Elamur Research⌕
☰
home / papers / 2026 / De-Anonymization at Scale via Tournament-Style Attribution

De-Anonymization at Scale via Tournament-Style Attribution

Paper · 2026 · Lirui Zhang and Huishuai Zhang

Summary

The paper examines whether large language models can break anonymity in settings such as double-blind peer review. In these settings the pool of possible authors is huge and no labeled writing samples exist for any of them, so classical closed-set authorship attribution does not apply. The authors propose DAS (De-Anonymization at Scale), a two-stage pipeline that requires no training:

  • Optional first stage: a CoSENT-based embedding model ranks the corpus by cosine similarity to a query text. This cuts tens of thousands of documents down to a short list while keeping recall high.
  • Second stage: a "tournament." Candidates are shuffled into small groups, an LLM picks the likeliest same-author text in each group, and the winners are regrouped until a top-k ranking remains. Several independent runs with different partitions award points to winners, and these scores are combined in a voting-like fashion.

The authors evaluate DAS on anonymized ICLR reviews from OpenReview, the Enron email corpus and the Blog Authorship Corpus. It recovers same-author texts far more often than chance and outperforms direct LLM prompting (the AIDBench baseline). The work shows that LLM-driven stylometric attacks are a practical privacy risk for anonymous platforms.

Key points

  • Shortlist success rates (Rank@20): about 44% for peer reviews, 94% for blogs and 88% for Enron emails. In practice, an attacker would only need to inspect a small list of candidates.
  • Enron, one-to-many identification with Qwen1.5-72B-Chat: DAS reaches 85.0 Rank@1 against AIDBench's 66.7 with 2 authors, and 80.0 against 66.7 with 5 authors.
  • Blog ablation (DAS vs. the DAS-PE variant): DAS reaches 94% Rank@20 against 68%, and its miss rate drops from 32% to 6%.
  • Robustness across LLMs: results hold beyond the two main models, Gemini-2.0-flash and Qwen1.5-72B-Chat. On a research-paper task with two authors, Claude-3.5-Sonnet scores 100% Rank@1 and DeepSeek-R1 scores 96.3%.
  • Data and ethics: review data come from public, anonymized ICLR 2023–2025 OpenReview records and are used only for evaluation, not training. A small human validation study involved 9 participants and 25 test cases. The authors report only aggregated results.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Peking UniversityBeijing · China315 works · 43,267 citations🎓Beihang UniversityBeijing · China86 works · 9,097 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

Cite

Cite as Lirui Zhang and Huishuai Zhang. 2026. De-Anonymization at Scale via Tournament-Style Attribution. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1489

@inproceedings{zhang2026de,
  title = {{De-Anonymization at Scale via Tournament-Style Attribution}},
  author = {Lirui Zhang and Huishuai Zhang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1489},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1489}
}

References

30 references, 4 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Khai Loong Aw, Syrielle Montariol, Badr AlKhamissi, Martin Schrimpf, and Antoine Bosselut. 2023. Instruction-tuning aligns llms to the human brain. arXiv preprint arXiv:2312.00575. — [arXiv:2312.00575](https://arxiv.org/abs/2312.00575) find
  2. Janek Bevendorff, Ian Borrego-Obrador, Mara Chinea-Ríos, Marc Franco-Salvador, Maik Fröbe, Annina Heini, Krzysztof Kredens, Maximilian Mayerl, Piotr Pezik, Martin Potthast, and 1 others. 2023. Overview of PAN 2023: Authorship verification, multi-author writing style analysis, profiling cryptocurrenc… find
  3. Janek Bevendorff, Xavier Bonet Casals, Berta Chulvi, Daryna Dementieva, Ashaf Elnagar, Dayne Freitag, Maik Fröbe, Damir Korenčić, Maximilian Mayerl, Animesh Mukherjee, and 1 others. 2024. Overview of PAN 2024: multi-author writing style analysis, multilingual text detoxification, oppositional thin… find
  4. Janek Bevendorff, Berta Chulvi, Elisabetta Fersini, Annina Heini, Mike Kestemont, Krzysztof Kredens, Maximilian Mayerl, Reynier Ortega-Bueno, Piotr P˛ezik, Martin Potthast, and 1 others. 2022. Overview of pan 2022: Authorship verification, profiling irony and stereotype spreaders, and style change d… find
  5. Michael Brennan, Sadia Afroz, and Rachel Greenstadt. 2012. Adversarial stylometry: Circumventing authorship recognition to preserve privacy and anonymity. ACM Transactions on Information and System Security (TISSEC), 15(3):1–22. find
  6. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, and 1 others. 2024. A survey on evaluation of large language models. ACM Transactions on Intelligent Systems and Technology, 15(3):1–45.
  7. Chris Emmery, Ákos Kádár, and Grzegorz Chrupała. 2021. Adversarial stylometry in the wild: Transferable lexical substitution attacks on author profiling. arXiv preprint arXiv:2101.11310. find
  8. Svetlana Gorovaia, Gleb Schmidt, and Ivan P Yamshchikov. 2024. Sui generis: Large language models for authorship attribution and verification in latin. In Proceedings of the 4th International Conference on Natural Language Processing for Digital Humanities, pages 398–412. find
  9. Moshe Koppel, Jonathan Schler, and Elisheva Bonchek-Dokow. 2007. Measuring differentiability: Unmasking pseudonymous authors. Journal of Machine Learning Research, 8(6). find
  10. Moshe Koppel and Yaron Winter. 2014. Determining if two documents are written by the same author. Journal of the Association for Information Science and Technology, 65(1):178–187. find
  11. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems, 33:9459–…
  12. David Madigan, Alexander Genkin, David D Lewis, and Dmitriy Fradkin. 2005. Bayesian multinomial logistic regression for author identification. Bayesian Inference and Maximum Entropy Methods in Science and Engineering, 803:509–516. find
  13. Xie He, Arash Habibi Lashkari, Nikhill Vombatkere, and Dilli Prasad Sharma. 2024. Authorship attribution methods, challenges, and future research directions: A comprehensive survey. Information, 15(3):131. find
  14. Tempestt Neal, Kalaivani Sundararajan, Aneez Fatima, Yiming Yan, Yingfei Xiang, and Damon Woodard. 2017. Surveying stylometry techniques and applications. ACM Computing Surveys (CSuR), 50(6):1–36. find
  15. David I Holmes. 1994. Authorship attribution. Computers and the Humanities, 28:87–106. find
  16. Alex Nyffenegger, Matthias Stürmer, and Joel Niklaus. 2023. Anonymity at risk? assessing re-identification capabilities of large language models. arXiv preprint arXiv:2308.11103. — [arXiv:2308.11103](https://arxiv.org/abs/2308.11103) find
  17. Baixiang Huang, Canyu Chen, and Kai Shu. 2024a. Can large language models identify authorship? ArXiv, abs/2403.08213. find
  18. Baixiang Huang, Canyu Chen, and Kai Shu. 2025. Authorship attribution in the era of LLMs: Problems, methodologies, and challenges. ACM SIGKDD Explorations Newsletter, 26(2):21–43. find
  19. Xiang Huang, Hao Peng, Dongcheng Zou, Zhiwei Liu, Jianxin Li, Kay Liu, Jia Wu, Jianlin Su, and Philip S Yu. 2024b. Cosent: consistent sentence embedding via similarity ranking. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 32:2800– 2813. find
  20. Chia-Yu Hung, Zhiqiang Hu, Yujia Hu, and Roy Ka-Wei Lee. 2023. Who wrote it and why? prompting large-language models for authorship verification. In Conference on Empirical Methods in Natural Language Processing. find
  21. Bryan Klimt and Yiming Yang. 2004. The Enron corpus: A new dataset for email classification research. In European conference on machine learning, pages 217–226. Springer. find
  22. Moshe Koppel, Jonathan Schler, Shlomo Argamon, and Eran Messeri. 2006. Authorship attribution with thousands of candidate authors. In Proceedings of the 29th annual international ACM SIGIR conference on Research and development in information retrieval, pages 659–660. find
  23. Jonathan Schler, Moshe Koppel, Shlomo Engelson Argamon, and James W. Pennebaker. 2006. Effects of age and gender on blogging. In AAAI Spring Symposium: Computational Approaches to Analyzing Weblogs. find
  24. Yanir Seroussi, Ingrid Zukerman, and Fabian Bohnert. 2014. Authorship attribution with topic models. Computational Linguistics, 40(2):269–310.
  25. Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models. arXiv preprint arXiv:2310.07298. — [arXiv:2310.07298](https://arxiv.org/abs/2310.07298) find
  26. Efstathios Stamatatos. 2009. A survey of modern authorship attribution methods. Journal of the American Society for information Science and Technology, 60(3):538–556. find
  27. Efstathios Stamatatos, Francisco Rangel, Michael Tschuggnall, Benno Stein, Mike Kestemont, Paolo Rosso, and Martin Potthast. 2018. Overview of pan 2018: Author identification, author profiling, and author obfuscation. In Experimental IR Meets Multilinguality, Multimodality, and Interaction: 9th Inte… find
  28. Zichen Wen, Dadi Guo, and Huishuai Zhang. 2024. Aidbench: A benchmark for evaluating the authorship identification capability of large language models. arXiv preprint arXiv:2411.13226. — [arXiv:2411.13226](https://arxiv.org/abs/2411.13226) find
  29. Ming Xu. 2023. Text2vec: Text to vector toolkit. https://github.com/shibing624/text2vec. ↗
  30. Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, and 1 others. 2023. A survey of large language models. arXiv preprint arXiv:2303.18223. *Figure 3: User interface of our platform*

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhang-2026-de-anonymization-scale-tournament-style/