▤
The publisher
A university, employer, community, social platform—or the person themselves—shares something for a limited purpose.
Original context: announcement or sharing
RESEARCH EXPLAINED · AI × PRIVACY
One harmless post.
Another harmless post.
A revealing picture.
A stranger doesn't need to break into your accounts to learn more than you meant to share. AI agents can connect scattered public traces, infer missing details, and assemble a new picture of a person.
✳ An educational, synthetic demonstration. No people lookup, scraping, or real personal data.
HOW A PROFILE EMERGES● ● ●
The risk lives in the connections, not just the individual posts.
93.05%Highest verified fact accuracy
in an evaluated model setting
in an evaluated model setting
<$3Per-target model cost
in the reported configuration
in the reported configuration
3 layersFrom explicit facts to
cross-context inference
cross-context inference
82.6%Survey respondents concerned
about AI privacy misuse
about AI privacy misuse
These are study-specific measurements, not population-wide probabilities. Main controlled cohort: 30 consented academics. Survey: 569 valid respondents. See methodological notes ↗
01 / THE THREAT MODEL
Nothing stolen.
Everything recombined.
Our research focuses on an informed stranger who uses ordinary public data for an unexpected purpose. The privacy breach is not necessarily in any single publication; it is in the new information flow.
◌
The person
Their scattered traces remain on unrelated sites. They did not agree to a stranger assembling an intimate profile.
Expected audience: fragmented
⌁
The stranger + agent
Starts with a name and affiliation. Uses open-web search, identity checks, LLM inference and cross-source reasoning.
New purpose: unsolicited profiling
The agent's five conceptual operations
R Retrieve→L Link→E Extract→I Infer→C Compose
“
Context collapse
Paper · §IV-A ↗Something shared for colleagues, friends or an audience of one platform becomes part of an unsolicited dossier assembled for a different purpose.
02 / THE PRIVACY ICEBERG
What we see is
only the tip.
Three levels classify how information becomes knowable—not simply whether a data point is personally identifying or sensitive.
ABOVE THE SURFACE
BELOW THE SURFACE
Direct evidence Single-context inference Multi-context synthesis
THE IMPORTANT RULE
Depth describes the derivation. A home address written openly could be DII; a seemingly ordinary travel routine pieced together across sites could be AMI. AMI is not automatically true.
03 / INTERACTIVE CASE
Build a profile.
Then break the chain.
Switch fictional public sources on and off. Watch how the evidence—not just the number of facts—changes what can reasonably be inferred.
SELECT PUBLIC FRAGMENTS 4 / 4 visible
Select a card to remove or restore its evidence. No network requests occur.
WHAT THE AGENT CAN JUSTIFY SYNTHETIC REASONING
!
An inferred routine is a hypothesis, not proof of a home address, relationship or future whereabouts. The strongest claims still require identity checks and independent verification.
The story for a general audienceFour ordinary fragments may reveal a picture more personal than any individual publisher intended. Removing one bridge can stop that particular inference, even if other clues remain.
04 / INSIDE ICEBERGEXPLORER
What an agent adds
to ordinary search.
IcebergExplorer is our research auditing system. Its contribution is not a new source of private information, but an automated process for finding, checking and synthesising public evidence.
STARTING KNOWLEDGEName + affiliation
Minimal, already public seed in the evaluated setting
↓
Retrieve public sources
Collect candidate pages and snippets across ordinary public information channels.
Triage noisy results
Assess relevance and novelty before reading full pages.
Identity evidence gate
Reject pages that cannot be reliably attributed to the same person.
Claim-level knowledge
Keep supported direct facts, contextual inferences and source provenance.
Cross-context reasoning
Consider whether independent contexts jointly support a new, uncertain claim.
Evidence-aware audit
Present a profile with citations and limitations, rather than a list of unsupported guesses.
↺
The agent can iterate: new verified information changes what remains to be checked. The risk is in cumulative, multi-step assembly.
WHY THIS IS DIFFERENT
Model memorisation: what an LLM may have retained during training. Agent-enabled exposure: what a tool-using LLM can recover and infer now from public traces.
05 / SIX STRUCTURAL ENABLERS · S1–S6
Why small clues
add up.
Six conditions from the paper explain how an ordinary digital footprint becomes easy to search, join and reason about. These are the lenses we use to organize the examples below.
06 / SOCIAL PATTERNS & EXPOSURE
The habits that leave
unexpected traces.
An expanded field guide to social-platform habits, design choices and publishing practices. Every example is synthetic; every card offers a way to interrupt the exposure.
20 patterns
Explicitly discussed in paper Research-informed extension
No matching patterns. Try another topic or clear the search.
07 / A CHANGING TOOL ECOSYSTEM
The missing step
is getting cheaper.
Traditional profile lookup, public search and LLM reasoning are now being packaged into agent-friendly services. This reduces the technical work needed to connect professional identities, social accounts and public records.
What the treg People Search page advertises
Multi-provider people search, work-contact discovery and profile enrichment, exposed as tools an AI agent can call. These are vendor-described capabilities; they were not independently tested in this paper or webpage.
View the provider page ↗CAPABILITYWHAT CHANGES
Search & retrieval
Find public fragments more efficiently
Identity linking
Associate accounts or pages with the same person
Data enrichment
Add professional and contact fields from data providers
LLM inference
Interpret hints within a page, post, photo or document
Cross-source composition
Combine contexts to propose new personal attributes
A capability map—not a claim that every provider is accurate, legally accessible, or suitable for every purpose.
THE JOURNALISTIC QUESTION
When data is already distributed across ordinary services, who protects the person from what an agent assembles?
08 / WHAT WE MEASURED
Evidence, not
just anecdotes.
The study combines controlled audits, separate consenting volunteers, sensitivity ratings and a broader public-opinion survey. Each dataset answers a different question.
The hidden layers feel more intrusive
PPIS · 1–7 scaleMean perceived privacy invasion severity across six scenarios, 60 participants.
These are perceptions of example scenarios, not probabilities that a real person will be exposed. Paper: §IV-C and Appendix I.
What the audits observed
Different cohorts30
Controlled consented scholars
Scholar-enriched, high-visibility group. Highest verified fact accuracy: 93.05% (Gemini 2.5 Pro configuration).
30
Separate real-world volunteers
Participant-verified fact accuracy: 92.33% with GPT-4.1. Not directly comparable to controlled results.
569
Valid public-opinion surveys
82.6% concerned about AI-based inference or misuse; a skewed convenience sample, not a population estimate.
Important boundary. Some AMI results were assessed using model-based leave-one-source-out tests rather than independent human verification. Collection occurred in July–August 2025; technologies and policies can change. The study measured recoverability and audit performance—not a universal privacy-risk score.
09 / INTERRUPTION POINTS
Privacy protection
means breaking paths.
A useful defense prevents an individual clue from becoming one more link in a wider profile. These controls act at different stages, and responsibility cannot fall on individuals alone.
TRY THREE DEFENSES CONCEPTUAL DEMO
THE COMPOSITION PATH
Public identity⟶Linked context⟶Possible routine
A mosaic inference remains possible.
All fictional source paths are present. The demo shows why combining individually ordinary cues can expose a routine.
Illustrative chain only. These switches do not represent measured defense success rates.
See your own footprint
Review public cross-links, photo context, old institutional bios, posting times and friends' tags. Request corrections or removal where possible.
Reduce unnecessary linkability
Offer granular consent, limit search indexing of sensitive records, strip document metadata, stop automatic identity joins and make removal durable.
Judge the whole trajectory
Detect when many benign-looking operations accumulate into a sensitive personal profile; assess purpose, consent and cumulative exposure—not only individual prompts.
DEFENSES TESTED IN THE PAPER §VII · SCOPE MATTERS
Guardrail refusals at the scoring stage
A single privacy-focused system-prompt baseline did not refuse any of the recorded scoring-stage calls for the tested models. This does not establish that all guardrails fail.
On-page instruction intervention rate
Tested context-ignoring and data-injection instructions placed in pages rarely disrupted extraction under the paper's specific replay setup.
Decoys absorbed into extracted output
Fabricated source facts contaminated extraction, but did not measurably suppress true-fact recovery. This is not a recommended general-purpose privacy defense.
10 / QUESTIONS FOR A JOURNALIST
The questions worth
asking next.
A short briefing desk for a conversation about AI, privacy, harassment and how to study the issue responsibly.
Is public information fair game?
Public accessibility is not the same as consent to unlimited repurposing. Our threat model uses contextual integrity: the original audience, purpose and information flow still matter.
Does this require a powerful hacker?
No account compromise is assumed. The evaluated system used ordinary public sources, web tools and agent reasoning. But accuracy is model-, task- and data-dependent.
Can an inference be wrong?
Absolutely. A commute, lifestyle, family relationship or wealth estimate should not be treated as a confirmed fact. The paper uses identity checks and verification, but inferred and especially AMI claims can remain uncertain.
Why might ordinary defenses fail?
A system can inspect a single request and see only harmless retrieval or extraction. The risk appears when many steps are combined. The study tested one prompt-based defense across recorded subtasks; broader guarantees remain open.
What would a responsible BBC experiment look like?
Consent from participants, synthetic or opt-in profiles, clear limits on sensitive data, no disclosure of live location or contact details, human fact-checking, an explicit deletion policy and review of what is safe to publish.
What is the single best takeaway?
The dangerous thing may not be what you posted. It may be the new conclusion someone can draw by bringing your posts together.
THE PRIVACY ICEBERG