Large language models are reshaping privacy work in two contradictory ways at once. They make it far easier to attack people's privacy, and they also make it far easier to build the tools that protect it. A practitioner with deep experience in both sides of that coin has published a detailed account of what he has seen in the field, and the picture is more nuanced than either the hype or the fear suggests.
LLMs turn re-identification into a low-effort task
Extracting identifying details from unstructured text, matching profiles across platforms, and joining datasets with mismatched schemas have always been core skills for OSINT researchers and private investigators. The work was painstaking and slow, requiring domain expertise and many hours of manual effort. LLMs have compressed that timeline dramatically.
A February 2026 paper from researchers at ETH Zurich and other institutions demonstrated an LLM-powered pipeline that links pseudonymous Hacker News accounts to LinkedIn profiles with 68% recall at 90% precision, compared to near-zero performance from classical baselines. A separate study from October 2023 showed that LLMs can infer personal attributes like location, income, and sex from Reddit text at up to 85% top-1 accuracy, at roughly one-hundredth the cost and one-two-hundredth the time of human analysts.
None of this is technically new information. If an LLM can re-identify someone by cross-referencing public data, a determined human could have done the same. The difference is scale and cost. Attacks that once required a specialist are now accessible to anyone who can write a prompt. The implicit threat model many people rely on, posting under a pseudonym while avoiding obvious identifying details and assuming nobody will bother to investigate, is eroding fast.
Non-experts can now prototype differential privacy features
Deploying provably robust anonymization has historically been a bottleneck. Even basic questions like "does this technique apply to my use case?" required hiring a specialist. Damien Desfontaines, a privacy researcher whose PhD thesis focused on making differential privacy more accessible, says he did not expect LLMs to change that. When non-experts started asking chatbots about sharing sensitive data safely, and the models recommended differential privacy, he assumed the results would be terrible.
What he found reviewing client projects was different. LLM-generated differential privacy implementations were directionally correct and roughly well-designed. There were always gaps and subtle errors that a non-expert would not catch on their own, some with serious practical consequences if left unaddressed. But none of the projects he reviewed needed to be thrown out entirely. Everything was fixable.
That is a meaningful shift. Before LLMs, even prototyping a differential privacy feature meant hiring a consultant for weeks or months before knowing whether the approach was viable. Now non-experts can experiment with parameter tuning, visualize results, and build rough integrations with existing products. That experimentation makes it easier to pitch the idea to stakeholders and secure a budget for a proper audit later.
The rigor problem is real and poorly understood
Here is where the story gets uncomfortable. LLMs struggle with the kind of precise, edge-case-aware thinking that privacy-critical code demands. Desfontaines reports seeing basic mistakes alongside subtle, hard-to-detect bugs, incorrect statements written as confident code comments and then accepted as fact by subsequent coding agents, and models that write correct code on the first attempt then replace it with wrong code after being asked a casual question about it.
Three hypotheses explain the pattern. First, next-token prediction may not produce the deep understanding needed for rigor. Second, coding agents rely heavily on empirical testing, which catches many bug classes but is nearly useless for privacy issues, which require adversarial thinking and cannot be validated by running the code. Third, small flaws in a design are easy to correct early on, but the same flaws buried in hundreds of lines of generated code become exponentially harder to reason about.
The fix, Desfontaines argues, is better tooling. Differential privacy libraries need interfaces that wrap guarantees in ways that are hard to misuse. They also need to be feature-rich enough that LLMs will use them instead of reimplementing everything from scratch when they hit a limitation.
Outside the critical path, LLMs earn their keep
Many tasks surrounding a privacy deployment do not require the same level of rigor, and LLMs handle them well. Building utility metrics and visualizing results is straightforward to review line by line. Setting up experiment tracking to compare configurations over time is boilerplate that agents execute reliably. Tuning hyperparameters and selecting the right mechanism for a given task involve exploring a large space where good-enough answers matter more than perfection.
Performance optimization is another area where LLMs punch above their weight. In a recent project involving synthetic data generation for a mental health research tool, Desfontaines hit runtime limits on the modeling and training stage. Claude Code rewrote the core logic in JAX with just-in-time compilation. The resulting code was incomprehensible to him, but that did not matter. The logic sat outside the privacy-critical zone, success was measurable empirically, and the runtime improvement was real. He could audit the output without needing to understand every line.
That reasoning breaks down where rigor is non-negotiable, or where long-term maintainability and multi-developer collaboration are in play. For one-off optimizations that can be validated empirically, though, handing the wheel to an LLM is a practical trade.
The gap between "works" and "works correctly" still needs a human
LLMs handle the hard-but-checkable tasks well and the hard-but-not-checkable tasks poorly. That distinction is often invisible to non-experts, who may not realize that a design that looks right on the surface has critical gaps underneath. The practical takeaway is straightforward: if you are shipping privacy-enhancing technology built with LLM assistance, get an expert to review it before deployment. The models can get you far, but the last mile is where the cost of being wrong is highest.