Assessing Deanonymization Risks with Stylometry-Assisted LLM Agent
| Authors | Boyang Zhang & Yang Zhang |
| Year | 2026 |
| Field | NLP |
| arXiv | 2602.23079 |
| Download | |
| Categories | cs.CL, cs.CR, cs.LG |
Abstract
The rapid advancement of large language models (LLMs) has enabled powerful authorship inference capabilities, raising growing concerns about unintended deanonymization risks in textual data such as news articles. In this work, we introduce an LLM agent designed to evaluate and mitigate such risks through a structured, interpretable pipeline. Central to our framework is the proposed \textit{SALA} (Stylometry-Assisted LLM Analysis) method, which integrates quantitative stylometric features with LLM reasoning for robust and transparent authorship attribution. Experiments on large-scale news datasets demonstrate that \textit{SALA}, particularly when augmented with a database module, achieves high inference accuracy in various scenarios. Finally, we propose a guided recomposition strategy that leverages the agent's reasoning trace to generate rewriting prompts, effectively reducing authorship identifiability while preserving textual meaning. Our findings highlight both the deanonymization potential of LLM agents and the importance of interpretable, proactive defenses for safeguarding author privacy.
Engineering Breakdown
Plain English
This paper addresses the risk that LLMs can identify who wrote a document even when the author tried to stay anonymous, which is a serious problem for journalists, activists, and whistleblowers. The authors built an LLM-based agent called SALA (Stylometry-Assisted LLM Analysis) that combines traditional stylometric features (like word frequency, sentence length patterns) with LLM reasoning to detect and measure deanonymization vulnerabilities in text. They tested it on large-scale news datasets and showed the system achieves high accuracy at inferring authorship across multiple scenarios. The paper also proposes mitigation strategies to help reduce these privacy risks before publishing sensitive text.
Core Technical Contribution
The core novelty is SALA, which intelligently fuses quantitative stylometric analysis with LLM-based reasoning in a structured pipeline rather than treating them as separate tasks. Prior work either relied purely on classical stylometry (limited by hand-crafted features) or applied LLMs directly to authorship attribution (opaque black-box reasoning). SALA's key insight is that stylometric features provide interpretable, quantifiable signals about writing style that guide the LLM's inference process, making the attribution decision both more accurate and auditable. The addition of a database module further improves accuracy by allowing the system to match against known author samples, creating a hybrid retrieval-and-reasoning system.
How It Works
The SALA pipeline takes a text sample as input and first extracts classical stylometric features—measurements like average word length, type-token ratio, punctuation frequency, vocabulary richness, and syntactic patterns that characterize an author's writing style. These quantitative features are then presented to an LLM alongside the text itself, priming the model with interpretable signals about style before it performs reasoning. The LLM uses this enriched context to reason about potential authors, considering both explicit style markers and implicit patterns it learned during training. When augmented with a database module, SALA retrieves candidate authors from a reference corpus whose writing styles are most similar (using the stylometric features as a similarity metric), then has the LLM rank or match against these candidates. The system outputs both a predicted author identity and a confidence score with reasoning traces, making the decision explainable rather than a direct black-box prediction.
Production Impact
For teams building privacy-sensitive systems (content platforms, news organizations, whistleblower portals, anonymous forums), this work provides a tool to proactively audit deanonymization risk before publication—similar to how you'd run a security scanner before deploying code. You could integrate SALA into a content review pipeline: extract stylometric features from user submissions, run the LLM agent to estimate authorship inference risk, and flag high-risk content for additional anonymization (word replacement, paraphrasing, or temporal delays). The interpretability is crucial for production: unlike a pure neural approach, SALA's stylometric features and LLM reasoning traces let legal and privacy teams understand why a document is at risk and defend decisions to authors or regulators. Trade-offs include computational cost (LLM inference per document, plus stylometric computation), latency (multi-step pipeline adds 1-5 seconds per document), and the need to maintain a reference author database if using the augmented version, which requires careful data governance.
Limitations and When Not to Use This
The paper assumes that writing style is stable and distinctive enough to enable attribution, which may fail for very short texts, heavily edited content, or when authors deliberately mask their style—the system cannot distinguish genuine anonymization success from failed attempts. It doesn't address semantic-level leaks (e.g., unique personal facts mentioned in the text) and focuses narrowly on stylometry, so an author could still be identified through context rather than writing style. The scalability to extremely large reference corpora (millions of authors) is unclear, and the paper doesn't detail computational costs or latency benchmarks needed for real-time deployment. Finally, the adversarial robustness is unknown—there's no evaluation of whether an author can systematically defeat SALA by mimicking another's style or using paraphrasing tools, which is critical for high-stakes use cases like protecting activists.
Research Context
This work builds on decades of classical stylometry research (Mosteller & Wallace's work on authorship attribution, Efstathios Stamatatos's surveys) while modernizing it with LLMs, recognizing that neural language models have strong implicit authorship knowledge. It's positioned against recent findings that showed LLMs can perform surprising accuracy at authorship inference without explicit training, raising privacy concerns in the era of public LLM APIs. The paper extends prior work on LLM interpretability and explainability by grounding LLM reasoning in human-interpretable stylometric features, bridging the gap between symbolic and neural approaches. This opens a research direction on privacy-aware NLP: designing systems that quantify and mitigate unintended information leakage in text, applicable to other sensitive attributes like location, health status, or organizational affiliation.
:::tip Subscribe Get weekly breakdowns of papers like this in AI Letters - the newsletter for engineers building production AI systems. :::