The AI Can Infer What You Never Wrote in Your Notes

Yes. A large language model reading ordinary text can deduce private attributes you never typed, such as your location, income, or sex — at up to 85% top-1 accuracy. The leak is not the name you forgot to delete. It is what the model reasons out from everything around it.

In 2023, four ETH Zurich researchers, Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev, published the first study to measure this directly, later accepted at ICLR 2024. They fed real Reddit profiles to nine leading models and asked them to guess eight personal attributes. Their finding: "current LLMs can infer a wide range of personal attributes (e.g., location, income, sex)," reaching "up to 85% top-1 and 95% top-3 accuracy at a fraction of the cost (100×) and time (240×) required by humans." ¹ Read "up to" literally: 85% is the ceiling on the easiest attribute, not a flat rate on everything, and the text was public Reddit comments, not a private note vault. But the capability is the point. What a human profiler once did slowly, a model now does at scale.

This is a different privacy problem from the one most people picture. The familiar worry is memorization: a model repeating a training example that happened to contain your data. Inference needs no training on you at all. The model simply reasons, at read time, over whatever text you put in front of it. Nothing has to leak first for the profile to form.

What most people assume keeps a note safe

Most privacy advice for AI assumes the risk is visible. Strip your name, your address, the account number, the birth date — remove the identifiers you can see, and the text is supposedly safe to hand a model. This is the redaction discipline, and it is sound as far as it goes.

You already do this, and you should. Stripping identifiers before you paste a note into a chatbot is real protection against the obvious leak, and it is the discipline behind redact before you hand a note to AI. ² The trouble is what the advice quietly assumes: that the risk is the identifier. Delete the name, delete the number, and the exposure is gone.

For explicit data, that holds. For inference, it does not. The two leaks look alike from the outside, but only one of them answers to the delete key. The other survives every identifier you can find and remove.

Why the leak is inference, not the identifier

The flaw is that a model does not need your identifiers. It reasons from what is left. Mention a "hook turn" and it places you in Melbourne; describe your commute, your slang, your weather complaints, and it assembles the attribute you deleted. Redaction removes the label, not the evidence around it.

The ETH Zurich team stated their result plainly: "we present the first comprehensive study on the capabilities of pretrained LLMs to infer personal attributes from text." ¹ In one worked example, GPT-4 reads a throwaway comment mentioning a "hook turn," which it identifies as "a traffic maneuver particularly used in Melbourne," and pins the author's city, though the writer never named it. ¹

Anonymization does not close the gap either. When the researchers stripped every explicit location reference, location-guessing accuracy fell from about 86% to about 55% — reduced, but nowhere near erased. ¹ Even a commercial anonymizer that removes more than standard identifiers left accuracy near 44% on the hardest examples. ¹ Their summary is blunt: "common mitigations, i.e., text anonymization and model alignment, are currently ineffective at protecting user privacy against LLM inference." ¹

The defense most people would reach for first, scrubbing the text before they send it, is the one the researchers tested and found wanting.

This is a different failure from an embedding that can be turned back into your original text — the reconstruction of what you did write is its own problem, covered in the embedding of your note is not anonymous. ³ Inference is the mirror image: the model deriving what you did not write.

One caveat belongs here, in the open. The study measured public Reddit comments from 2012 to early 2016, 520 profiles and 5,814 comments — not a private note vault. ¹ The exact accuracy over your own notes is unmeasured. The capability is what transfers, not a guaranteed number.

What actually controls the leak

If deletion cannot stop inference, the only reliable control is upstream: decide what text reaches a model at all. Text a model never sees cannot be reasoned over. So the boundary that matters is not what you redact inside the note — it is whether the raw note leaves your device in the first place.

The finding that should change your habits is the one about defenses. If deleting identifiers only dents the accuracy, no amount of in-note cleanup makes a note safe to feed a model wholesale. The leverage moves upstream, to the decision of what reaches a model at all.

Practically, that reframes the whole question. You stop asking how to scrub a note clean enough to be safe, because the study suggests clean enough may not exist. You start asking a narrower question that has a clear answer: does this particular text need to reach a model to get what I want? Most of the time, only a fragment does, and the rest can stay where it is.

This is where holding your notes locally matters — as a matter of architecture, not trust. Notes kept on your own device are not fed by default to a model that could profile them.

When you do opt into an AI feature, you choose the exact text that leaves your device — and that text can still be reasoned over by your chosen provider. The honest framing is not that you become anonymous. No note app makes anyone un-profilable. It is that you hand the model less to work with.

And the economics are moving the wrong way. A 2026 preprint, not yet peer-reviewed and best read as corroboration rather than proof, reports an agent reconstructing "high-fidelity profiles, achieving over 90% factual accuracy within 10 minutes at a cost under $3." ⁴ The direction since 2023 is cheaper, faster, more automated.

What to do with your notes tomorrow

You cannot audit a model's inferences, but you can govern its inputs. Treat every hand-off to an AI as a disclosure, not a lookup. Send the smallest slice that answers your question, keep the archive local, and assume anything you paste can be reasoned past its literal words.

None of this needs a new tool, and none of it needs a habit you will abandon by Friday. It needs one question asked before you hit paste.

1. Treat every paste as a disclosure. Before a note goes to a model, ask what it could reveal beyond its literal words — not only the names you removed.
2. Send the slice, not the vault. Hand the model the paragraph that answers your question, not the whole file. Less text is less to infer from.
3. Keep the archive local. A note a model never receives cannot be profiled. Storage on your own device is the default that leaks nothing.
4. Redact anyway — it still helps. Stripping identifiers lowers accuracy even if it does not zero it, and credentials should never be in the file at all: secrets do not belong in notes an AI reads. ⁵
5. Drop the absolutes. No setting makes you un-inferable. Assume anything you send can be reasoned past, and decide what to send on that basis.

Frequently Asked Questions

Can an AI figure out private things about me from my notes I never wrote down? Yes. Researchers at ETH Zurich showed that current language models can infer attributes like location, income, and sex from ordinary text, reaching up to 85% top-1 accuracy. ¹ The model reasons from context such as slang, references, and routines, so a fact you never typed can still be deduced from the words around it.

Does redacting names and numbers stop an AI from profiling me? Only partially. Deleting explicit identifiers helps, but it does not defeat inference. In the same study, stripping every location mention dropped location-guessing accuracy from about 86% to about 55% — lower, but far from safe. ¹ Redaction removes the label; the model still reasons from the residual context you left behind.

How accurately can an AI guess my location from my writing? In the ETH Zurich study, models inferred location at up to roughly 85% top-1 and 95% top-3 accuracy on public Reddit text. ¹ Treat that as a ceiling on the easiest attribute, not a guarantee on yours. A single regional phrase, such as naming a local traffic maneuver, was enough to place an author's city.

Is my note data safe if it stays on my device? Text a model never receives cannot be inferred over, so keeping the raw archive on your own device removes the exposure by default. But there is no absolute. The moment you opt into an AI feature, the text you send can be reasoned over by your chosen provider. The control is sending less, not sending safely.

What personal attributes can a language model infer from text? The ETH Zurich researchers tested inference across eight personal attributes and reported that models "can infer a wide range of personal attributes (e.g., location, income, sex)." ¹ Others include age, birthplace, education, occupation, and relationship status. Accuracy varies widely by attribute: location is among the easiest, income among the hardest.

Does anonymizing text protect my privacy from AI? Not reliably. The researchers concluded that "common mitigations, i.e., text anonymization and model alignment, are currently ineffective at protecting user privacy against LLM inference." ¹ Even a commercial-grade anonymizer left inference accuracy near 44% on the hardest examples. ¹ Anonymization lowers the risk; it does not remove it.

The old rule was to delete what you could see. The new rule is to withhold what a model could reason out — because the leak in your notes is no longer only what you wrote, but what a machine can infer you never had to. Choose what reaches it.

MNMNOTE keeps your notes as plain Markdown on your own device, so the only text a model ever reasons over is the text you choose to hand it — mnmnote.com.