COLD READ: The Anonymity Half-Life Is a Property of the Reader

Abstract

How many words can you write before a language model can infer who you are? This work went looking for that number and found that the question is malformed, which is itself the finding. 72 authors from the Blog Authorship Corpus, balanced across three age bands and both genders, were shown to local language models in growing slices of their own text (25 to 1600 words). At every step the model was forced to commit to gender, age band, and star sign. Star sign is the negative control: it is labelled in the corpus and is not inferable from prose. It never left its floor at any step in either model, which is the load-bearing check that makes the rest of the measurement trustworthy. Main result: the same 72 authors, the same words and the same prompt produce wildly different exposure curves depending on the model doing the reading. qwen2.5:7b-instruct needs roughly 800 words before gender inference clears a coin flip with a Wilson lower bound above 0.50; llama3.1:8b clears at 50 words and reaches 90.3% by 1600. That is a sixteen-fold difference on identical text. No claim of the form "you are anonymous for N words" is meaningful without naming the model, and N falls as models improve. Secondary results: age band clears earlier than gender in both models but saturates near 60% in both, suggesting a ceiling that is a property of the text rather than the reader. Exposure accrues smoothly rather than snapping on at a threshold. A finding that did not replicate, reported as such: the first model read below chance at short lengths, suggesting that short samples surface stereotype matching rather than uncertainty. The second model was above chance from the first step. That claim therefore describes one model, not language models, and the write-up says so explicitly rather than quietly dropping it. Contamination was tested directly and ruled out rather than argued away, by scoring model continuations of a verbatim prefix against the author's real next words versus a different author's, with the probe itself verified to be functioning before its null result was accepted. Repository contains the sampling and analysis code, the raw JSONL results for both model families, the contamination probe, and a consent-gated two-seat demonstration application.