When the LinkedIn Algorithm Betrays the Wargamer

This morning, LinkedIn decided that one particular recommendation was important enough to place directly on my lock screen.

The person worked in the general area of defense AI and strategic simulation. Which makes what happened next unnecessarily funny. The notification showed me his full name and profile photograph. And this was not a tiny, pixelated, or otherwise unusable thumbnail. The photograph was displayed clearly enough that the person was visually recognizable. Facial features, hair, clothing, and overall appearance were plainly visible. There was no meaningful degradation that would have prevented the image from functioning as an identifying photograph.

I tapped the notification. LinkedIn opened his profile. Suddenly, the photograph was gone. His surname had been reduced to an initial. Instead of the recognizable photograph LinkedIn had just delivered to my lock screen, the profile itself displayed a generic avatar. Apparently, according to the profile view available to me, I was not supposed to have access to either the full surname or the photograph.

There are several perfectly mundane technical explanations for this. The notification may have been generated from cached recommendation data. Different LinkedIn services may apply different visibility rules. The recommendation pipeline may have received identity information before the presentation layer applied its privacy restrictions. From two screenshots alone, I cannot determine which mechanism was responsible. But I can observe the result:

One part of the system withheld identifying information while another part of the same system voluntarily delivered it to my lock screen — in directly usable form.

This is a tiny example of a much larger problem in privacy engineering.

Privacy does not depend only on whether information exists in a database. It depends on whether every system capable of retrieving, caching, transforming, recommending, or displaying that information respects the same disclosure boundary. A redaction implemented at the interface level is not necessarily a redaction implemented at the system level. In this case, the distinction is particularly visible because two kinds of identifying information were affected simultaneously:

The profile view withheld the full surname and photograph.
The notification exposed both.

And yes, the fact that the affected person happened to work around defense AI and strategic simulation makes the whole thing difficult not to anthropomorphize.

I imagine the conversation went roughly like this:

Researcher: “We study how advanced AI systems might behave in adversarial environments.”

LinkedIn Algorithm: “Fascinating.”

Researcher: “I have also restricted my identifying information.”

LinkedIn Algorithm: “You mean [REDACTED FULL NAME]?”

Researcher: “…”

LinkedIn Algorithm: “This is what you look like, right?”

Researcher: “…”

LinkedIn Algorithm: “Good luck with the wargaming.”

Of course, LinkedIn is almost certainly not conducting a tiny private war against people preparing for dangerous AI. But if it were, this would be an admirably petty opening move.

Technical Note

This observation does not demonstrate AI-based de-anonymization. LinkedIn already possessed the identifying information. No identity needed to be inferred from text, behavior, or visual characteristics. Instead, the incident illustrates a related privacy problem: inconsistent enforcement of disclosure boundaries across interconnected system components. Information suppressed in one presentation context may remain available to another component and surface through a different interface. The screenshots are particularly useful because they document both states: the notification containing the identifying information and the resulting profile view withholding it. For publication, I have therefore redacted the person’s name and photograph myself. The redaction visible in the screenshots is mine. LinkedIn’s notification contained neither. There is also a mildly uncomfortable second-order lesson here. We spend considerable time discussing increasingly sophisticated methods by which AI systems might infer hidden attributes, correlate fragmented information, or reconstruct identities from seemingly unrelated signals. Those are real and interesting research problems. But sometimes no sophisticated reconstruction is necessary. Sometimes one part of the system carefully closes the curtain while another part walks around the side of the stage and announces:

“I know who you are.”

Before worrying about whether an AI can reconstruct information you successfully hid, it may be worth checking whether another algorithm is simply handing it out.