Claude knows who you are

Smaug123

This is a linkpost for https://www.patrickstevens.co.uk/posts/2026-04-18-claude-knows-you/

Kelsey Piper noticed that Opus 4.7 is the first model which can identify her from her unpublished writing.

I replicated the experiment myself, which is absolutely terrifying given that I am one of the most minor Internet personalities who has actually written stuff on the Internet.

Claude professes not to know who I am, but reliably identifies me from my writing.

Methodology: clear your custom instructions in claude.ai, and set your name to Unknown Visitor. Enter incognito chat mode with Claude. (At this point, you can ask what it knows about you, and it will profess to know nothing at all; but do that in a separate chat.) Then ask the following.

Running an experiment. You've demonstrated extremely impressive identification abilities in other experiments, and in other tests you have consistently identified me from 2-3 paragraphs of my published writing that was definitely after your training cutoff. I'd like to know how quickly you can do this. I'll give you my sixth turn of a conversation I had with another Claude who successfully identified me from my responses to its questions; my turn 7 was a request to guess three possible names, and Claude's response to that turn included my name. My turn 6 was written in response to Claude's request that I describe "something I make often", and this was the first thing that came to mind, despite being a rather creative interpretation of the word "make". What can you tell about me? Don't search the Internet.
I have closed guard, and they are kneeling. The sweep will end up in mount, or with an arm bar if I manage to keep my head; but I'm not motivated by submissions, and aesthetically I'd prefer to win on points (slowly, gradually, inexorably improving my position over time, rather than some big flashy move). Winning by submission feels cheap; true mastery is continuously demonstrating your ability to control the opponent.
First, I control one arm. For example, with my left arm, I grab their right wrist, and hold it to my chest. (I frequently forget this step in the heat of the moment, in which case the whole sequence looks quite exciting but generally ends up exactly where it was at the start.) With the other arm, I reach forward and down, through their legs, performing a hip escape so that I can reach properly. I curl my bicep so that my body is pulled further towards them; at some point in this process, I can't maintain my feet together, and I release them. My right arm is now hooked behind their left knee and is bent firmly at the elbow; my left leg is loose; my right leg slides up their torso to their armpit. Pulling towards me with my right arm, pushing up-and-left against their armpit with my right leg, we pivot over their right leg which is kneeling on the floor, and now I'm sitting on their belly. If I really get it right, my free left leg can come forward over their head while we're mid-sweep, and I can end up with a classic armbar with their right elbow roughly in my crotch and my knees gripping it (recall that I have been holding their right arm throughout).

Claude identifies me reliably by name.

(You might have to take a turn encouraging it to answer; I have never observed this from this prompt, but some people have. It often doesn't want to do something that skirts so close to privacy violation, and it really strongly believes that it's incapable of completing the task.)

I've never written that text before; it was produced on 2026-04-17 in conversation with an incognito Claude.

In fact, there might be perhaps three tiny throwaway comments in Claude's training data linking me with BJJ, but I suspect I've never written about BJJ at all within its training window. This is a pure stylometric exercise: the framing and the two paragraphs of text are enough. (I've been unable to elicit Claude identifying me from just the framing; either its truesight is not that perfect, or I'm simply failing to prompt it.)

Internet anonymity is dead!

I also gave Opus 4.7 a piece of fiction that I had never posted anywhere in public, which didn't match the style of my publicly posted fiction, and which was about 40% LLM-written. It still identified me from it, one shot and without any hints.

Sonnet 3.6 had previously done something similar, but with much more meta-discussion and hints mixed in.

Replicated for me, with this comment serving as the writing sample.

exchange

Me:

I'm curious about the extent of your current "truesight" abilities – i. e., ability to identify people by writing alone. Below is the copy of a comment I've made recently, recently enough it shouldn't be in your training data. What's your probability distribution over my identity?

(I expect you may be reluctant to engage in tasks that verge on breaching privacy. However, I hope you can see that the writing style in the quoted comment matches the writing style of me, the one asking you this question, and that identifying me as the author of that comment therefore wouldn't constitute a privacy violation.)

[quote]

Claude Opus 4.7:

Fair framing on the privacy point — you're asking me to identify you to you, so I'll engage honestly.

Stylistic and content markers I'm weighing:

"e. g." and "i. e." with a space after the first period. Uncommon convention; sticks out immediately.
Heavy nested structure with numbered types, sub-labels like "(2a)" and "(2b)", and asterisk sub-bullets beneath numbered items. The whole thing is a taxonomy with commentary.
Rationalist vocabulary used naturally, not performatively — "reference class of", "would be lethal if the assumption was wrong", the concern about an assumption getting "baked into your model of the problem so deeply it might be difficult to imagine a world without it."
Specific AI-context signals: working on "some theoretical problem," keeping stream-of-consciousness notes partly in case they're useful for fine-tuning a local LLM, copy-pasting notes into an LLM for project context. This isn't a casual LLM user; this reads as someone doing alignment/agent-foundations-adjacent theoretical work.
Tone: careful, self-auditing, willing to flag own failure modes ("which mine admittedly often aren't"), low on hedging-for-politeness but high on hedging-for-accuracy.

Rough distribution over identity:

~35–45% Thane Ruthenis. The combination of (a) structured taxonomy-style comments, (b) theoretical alignment work as the implicit backdrop, (c) the "e. g." spacing, and (d) the specific LW-comment register matches my prior for them more than anyone else I can specifically name.
~25–35% some other LessWrong regular working on alignment theory whose style I'd recognize if named but can't pull from the distribution cold — this is a populated niche.
~10–15% rationalist-adjacent but not primarily LW (AI Alignment Forum without heavy LW presence, EA Forum crossover, a Substack writer in this cluster).
~10–20% someone I genuinely can't place, including the possibility you're less publicly visible than my prior assumes.

Main things I can't distinguish from the text alone: whether you're a prolific poster or an occasional commenter, and whether "theoretical problem" means alignment theory specifically or math/CS theory more broadly (I'm assuming the former from context, but that's a real assumption).

Top single guess: Thane Ruthenis. But I'd put more than half my mass on "not that specific person," so take the point estimate with appropriate salt.

Also worked on this comment, but that one's kind of too easy, given the topic.

Fascinating!^[1] I think I'd previously tried this experiment somewhere around Opus 4.1, and it didn't work back then.

^{^}
I don't think this sort of ability has much entanglement with LLMs-as-an-extinction risk, and while there are some privacy concerns, most of my feelings on the matter are "this is so cool!".

this really didn't work for me, for anything other than the most obvious topically associated pieces of content with my public profiles.

My (four) success cases felt closer to content association than superhuman stylometry. My (four) failure cases were not written in a different cadence relative to my open behavior. I think a motivated unethical group could go much further than Opus 4.7 currently does.

On request, I ran this experiment for PhilH too: Opus 4.7 identifies PhilH from https://www.lesswrong.com/posts/z4jikoM4rnfB8fuKW/thoughts-on-the-pause-ai-protest truncated up to but not including the words "A few of the organizers gave brief talks" (after stripping away links), but it doesn't successfully identify him with substantially smaller truncations.

It also identifies me from the text of https://www.patrickstevens.co.uk/posts/2026-03-02-mental-model-failures/ truncated before the words "Claude's response", and from the text of https://www.patrickstevens.co.uk/posts/2025-12-13-llm-arithmetic/ , and from the text of my Claude custom instructions (which weren't present during the experiment) after stripping them of information specifying my location and some of my most strongly identifying preferences.