Taking your name off is not the same as being anonymous
Most of us have been told that privacy means hiding your name. Take the name off, take the address off, take the account off, and what is left is "anonymous." A new study shows how weak that idea is, using something many people now type into every day: conversations with AI chatbots.
The paper is Can Prompt Anonymity Protect Your Identity From LLM Providers?, by Dzung Pham, Dillon Sheils, Naina Singh and Amir Houmansadr of the University of Massachusetts Amherst. It is a preprint, still under review. Its authors have nothing to do with Cluzy. We are writing about it because it tests, with real data, an assumption the whole data industry leans on.
The setup
Some services now let you use ChatGPT, Claude and similar tools without the AI company knowing who you are. Your question goes to a go-between first. The go-between removes your account, your IP address and anything else that points at you, then passes the question along. Some also rewrite the question to remove names and smooth out your writing style.
What the AI company still sees is the question itself. The researchers asked a simple thing: is that enough to work out who wrote it?
What they found
They gathered more than 175,000 real conversations, some from people using ChatGPT and some from software developers using AI coding assistants. Then they played the part of the AI company. The company already holds each person's earlier conversations under their real account. Later, the same people start arriving anonymously.
The attack was not elaborate. Each conversation was turned into a numerical summary of what it was about, and each anonymous conversation was matched to the known person whose past conversations were closest.
It worked far better than chance:
- Developers: for 50 to 75 percent of them, at least one anonymous conversation was traced back to the right person.
- Everyday chatbot users: up to about 10 percent, out of a much larger and more varied crowd.
- Even without naming anyone, anonymous conversations could be grouped by who wrote them, well above chance.
Those rates hold while keeping false accusations low. The attacker was allowed to wrongly claim no more than one in ten of the people it had never seen before.
The fixes did not fix it
The researchers then tried the defenses on offer today. One rewrote every message in a neutral, formal style. Another, taken from a real anonymous-AI service, swapped names and organisations for placeholders and removed signatures, emoji and catchphrases. A third, their own invention, tried to confuse the attacker's tools directly.
None of them meaningfully stopped people from being identified. The reason is the most useful idea in the paper. What gives you away is not your name, and mostly not your style. It is what you ask about, and how you work. A person who keeps asking about the same project, the same illness or the same dispute is recognisable without ever saying who they are. As the authors put it:
Our findings unveil the risk of relying only on anonymity for private LLM inference and the gap in existing text privacy defenses.
Why this matters beyond chatbots
Swap "chat conversation" for "data broker file" and the lesson is the same. The data industry often defends itself by saying the records it sells are "de-identified": names removed, emails hashed, a number in place of a person. This study is one more piece of evidence that removing labels does not remove identity. The content is the identity.
That is also why people-search listings matter even when they seem harmless one at a time. An old address, a relative's name, a phone number. Each is a clue, and together they point at one person.
How Cluzy thinks about it
Cluzy shows you what data brokers may be selling about you and helps you remove your listings from people-finder sites. Over time we want to give you a say in what, if anything, is shared about you, and on what terms.
This paper sharpens three rules we hold ourselves to:
- We will not call something anonymous just because the name is gone. Taking out identifiers is a start, not a guarantee, and we will not use the word loosely.
- Share answers, not records. If someone wants to learn something from people like you, the safer design gives them a count or a conclusion across many people, not your records with the labels peeled off. A record can be traced. A well-built answer about a large group is much harder to trace back to anyone.
- Less is safer. In our last post we wrote about sharing only the slice that answers a question. This paper adds the other half. Even the slice can identify you, so the smallest useful amount, from the largest group, is the goal.
What the paper does not show
- It is a preprint. It has not finished peer review, and its numbers may change.
- The attacker had a head start. It assumes the AI company already has your earlier conversations under your real name. Someone it has never known by name cannot be named this way, though their conversations can still be grouped together.
- Ten percent is not everyone. For everyday users, most were not identified. But a privacy tool that fails one person in ten is not one you would choose knowingly.
- It is about chatbots. We are drawing a lesson about personal data in general. The authors did not test data broker records.
The takeaway is simple and worth repeating. Hiding your name is not the same as being private. What protects you is sharing less, and sharing it in a form that cannot be traced back to you.
Reference
Dzung Pham, Dillon Sheils, Naina Singh and Amir Houmansadr. "Can Prompt Anonymity Protect Your Identity From LLM Providers?" Preprint, under review. arXiv:2609.33903, September 2026. arxiv.org/abs/2609.33903