Machine learning deanonymisation¶

Statistical patterns run through a person’s writing: the words they favour, the sentence structures they default to, the way they punctuate, the phrases they reach for without thinking. Those patterns can persist from one text to the next, though how well they transfer depends on the writer, the genre and how much text there is. An author identification model trained on known samples can attribute anonymous text with an accuracy that is uncomfortable for anyone writing under a pseudonym.

Such a model attributes; it does not identify. It can say that two texts are more consistent with one author than another. Turning a candidate author into a named person takes an external bridge, and the model supplies none of it.

Counting the small words¶

The model learns to associate statistical patterns in text with specific authors. The step that does the work turns readable text into a numerical representation of word and phrase frequencies, with no explicit model of meaning.

# Training phase: build a model that recognises each author's style
for each known author:
 collect multiple text samples from that author
 for each sample:
 convert to feature_vector using TF-IDF:
 measure frequency of each word and phrase (n-gram)
 weight rare terms more heavily than common ones
 result: a numerical fingerprint of writing style
 store (author_label, feature_vector)

train classifier to map feature_vectors to author_labels

# Attack phase: identify anonymous text
anonymous_text = load suspicious document or post
feature_vector = TF_IDF_transform(anonymous_text)
predicted_author = classifier.predict(feature_vector)
confidence_scores = classifier.predict_probability(feature_vector)
→ author_A: 68%, author_B: 21%, author_C: 11%

The model does not need certainty to be useful. It returns a ranked set of candidates, and whether a score like 68% is a reliable probability depends on the classifier and whether anybody has calibrated it. A ranking still narrows the field when set beside independent evidence: posting time, vocabulary domain, apparent technical knowledge. That combination is what takes an attribution across to a person, and the model is only one part of it.

A long forum post¶

greenhouse-attacks’ stylometry.py generates authors whose idiolects are planted in the function words: the rates at which each of them reaches for of, though, which, and how often a comma arrives. Content words are interchangeable filler, because content is not what the attack reads.

The experiment uses a deliberately narrower representation than the pseudocode above. It counts a fixed list of fifty function words and nothing else, with no n-grams, no sentence lengths and no punctuation, then fits a logistic regression over those counts. Every result below is bounded by that choice.

The planting can be checked. Each author was given a rate for every function word, higher or lower than the average author’s, and the fitted logistic regression assigns each author a weight on every word. The two lists correlate at 0.90 across ten candidates, with no author below 0.85, so the fitted coefficients track the planted variation closely.

How much anonymous text it takes, against ten candidates:

At two hundred words the model places 89% of texts with one of ten candidates, and two hundred words is a short comment by the standards of anywhere people argue online.

Widening the field of candidates barely changes the accuracy:

Those figures are cleaner than anything a real corpus would give. Planted idiolects separate more tidily than real writers, who overlap, drift, and write differently when tired. The shape of the two curves is what survives into a real corpus: attribution climbs steeply with a few hundred words and falls away slowly as the field widens, while the heights themselves depend on how much real writers overlap and how closely the known and anonymous texts match.

Trying to sound like somebody else¶

A writer who suspects they can be identified changes what they can think to change. The model here reads function-word counts and nothing else. Hence the first two rows are flat rather than merely reduced. Against the same ten candidates and 500 words:

Rewriting the topic entirely does nothing, because the topic was never read. Chopping every sentence to six words does nothing, because a model counting the and of does not care where the full stops fall. Only the third row cuts attribution, from 100% to 20%, and it is the hardest of the three to perform on purpose: most writers do not know their own rate of which against that, and holding a new distribution steady across a thousand words is harder still.

A feature set that also counted sentence length would be disturbed by the second row. The features doing the identifying sit below the ones a writer can reach.

Galbraith¶

Stylometric analysis confirmed J.K. Rowling as the author of The Cuckoo’s Calling in 2013. The novel had been published under the pseudonym Robert Galbraith, and a Sunday Times reporter, acting on an anonymous tip, approached Patrick Juola of Duquesne University and Peter Millican of Oxford. Juola ran the comparison of the text against Rowling’s known work and against work by other candidate authors, and it left her as the only writer not excluded by any of the tests. The chronology is the part to keep. The tip came first, and stylometry was used to test a lead somebody else had supplied. It corroborated an attribution; it did not discover Rowling out of an unconstrained population of writers. Attacks of this kind usually run in that order.

The software Juola used is published and free. What applying it needs is enough comparable writing from the candidate authors and a plausible list of candidates to begin with. For anyone who has published under their real name, the reference texts are already public.

Below the waterline¶

Writing style can be partially obscured by consciously using different vocabulary, shorter sentences, or different punctuation habits. Paraphrasing tools can alter surface features while preserving meaning. Either can reduce attribution accuracy, and how far depends on the model, the amount of text and how consistently the altered style holds, because the most distinctive patterns tend to sit below conscious awareness.

A different strategy stops the anonymous account being associated with any known writing sample at all. That sidesteps the attribution problem instead of trying to beat it once a model has reference material. That is hard to arrange, because anyone who has posted under their real name on any public platform has already supplied the training data. A separate register held from the first post leaves an attacker less directly comparable material than an established account whose writing can be set beside a large archive of known work.

Last reviewed: 2026-09-20.