Pseudonymized but Linkable: Cross-Document Re-identification Risks in LLM-Ready Sensitive Text Corpora

Sensitive text corpora are increasingly prepared for retrieval, evaluation, sharing, and model adaptation by transforming one document at a time. This document-local workflow removes obvious direct identifiers, but it can leave a corpus-level failure mode: records with no names, emails, or account numbers may still be linkable through repeated quasi-identifiers such as role, region, institution type, family context, health context, financial context, schedules, and rare events. We introduce CrossDoc-PrivacyBench, a fully synthetic benchmark with 120 personas, 480 documents, risk tiers, utility labels, decoy auxiliary profiles, and RAG-style exposure tasks. We show that common document-local transformations remain linkable: direct redaction leaves local auxiliary matching at 0.71 top-1, a Presidio-style personally identifiable information (PII) baseline remains at 0.59, and a GPT-5.5 auxiliary attacker matches direct-redacted and document-local corpora almost perfectly on a 48-person stress audit. We propose LinkGuard, a simple corpus-aware generalization heuristic that estimates cross-document uniqueness and generalizes high-risk quasi-identifiers until a target anonymity set is reached. At target k=5, LinkGuard reduces local auxiliary top-1 to 0.04 while preserving issue classification and retrieval Recall@5 at 1.00; aggressive redaction reaches similar local privacy but drops issue accuracy to 0.35 and retrieval Recall@5 to 0.31. These results suggest that LLM-ready data transformations should be evaluated for corpus-level linkage resistance, not only document-local PII removal.