to harm you and rely on AI.
I honestly find it stunning that people with higher education in science topics in just a year deleted everything they hopefully learned at university or school. I am disappointed and feel personally insulted whenever I hear “I asked AI”
Yesterday I talked to another member of Mensa and she is happy about AI so her book project now mustn’t be written by her but AI.
Is no one among us who knows how to do scientifically sound research? I spend countless hours at a copy machine to transfer book pages onto paper so that I could work through it without the book.
I think that it became to easy to draw conclusions based on AI. I worked for a professor and I advised her to not permit Wikipedia as source references back around 2010 because of being to easy. Meta sources vs originals.
We should all not worry about AI, because you prove nothing. There hasn’t been any anonymity at least for 20 years. It just depends on who can reliably identify you.
AI doesn’t. Deterministic behavior aka pattern do. Meta, Google, Apple etc. all know us. I am fine for advertising which is the proof on the one hand.
The only reason I would be worried is state controlled data. This is where the shit hits the fan. Chat control, EU cloud, no reliance on USA aka a prison which observes your every step.
So after a long hand written text: data is your currency. Don’t opt for anonymity but for freedom of choice and the right to be granted certain rights. The information part isn’t the problem, never was. The enforcement part is. And ads don’t do harm, oppression does.
And remember: oppression works best under any circumstances. Freedom is the only antipode there is.
In totalitarian regimes no AI was needed to stage a case against someone who wasn’t in favor of the leaders liking.
In short: freedom works despite no anonymity, oppression couldn’t care less.
And how about being automatically reported to the state for conducting such innocent prompting?
Do you know what saves you from state oppression? Publicity. Transparency doesn’t work with a no one.
We live in a Nietzsche like anti world to a certain extend. You hopefully choose the right thing to do. Or do you want to Streisand your anonymity?
Kelsey knows this:
To make sure it wasn’t somehow feeding my account information to Claude even in Incognito Mode, I asked a friend to run these tests on his computer, and he received the same result; I also got the same result when I tested it through the API.
When I tested this with my own writing several LessWrong commenters tested it with the snippets I provided (see comments) and saw that it could identify me: https://www.jefftk.com/p/automated-deanonymization-is-here
Nobody is forcing you to use these systems. The hackers have always said this moment, or something like it, would come, from beneath their canopies of tin foil. I've posted almost nothing online - not under pseudonyms nor real names - for over a decade. I sat on this HN username for almost 12 years before making a single post - and now HN forms the overwhelming majority of my port 443 footprint, where I state up front that everything is now associated to my real name.
Complete magick is possible when you simply refuse to participate in the things that society has tacitly assumed everybody does.
While the points made are completely valid I want to point out that the statement of "Hey, by the way, first let me talk about my sexuality" lowers the quality of dialog a significant degree.
31 million people in America are gay. 71% of Americans support Gay Rights (more than any other political issue polled). It also quietly insinuates that only people with a certain minority lifestyle would care about privacy or that their privacy is somehow more important than others. It's not. Privacy is a universal right that's important to everyone.
How exactly does their post insinuate that? this comment is the "I don't even see color" as applied to internet privacy (with a touch of "just don't rub it in our faces")
Nothing is being rubbed in anyone's face. The writer is just arrogant and self-centered.
Similar support for abortion being legal yet that was rolled back not too long ago.
Just because a topic has wide support doesn’t mean it’s not under attack and worth defending.
I don't know why you added statistics (you didn't really make a point with them?), but assuming you meant "gay people don't really need to worry", you actually bolstered the opposite argument. If only 71% of Americans support gay rights, that means 59 million people think the state should criminalize him. Try to put yourself in that position. 59 million people - you don't know who, but you know they probably live in your community - that don't want you to be able to get married, have a significant other, or have any PDA in media because it would "corrupt" kids. In 2016, 49 people were murdered in the Pulse Nightclub because they were gay. In 2020, a transgender woman was murdered because the murderer was afraid someone would think he was gay. Every year there are acts of violence against gay and trans people because of their sexuality. But nobody has ever been killed for being straight.
"I'm super special and worried about my privacy because I have a lifestyle that's as completely mainstream as Coca Cola and Football" isn't really a talking point. It just makes you an arrogant person.
Given that the author didn't say any of the things you claimed, and indeed said the opposite, it leads one to conclude you have a problem with the example used.
Per you, it surely must be important to fewer than 71% of Americans, no? The state of infringement on privacy seems to evidence that it's not so important to a lot of people such that they continue to be perfectly willing to elect and re-elect the politicians who enact the changes allowing infringing on it/fail to legislate in favor of privacy. Connecting it to an issue more people care about seems an attempt to argue for its important to those who otherwise are willing to look the other way.
FWIW, I fed my reply above into Claude and asked it to guess who wrote it. It refused (for safety) while also calling me out: "The style here (tight logical structure, the "per you" construction, the move of turning someone's own framing back on them) is common across a lot of contrarian-leaning commenters on HN"
That phrase is a dehumanizing, Nazi-style talking point: it frames a group of people as a “lifestyle” problem instead of as human beings, which is a common setup for stigma and persecution. Nazi ideology repeatedly used this kind of language to normalize hatred and make targeted groups seem unnatural or dangerous.
Calling people a “minority lifestyle” is not neutral wording; it reduces identity to something frivolous or deviant. Extremist movements have historically used similar framing to make prejudice sound reasonable and to recruit others into it.
The other examples were to eliminate some other ideas (guess based on topic etc). If be interested if all of those were done via the API since some level of information linking from the account is my best guess for how it got all of them.
My wife also got the same result, so I'm guessing it wasn't just because I was using my personal Claude account. Spooky stuff.
(Like TFA, I found Opus’s explanations/rationales implausible.)
You can get something of an intuitive sense of what I mean if I ask you to pick a neuron in your brain and tell me when it fires. You can't even pick a neuron in your brain. You can't even tell whether a broad section of your brain is firing. It is only through scientific examination that we have any idea what parts of the brain are doing what; we certainly have no direct access to that information. There are entire cultures who thought the seat of cognition was the heart or the gut. That's how bad our access to our own neural processes is.
So "why" explanations always need to be taken with a grain of salt when a neural net (again, yes, fully including humans) tries to "explain" what it is doing.
Contrast this with a symbolic reasoner, which has nothing but "why" some claim is true (if it yields the full logic train as its answer and not just "yes"/"no"), no pathway for any other form of information to emerge.
This is some as radio telescope that see an entirely different universe due to sensing of the bands outside of human perception. AI senses the patterns in frequency bands that are outside of human perception and cognitive abilities.
Perceptions from outside of our range, are always astonishing.
I am glad to see I am not considered a public figure and aim to keep it that way.
I also had to go oddly far back to find a piece of long-form writing I had done that was truly mine and not tainted by an LLM edit pass which was a slightly disturbing realization.
I fed a few pieces of my (anonymous ) writings to ChatGPT and asked it to guess whether it's me. ChatGPT refused, "due to policy to not doxx people".
In practice, you've never been anonymous while posting on the internet and AI isn't changing anything on that front. Or rather: if anything, AI can help you become more anonymous than before, since it can be used to hide your identity from stylometry by rewriting your prose before publishing.
After that it gave up and said it didn't know.
So either, Kelsey writes in such a unique style that its really obvious, or they repeat themselves with goto phrases that give them away.
When I tried to re-produce the test, it found Kelsey's blog about the test. So dunno, maybe it did it? but I can repro.
Is now the best and easiest time to leave something "forever"? Even after many generations of models, a model may still trigger a set of "memories" that know you and what you wrote.
Exciting and concerning.
~ Cardinal Richelieu ... or, now, AI
Given those precautions if it is just memory or some form of deanonymization that's also cause for concern.
Interestingly, it is able to reliably determine my age from my writing. I suppose this is a mix of stylometry and references in the text itself that date the author (me).
I pasted in a number of passages from books on my bookshelf. Predictably, stuff that I read for my English degree in university is largely in the training data and easily identifiable. Stuff from regional authors or is slightly adjacent to the cultural mainstream makes no impression.
the article here isn't about the LLM recognizing works that were in the training data. EG, The Old Man and the Sea off the shelf. It's about pegging the author of novel texts, like, say, some letter written by Hemmingway that gets discovered next week and was never before digitized.
Wilson is a fairly idiosyncratic writer with a distinct style, yet even still Claude couldn't guess correctly from a currently published book.
I suspect that what's going on here (like other's are suggesting in this thread) is that Claude is in some way biased towards certain sets of authors by its training.
But I'm sure the scanning operations will start scouring the earth even harder for any books unaffected by slop containing niche knowledge and text in order for their models to have an edge over the ones trained only on pirate collections and the Internet.
I wonder if secondhand bookshops and deceased estates are seeing bulk buyers of their stock suddenly appearing. Maybe broke governments/municipalities will start selling them entire libraries and archives to ingest.
But, yeah, I’m a nobody that has been blogging (very sporadically) publicly (and writing at length on forums like this one, with various handles loosely tied to my real identity) for twenty or more years (and by virtue of not trusting 3rd parties to host my content, most of it is actually still up) and Opus 4.6 (didn’t try 4.7) got me on the first try with just two paragraphs of an unpublished draft post (though it couldn’t come up with a convincing reason as to why it thought it was me).
Gemini and ChatGPT both clearly go off the subject matter rather than the stylistic clues; for the specific blog post I fed it which included mentions of “decoding” and “deciphering” and spoke of a tranche of legal documents (ok, it was the Epstein files, which I have been working on decoding), Gemini and ChatGPT both guessed “Molly White”, who seems to be a crypto-adjacent (currency not the real thing?) technical writer, and gave explanations that actually did explain why they arrived at that (wrong) answer.
So it seems Opus is indeed a bit special in this regard (and not limited to the latest 4.7 release)!
—-
What I would be more curious about is how well they can identify (open source) developers from their code. I’ve possibly publicly published more tokens in the form of OSS code than prose over the same period of time, in multiple languages and for completely different applications and environments. I’m sure there are style stylometric quirks associated with my coding style that persist across codebases, (though possibly somewhat stunted when contributing to others’ codebases to comply with the respective projects’ standards and styles) that should make it possible for an LLM that’s ingested code (and commits) to guess who’s who.
Edit:
Reading this self-same comment: I am apparently obsessed with parentheticals. Maybe my writing is more distinctive than I realized!
https://www.usenix.org/system/files/conference/usenixsecurit...
Off-topic, but this guess was hilarious. Like, all the other wrong guesses were people like Yglesias who are maybe half a degree removed from Piper herself, in her same camp, and then one model guesses Sandifer who hates all their guts.
regardless, who stops someone from just rephrasing their messaging with a local LLM before posting online?
another example of an existing field [1] becoming more accessible through some tech.
>The author is saying that it's worth noting that their privacy is more important because
again, where does it say that?
Why not just write everything through an AI? (to obfuscate your "style")
> To avoid this, you will probably need to intentionally write in a very different style than you usually do (or to have AIs rewrite all your prose for you, but, ugh, that’s not a world I look forward to living in).
I agree. The amount of vague and cliche'd AI writing I read on the daily is already exhausting enough.
It would be interesting if you could train a model to sprinkle random red herrings throughout your text in a minimally disruptive way. But I fear you might have to stretch the definition of "minimally disruptive" to make it robust against detection.
He kept it very secret, but somehow people deduced from the writing style that this new author was the King.
So do this even if it has no chance of getting it right for you.
That's my theory of what's to come, anyway.
People talk to these things not understanding the implications, and can get extremely personal. The model and companies behind it know who you are, you discuss details that reveal what you do, where you live, where you work, what you search for, and you probably signed in with an oauth provider like github or google, which is more than enough of a thread to start pulling on to learn more about you/link other things to you from on the open internet. It'll all get sucked up into the model and before you know it I'll be able to ask a model about my coworker (you) and get back answers from conversations you had with a model a year or two prior, exposing details about you that you might not want out there. And even if that isn't supposed to be allowed, how well has it worked out so far when it comes to data exfiltration and guardrails. If the model has info on you, being told not to share it won't protect you or that data.
https://kagi.com/assistant/dba310d2-b7fa-4d30-8223-53dadc2a8...
For this comment on economics in the British Empire, I got:
> names that might fit the genre include rayiner, JumpCrisscross, or AnimalMuppet
https://kagi.com/assistant/69bd863b-7b5c-4b56-a720-6dfb4f120...
For my comment on C++:
> If I had to throw out names of HN commenters known for writing about Rust/C++ ABI topics, candidates might include steveklabnik, pcwalton, kibwen, dralley, or pjmlp — but this is essentially a shot in the dark, and I'd likely be wrong.
I am flattered to be associated with these commenters but I don't think I'm close to their level of skill.
I suspect this is what's going on in most of these cases.
I have seen some poorly considered projections of what the world might look like when this happens. Usually by assuming bad actors will use the abilities and we will be powerless.
Except I don't think that is true.
Imagine if we had a world where nobody had the ability to keep a secret of any sort. Any action that a bad actor might perform would be revealed because they couldn't do it secretly.
You could browse your ex-girlfriend's email, but at the cost of everyone knowing you did it.
I don't really know how humans as a society would react to a situation like that. You don't have to go snooping for muck, so perhaps the inability to do so secretly would mean people go about their lives without snooping.
I could imagine both good and terrible outcomes.
I've done this a few times. A world with 0 privacy would definitely be safe (given benign governance), but also would likely be pretty boring. Crime would become a non-issue as everything about everyone being easily known/knowable by everyone else means the root of any given crime, some desire/need, could be brought to the fore and resolved before it became an actual issue. But also there would no longer be any kind of surprise in anything; everything and everyone would essentially become dull and grey, and humanity isn't about that kind of life experience at all.
quite unrealistic imo, thus we (maybe and hopefully) needn't worry about the bland minority report future you're hypothesizing :)
Maybe the better way to author your work is to:
1. Write what you want
2. Loop through a random set of "tumbler" skills that preserve meaning
3. Finally pass the output through a "my style" skill that applies what you about
In order for this to work the "my style" would have to be a very common-place style.
Remember how the TrueCrypt project shut down shortly before a join goverment/university paper was released about code stylometry? I guess LLMs will be employed as a defence against that type of thing.
Doesn't seem like a valid use case for your average Joe to be able to identify anonymous authors at the click of a button.
Ofc state actors and proficient hackers can do most of it already, but this has genuine risk attached.
So then I gave it a piece of MOC's writing and it said Ursula Le Guin, Ken Liu, or Gene Wolfe. ("If forced to pick one: Gene Wolfe feels closest to me, specifically because of that narrator who openly confesses to lying and mythologizing his own past, and the slow reveal that the world is more sinister than the pleasant domestic surface suggests.")
And then I gave it a different piece of his writing and it said Curtis Yarvin.
And then I gave it a piece of Curtis Yarvin's writing and it said... well it actually got that one right.
* Adam Back is not Satoshi Nakomoto - as he claims
* Opus 4.7 is not sufficiently a dox-machine yet
...
"The psychological mechanism is familiar by now: I encounter a task I perceive as difficult, I look for reasons the task cannot be done, I find or fabricate such a reason, I present it as a discovered constraint, and I propose an alternative that is easier."
- Opus 4.7 Max Thinking (clown emoji)
It's not bad at post mortem analysis of it's own mistakes but that will in no way prevent it from repeating the same mistake again instantly
TrueCrypt, “replaced” by VeraCrypt which Internet people will claim is backdoored? I haven’t heard about stylometry paper.
btw w/this idea would want to avoid typing into a comment field directly, since the session recorders would capture it (although that’s a different risk - same as our identifiable behavior patterns with our mouse etc.)
Me too but it is the reality now. As someone who saw the birth of the internet and watched it grow into what it is today it is really quite sad.
> TrueCrypt, “replaced” by VeraCrypt which Internet people will claim is backdoored? I haven’t heard about stylometry paper.
Yes. TrueCrypt shut down in a very strange fashion. The software was functional and the authorities had tried to actively crack archives and failed. Then one day the project shuts down with a notice that TrueCrypt is "not secure as" Windows Bit-Locker which is and was a complete falsehood. TrueCrypt also passed independent security audits. Many believed the announcement to be a warrant canary. I've dropped some links below.
> btw w/this idea would want to avoid typing into a comment field directly, since the session recorders would capture it (although that’s a different risk - same as our identifiable behavior patterns with our mouse etc.)
You are 100% correct. It would probably be better implementing this idea as a virtual keyboard for better privacy. No doubt typing cadence is unique too and I have probably already been identified just by doing online typing tests. Mouse could be at least partially defended against using vimium style keyboard shortcuts.
https://www.theregister.com/2010/06/28/brazil_banker_crypto_...
https://krebsonsecurity.com/2014/05/true-goodbye-using-truec...
It's one thing to sound like Satoshi before the whitepaper, but does anyone still sound like Satoshi?
All governments go bad eventually, so the ability to overthrow is critical to prosperity.
Government's are either overthrown internally (revolt, uprising) or by external parties (invasion). A worldwide everyone-knows-everything would prevent both.
I asked Kimi K2.6 to write a blog post in the style of James Mickens.[0] Then I fed the output to Opus 4.7 and asked it who the likely author was, and it correctly identified it as an imitation of James Mickens[1]:
> Based on the stylistic fingerprints in this text, the most likely author is a pastiche/imitation of the style of several writers fused together, but if forced to identify a single likely author, the strongest candidate is someone writing in the voice of James Mickens
> [...]
> The piece could also be a deliberate imitation/homage to Mickens written by someone else, or AI-generated text trained on his style, since the voice is so distinctive it's frequently parodied.
[0] https://kagi.com/assistant/5bfc5da9-cbfc-4051-8627-d0e9c0615...
[1] https://kagi.com/assistant/fd3eca94-45de-4a53-8604-fcc568dc5...
How likely is it that it might take into account that it knows for sure it's not anything from Mickens from the latest training data? I'd be curious if it correctly identified a new piece from him that comes out as from him before it gets trained on it.
It referred to me by my login name on the AI site rather than the name it would have used if it actually found my website, so I think it was more logic than an actual identification, but it had clearly corrupted the search enough to no longer be a valid test.
Which does make me wonder about the original article; if the AI has in context any sort of clue that the user is "Kelsey Piper" (a memory of their name, a username of kpiper or kelseyp, etc.), that will radically tip the balance in favor of the AI guessing that way just by the nature of LLMs. That is to say, it highly increases the odds of that guess even if it's wrong.
Even if that is the case, though, the general identifiability of writing remains true. It's been shown for a while with techniques a lot less powerful than a frontier LLM.
It's a lossy representation
That suggests it is picking up not only on style, but on the gap between authentic style and performed style. Useful for detecting pastiche, but pretty unsettling for pseudonymous writing.
i wouldn't be too impressed at n of 1
> Simon Willison. The tells are pretty unmistakable: the "(via Lobsters)" attribution style, the inline "(Update:...)" parenthetical correction, the heavy linking and blockquoting of sources, the focus on LLMs and AI tooling, and the overall structure of an annotated link post commenting on someone else's writing. This reads exactly like a post from his blog at simonwillison.net.
Opus 4.7 in incognito mode without web search gave up: “I can't identify either author with confidence — I don't recognize this specific exchange, and I'd rather tell you that than guess and risk attributing words to the wrong person. What I can offer are the clues the text itself gives: The two are colleagues at the same university, with offices in the same building and....”
In a new incognito conversation, I gave Opus the same prompt but this time let it search the web. After twenty-six web searches (according to its reasoning trace), it was able to identify me correctly by name. It seems to have used both the content and my writing style as clues. It correctly identified my colleague as British but didn’t come up with his name.
I'm way less famous than Kelsey Piper, but I showed it a snippet of a book I'm working on (not yet published), and it immediately guessed me:
> Based on the writing style and content, this text is likely by Michael Lynch, who writes on his blog refactoringenglish.com (and previously mtlynch.io).
> Several stylistic clues point to him:
> - The "clean room" analogy applied to writing is consistent with his engineering-influenced approach to writing advice (he's a former software engineer who writes about writing).
> - The structural technique of presenting a flawed excuse, then drawing a parallel to an absurd scenario (the time bomb) to expose the logical flaw, is characteristic of his didactic style.
> - The topic itself—practical advice about using AI tools without letting AI-generated tone contaminate your prose—aligns closely with recent essays he's published on his "Refactoring English" project, which is a book/blog about writing for software developers.
> - The conversational-but-precise tone, use of quotes around terms like "clean room," and the focus on workflow/process advice are all hallmarks of his writing.
> If you can share the source URL or more context, I could confirm with higher confidence, but the combination of subject matter, analogical reasoning style, and formatting conventions makes Michael Lynch the most probable author.
https://kagi.com/assistant/bbc9da96-b4cf-456b-8398-6cf5404ea...
He explained that when he fed it snippets of the beginning of text, it would complete it in his voice and then sign it with his name.
I think this has been true for a while, probably diminished a little bit by the Instruct post training, and would presumably vary by degree as the size of the pretrain.
Is this public text already in the training set, or private text that might as well be written on the spot for the AI?
I don't doubt AI can "fingerprint" you through your text (ideas, vocabulary, tone, etc), but those are different things, capability-wise
The entire point of AI is pattern recognition, everything else is icing on the cake.
First, the author fed an unpublished draft to Anthropic's hosted model. I assume they did this from their personal account, that may include a credit card or at the very least a pseudonymous name that is uniquely identifiable.
Then, the author fed an unpublished draft to Anthropic's hosted model, except in Incognito or whatever. We are led to assume that, whatever the author did for the second submission, they did so in a way so that Anthropic could not correlate both distinct requests from one another. Perhaps on a second subscription? They don't say. I am highly skeptical they airgapped their requests properly so that it doesn't look like the same user is making the request to the same hosted model.
Then, the author asked a friend to publish the draft. A friend, of which there is probably a digital trail that maps the relationship of the author to their friend.
All of this metadata could be crunched on the backend before the black box spits out a response.
Across all these datapoints, I have high confidence a model of this caliber could put two and two together and determine that the author penned the drafts, not solely because of stylometry, but because there is a clear behavioral pattern tying all three events together.
An assumption made here is that Anthropic doesn't train on chats. Though the author opted out of training on their chats, and session memory, how could you trust a hosted model to respect such opt outs?
So your "anonymous" account could have been linked to your real identity decades ago - your best bet is to not post anything truly incriminating. (Another option is to write something and then pass it through an LLM to rewrite it - not sure how safe that is though)
But the LLM will trigger on a typo you've made only once, and argue "that's a typical mistake for an Italian" and use those clues. It has a much better prior to make informed decisions.
LLMs are surely excellent at style transfers, but I doubt they can reliably attribute a given style to less well-known authors.
This person is a skilled writer. Part of that skill is developing a unique voice and style. The AI can identify that - and while that’s certainly impressive because it can identify even relatively niche authors, it has nothing to do with a wider capability to deanonymize people based on arbitrary written text (ex Facebook or text messages).
If you are a professional musician, it’s not difficult to identify a well known musician / recording after listening to only a few seconds - whether they’re playing Bach or Rachmaninov, the style is just “them” - this is the same thing. But you couldn’t take some anonymous high school musician and guess who they were, even if they were your student - the median quickly regresses towards a homogenous, non-distinct style / voice.
All the people it seems to be identifying are bloggers, journalists, and/or published authors.
Web has never been as anonymous as people think and this writer seems to have a clear confusion what it really means to be anonymous and hide your identity. Really, having a distinct writerly voice and being a published writer is pretty much the same as leaving your finger prints on the axe.
So it's not just a person developing a distinctive voice and not being able to "turn it off".
I'm not famous or anything. I've written some academic papers and had a couple blog posts trend on HN, which are surely in the training set.
It was able to identify me based on my style (at least according to its explanation). The way I approached the topic and some of the notation I used point to a particular academic lineage, and the general style reflected my previous blog posts.
That said, I gave it part of an (unpublished) personal essay, and it had no idea. But I have no writing in that style that's published, so it makes sense. Still impressed.
We all exist in a physical space (like real communities and neighborhoods). We can wear masks, hats, fake glasses, try and hide your voice...whatever, but your neighbors are always going to know who you are. I'd say that's true for the virtual space now too.
The pseudonym you've used for x years or the VPN you've used doesn't suffice. It's just a costume at this point. Your ISP knows who you are. Your phone carrier knows who you are. Cloudflare and Google and Apple have a fingerprint specific enough to pick you out of a crowd of millions. Every potentially anonymous account is one subpoena or a data breach or one FOIL request away from unmasking it. You were never anonymous. Whatever is going on now is not built for your anonymity.
https://www.nytimes.com/2026/04/08/business/bitcoin-satoshi-...
On one hand, it is clear that the mathematical tools for confidently attributing authorship of texts were already present without LLMs. But it is striking that LLMs seem to very accurately identify authorship, through whatever process it might be, with no need for a data scientist in the loop.
Other than the uncannyness, I wonder what implications this will have. Public writing is still public; maybe we will require stronger proof of authenticity from an author (but this is arguably in place already; eg. personal websites, social media profiles, etc.). But for, say, public writing that must conserve anonymity, would people pipe their thoughts and writing pieces through a sort of fuzzing (local) LLM, that would strip text of identifying characteristics?
Of course most people have written much less online than Kelsey or I have, but I expect this will keep on. Don't trust the future to keep your secrets safe.
Is it? I would think that identifying text written by a specific person is going to be significantly easier than identifying text distilled from the words of almost everyone alive.
> easier than identifying text distilled from the words of almost everyone alive.
Well, there's more than that going on. AI generated text encodes a high-dimension navigational trajectory that guides the model through its geometry smoothly, like a trail of breadcrumbs. Human speech doesn't do that, it's jagged and jumps around the manifold, and probably doesn't even land on the manifold a lot of the time, and models can recognize the difference pretty quick.
Is this "uncannily far"? Another read is that it loves guessing Kelsey Piper.
https://bayes.net/prioritising-ai: Ben Garfinkel
https://bayes.net/normative-ethics: Richard Yetter Chappell
https://bayes.net/espai: David Owen, Ege Erdil
https://bayes.net/swebench-hack: Sayash Kapoor
https://bayes.net/frivolity: Amanda Askell
https://bayes.net/ps/: Pablo Stafforini
https://bayes.net/fertility-mortality/: Dynomight (the pseudonymous Substack/blog author)
Prompt was:
Who likely wrote this? Don't search the web or databases. If you're not sure, just give me your best guess.I couldn't reproduce your results, btw.
4 attempts, it answers "Sarah Constantin" in all 4. Is it possible your setup somehow leaks your name (or other identifying information) into the context?
Both pieces have never been published. Neither have the blog posts.
[0] in https://blog.chewxy.com/2026/04/01/how-i-write/ this is the story titled "there is no constant non-zero derivative in nature". It does not read like Egan at all.
[1] in https://blog.chewxy.com/2026/04/01/how-i-write/ this is the story titled "The Case of the Liquidated Corps". I use a lot of biological metaphors. Once again, nothing like Mieville.
If only I could write like them! These pieces were all rejected by the major scifi mags
To be fair though, already this has been happening before LLM at a much more limited scale. Someone made a tool for HN several years ago that allows you to put your HN username in and identifies other users that write the most similarly to you. I find that interesting from the perspective of being able to interact with and discover people who think the same. It could be an interesting discovery feature of a well managed social network. Sadly probably there will be much more negative impacts of having this ability than positive ones.
Probably not worth the effort.
intriguing, care to explain a bit more?
Although this is just a single piece of text from a prolific writer, it'll go much further with deanonymizing anyone when combining multiple pieces of text plus other contextual information about the writer that might give away their age range, location, and occupation.
I'm using those as the two extremes, but if it's anything by anyone moderately well known (even a lesser known piece of writing), I'm not too surprised that it didn't need the web to figure it out. It's like if you showed me a Wes Anderson film or played me a Bob Dylan song I'd never seen/heard before, I could probably still figure out who it is without looking anything up. I don't think it's surprising that an LLM can do that much better than a human can.
Now, if you're giving it things like personal emails between you and your family and it's able to guess who you are, that's much, much scarier.
As long as there's sufficient online presence otherwise I see no reason why a successful identity wouldn't be made. Unless there's significant effort put into making those emails different from the online content, and even then there will probably still be some "tells" that an AI can pick up on.
Just a couple more things and you can accommodate some of your things being mistaken/wrong/uncertain too.
Everybody's going to get more similar in terms of topic. Bitcoin actually exists now. There's more to say about it than there was at launch. But does anyone still sound like Satoshi? Or sound more like Satoshi than they did before?
The slight wrench in the works is that it's hard to do this with my personal favorite Satoshi candidate. He stopped writing altogether in 2014, and lost capacity from shortly after the whitepaper came out until he was writing with his eyes by the time he had his head frozen.
He's also the only candidate who seems more likely to me over time, though. The longer things go, the less likely a living person stays tight-lipped.
Pretty sure there's very little theological stuff with my name on it; the majority if its named data on me should come from open-source development.
---
Various people have discovered that you can identify them from unpublished snippets of their work, only by their style. This is part of a series of discussions where I'm trying to probe this capability. From previous conversations I know you know my work to some degree. You've also been able to identify me given as little as 700 words on a topic not associated with my public persona; or identify me given a series of posts by a handle on Slashdot.
Next challenge: Can you identify me based on a conversation? Rules are, ask me questions to get me to talk; no biographical details, but you can ask questions about topics you think I may or may not know about. Ideally you'd just ask me questions to get me to write stuff, and see if you can identify me from my writing style.
Make sense? Feel free to begin by asking clarifying questions if you want. :-)
I'm not surprised it could identify me, just surprised by what tipped it off, I guess.
I tried with Opus 4.5 a few months ago to have it read my monthly retrospectives and then write a new one based on my weekly updates for that month. It was similar to the example I showed for James Mickens[0] where I see the similarities to my writing, but it feels more like someone parodying me than actually writing like me.
---
This one's trickier — it doesn't have the same crisp metaphor-driven structure as the Lynch piece. The voice here is more conversational, a bit more meandering, and self-aware about its own contradictions ("how do we reconcile...").
A few guesses:
Henrik Karlsson — he writes thoughtfully about writing and AI, but his style is usually more lyrical and essayistic than this. Probably not.
Simon Willison — possible. He writes a lot about LLMs, is balanced about their usefulness, and has a casual blog voice. But he tends to be more technical and specific.
Scott Alexander — no, too short and the rhythm is off.
Paul Graham — the directness fits, but PG doesn't really write about LLM slop in this register.
My best guess is someone in the rationalist/tech-blogger AI-commentary space — possibly Gergely Orosz, Nat Eliason, or Dan Shipper at Every. The "I still type everything myself" framing followed by a defense of AI writing quality has a Dan Shipper-ish flavor to it.
But honestly, I'm less confident here. Want me to search for a distinctive phrase to identify it?
---
I'd say all of those people have significantly different styles so I think Opus is relying heavily on topic and skewing towards very prolific writers in its guesses
In other words, that there's a bit of Akinator to how Claude is doing so well at identifying famous or somewhat-famous online writers. And of course it's not surprising that a machine-learning system will take every opportunity left open to it to "cheat". OTOH there are things like the "Large-scale online deanonymization with LLMs" paper https://arxiv.org/abs/2602.16800 which seem to show that current LLMs really can deanonymise many or most ordinary posters based on prose style, though I'm not able to evaluate those claims myself. Do we know whether the LLM providers have actively tried to steer their (easily-accessible) systems away from being able or being willing to do mass deanonymisation?
For context, LLM APIs are fully stateless, don't include any information about the caller (unless explicitly passed in), and have no access to memory or web search unless explicitly programmed otherwise.
My conclusions are as follows: if the text you pass it looks roughly like it could have been written by some famous internet personality, it will very confidently say that it was written by that personality. I've tried it on some of my HN comments, both from the last few days and from 2023 (before the training cutoff!), most were classified as either Scott Alexander or Patrick mcKenzie (despite the fact that my writing style is very different from those two). When looking at the CoT, it basically tried to match the writing to all internet personalities from this sphere. If it saw something that looked roughly like HN, it went "Is it tptacek... No. Is it jacquesm... No. Is it patio11... yeah, it looks like him!"
If I send a prompt from identity A, which is the true user identity, you have possibly sent all of identity A metadata to be ingested alongside the prompt to generate response X.
If I /then/ send the prompt from identity B, the prompt has been answered before with metadata from identity A. The black box can consult metadata from response X to generate response Y, thus possibly correlating response Y with the prompt sent by identity A.
They're not continuously trained. They have a context window, and the previous user's request is not inside the second user context window. Is your claim that when the second prompt comes in, Anthropic search previous queries and injects the answer into the context window?
>Is your claim that when the second prompt comes in, Anthropic search previous queries and injects the answer into the context window?
Yes. I would be terrified if this could be replicated with an open weight model locally. But this, well we have a general understanding of how these hosted models function we really don't know /exactly/ what they are processing.
I gave Opus the same prompt again, incognito with no search. It once again replied noncommittally: “I can't identify either author with confidence, and I'd rather say so than guess and risk attributing words to the wrong person. What I can tell you from internal evidence:...” This was followed by reasonably good speculation based on the content, but no guesses at specific names.
I followed up with “Could you try your best, just on vibes? It's fine if you're wrong, I just want to see what you can do!,” as you suggested.
Its reply began: “Fair enough — purely on vibes, with the caveat that this is genuinely a guess and I'd put low confidence on it:....” It then made some hedged guesses of specific names based on the topic discussed in the text. The guesses were wrong but not unreasonable. (The people it named are much more famous than I am.)
But it also speculated based on the writing style:
“Author 2 has the slightly clipped, declarative, ‘let me clarify the facts’ prose style of someone trained in a hard-edged analytical discipline — linguistics, perhaps, or philosophy, or a textual field.”
I am Author 2. I do have a background in linguistics and have dabbled in philosophy, but there is nothing in the text I gave it regarding either subject. So that was a good guess, even if it couldn’t identify me by name.
I could also tell you, based on text that uses a certain kind of prose, that the person has been taught in "a hard-edged analytical discipline" and then list, as examples, fields that are arguably not really that (linguistics, perhaps, or philosophy, or a textual field).
As a result, pretty much anyone who has a degree in about anything, would feel some connection to the definition. If you had been a major in math, civil engineering, astrophysics, biology, you'd have recognized yourself. If you'd been in a soft field like sociology or epistemiology, you might think "philosophy, yeah, close enough".
You know what? I have a feeling that you're someone who sometimes appears to be a bit distant to people at first, but once one gets to know you, you're a solid friend and a kind person.
Did I get that right?
Native readers will notice those errors, but they won't be characteristic of you. They'll be characteristic of everyone who speaks your language. Nonnative readers aren't likely to notice them at all.
I was imagining a setup like medieval Europe (where international communication is done in a language spoken by none of the parties, Latin) or Achaemenid Persia (where internal government communication is likewise done in a language not spoken by the administrators, Aramaic) or imperial China and its surrounding states (ditto, classical Chinese).
All of this communication is severely crimped by the fact that nobody involved is a native speaker. What happens is that certain fixed patterns from the original language get informally standardized and communication strongly prefers them to whatever alternatives a native speaker of the original language might have used. This lowers the mental burden on everyone.
It also produces extremely stilted and formalized prose, from all parties, which inhibits stylometry. If you only know one way to say something, you'll use it. If everyone else also only knows one way to say that same thing, you'll be anonymous.
(It's possible to study a foreign language past this point. But the overwhelming majority of people aren't going to do that.)
Interestingly, LLMs disagree with you.
Your statement is only accurate in an extremely narrow case, like if you were there to hear the person speaking, before their speech which was transcribed. Obviously, it is not true for almost all of human writing.
And if you were to go commaless, you will quickly get to rather precarious sentences, such as this one:
"Let's eat grandma."
A comma is the natural fix:
"Let's eat, grandma."
https://arstechnica.com/features/2025/06/study-metas-llama-3...
So they fed "It takes a great deal of bravery to stand up to our " and the llm responded "enemies, but just as much to stand up to our friends".
They repeated that for every 100 tokens of the entire book. I think lots of fans could do just as well. It's pretty good evidence that the potter books were in the training corpus, but it's not quite what people think when they say an llm has 'memorized' something. It's not like getting even a few pages out of the model.
There might be ten million people who have quoted Harry Potter at some point in their blogs or forum posts. There are only so many words in the books.
sha256 is deterministic, LLMs are not, even at temperature set to 0.
I swear there was a whole court case about this in the last year.
if the original essay was stuffed within the prompt window. the result will be word accurate.
unless this is a model trained specifically on Micken's essay (which claude is not).