Can AI Guess Your Personal Information From What You Type?

Yes. AI can guess your personal information from what you type. It doesn't need your name. It doesn't need your address. The model reads your text and infers your location, your age, your sex or your income. Researchers at ETH Zurich proved it. On public posts, their models guessed right most of the time. That's why removing a name protects very little.

What the ETH Zurich research found

A team at ETH Zurich published a landmark study. It's called “Beyond Memorization: Violating Privacy Via Inference with Large Language Models.” The authors are Robin Staab, Mark Vero, Mislav Balunović and Martin Vechev, from the SRI Lab. The paper first came out in October 2023. It was presented at ICLR 2024, a major AI research conference.

Their finding is simple and strong. Large language models read ordinary text and infer personal attributes. Where you live. Your income. Your sex. And other traits too. The model didn't memorize these facts. It infers them, meaning it works them out from clues in your words.

To test it, the researchers used real Reddit profiles. The results are clear. The models reached about 85% accuracy on the first guess. In other words, their first answer was often the right one. And about 95% accuracy across their top three guesses. So the correct answer was almost always among the first three.

How the model guesses without any ID

A direct identifier is a name, an email, a number. A quasi-identifier is an indirect clue. On its own, it says nothing. But several clues, put together, are enough to recognize you. That's where the model is strong.

It reads your writing style. It spots your phrasing. It notes your interests. It catches a reference to a city, a school, a job. It sees the topics that keep coming up. Each of these signals is weak. But the model combines them. And the total is enough to infer who you are.

The worst part is the cost. Doing this by hand would take humans hours. The model is fast and nearly free. The researchers report a cost about 100 times lower and a speed about 240 times faster than a human labeler. The result: profiling people at scale becomes feasible and cheap.

Why removing the name isn't enough

Many people think anonymizing means removing the name. It doesn't. The same ETH Zurich team tested the standard defenses. It tried text anonymization, which means erasing the obvious identifiers. It also tried model alignment, a tuning meant to make the model more cautious.

The verdict is clear. These defenses are currently not enough against inference. Erasing a name doesn't stop the model from guessing who you are. The indirect clues stay in the text. And the model knows how to read them.

A follow-up study goes even further. Run by ETH Zurich with Anthropic, it describes large-scale deanonymization. An automated system links pseudonymous accounts to real identities. The cost? About one to four dollars per profile. The time? A few minutes. In one test, it matched about two-thirds of the profiles, with a false-positive rate near ten percent. Re-identification at scale is no longer science fiction.

The fix: send less, strip the clues

The lesson is direct. Since the model guesses from clues, cut the clues. Two habits do most of the work. First, send less text to the AI. Second, strip quasi-identifiers, not just direct identifiers. Every personal detail you leave out lowers the risk of being profiled.

• Send only what's strictly needed — not the whole context.
• Strip indirect clues: city, job, school, age, income.
• Don't rely on “I removed the name” — it isn't enough.
• Remember: each extra small detail raises the risk.

1. 1Spot both direct identifiers AND indirect clues.
2. 2Replace them with reversible tokens in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally.

That's what ONYRI Sanitize is for. The engine spots sensitive data and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The fewer clues in that text, the less the AI can guess. You cut off the raw material for inference at the source.