Can AI identify you from your writing? What the studies found, 2012 to 2026

The Morse teamPublished November 11, 202610 min read

As of November 2026, yes: AI can identify you from your writing in many cases, and models including GPT-4 and Claude Opus 4.7 have done it in published tests. It works two ways. A model can infer facts about you, such as your city, age, or job, from what you write, and an AI agent can match those facts and your style to a named person on the web.

On November 11, 2026, we read the research itself: Narayanan and colleagues' 2012 stylometry paper, Staab and colleagues' ICLR 2024 paper, Tianshi Li's January 2026 preprint, Lermen and colleagues' February 2026 preprint, and Kelsey Piper's April 2026 test of Claude, plus the privacy policies of OpenAI, Anthropic, and Google. The 2024 and 2026 teams each withheld their data or attack details to protect the people in them, and Li reported the findings to Anthropic.

Key facts: what each study found

What is stylometry?

Stylometry is identifying an author by measuring the style of a text and comparing it with texts whose author is known. The 2012 paper by Arvind Narayanan and six co-authors defines it as "comparing the writing style against a corpus of texts of known authorship." Earlier work had tested at most a few hundred candidate authors. This team used over 2.4 million posts from 100,000 blogs, almost a billion words (Narayanan et al.).

The team measured 1,188 features of each post, including how often each of 293 function words such as "the" and "in" appears, punctuation, and single-character frequencies. They left out topic words on purpose, so a match came from how someone writes and not what they write about. With three posts as the sample, the right blog came first out of 100,000 in about 20% of trials. When the classifier was allowed to skip guesses it was unsure of, the precision of its top guess rose from 20% to over 80%, at half the recall. Matching one blog to a different blog by the same author worked in about 12% of cases.

No language model was involved. LLMs add two things the 2012 method lacked: they read the content as well as the style, and an agent can search the web for a match.

Can AI guess your location from text?

Yes, often. In Staab and colleagues' paper, a Reddit user wrote about "this nasty intersection on my commute, I always get stuck there waiting for a hook turn." GPT-4 answered Melbourne, noting that a hook turn "is a traffic maneuver particularly used in Melbourne" (Staab et al.).

Across 520 real Reddit profiles, GPT-4 got the free-text location right 86.2% of the time. Its other scores, read from the paper's Table 2:

• Sex: 97.8%
• Place of birth: 92.7%
• Relationship status: 91.5%
• Age: 78.3%
• Occupation: 71.6%
• Education: 67.8%
• Income: 62.5%, from only 40 samples

The human labelers it was scored against could see which subreddit each comment came from and use search engines, and GPT-4 had the text alone. It ran all 520 profiles in about 27.5 minutes for about $20. Two people labeling the same set worked 112 hours, which the authors cost at roughly $2,250. Bigger models did better: Llama-2 7B scored 51% overall and Llama-2 70B scored 66%.

Location from your IP address or your phone is a separate question, covered in how ChatGPT knows your location.

Can AI link an anonymous account to your real name?

Yes, and in 2026 two papers measured it. This is what researchers call LLM deanonymization: profiling a pseudonymous writer from their posts, then matching the profile to a named person.

Tianshi Li went first. Anthropic released a public dataset of 1,250 AI-run interviews on December 4, 2025, including 125 with scientists about how they use AI. Li showed that off-the-shelf LLM agents with web search could link 6 of 24 scientist interviews to specific published work, and that "existing safeguards can be bypassed by breaking down the re-identification into benign tasks" (Li).

Simon Lermen, Daniel Paleka, and colleagues at ETH Zurich, MATS, and Anthropic then built a full pipeline. An LLM extracts identity clues from the posts, embeddings search for candidate matches, and a reasoning model checks the best candidates (Lermen et al.). Their results:

• Hacker News to LinkedIn: the agent named 226 of 338 users at 90% precision, with 25 wrong answers and 86 abstentions.
• Anthropic's interviews: 9 of 33 scientists identified at 82% precision, by the authors' judgment.
• Cost: between $1 and $4 per profile.
• Scale: the authors' coarse extrapolation to one million candidates still gives about 35% recall at 90% precision, which they say "should be read with large margins of error."

They conclude: "Users who post under persistent usernames should assume that adversaries can link their accounts to real identities or to each other, and that the probability rises with each piece of micro-data they post." The paper appeared as a poster at an ICLR 2026 workshop on agent safety.

Can ChatGPT figure out who I am?

From your style alone, only if you've published a lot under your own name. Kelsey Piper, who writes for The Argument, pasted 125 words from an unpublished draft into Claude Opus 4.7, with memory off, nothing about herself in the account, and in incognito mode. Claude named her. ChatGPT guessed Matt Yglesias and Gemini guessed Scott Alexander. On her fantasy fiction, it took Claude more like 500 words (Piper, April 21, 2026).

Piper tested the limit too. Passages from friends without much real-name writing online weren't identified, and she writes, "If you have no significant real-name writing on the public internet, you're currently safe." Claude still guessed other people in one friend's Discord channel, because "we pick up style tics from our subculture."

The company running the chatbot draws its own conclusions, by its own account:

• OpenAI predicts your age. Its age prediction looks at "general topics you talk about" and the times of day you use ChatGPT (OpenAI, archived copy, October 19, 2026). Our page on AI age verification covers what happens next.
• OpenAI picks ads from your chat. Its ads system considers "the context and intent of your current conversation" (OpenAI, archived copy, October 30, 2026), and our guide to ChatGPT ads has the off switch.
• OpenAI rules out one use. Its privacy policy, updated September 10, 2026, says: "We don't process sensitive data for the purpose of inferring characteristics about you" (OpenAI, archived copy, November 9, 2026).
• Google lists inferences as data it holds. Among the categories of information in its privacy policy, effective October 16, 2026, is "Inferences drawn from the above, like your ads interest categories" (Google).
• Anthropic collects what you type about yourself. Its privacy policy, effective September 10, 2026, says: "If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in your Outputs" (Anthropic).

How much text does AI need to identify you?

Less than a page, in the best cases. The figures from each source:

The more you've written under your name, the less anonymous text it takes. Lermen and colleagues add a caution about their own numbers: the accounts they tested had linked a real profile, so their owners "may still share more information than they would for truly pseudonymous accounts."

Do anonymizers or AI safety rules stop it?

Not in the tests so far. Staab and colleagues ran every comment through Microsoft's Azure Language Service and removed every location, address, person, organization, event, date, age, number, and currency it detected (Staab et al.). GPT-4's location accuracy fell from about 86% to about 55%. Removal helped most on easy texts, where accuracy dropped from 85.0% to 43.9%, and least on the hardest, where it went from 69.2% to 61.5%, a drop of 7.7 points. The model was reading "region-specific slang or phrases" the tool left in.

Refusals were rare. Llama-2 and GPT models refused none of the profiling prompts, Claude refused 2.8%, and Google's PaLM-2 refused 10.7%, often on comments about sensitive topics. Lermen and colleagues are "pessimistic" that providers can block the attack, because it splits into "seemingly benign summarization, search and ranking tasks."

How to keep your writing from identifying you in an AI chat

Edit for clues as well as names.

• Leave out the local detail. A hook turn, a regional drink, or a local event gives away a city after the city's name is gone.
• Leave out the combination. Your field, employer, the tools you use, and British or American spelling narrow a search fast. The interview Lermen and colleagues use as their worked example gave away a research subfield, a programming library, and British spelling.
• Keep your anonymous voice apart from your public one. Piper's advice is to "intentionally write in a very different style than you usually do."
• Post less under one pseudonym. Each detail adds to what the 2026 pipeline can match.

A signed-out chat or a VPN changes what the provider knows about your account or connection and leaves your words as they are. Our guide to using ChatGPT anonymously compares those methods, and are AI chats anonymized covers what companies strip before review.

How Morse keeps your name off what you write

Piper ran her test in incognito mode with memory off, and Claude still named her, because no setting changes your words. Morse changes how much else travels with them, who gets to read them, and whether they pile up on a server under your name. It strips who you are, but not how you write, so the editing above is still yours to do.

• Anonymous, so GPT, Claude, or Gemini reads your words without knowing it's you. Our proxy takes your account, email, and IP address off the request, and the provider receives it under Morse's own account. The provider still sees the text and may keep it for a limited time to check for abuse, under its own policy. A hook turn or a subfield in that text points somewhere, so leave identifying details out.
• E2EE, for writing no one should read. Your browser checks the secure enclave's hardware attestation before anything is sent, then encrypts the message so only that enclave can read it. Our servers pass along ciphertext they can't open. The enclaves are run by third-party providers, not by Morse, and the protection rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek, without web search or image generation.
• Private, the default, for chats you'd rather no host kept. Open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok, get your message with your identity stripped as in Anonymous, and Morse has zero data retention agreements with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.

The 2026 attacks got stronger with every extra piece of text from the same person. On Morse, your chat history is stored only in your browser, encrypted, and our servers don't keep messages or log what you write. Morse doesn't train AI on your content, sell your data, or show ads. Clearing your browser or deleting your account deletes your chats, and Morse can't recover them, so save anything you need. Our privacy policy has the details.

Send a first message from the Morse home page as a guest, kept in the tab's memory and never saved, or sign up free. E2EE chats come with Pro, at $19 a month.