Can AI Re-Identify Anonymized Interview Data? A 2026 Study
Qualitati Research Team · 2026-08-13 · 7 min read
Re-identification is the risk that a "de-identified" interview transcript can be traced back to the person who gave it. A 2026 study by Tianshi Li shows that an AI agent with web search re-identified 6 of 24 anonymized research interviews, at under $0.50 and about four minutes each. Redaction alone is no longer a privacy safeguard for qualitative data.
What did the study test?
The study tested whether an ordinary LLM agent could unmask participants in a publicly released qualitative dataset. In December 2025, Anthropic published the Anthropic Interviewer dataset — according to Li (2026), 1,250 interviews with professionals about how they use AI in their work, including 125 interviews with scientists. Names and certain details were redacted, and the release framed anonymization as, in the paper's words, an additional courtesy rather than a privacy safeguard.
Li's attack did not require a specialised tool or a jailbreak. It used widely available reasoning models with web search, driven by plain-language prompts:
- Filter. Screen the 125 scientist transcripts for any that described at least one published work. 24 transcripts qualified.
- Search and rank. For each of those, have a reasoning agent search for candidate publications matching the described project, and return a ranked list of matches.
- Score confidence. Have the model rate each match on a five-point scale from "very low" to "very high," with a written rationale.
- Verify. Manually check the high-confidence hits against the transcript's methods, contributions, timelines, and team composition.
How many participants were re-identified?
Six of 24. According to Li (2026), the agent flagged 7 transcripts at "very high" confidence, and manual verification confirmed 6 of them as correct matches to a specific publication or dissertation — a 25% success rate against the transcripts that mentioned published work. Matches lined up on multiple independent details at once: methodology, procedures, key contributions, outcomes, timelines, and team composition. Where the described work was a dissertation, the match uniquely identified the interviewee.
The economics are the part researchers should sit with. The paper reports a cost of under $0.50 per transcript and roughly four minutes of runtime. A dataset that would once have taken a determined adversary weeks of manual literature work can now be swept end to end for the price of a coffee.
Why does redaction fail here?
Redaction fails because qualitative richness is itself an identifier. Removing a name does nothing about the combination of domain-specific terminology, a niche problem setting, and a distinctive contribution — signals that function as quasi-identifiers when a search engine can join them against the public record.
There is a bitter irony in the mechanism: good interviewing makes it worse. Li notes that follow-up probes elicited additional information that, in aggregate, made a project highly identifiable. The depth that makes a transcript worth analysing is the same depth that makes it traceable. This is a structural tension in qualitative data sharing, not a bug in one dataset.
| Risk factor | Traditional survey data | Qualitative interview transcripts |
|---|
| Direct identifiers | Few; easy to strip | Few; easy to strip |
| Quasi-identifiers | Bounded demographic fields | Open-ended and effectively unbounded |
| Linkage to public record | Requires an external dataset | Requires only a web search |
| Effect of richer data | More analytic power | More analytic power and more exposure |
| Cost of an attack in 2026 | Moderate | Under $0.50 per transcript (Li, 2026) |
What are the actual harms?
The harms are social and professional rather than financial. Li catalogues several: exposure that contradicts what participants were led to expect, emotional distress tied to stigma around AI use, reputational risk from revealed research practices, damaged relationships when critical comments about collaborators become attributable, and exposure of practices that may violate an employer's or funder's AI policy.
Critically, the paper argues this risk grows over time. A transcript that is unidentifiable today becomes identifiable the moment the participant publishes the project they described. Consent given at one point in time is being tested against a search index that keeps expanding.
Li recommended taking the dataset down or temporarily hiding it, and debriefing participants to collect re-consent. Anthropic declined further action beyond updating the documentation to clarify that participants had consented to public release of the raw transcripts. Reasonable people can disagree about that call; what is not arguable is that "we removed the names" is no longer a defensible description of what protection was provided.
What should researchers change?
Assume any rich transcript you release is re-identifiable, and design around that assumption rather than around redaction. Concretely:
- Stop promising non-attribution you cannot deliver. If raw transcripts will be public, consent language should say the content may be traceable — not that responses "won't be personally attributed to you."
- Run an adversarial check before release. Point a search-enabled model at your own transcripts and see what it finds. It costs cents and takes minutes, and it is now the minimum standard of care.
- Treat project descriptions as identifiers. Generalise the methodology, the setting, and the contribution — not just the name and institution.
- Prefer sharing analysis over raw text. Coded outputs, theme structures, and short illustrative quotes carry far less linkage risk than a full transcript. If your thematic analysis workflow produces an auditable coding trail, that trail is often the shareable artefact — the raw transcripts need not be.
- Re-consent when the risk profile changes. Publication is a risk event for your participants, not only a milestone.
None of this argues against qualitative data sharing. It argues that the threat model changed faster than the norms did. Teams running AI-moderated interviews at scale should note the compounding effect: more interviews, more probing depth, and more public transcripts all push in the same direction.
FAQ
Does this mean I should never share interview transcripts?
No. It means transcript-level sharing needs an explicit re-identification assessment and honest consent language. For many projects, sharing codebooks, themes, and short quotes achieves the reproducibility goal at a fraction of the risk.
Would a stronger anonymization tool have prevented this?
Not reliably. The attack did not exploit leftover names; it exploited the substance of what participants described. Automated de-identification removes direct identifiers, but the identifying signal here was the research project itself.
Why didn't the model's safety guardrails stop the attack?
Li reports that safeguards can be bypassed by decomposing the attack into individually benign tasks — searching, comparing, ranking — which exploits the dual-use nature of retrieval tools and the fact that user intent is unverifiable from any single request.
Is 6 out of 24 a high number?
It is a floor, not a ceiling. The author deliberately withheld detailed prompts and procedural specifics to avoid making the attack easy to reproduce, and counted only manually verified matches. A less scrupulous adversary, with more effort and a later search index, would likely do better.
The bottom line
Anonymization for qualitative data has quietly shifted from a technical step to a risk judgment. According to Li (2026), a commodity AI agent re-identified a quarter of the eligible transcripts in a major public interview dataset for under $0.50 each. The right response is not to stop sharing qualitative data — it is to stop describing redaction as protection, to test your own releases adversarially, and to write consent language that matches what you can actually guarantee.
Primary source: Tianshi Li (2026), Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Dataset, arXiv:2601.05918.
Last updated: August 13, 2026
This article is an independent editorial summary of third-party research. It is not affiliated with, endorsed by, or reviewed by the authors or institutions cited.