arXiv CSopen access

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Scaling Author Identity Disambiguation to the World of Code: A Methodology Audris Mockus University of Tennessee Knoxville, USA

arXiv:2607.06920v1 [cs.SE] 8 Jul 2026

Abstract

version V2604: ∼107M distinct author ids over ∼6B commits, an

We describe the methodology used to alias the free-text author/committer order of magnitude beyond the largest published resolutions [3]. At this scale the dominant failure mode inverts from the literature’s identities of the entire World of Code (WoC) collection (version usual concern. Classical de-aliasing maximizes recall against missed V2604, ∼107M distinct author strings over ∼6B commits) into canonmerges; in a global transitive union over 108 identities, the bindical persons, extending the fingerprint-based anti-aliasing of ALing constraint is over-merge: a handful of bridge identities (placeFAA [1] and the 38M-id resolution of Fry et al. [3] by an order of holder emails, role accounts, template author strings, commonmagnitude. The central engineering problem at this scale is overname homonyms) weld unrelated clusters into mega-components merge rather than missed merges: a small number of bridge identithat absorb millions of people. Our predecessor production map ties (bots, role accounts, placeholder emails, multi-author commit carried a 3.0M-member cluster; the first ungated union of V2604 fields) transitively weld otherwise-unrelated clusters through the produced a 170,431-member one. Most of this paper is the systemglobal union step into million-member “mega-clusters.” We report atic dissolution of that cluster without sacrificing the legitimate the full experimental record (twenty experiments, including every merges around it, followed by the recovery, once precision machinunsuccessful approach) that led to the deployed design. Node-level ery existed to make it safe, of the recall that caution had deferred. gates (information score, project spread, link degree) preserve reThe paper makes five contributions. (1) A methodology-as-record: call but cannot dissolve the mega; per-value blocklists of bad highall twenty experiments are reported, including the failures, bequality attributes are recall-safe but cannot break a redundant mesh; cause the failures carry the design information: three families of the working composition is a betweenness-centrality cut over the node-level gates and an exhaustive attribute-blocklisting arc had exact union graph plus a per-edge classifier trained on 2.6M labels to fail, measurably and for articulable reasons, before the workmined for free from GitHub no-reply ids. The same classifier, filtering design was identifiable. (2) A diagnosis: over-merge at scale is ing the expansion of dormant cross-project shingle groups, joined driven by bad high-quality attributes, values rare enough to look by GitHub’s own account assertions mined from no-reply ids, then identifying yet semantically void (Cloudflare relay hashes, unconrecovers the recall the precision work had foregone. Against humanfigured git templates), and we separate them by intent into privacy adjudicated pairs the deployed map’s per-edge model transfers at masks (chosen; must never be merged) and homonym defaults (acAUC 0.99; end to end, the largest cluster falls from 170,431 (and a cidental; re-linkable by later evidence). (3) Labels for free: GitHub predecessor’s 3.0M) to under 7,000 while gold recall rises from 0.44 no-reply ids embedded in raw commit strings yield 2.6M labeled to 0.70 at increasing precision, and on an independent 21M-alias identity pairs at zero annotation cost; a per-edge logistic classifier GitHub ground truth the final map outscores both its predecessors on gate signals turned features transfers to human-adjudicated and the published state of the art among global, privacy-preserving labels at AUC 0.99, matching an actively-learned random forest resolvers. The record doubles as a catalog of scale lessons: structhat required behavioral fingerprints [1]. (4) A composed design: an tural cuts do not transfer to edge sets they never saw, gradient exact reconstruction of the union graph, a sampled-betweenness boosting shortcut-learns label-construction artifacts that a linear cut of its 2,000 load-bearing nodes, per-edge pruning of the residual model survives, and recall-only and precision-only benchmarks homonym fragments, and classifier-filtered expansion of dormant invert verdicts unless read together. cross-project shingle groups, completed by GitHub-asserted sameaccount edges, each mechanism validated end-to-end, with the 1 Introduction recall stages together raising gold recall from 0.44 to 0.70 while Nearly every quantitative claim about open-source software rests on precision rose. (5) External evaluation at adversarial scale: on the knowing who: developer productivity and turnover, project health 21M-alias single-author-repository ground truth of Bock et al. [2], and bus factors, the provenance chains behind supply-chain secuthe final map outperforms both predecessor maps and the published rity, the demographics of contribution. Git records authorship as global state of the art, while remaining mega-free. The benchmark’s a free-text string, and developers scatter their work across name recall-only construction, read against the precision-only gold audit, spellings, work and personal emails, usernames, and, increasingly, illustrates why identity resolvers must be graded on both axes at deliberate anonymization. Resolving these strings to persons (deonce. aliasing) is therefore foundational infrastructure for mining softThe map described here is deployed as the production identity ware repositories, and getting it wrong is worse than not doing it: a layer of WoC V2604. Section 2 presents the pipeline, the experimenresolver that welds strangers together fabricates super-developers, tal record (Table 1), and the analyses; Section 3 distills the lessons corrupts network analyses, and overrides explicit privacy choices. we believe transfer beyond this system. This paper documents, as a complete experimental record, the construction of the author identity map for World of Code (WoC) [4]

Conference’17, July 2017, Washington, DC, USA

2 Methodology 2.1 Problem and Prior Work ALFAA [1] disambiguates developer identities by combining string similarity with behavioral fingerprints under active learning; Fry et al. [3] scaled a variant to 38M author ids over 2B commits. WoC V2604 contains roughly an order of magnitude more identities. At this scale the precision failure mode inverts: a single highconnectivity identity that links to many distinct people produces a transitive “mega-cluster” that absorbs millions of unrelated authors. The methodology below is therefore organized around detecting and gating bridge identities rather than maximizing recall.

2.2

Data and Pipeline

The pipeline is two-phase, mirroring ALFAA’s local-then-global structure:

Audris Mockus

(C) Link-graph degree-gate. A third signal targets the bridges that (A) and (B) both miss. We compute each identity’s degree 𝑑 (𝑖𝑑), the number of distinct Phase-1 partners it links to, directly from the link list, and gate a pair only if both endpoints are non-bad, non-multi-name, and 𝑑 < D. The hypothesis: the identities that hold the residual mega-cluster together are not prolific in projects but prolific in links: shared/template author strings that co-occur with thousands of distinct real people inside a single dense corpus. Because the loader of (B) already gates on a generic “value;id” file, the same code serves the degree-gate by swapping the spread file for a degree file.

2.5

Discussion of the Experimental Record

The information-score cutoff (Exp. 2) is a blunt instrument: the union rate is flat (∼93%) until cutoff ≈ 48 and then falls off a cliff (74% → 7.6% between 48 and 64), because a single rare email already Inputs. CmtV2604.split (per-id fingerprint fields: name 𝑓 , scores ≈ log(108 ) ≈ 18, so almost every id clears a low bar. Only family-name 𝑙, username 𝑢, email 𝑒, GitHub numeric id 𝑔); P2aFull.V2604.{0..31}.s (project→author, project-sharded); cutoff = 64 dissolves the mega-clusters (>10k bucket → 0), but a2PFull.V2604.{0..31}.s (author→deforked project 𝑃, author- it simultaneously destroys legitimate merges, collapsing the size-2 bucket from 9.60M to 2.14M pairs. The cutoff cannot separate “low sharded and author-sorted). information” from “genuine but sparse” identities. Phase 1 (local). Within-project co-authorship/fingerprint linkProject spread (Exp. 3) is a more direct signal: of the 22,877 ids in ing (aliasLink) emits candidate same-person pairs. For ≥ 100 deforked projects, only 645 (3%) were already on the bad/bot V2604 this yielded 49.76M links over 70.3M raw clusters. list, so spread recovers ∼22k bridges that both the name/email Phase 2 (global). Union–find over the pairs, then per-cluster heuristics and the info-score gate miss (e.g. ImgBotApp, Cursor representative selection (selectRep). The representative Í 𝑁𝑥 Agent, GitHub seed-course accounts). Crucially, the spread-gate maximizes an information score info(𝑖𝑑) = 𝑥 ∈ { 𝑓 ,𝑙,𝑢,𝑒,𝑔} log freq (·) , 𝑥 is the first mechanism that preserves recall: the legitimate size-2 i.e. rarer field values are more identifying. “Bad” ids (bots/generic/machinebucket stays fixed at 9.60M across the entire sweep, because the local, from getUninformative) get −∞ and are never repgate only ever bars a high-spread id from bridging, never from resentatives. keeping its own identity. Its failure is on the precision axis: the mega dissolves only slowly (top 51,860 → 28,526 as the gate tightens 2.3 The Over-Merge Phenomenon from T = 200 to 100), and each halving of the giant costs roughly Run unconditionally, Phase 2’s union step welds clusters through 4× more gated ids. The residual mega is held together by a long tail bridge identities. The largest resulting cluster contained 111,926 of low-spread bridges, identities that appear in only a handful of members spanning 857,853 distinct projects, clearly not one perprojects and so never trip any spread threshold. son. Manual triage attributed the bridging to three identity types: Inspecting those low-spread bridges (Exp. 4) reveals what they multi-name commit fields (“A and B”), shared role/service accounts, are: high-degree shared and template author strings. The top of and rare-but-shared emails. The remaining experiments test mechthe degree ranking is not bots-in-many-projects but French legalanisms for suppressing these bridges without discarding legitimate text citation strings (Plusieurs textes, Inconnu, Loi n°..., small-cluster merges. Décret n°...), bare operators (=, <=>), and empty-name machinelocal accounts, each confined to one corpus (low 𝑛𝑃 ) yet linked to 2.4 Gating Strategies thousands of distinct committers (high 𝑑). Degree is also a sharper We define an identity as eligible to bridge only if it passes a gate; signal: only 296 ids have 𝑑 ≥ 500 and 54 have 𝑑 ≥ 1000, versus tens ineligible ids still alias to themselves but cannot transitively union of thousands of gated ids needed at comparable spread thresholds. others. Two gate signals were evaluated. This explains the Exp. 3 plateau and motivates the final design. The degree hypothesis is then confirmed by independent ground (A) Information-score cutoff. selectRepGated unions a pair only truth (Exp. 5, Table 23): labeling each link by whether its endpoints’ if both endpoints are non-bad, non-multi-name, and have info > GitHub numeric ids agree, the false-link rate is a near step-function cutoff. The hypothesis: uninformative ids are the bridges. of endpoint degree: 5.7% at 𝑑 < 10 but 99.8% at 𝑑 ∈ [100, 499]. A (B) Project-spread bot-gate (“opposite approach”). selectRepSpread moderately high-degree identity that carries a GitHub id almost gates on deforked project spread 𝑛𝑃 (𝑖𝑑) computed from a2PFull never links to the same account, i.e. it is virtually always a bridge. (uppercase 𝑃 = fork-collapsed; lowercase 𝑝 would over-count beThe very top of the degree distribution (𝑑 ≥ 500) is unlabelable cause forks share git history). A pair unions only if both endpoints precisely because those bridges are non-GitHub template strings, are non-bad, non-multi-name, and 𝑛𝑃 < T. The hypothesis: bridges so degree is the only signal that reaches them. The same labels turn are exactly the ids present in implausibly many unrelated projects the gating sweeps into a feature ablation for a per-edge classifier (bots, role accounts). (§ Toward a Learned Edge Classifier).

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Conference’17, July 2017, Washington, DC, USA

Table 1: Experiment log for over-merge suppression in WoC V2604 aliasing. Baseline = unconditional global union. “size-2” is the count of legitimate two-member clusters (a recall proxy we want to preserve); “top” is the largest cluster size (an over-merge proxy we want small). #

Approach

Hypothesis / setup

Outcome

St.

1

Ungated union (baseline)

Global union over all 49.76M Phase-1 pairs; rep = max info-score.

Over-merge: top cluster = 111,926 members across 857,853 projects; 70.3M clusters total. Bridges = multi-name fields, role accounts, shared emails.

✗

2

Info-score cutoff gate

Union only if both endpoints non-bad, nonmulti-name, info > cut. Swept cut ∈ {16, 24, 32, 48, 56, 60, 64, 96} (Table ??).

Blunt. Union rate flat (∼93%) then cliff 48 → 64. Only cut = 64 dissolves mega (>10k → 0) but collapses size-2 from 9.60M→ 2.14M. Cannot separate low-info from sparse-genuine.

✗

3

Project-spread bot-gate

Union only if both endpoints non-bad, nonmulti-name, deforked spread 𝑛𝑃 < T. 𝑛𝑃 from a2PFull.V2604 (fork-collapsed). Swept T ∈ {200, 500, 1000, 2000, 5000} (Table ??).

Recall pristine (size-2 fixed at 9.60M for all T) but the mega dissolves only slowly with more gating (top 51,860 → 28,526 from T= 200 → 100); each halving of the giant costs ∼4 × more gated ids. The residual mega is welded by a long tail of low-spread bridges no spread threshold reaches. Beats Exp. 2 on recall but cannot dissolve the mega alone.

✗

4

Link-graph degree-gate

Gate on co-link degree 𝑑 (𝑖𝑑 ) (distinct Phase-1 partners), reusing the Exp. 3 loader with a degree gate file. Hypothesis: the low-spread residual bridges are high-degree shared/template author strings.

Signal strongly validated: degree is far more concentrated than spread (only 296 ids with 𝑑 ≥ 500, 54 with 𝑑 ≥ 1000; max 4380) and its top nodes are precisely the residual-mega bridges: French legal-text template strings, bare =/<=>, machinelocal empties (Table ??), all low-spread, so invisible to Exp. 3. But the gated sweep slow-peels exactly like Exp. 3 (top 71,172 → 20,635 for D= 1000 → 50; >10k never < 2): each threshold gates the top bridge and exposes the next. Even the combined union-gate 𝑑 ≥100 ∨ 𝑛𝑃 ≥100 (42k ids, recall pristine) only reaches one residual mega (top 25,957), welded by a moderatedegree/spread Cloudflare hash string no node threshold reaches (Table 24). No node-gate dissolves the mega cleanly.

✗

Recommendation. No single signal dissolves the mega while preserving recall: the info-score cutoff (Exp. 2) destroys recall, and project spread (Exp. 3) and degree (Exp. 4) preserve recall but slowpeel; each threshold gates the top bridge and merely exposes the next. The signals are complementary (spread catches many-project bots, degree catches many-partner template strings, and the two populations barely overlap), so we adopt a union of bridge-gates: an identity is ineligible to bridge if it is bad/multi-name, or 𝑛𝑃 ≥ T, or 𝑑 ≥ D, with T, D set at the ghid-validated knee (≈ 100, where the cross-ghid false rate jumps to 99.8%). Evaluated (Table 24, combined row), this union is the best node-level design by a wide margin: gating only 42,110 ids it drives the top cluster 111,926 → 25,957 and the >10k bucket from 2–3 to a single residual, while improving recall to 9.60M two-member clusters (the highest of any run), because each gated identity still aliases to itself and only loses its power to transitively weld others. But it does not dissolve the mega. Once every noreply.github.com service account and high-spread bot is gated, the lone survivor is a Cloudflare email-relay hash string of moderate degree and moderate spread that sits below every node threshold. This is the decisive negative result of the node-gating program: the residual over-merge is welded not by a few extreme hubs but by a long tail of moderate bridges, so no union of node-gates can reach it. Raising either threshold to catch the hash string would begin to sacrifice recall without any guarantee the next moderate

bridge is caught. The principled remedy must therefore act below node granularity: per edge.

2.6

Toward a Learned Edge Classifier

The gating experiments above operate at the node level: an identity flagged as a bridge is barred from all unions, even those that are correct. This is the source of their residual imprecision (a prolific maintainer who is also lightly bot-adjacent loses some true aliases) and, as the combined-gate result shows, of their fundamental ceiling: a moderate bridge that no node threshold can flag without collateral remains free to weld a 25,957-member mega. An identity is rarely globally a bridge; it is a bridge only on the specific edges that cross between communities. Gating the node discards the good edges with the bad; classifying the edge keeps the good and drops only the welds. Every gate is, moreover, a downstream patch: over-merge is a Phase-2 symptom of imprecise Phase-1 links, so the principled fix is to raise link precision at the edge level, in the lineage of ALFAA’s learned pairwise model [1]. Centrality choice. If a graph signal is to be added, the objective is to break a connected component, for which the matching measure is betweenness / articulation-point status (“does removing this node disconnect the cluster?”), not Katz or eigenvector centrality. The latter reward embedding in a dense core and would, by contagion, elevate legitimate maintainers adjacent to a bot hub. Because

Conference’17, July 2017, Washington, DC, USA

Audris Mockus

Table 2: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

5

Cross-ghid false-link rate (edge labels)

Free ground truth: a Phase-1 link whose endpoints carry agreeing GitHub numeric ids is a true positive, conflicting ids a false link. Mine the id from the raw NNNN+login@. . . noreply.github.com prefix; cross-tabulate the false rate by endpoint degree (Table 23).

29.95M ids labeled; 2.64M links labeled on both ends; 11.4% are false. The rate rises sharply with degree (5.7% at 𝑑 <10 to 99.8% at 𝑑 ∈ [100, 499] ), an independent confirmation that high-degree ids are bridges (Exp. 4), and the label set for a peredge classifier.

✓

6

Learned per-edge classifier

Replace node-gating with a pairwise model on the 2.64M ghid-labeled links (Exp. 5). Features = the gate signals turned peredge: endpoint degree (min/max), spread (min/max), info-score (min/max), componentmatch flags (f/l/u/e/domain), and matchScore Í ( log(𝑁 /freq) over matching components). Logistic regression, 300k train / 2.34M test (Table 25).

Test accuracy 95.2% vs. a 88.6% predict-all-true baseline; AUC = 0.956. The false rate is monotone in both degree (the over-merge axis) and matchScore (the true-link axis); the model keeps a high-degree id’s strongly-matched links and drops only its weak high-degree welds, exactly what no node-gate could do. External validation on the human-labeled ALFAA gold set [1] (469k pairs, all 2,345 ids found in V2604): in-domain 5fold AUC = 0.994; the ghid-trained model transfers to the human labels at AUC = 0.987, matching ALFAA’s random forest without its doc2vec behavioral fingerprint.

✓

7

Flat edge-probability threshold

Apply the Exp. 6 classifier to score all 49.76M Phase-1 links, keep those with 𝑝 ≥ 𝜏 , and re-run the global union. Sweep 𝜏 ∈ {0.30, 0.50, 0.70, 0.90} and check whether any 𝜏 dissolves the residual mega (>10k → 0) while holding size-2 near baseline (Table ??).

The mega survives 𝜏=0.30 and 0.50 (>10k = 1) and dies only at 𝜏 ≥0.70, but by then size-2 has fallen to 7.78M and 2.6M ids have dropped to singletons. The trade is monotone: no 𝜏 both kills the mega and preserves recall, because the mega’s welds share an exact placeholder email and so the classifier scores them high (𝑒/dom/rawJac all fire). A global threshold cannot separate them.

✗

8

Bad high-quality attribute detection

Root-cause the high-scoring welds: an attribute value is a bad bridge if a single exact string ties together many distinct person-names. Stream Cmt.split.e (sorted by email) and count distinct ⟨ 𝑓 , 𝑙 ⟩ names per email; classify each by intent (Table 11).

3.84M emails bridge ≥ 3 distinct names. A recall-safe two-tier rule (lexical placeholders at ≥ 3; form-only signals such as github-noreply, long-numeric QQ, and pure spread only at ≥ 10) yields 91,432 bad emails (90,011 new beyond the 4,776-entry manual stoplist), split by intent into privacy (deliberate anonymisation: 123@, anonymous, johndoe@, Cloudflare/githubnoreply hashes) vs. homonym (unintentional defaults: root, admin, *.local). Neutralising these at source removes the welds before scoring, the fix Exp. 7 shows a threshold cannot make.

✓

the observed bridges are stars (a template string linked to many otherwise-unconnected committers), degree already approximates betweenness for them at the cost of a single pass; the cheap principled upgrade, if needed, is Tarjan articulation points (𝑂 (𝑉 +𝐸)), reserving sampled betweenness for a later refinement and avoiding Katz. Labels for free. What made the ALFAA classifier expensive, active learning with human labeling, is unnecessary at WoC scale because verified GitHub numeric ids (ghid) supply ground truth in bulk: a candidate link whose endpoints carry agreeing ghid is a positive, and one whose endpoints carry conflicting ghid is a negative. This yields tens of millions of labeled pairs at no annotation cost (cf. Fry et al. [3]), but only if the numeric id is mined from the raw identity string, where the GitHub no-reply email carries it as a [email protected] prefix: the pipeline’s normalized email field strips the number and its login field is non-numeric, so reading the parsed columns yields only 163K labels versus 29.95M from the raw prefix. Under this lens the gating sweeps become an ablation study: each gate’s signal (string similarity, info-score, project spread 𝑛𝑃 , link degree 𝑑, temporal and project overlap) becomes a feature of a pairwise classifier that

replaces hand-set knees with a learned decision surface, and acts per edge so a high-degree id keeps its true links and sheds only its spurious ones. As an immediate bridge to that model, the cross-ghid link rate (the fraction of Phase-1 links whose endpoints carry conflicting ghid, cross-tabulated by endpoint degree) both quantifies the over-merge source and independently tests whether false links concentrate on high-degree nodes (Exp. 5). Realized classifier (Exp. 6). We trained the pairwise model on the 2,635,882 links labeled on both ends (Table 25). Each gate signal becomes a per-edge feature: endpoint degree, spread and info-score (as min/max over the two endpoints), binary component-match flags Í (first/last/user/email/domain), and a matchScore log(𝑁 /freq) summed over the components the endpoints share, the rarity-weighted linkage evidence. A plain logistic regression (300k train, 2.34M held out) reaches 95.2% accuracy against a 88.6% predict-all-true baseline, AUC 0.956. The learned weights recover the entire experimental record in one model: degree carries a negative coefficient (the overmerge axis: higher degree, more likely false), while matchScore and the user/email/domain matches carry the largest positive weights (the true-link axis); project spread is near-zero, censored because most ghid-labeled developers sit below the 𝑛𝑃 ≥ 20 floor. The false

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Conference’17, July 2017, Washington, DC, USA

Table 3: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

9

Source-blank emails + re-union

End-to-end test: blank all 91,432 bad emails in the commit table, re-run Rule 2, recompute the global union (Table 12). Does removing bademail welds at source dissolve the mega while preserving recall?

Recall-safe but insufficient. Blanking voids 1.07M fields and drops 403,635 email-only welds; size-2 rises 9,304,193 → 9,307,723 (vs. Exp. 7’s collapse): a source-neutralised value severs only spurious welds. But the mega persists (>10k = 1): it is multiply connected through placeholder names/usernames too. Bad-attribute neutralisation is necessary and recall-safe, but must cover every attribute (or pair with a structural cut).

✗

10

Multi-attribute source-blanking

Extend Exp. 8’s spread detector to usernames (distinct names per login) and names (distinct emails per ⟨𝑓 , 𝑙 ⟩ ), classify by the same intent taxonomy, and blank all three blocklists (91,432 emails + 12,418 logins + 628 names; 5.46M fields over 106.8M rows) before re-running all three Phase-1 link generators and the union.

Recall-safe but still insufficient. Clusters +112k, 117k ids drop to singletons, size-2 unchanged (9,304,193 → 9,304,250); but the mega shrinks only 6.4% (170,431 → 159,483, same representative). Side finding: the +17.6M “pairs” in the treatment log is an artifact: shingle lines parse as type;anchor pseudo-node unions invisible to the member stats, so the union is driven by Rules 1–2 alone (84M links). The mega is welded by a redundant mesh no per-value blocklist reaches.

✗

11

Structural bridge detection

Reconstruct the production union graph exactly in NetworKit (45.1M eligible ids, 41.7M unique Rule 1–2 links; giant = 170,431, matching the union mega to the node). On the mega subgraph (347k edges, mean degree 4.1) compute sampled betweenness centrality (4,000source Brandes), articulation points (iterative Tarjan), and 𝑘 -cores; rank candidate cut-nodes and test overlap with the attribute blocklists.

Betweenness finds what no value rule can. Two bridge populations emerge: uncaught placeholder hubs (= <=> deg 3,216, betw. 0.258; Gerrit service/relay accounts; Badger bots) and, invisible to every attribute detector, homonym chains of moderate-degree common-surname ids (kim/lee/smith/unknown dominate the top-2k last-tokens). Of the top-2,000 bridges, 0 are in bad.ids and only 32 carry a blocklisted email (98.4% attribute-clean). Cut sweep (Table 13): removing the top 2,000 by betweenness (1.2% of mega nodes) shatters the mega to a largest component of 7,268; top-5,000 → 1,813 with 89.5% of survivors freed into ≤ 100-size components. 28% of mega nodes are articulation points. End-to-end: gating these 2,000 ids in the production union dissolves the mega (>10k 1 → 0; top 170,431 → 7,268, exactly the local prediction) with recall above baseline (size-2 9,304,193 → 9,305,460). The first design in the record to achieve both.

✓

12

Classifier refinement of residual fragments

Extract the ten residual mega fragments of size ≥ 1,000 left by the 𝐾=2,000 cut (29,315 ids, 61,637 internal edges, exactly the new 1k–10k clusters of the gated union), score every internal edge with the Exp. 6 classifier, and prune at 𝑝 < 𝜏 inside the fragments only (unscored edges kept).

Targeted pruning shatters the homonym blocks a global threshold could not afford to. Member samples confirm the fragments are given-name homonym blocks (David, Michael, Daniel, Thomas, James, Jan, Chris), a Koreansurname block (Kim), an institutional-domain block (RIT students), and a dense Gerrit-relay remnant (Table 14). At 𝜏=0.5 the largest surviving sub-component is 1,942 (from 7,268) and ∼46% of fragment ids are freed into components ≤ 100, at a recall risk bounded to 0.03% of all ids, via edges the model itself certifies as unlikely. Contrast Exp. 7: the same classifier applied globally cost 2.6M singletons. Caveats: the Kim and RIT blocks resist (freed 27/26%; shared exact emails and @rit.edu domains score high), and the Gerrit fragment is only 16% scored (relay ids lack parseable features).

✓

rate is monotone along both axes: 0.057 at 𝑑 max <10 rising to 0.998 at 𝑑 max ∈ [100, 500), and 0.887 at matchScore<5 falling to 0.004 at matchScore ∈ [30, 50). The two axes are independent: a high-degree id with strongly-matched endpoints is kept, a high-degree id with weak matches is dropped. This is the per-edge discrimination no node-gate could express. Richer models (gradient-boosted trees, the ALFAA random forest) and raw string-similarity features can

only raise the ceiling above this linear-model floor; the labels and feature pipeline are now in place to fit them. A flat threshold does not dissolve the mega (Exp. 7). A per-edge score is not yet a clustering. To test whether it suppresses overmerge we scored all 49.76M Phase-1 links, kept those with 𝑝 ≥ 𝜏, and re-ran the global union for 𝜏 ∈ {0.30, . . . , 0.90} (Table ??). The result is a clean negative: the residual mega survives 𝜏≤0.50 and

Conference’17, July 2017, Washington, DC, USA

Audris Mockus

Table 4: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

13

ALFAA gold pairs as arbiter (and audit of the gold itself)

Score V3 and production V2604 against the 469,369 human-rated ALFAA pairs, of which 264,346 are unique non-self pairs over 2,345 ids with 1,644 true matches (the 2,345 trivial selfpairs excluded): a map predicts “same” iff both ids share a representative (Table ??); decompose every disagreement and lexically audit the labels.

The mega is V3’s recall engine and its precision sink; V2604’s misses are genuine, structural, and largely recoverable. V3: recall 1.000, precision 0.522; 180 gold ids (7.7%) sit inside its 3.0M mega, where 94.6% of its 1,505 FPs are manufactured while buying only 139 TPs (10:1); mega-free V3 scores 0.915/0.949. V2604: precision 0.873 (104 FPs), recall 0.436; 95.8% of misses are alias/alias (not gate-imposed), incl. exact-same-email pairs; cause: Phase-1 requires project co-occurrence and Rule-3 shingles are inert (Exp. 10), yet 83.9% of missed pairs already sit in a computed shingle group (87.3% of all matches ⇒ recall ceiling ∼0.87 via classifierfiltered expansion; naive expansion unsafe: one username group spans 23 distinct people). Gold audit: 20 of V2604’s 104 “false” positives share an exact email/name/handle the raters overrode; ∼6 of 9 zero-overlap “matches” look mislabeled, while the 3 real ones (handles paulczar, dimtruck) V2604 co-clusters without any mega.

✓

14

Classifier-filtered shingle expansion

Claim the recall ceiling Exp. 13 located: expand every Rule-3 shingle group into member pairs, score each with the Exp. 6 classifier, and admit pairs with 𝑝 ≥ 𝜏 as first-class union edges alongside the production inputs (betweenness gate + fragment pruning). 66,459,771 unique expansion edges score 𝑝 ≥ 0.5; sweep 𝜏 ∈ {0.5, 0.7, 0.9} end-to-end (Table 18).

𝜏=0.9 adds 30.8M cross-project edges with a clean profile. At 𝜏=0.5 the mega returns (2,292,596 members): the betweenness cut was computed on the pre-expansion graph, so the new edges re-weld around the gated bridges; a structural cut does not transfer to an edge set it never saw. 𝜏=0.7 still leaves two >10k clusters. At 𝜏=0.9 (46% of scored edges): >10k = 0, top = 3,862, unioned ids 110.6M → 141.4M (+30.8M), size-2 9,307,433 → 10,189,048 (+881,615), the largest recall gain of any experiment, at the cost of 14 clusters in the 1k–10k band (vs. 4 in production). Gold verdict: recall 0.4361 → 0.6454 with precision rising 0.8733 → 0.8820 (TP 717 → 1,061, FP 104 → 142), the first experiment to move recall materially, and it escapes the Exp. 7 monotone trade entirely.

✓

15

Enriched per-pair classifier (v2)

Re-arm the scorer before re-scoring the expansion: add true deforked-project IoU (exact 𝑛𝑃 + capped 100-hash project sets from a2PFull, fixing the spread20 truncation that zeroed 𝑛𝑃 for 99.4% of ids), log(1+𝑥 ) on heavy-tailed counts, per-value spread of each matched attribute, two name↔email-local-part features (f.l-pattern and token-in-handle), and a Wiktionary given-name flag; compare logistic vs. gradient boosting (Table 19).

Logistic v2.1 reaches gold-transfer AUC 0.9910 (v1: 0.9861). LGBM wins in-distribution (test AUC 0.9990) but collapses on gold to 0.56: shortcut learning: 74% of its split gain is on rawJac3, which leaks the shared noreply handle inside both email strings of every ghidlabeled pair; trees threshold the leak, the linear model uses it benignly. Ablating rawJac3 recovers LGBM to 0.981, still below logistic. Caveats from the learned weights: project IoU is inert indistribution (ghid pairs nearly all co-occur; its value is on cross-project pairs), and matchedvalue spread enters positive (synonym-richness confound), so spread cannot serve as a per-pair homonym signal without out-of-distribution labels. Map-level verdict: v2.1 does not transfer. Re-scoring all 256.7M expansion pairs yields 54.0M unique pairs 𝑝 ≥ 0.5 (v1: 66.5M; 𝜏=0.9: 26.1M vs. 30.8M), more selective, structurally cleaner (1k–10k = 9 vs. 14, >10k = 0). The S2 map edges gold recall (0.6490 vs. 0.6454; precision 0.8789 vs. 0.8820) but loses the GitHub benchmark outright: max9 recall 0.5118 vs. 0.5886, FullyMerged 0.4658 vs. 0.5403; the pairs v2.1 prunes are exactly the within-handle mass Exp. 16 counts. A better in-distribution AUC (0.9910 vs. 0.9861) bought a worse map: v1scored S retained as the production candidate.

✗

vanishes only at 𝜏≥0.70, by which point size-2 has fallen from

7.83M to 7.78M and 2.6M ids have decayed to singletons. The recall/dissolution trade is monotone in 𝜏: there is no operating point

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Conference’17, July 2017, Washington, DC, USA

Table 5: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

16

GitHub-scale external recall benchmark

Evaluate the maps on the single-authorrepository ground truth of Bock et al. [2]: 9,568,385 GitHub handles owning 21,477,370 commit ids in their own single-author repos, 104 × larger than ALFAA, recall-only by construction (only within-handle pairs are visible; lumping is invisible). Their metrics: perhandle pairwise recall (macro-averaged), FullyMerged%, ExclSingle%, at handle-size caps max3/max9/all (Table 20).

At max9: V3 recall 0.487 / FullyMerged 0.442; production V2604 0.433 / 0.395; published baselines: WoC V2409 0.450 / 0.411, GitAuthority 0.771 / 0.736. V2604 sits below its own predecessor on a recall-only yardstick: the over-merge surgery of Exps. 1–12 traded exactly the pair mass this benchmark counts, and V3’s edge is partly mega-bought (its map also resolves only 19.2M of the 21.5M aliases vs. V2604’s 21.5M). Confirms Exp. 13 externally at 104 × the scale. The Exp. 14 expansion map then retakes the lead: recall 0.5886 / FullyMerged 0.5403 at max9, above V3, above published V2409, above GitAuthority’s privacy mode (0.478), mega-free; remaining gap to full GitAuthority (0.771) = within-repo context + noreply mining. The v2.1-rescored map (S2) drops to 0.5118 / 0.4658 at max9 despite its better gold AUC: this benchmark, not the indistribution score, made the production call (S over S2).

✓

17

Production alternatives: 𝜏 relaxation, ghid edges, unions; coverage metric

Three user directives reframe the selection: (a) explore all promising edge sources; (b) treat both benchmarks as noisy (gold has mislabels; large same-ghid groups are shared/org accounts, not persons); (c) judge maps also by commit-weighted coverage, counting lowquality ids matchable within a project. Candidates beyond S/S2: v2.1 at 𝜏=0.8 (34.1M edges); 5,736,921 same-ghid pairs from NNNN+login noreply ids (groups of 2–20 only; 346 larger groups up to 12,140 ids excluded as shared accounts); and unions thereof. Every new edge set passes a STATS mega-check before any map (Exp. 14 lesson).

All STATS-clean (>10k = 0). S2@𝜏 0.8: gold recall 0.7019 / precision 0.8789 (TP 1,154), GH max9 recall 0.5828 / FM 0.5354. S+ghid: gold identical to S (0.6454/0.8820: the gold set has almost no noreply ids) but GH max9 recall 0.5995 / FM 0.5516: GitHub’s own account assertion is orthogonal evidence. The two gains are independent and compose: the triple union SUG ([email protected] ∪ [email protected] ∪ ghid; 181,156,655 unioned pairs, largest 6,910, a single noreply identity) beats the pairwise SG8 on both benchmarks: gold 0.7026/0.8790 (TP 1,155, FP 159; SG8 0.7019/0.8789) and GH max9 recall 0.6035 / FM 0.5558 (SG8 0.5931/0.5460), and tops commit-weighted coverage: 73.5% of all 5.87B commits land in a multi-id cluster (B 66.3%, S 72.7%, SG8 73.2%). a2AFullSUG.V2604.s.gz is the production map, superseding a2AFullB.

✓

Table 6: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

18

Within-project matching of low-quality ids; commit-coverage gain

The production map deliberately self-maps 5.77M bad/local ids (generic names, machinelocal addresses) because they are ambiguous across projects; within a single deforked project 𝑃 their reuse is usually unambiguous. Matcher rules: anchor: the bad id’s exact lowercased full name or email local-part matches the ids of exactly one person in 𝑃 (a ∼50-token stoplist of generic names and a 3-character minimum guard the anchor); solo: 𝑃 has exactly one person, so unmatched bad ids default to them; anything ambiguous stays self-mapped, bots are dropped. Primary metric (user directive): commit coverage of human IDs, i.e. by how much does within-project expansion raise the share of commits attributed to a human identity over the cross-project map alone? Measured directly at commit level via provenance tags (global 𝑔 | bot 𝐵 | within-project 𝑝 | self 𝑠 ) in the new c2AFull table over all 5,866,595,698 commits. The bad/local pool that survives the cross-project map and the bot filter is 𝑝 + 𝑠 = 195,352,712 commits (3.33% of all; a commit-weighted count that supersedes the earlier 0.61% distinct-id estimate).

Done. Phase 1: 189,359,993 projects scanned, 11,352,698 bad-id occurrences, 2,355,347 matched by anchor + 3,003,834 by solo = 5,359,181 recovered (47.2% of occurrences; P2aAFull.V2604.s: 𝑃 ;raw;𝐴;rule), parallelized 32× by sHash(𝑃 ) bucketing (∼24h single-core → ∼45min/bucket). Phase 2 (provenance-tagged c2AFull, 128 shards): within-project resolved 𝑝 = 93,381,683 commits = 47.8% of the 195.35M bad/local pool (141 conflicts, negligible). Commit coverage of human (non-bot) IDs rises from 𝑔/(𝑔+𝑝+𝑠 ) = 96.49% (cross-project map alone) to (𝑔+𝑝 )/(𝑔+𝑝+𝑠 ) = 98.17%, i.e. +1.68 pp; residual self/unresolved 𝑠 = 101,971,029 (1.83%). Deliverable A2clsFull.V2604.s (member;canonical;class, 106,826,059 ids): good 94.37% / bad-attr 2.48% / local 2.40% / bot 0.52% / partial 0.23% (partial = only one of name/email), companion to the within-project layer P2aAFull.

✓

Conference’17, July 2017, Washington, DC, USA

that both kills the mega and preserves recall. The reason is diagnostic: the mega’s welds are not weak. They share an exact placeholder email (a Cloudflare relay hash), so 𝑒Match, domMatch and rawJac all fire and the classifier, correctly on its features, scores them high. The over-merge does not live in the model’s low-probability tail where a threshold could reach it; it lives among the high-probability links, indistinguishable by any global cut from genuine sharedemail aliases. The classifier is an excellent edge ranker (AUC 0.987 on human labels) and a poor mega dissolver, and these are not in tension: the welds are high-quality evidence built on a bad value.

2.7

Bad High-Quality Attributes

Exp. 7 relocates the problem from the model to the features: the mega persists because a small set of email strings are simultaneously high-information (rare enough to escape the inverse-frequency down-weighting that aliasRel applies) and semantically void (a placeholder shared by strangers). We call these bad high-quality attributes, and detecting them is cheaper and more decisive than any downstream gate or classifier. Detection by name-spread. The signature is structural, not lexical: a genuine personal email attaches to one person, hence ≈ 1 canonical ⟨first,last⟩ name; a placeholder attaches to many. Streaming the email-sorted commit table and counting distinct names per exact email surfaces every bridge in one pass: 3.84M emails tie together ≥ 3 distinct names, led by [email protected] (69,291 names), none@none (13,334), and the Cloudflare relay hashes that weld the residual mega itself (134f31. . . @cloudflare.com, 171 names). A names/rows ratio near 1.0 (almost every commit a new person) separates a placeholder from a merely prolific contributor.

Audris Mockus

Source-blanking is recall-safe but a single attribute is not enough (Exp. 9). To test the fix end-to-end we blanked all 91,432 bad emails in the commit table (1,074,504 fields over 106.8M rows), re-ran Rule 2 on the blanked input, which dropped 403,635 welds that had existed only because of a shared bad email, and recomputed the global union. The recall result is decisive in the opposite direction from Exp. 7: size-2 did not fall but rose slightly, 9,304,193 → 9,307,723 (Table 12), confirming that neutralising a value at the source severs only spurious welds, never genuine aliases, the property a global probability threshold could not provide. However, the mega did not dissolve (top bin >10k stays at 1; the 1k–10k bin only edges 4 → 3). The diagnosis is structural: the mega is multiply connected. Its members are welded redundantly, through shared placeholder names and usernames in the Rule 1 (2–3 author) and name-shingle paths, so cutting the email edges alone leaves the component intact. Bad-attribute neutralisation is thus necessary and recall-safe but not sufficient: it must be applied to every high-quality attribute (email, then username and display name by the same name-spread detector), or paired with a structural cut (articulation points) on the residual. The email pass is the recall-safe first layer; the remaining layers are the immediate next step.

Covering every attribute still does not dissolve the mega (Exp. 10). We extended the spread detector to the two remaining high-quality attributes, usernames (distinct ⟨𝑓 , 𝑙⟩ names per login) and display names (distinct emails per name), using a sort-based streaming pass after the per-value perl hashing proved 30× too slow. The same intent taxonomy classifies the candidates, with two recall guards learned from inspection: bare common given-names (john, jane, alex) are never blocked even at high spread (only compounds like johndoe and full phrases like “John Doe” are), and the enIntent: privacy versus homonym. The bridges fall into two mechtire form-only high-spread username tier is dropped because freanisms that demand the same action (never weld) for opposite reaquent real given-names dominate it. Blanking all three blocklists sons (Table 11). Privacy bridges are anonymity chosen: [email protected], at once (91,432 emails, 12,418 logins, 628 names; 5.46M fields) and anonymous@, [email protected], and the Cloudflare / users.noreply.github.com re-running all three link generators plus the union is again perfectly relays GitHub issues to mask a real address. Different people delibrecall-safe (size-2 9,304,193 → 9,304,250) and again insufficient: the erately wear the same mask; merging them not only errs but defeats mega shrinks only 6.4%, 170,431 → 159,483, with the same reprean explicit privacy decision. Homonym bridges are defaults inhersentative. A diagnostic side-finding explains an apparent paradox ited: root@localhost, admin@. . . local, [email protected], in the logs: the treatment “pair” count rose by 17.6M, but those pairs and the [email protected] git template a user never reconfigured. are inert: the union parses each shingle line as type;anchor, two Here the collision is accidental, an artifact of unconfigured tooling. pseudo-node tokens that never coincide with an author id, so the The distinction is recorded because it governs downstream use: a production component structure is driven by Rules 1–2 alone (84M homonym may be re-linked later by behavioral evidence, whereas links) and the shingle growth is invisible to it. The conclusion of the a privacy mask should remain split as a matter of intent. blocklist arc (Exps. 8–10) is that per-value neutralisation, however complete, cannot dissolve a component that is a redundant mesh Recall-safe blocklisting. Spread alone over-reaches at the low of many moderately-bad values: each blanked value removes one end. A 9-digit string such as [email protected] is a real QQ acweld and the remaining mesh re-closes around it. count, and four name-variants on it are far more likely one Chinese developer’s spellings than four strangers, exactly the under-split Structural bridge detection (Exp. 11). The blocklist arc motivates WoC already suffers. We therefore tier the rule: lexical placeholdattacking the topology rather than the values. We reconstruct the ers, where the string itself is proof (123@, root@, @example.com, production union graph exactly (nodes are the 45.1M author ids @*.local), are barred at ≥ 3 names; form-only signals that can also incident to an eligible Rule 1–2 link, edges the 41.7M distinct elibe legitimate (any github-noreply, ≥ 6-digit numeric locals, bare gible links) in NetworKit, and verify fidelity: its giant connected empirical spread) are barred only above ≥ 10 names, where sharcomponent has 170,431 nodes, matching the production mega to ing is no longer explicable by one person. This yields 91,432 bad the node. Two structural facts emerge immediately. First, without emails (90,011 new beyond the hand-curated 4,776-entry stoplist, the bad-id/multi-name eligibility gate the giant would have 10.8M a 19× expansion) while sparing 271,766 legitimate github-noreply members: the existing gates already do the heavy lifting, and the addresses that carry only a handful of name variants. mega is the residue they cannot reach. Second, the mega subgraph

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Conference’17, July 2017, Washington, DC, USA

is sparse: 347,008 edges, mean degree 4.1, so its connectivity rests on relatively few load-bearing nodes, the regime where betweenness centrality and articulation points are informative. On the mega subgraph we compute sampled Brandes betweenness (4,000 sources), the biconnected decomposition (articulation points), and 𝑘-cores, then rank candidate cut-nodes and measure their overlap with the attribute blocklists: nodes that are structurally load-bearing and carry a blocked attribute validate the detector; structurally load-bearing nodes with clean attributes are exactly the bridges no attribute rule can find. The ranking reveals two distinct bridge populations. The degree axis recovers uncaught placeholder hubs: = <=> (degree 3,216; betweenness 0.258, a quarter of all sampled shortest paths route through one junk id), three Gerrit Code Review service accounts (degree 742–857), dozens of Gerrit User NNNN <NNNN@uuid> anonymized relay ids, and badge bots (The Gitter Badger, The Codacy Badger, unknown <unknown>). The betweenness axis additionally exposes what no value-based rule can see: homonym chains, runs of moderate-degree, real-looking ids welded by Rule-1 surname matches in small projects (the top-2,000 last-token histogram is dominated by unknown, kim, lee, smith, alex, david). One cannot blocklist the value “Lee” without destroying recall for thousands of genuine Lees, but betweenness pinpoints the specific load-bearing nodes. Indeed 98.4% of the top-2,000 bridges carry no blocklisted attribute at all (0 are in bad.ids; 32 have a blocked email): structurally load-bearing but attribute-clean, the population that terminated the blocklist arc. The local cut sweep (Table 13) is decisive: deleting the top 2,000 by betweenness (1.2% of mega nodes, 0.002% of all ids) collapses the largest component from 170,431 to 7,268, and the top 5,000 leave 1,813 with 89.5% of surviving nodes freed into components of size ≤ 100. By contrast the best attribute design (Exp. 3/4 combined gate) needed 42,110 gated ids to reach top = 25,957, and Exp. 10’s 5.46M blanked fields left 159,483. 28% of mega nodes are articulation points, confirming a sparse tree-like weld structure once the hub edges are gone. The end-to-end confirmation closes the arc. Feeding the top2,000 ids into the production union through the same value;id bridge-gate interface as Exps. 3–4 (gated ids cannot transitively merge others but still alias to themselves) reproduces the local prediction exactly: the largest cluster falls 170,431 → 7,268 and the >10k bin empties for the first time in the record, while size-2 rises above baseline (9,304,193 → 9,305,460) and only 5,722 ids drop to singletons. Every prior design faced a monotone trade between dissolution and recall; the betweenness gate escapes it because it spends its budget on the 2,000 nodes the topology itself certifies as load-bearing, rather than on attribute values that are mostly carried by innocent ids. The residual 1k–10k fragments (4 → 14) are homonym clusters (Kim/RIT-student/Gerrit groups) within reach of the per-edge classifier (Exp. 6) now that no giant component hides them. The method is also cheap: one exact reconstruction of the union graph (∼2 min in NetworKit), sampled betweenness on a 347k-edge subgraph (∼11 min), and a 2,000-line gate file.

cut (29,315 ids, 61,637 internal edges, exactly the new 1k–10k clusters observed in the gated production union) and sampled their members: every one is a homonym block, and strikingly they are organized by given name: David, Michael, Daniel, Thomas, James, Jan, Chris, plus a Korean-surname block (Kim), an institutionaldomain block (RIT student accounts), and one dense Gerrit-relay remnant (Table 14). Scoring each fragment’s internal edges with the Exp. 6 classifier and pruning at 𝑝 < 0.5 inside the fragments only (unscored edges kept) shatters them: the largest surviving subcomponent is 1,942, and ∼46% of fragment ids land in components of size ≤ 100. The contrast with Exp. 7 is instructive. There, the same classifier applied as a global flat threshold decayed 2.6M ids to singletons before the mega died, because the threshold spends recall everywhere while the over-merge lives in a few places. Scoped to the 29,315 ids the topology has already isolated (0.03% of the corpus), the identical model removes only edges it certifies as unlikely, exactly where they do damage. Two honest caveats: the Kim and RIT blocks resist pruning (27%/26% freed) because their welds carry shared exact emails and @rit.edu domains that the classifier (correctly, on its features) scores high: separating same-surname Korean developers and students sharing lab machines needs behavioral evidence beyond our feature set; and the Gerrit fragment is only 16% scorable, its anonymized relay ids lacking the name/email features the model consumes. The composed design, betweenness gate then within-fragment classifier pruning, bounds every formermega cluster below ∼2k with recall risk confined to the fragments themselves.

Classifier refinement of the residual fragments (Exp. 12). The structural gate and the per-edge classifier compose naturally. We extracted the ten residual fragments of size ≥ 1,000 left by the 𝐾=2,000

Precision-stage map (B).. The full run (top-5,000 betweenness gate over the pruned link files, full member;canonical;type output) yields a2AFullB.V2604.s.gz: 106,824,568 rows = 101,056,344

Choosing the production design. We ran both candidates endto-end (Table 15). Deepening the gate to the top-5,000 betweenness ids again reproduces the local prediction exactly (the largest former-mega fragment is 1,813, the 1k–10k bin holds only the four pre-existing non-mega clusters plus that one fragment), and size2 rises further (+2,201), at a cost of 11,684 singletons (0.012% of ids). The composed design (betw2000 + within-fragment pruning) achieves the best recall of the record (size-2 +2,240, fewer singletons) with six sub-2k residues. The aggregate metrics are nearly tied, but the designs fail differently: the deeper gate shatters positionally, leaving its surviving fragments internally welded by the same false name edges; the prune splits on per-edge evidence, keeping exact-email sub-clusters intact, but its residues are held together by edges the classifier never scored. Since both mechanisms are independently validated and act on different objects (nodes vs. edges), production combines them: the top-5,000 betweenness gate over the classifier-pruned link files. A per-edge audit of the prune is honest about its cost: 72.6% of dropped pairs share an exact name, which inside homonym blocks is precisely the evidence to distrust, but rare-surname cases (e.g. Michael J. Radwin across employer and personal emails, 𝑝=0.118) are likely true matches sacrificed; such ids retain their exact-email aliases (the model keeps Micahel/Michael Radwin at the same email together at 𝑝=0.974, and correctly rejects the family-member weld Ariella–Michael Radwin sharing a domain at 𝑝≤0.14).

Conference’17, July 2017, Washington, DC, USA

author ids plus 5,768,223 bad ids mapped to self. Its cluster histogram delivers the strongest result of the record: the >10k bin is empty, the 1k–10k bin holds only the four clusters that pre-date the mega (largest 2,891), and every cluster descending from the former 170,431-id mega is below 1,000. Recall is the best measured: 9,307,433 size-2 clusters (+3,240 over the ungated baseline), at a total cost of 16,741 additional singletons (0.017% of ids). This map is the precision foundation of the record; the deployed V2604 production map is its recall-extended superset (Exps. 13–17).

2.8

Comparison with the Prior Production Map (V3)

The previous deployed map, a2AFullH.V3 (August 2024; 89,104,948 ids, id;rep;bad1 ;bad2 ), permits a generation-over-generation audit. Coverage nests almost perfectly: 99.998% of V3’s ids appear verbatim in V2604 (only 2,155 missing), which adds 17.7M new ids. The headline difference is structural: V3 contains a 3,006,318member mega-cluster (representative <>; 3.4% of all its ids), 17.6× the V2604 ungated mega of 170,431 that this paper spent eleven experiments dissolving, and welded by the same pathology at greater scale: its top representatives are truncated and placeholder ids (git <t>, Tom <Tom@>, noo8 <xl>). Pair-level clumping/splitting errors under both gold framings (Table ??) quantify the gap. Taken whole, the comparison is degenerate: the V3 mega alone carries 99.9986% of V3’s 4.519 × 1012 co-clustered pairs, so V2604 “splits” essentially all of V3’s pair mass (splitting error 1.0000 under gold = V3), a verdict on the mega, not on V2604. Excluding that single V3 cluster makes the universes comparable (62.2M vs. 77.8M pairs, 28.3M agreeing): V2604 separates 54.6% of V3’s remaining pairs and V3 lacks 63.7% of V2604’s. The disagreement decomposes into the two corrections this paper develops. Splits of V3 welds: 47.2% of V3’s multi-member clusters fragment in V2604, and the larger they are the more completely they dissolve (Tom <Tom@>: 651 members → 630 V2604 parts, six hundred distinct Toms), reflecting the eligibility gates, blocklists, and the structural cut. Merges V3 missed: 40.5% of V2604’s multimember clusters consolidate ids V3 kept apart, reflecting the scorethresholded Rule-2 linkage and two additional years of data. Bad-id handling sharpened in both directions: V2604 excludes 5,768,223 ids as bad/bot/generic/local (1.7× V3’s 3.43M among shared ids), yet also rehabilitates 2,484,673 ids V3 had flagged bad but which alias normally under the current rules. Neither map is ground truth, but the asymmetry of evidence favors V2604: its per-edge machinery transfers to human-adjudicated labels at AUC 0.987 (§ Toward a Learned Edge Classifier), its largest cluster is 2,891 vs. three million, and the pair mass it discards is concentrated in clusters whose representatives are visibly non-identities. External validation on human labels. The ghid labels are free but self-referential (both ends are GitHub no-reply ids). We therefore validate against the independent, manually-rated ALFAA gold set [1]: 469,369 adjudicated pairs over 2,345 identities (only 5,633 true matches; the rest are hard within-block non-matches). All 2,345 ids are present verbatim in V2604, so we compute the same per-edge features for every gold pair. Two tests: (i) in-domain, 5-fold crossvalidation training on the human labels with our features reaches AUC 0.994 (accuracy 0.9965 vs. a 0.988 predict-all-non-match base);

Audris Mockus

(ii) transfer, the model trained only on the ghid free-labels, applied unchanged to the human gold, reaches AUC 0.987. The transfer result is the central one: a classifier that never saw a human label reproduces human identity judgments at AUC 0.987, confirming that the free ghid signal is a faithful proxy for ground truth. Notably this matches the quality of the published ALFAA random forest without its most expensive feature, the doc2vec behavioral fingerprint over each developer’s files and projects, because the graph-degree fingerprint supplies the over-merge signal that string similarity alone lacks. Our contribution to the ALFAA lineage is thus the graph fingerprint (link degree / project spread) as a cheap, label-free complement to its string and behavioral fingerprints. The gold pairs as arbiter between the maps (Exp. 13). Beyond validating the classifier, the gold set scores the two maps directly: a map predicts “same person” iff both ids resolve to one representative. On the 264,346 unique non-self gold pairs (1,644 rated matches; the 2,345 trivial self-pairs excluded), the verdict splits exactly along the axis this paper has been fighting (Table ??). V3 attains perfect recall at precision 0.522; its mega is the engine of both. 180 of the 2,345 gold ids (7.7%) sit inside V3’s three-million-id mega, which manufactures 94.6% of its 1,505 false positives (sampled FPs weld Itxaka to Luca Milanesio, Cory Benfield, and Ana Krivokapić) while buying only 139 of its 1,644 true positives, a 10:1 error-to-recall trade. With the mega discounted, V3 scores 0.915/0.949. V2604 attains precision 0.873 at recall 0.436; its misses are genuine, structural, and largely recoverable. Only 4.2% of its false negatives touch a quarantined (bot/generic/local) id; the rest are alias/alias pairs the union never linked, including ids sharing an exact email (takahashi.minoru <[email protected]> vs. TAKAHASHI Minoru at the same address). The cause is architectural: Phase-1 links require project co-occurrence, and the cross-project layer, Rule-3 shingles, is inert in the union (Exp. 10). 83.9% of the missed pairs (778/927) already sit in a computed shingle group, and 87.3% of all real matches are covered, a recall ceiling of ∼0.87 lying unclaimed in an existing file. Mega-free V3’s recall of 0.915 confirms the diagnosis from the other side: its ALFAA-lineage links were global string matches, not project-anchored. The repair is not naive expansion: the u;iserrano shingle group spans 23 distinct people (Irene, Israel, Ignacio, Isaac, Ismael, Iván, and Itxaka Serrano), so pairwise expansion must pass through the Exp. 6 edge classifier, the same composition that pruned the residual fragments in Exp. 12. The 149 uncovered misses (same name, disjoint rare emails: Andrey Pavlov at yandex.ru vs. mirantis.com) require behavioral evidence: the doc2vec fingerprint of the original ALFAA. Auditing the arbiter. Human gold is not infallible, and the maps’ disagreements expose its errors symmetrically. Among V2604’s 104 false positives, 20 share lexical identity evidence the raters overrode: 4 pairs an exact email (Joe (rook) <[email protected]> vs. Joe Talerico <[email protected]>, rated “different”), 5 an exact full name (Victoria Martínez de la Cruz, twice), and 11 a handle or email local part (EmilienM, e0ne, newptone). These read as label errors, or a rater policy of refusing handle-only and root-prefixed ids, putting V2604’s true precision nearer 0.90. Conversely, 9 of the 1,644 rated matches have zero lexical overlap: three are real (the known handles paulczar and dimtruck, which

Scaling Author Identity Disambiguation to the World of Code: A Methodology

V2604 co-clusters without any mega) and roughly six look mislabeled (Takashi Tanaka vs. Yuuki Tanabe, Marius Cornea vs. Matthieu Huin). The remaining 64 V2604 false positives share a single name token, the given-name homonym welds already identified as Exp. 12’s residue (Sergey Lukjanov/Vasilenko/Kulanov, David Gurtner/Moreau Simard, Sean Collins/Perry), and are our map’s genuine errors, counted as such. The audit cuts both ways by design: the maps grade the gold exactly where the gold grades the maps, and neither is exempt.

2.9

Activating the Dormant Rule-3 Layer (Exps. 14–15)

Exp. 13 ended with a recall ceiling of ∼0.87 “lying unclaimed in an existing file,” and Exps. 14–15 go and claim it. The mechanism is the composition already proven twice (Exps. 6 and 12): expand every Rule-3 shingle group into its member pairs, score each pair with the per-edge classifier, and admit only confident pairs, here as new union edges rather than as prunes. The expansion yields 66,459,771 unique pairs at 𝑝 ≥ 0.5 with a strongly bimodal score distribution (46% of the mass above 0.9; Table 18), and the end-toend 𝜏-sweep teaches one more structural lesson: at 𝜏=0.5 the mega returns, 2.3M strong, because the betweenness cut of Exp. 11 was computed on the pre-expansion graph: a structural gate certifies the edge set it saw, not the design; any new edge source must re-earn safety. At 𝜏=0.9 the profile is clean (>10k = 0, top 3,862) and the gain is the largest in the record: +30.8M ids unioned, size-2 clusters +881,615 (+9.5%), against 14 residual 1k–10k clusters. The gold pairs return the verdict: recall 0.4361 → 0.6454 with precision rising to 0.8820, the first material recall movement in the record, and a clean escape from the Exp. 7 monotone trade: where the flat threshold bought mega-death with 2.6M singletons, the expansion buys 344 recovered gold pairs with 38 new false positives, because the candidate set (shingle groups) and the confidence bar (𝜏=0.9) are both targeted. Before spending that confidence budget, Exp. 15 re-arms the scorer. The v2 feature set repairs a silent defect (the v1 projectspread feature was 0 for 99.4% of ids, its source table only listed ids with ≥20 projects) and adds the signals the expansion pairs will actually stress: true deforked-project intersection-over-union, per-value spread of each matched attribute, name↔email-handle pattern matches, and a given-name-list flag aimed at the homonym welds of Exp. 12. Two findings generalize beyond this pipeline. First, gradient boosting shortcut-learns a label-construction leak: every ghid-labeled pair shares the literal users.noreply.github.com substring, so trigram Jaccard over full id strings carries 74% of the LGBM split gain and its human-gold transfer collapses to 0.56 (test AUC 0.9990!), while the same feature in a linear model is benign; in-distribution accuracy is worthless as a model selector when the labels embed an artifact (Table 19). Second, the learned weights expose which intuitions do not survive the training distribution: project IoU, requested as an obvious match signal, is inert on ghid pairs (nearly all co-occur in a project, both classes), and matched-value spread enters positive, because in training data a high-spread username shared by two ids usually marks one prolific person’s many aliases, not two strangers, the synonym-richness confound. The homonym danger that spread is meant to flag (a jenkins or a

Conference’17, July 2017, Washington, DC, USA

bare kim bridging strangers) is exactly the out-of-distribution case, which is why the pipeline neutralizes such values upstream (Exps. 8– 11) rather than trusting the classifier to learn what its labels cannot teach. The logistic v2.1 transfers to the human gold at AUC 0.9910, the best of any variant, and re-scores all 256.7M expansion pairs in a 48-way parallel pass. The map-level verdict, however, reverses the model-level one. v2.1 is more selective (54.0M unique pairs at 𝑝 ≥ 0.5 vs. v1’s 66.5M; 26.1M vs. 30.8M at 𝜏≥0.9) and its 𝜏=0.9 map (S2) is structurally cleaner (1k–10k band 9 vs. 14, >10k = 0) with marginally better gold recall (0.6490/0.8789 vs. 0.6454/0.8820), but it gives back 0.077 of the GitHub-benchmark recall (0.5118 vs. 0.5886 at max9; Table 20): the pairs the better-calibrated model declines are disproportionately the real within-handle aliases the external GT counts. A better in-distribution AUC bought a worse map, the third face of the same lesson the LGBM collapse and the inert project-IoU weight already showed (the training distribution, not the model class, is the binding constraint), and the v1-scored 𝜏=0.9 map remained the production candidate (v2.1 returns at a relaxed threshold in Exp. 17, where the external benchmark prices the trade correctly).

2.10

An External Recall Benchmark at GitHub Scale (Exp. 16)

The ALFAA gold is precise but small (2,345 ids, OpenStack-centric). Bock et al. [2] contribute the complementary extreme: every GitHub repository with exactly one committing GitHub account yields free within-handle alias labels, 9.57M handles over 21.5M commit ids after bot and organization filtering. The benchmark is recall-only (only within-handle pairs are scored, so over-merging is invisible and a mega-cluster is priced at zero), and on it the verdicts of Table ?? invert exactly as that design predicts (Table 20): V3 (recall 0.487 at max9) outscores production V2604 (0.433), which also trails its V2409 ancestor (0.450) as published. The inversion follows from the construction: Exps. 1–12 deliberately removed pair mass, and this GT counts pair mass. The same study reports that fully connecting common-name developers is where IDF-style weighting “dramatically reduces accuracy”; our Exp. 12 measured the same tension from the precision side, where given-name homonym fragments resisted pruning. Their GitAuthority (0.771, within-repository) shows the headroom local context buys; its privacy-respecting mode (0.478), which refuses to mine the noreply ids that are 30% of the GT, lands almost exactly on our global maps: the cost of honoring GitHub’s anonymization is roughly the entire gap. The Exp. 14 expansion map then resolves the inversion in both directions at once: recall 0.5886 / FullyMerged 0.5403 at max9, +0.156 recall over production, ahead of V3 (without its mega: largest cluster 3,862 vs. three million), ahead of the published V2409, and ahead of GitAuthority’s privacy mode, while simultaneously raising ALFAA precision (Table 18). What remains to full GitAuthority (0.771) is the withinrepository evidence a global map does not see. The benchmark also adjudicated the candidate decision: when the v2.1-rescored map (S2) edged the small gold set but shed 0.077 recall here (Table 20), the 21.5M-alias external GT, not the in-distribution AUC, was the evidence that kept the v1-scored map as the candidate.

Conference’17, July 2017, Washington, DC, USA

2.11

Selecting the Production Map (Exp. 17)

With two precision-validated edge sources in hand and two benchmarks now read jointly, the production-selection experiment swept the remaining design space under three user directives: explore every promising edge source; treat both benchmarks as noisy instruments to be read directionally (the gold set has ∼26 audited mislabels, Exp. 13; large same-ghid groups are shared and organizational accounts, not persons); and judge maps also by commitweighted coverage, the fraction of all 5,866,595,698 V2604 commits whose author id lands in a multi-id cluster, the quantity downstream consumers actually experience. Three new edge sources were built, each passing the STATS mega-check (the Exp. 14 lesson) before any map: the v2.1 scores relaxed to 𝜏=0.8 (34.1M edges, the better-calibrated model is usable at a threshold v1 cannot afford); 5,736,921 same-ghid pairs from NNNN+login noreply ids, GitHub’s own assertion that two strings are one account (groups of 2–20 only: 346 larger groups, up to 12,140 ids, were excluded as shared accounts per the homonym caveat); and unions thereof. The single-source results decompose cleanly. v2.1@𝜏0.8 lifts gold recall to 0.7019 at unchanged precision (0.8789) but only partly recovers the GitHub benchmark (0.5828 at max9); the ghid edges leave the gold verdict exactly unchanged (the gold set predates noreply adoption) while adding +0.011 GitHub recall over S—orthogonal evidence the classifier cannot see. Because the two gains live on disjoint margins they compose: the triple union SUG ([email protected] ∪ [email protected] ∪ ghid; 181,156,655 unioned pairs) beats the pairwise alternative SG8 on both benchmarks: gold 0.7026/0.8790 vs. 0.7019/0.8789 and GitHub max9 recall 0.6035/FM 0.5558 vs. 0.5931/0.5460 (Table 20), while staying mega-free: largest cluster 6,910, itself a single noreply identity, with the >10k bin empty. Commit-weighted coverage tells the same story monotonically: 66.3% (B) → 72.7% (S) → 73.5% (SUG) of all commits now resolve into a multi-id identity. a2AFullSUG.V2604.s.gz (106,826,059 rows) is the deployed production map, superseding the precision-stage a2AFullB; relative to where the record started, gold recall rose 0.4361 → 0.7026 and precision rose 0.8733 → 0.8790, with the largest cluster down from 170,431 (ungated) to 6,910. The excluded low-quality ids (5.77M bad and local ids, mapped to self) are ambiguous across projects but usually unambiguous within a single deforked project, where reuse is local; matching them there (Exp. 18) recovers author-level signal the cross-project map discards, and emits what the map alone does not: a per-id classification (good, bad-by-attribute, local, bot, partial) alongside the aliases. The headline metric is commit coverage of human IDs, measured directly at the commit level through provenance tags (global 𝑔 | bot 𝐵 | withinproject 𝑝 | self 𝑠) in the new commit-to-identity table c2AFull over all 5,866,595,698 commits: 𝑔 = 91.53%, 𝐵 = 5.14%, 𝑝 = 1.59%, 𝑠 = 1.74%. The bad/local pool that survives both the cross-project map and the bot filter is 𝑝 + 𝑠 = 195,352,712 commits (3.33% of all, a commit-weighted figure that supersedes the earlier 0.61% distinct-id estimate). The within-project pass resolves 𝑝 = 93,381,683 of them (47.8%; 141 conflicts), raising commit coverage of human (non-bot) IDs from 𝑔/(𝑔+𝑝+𝑠) = 96.49% under the cross-project map alone to (𝑔+𝑝)/(𝑔+𝑝+𝑠) = 98.17% (a +1.68 percentage-point gain), while the residual self/unresolved fraction falls to 𝑠 = 1.83%.

Audris Mockus

Alongside the aliases, the deliverable emits a per-id classification table A2clsFull (one row member;canonical;class per id, all 106,826,059 ids) under a five-class taxonomy: good (100,814,372, 94.37%; a real name and email), bad-by-attribute (2,652,369, 2.48%; generic name or shared/ placeholder attribute), local (2,562,118, 2.40%; machine-local address with a real username), bot (553,736, 0.52%), and partial (243,464, 0.23%; only one of name/email present, carved out of the otherwise-good class by attribute completeness). The first three non-good classes sum to the 5.77M ids the production map self-maps; the within-project layer P2aAFull (𝑃;raw;𝐴;rule) is the companion artifact that resolves them inside individual projects. The classification thus makes explicit, for every id, both why an id is or is not a global representative and where (which project) a low-quality id can still be attributed.

2.12

Cryptographic Signatures as an Identity Anchor (Exp. 19)

The map built to Exp. 17 resolves identity from claimed attributes: the name and email a commit carries are asserted by whoever authored it, and nothing binds that claim to a real actor. A cryptographic signature is different in kind. When a commit carries a PGP, SSH, or X.509/sigstore signature, a private key held by some actor has attested to the commit, and that attestation is verifiable against a public key. The question this experiment asks is whether that stronger binding is useful for aliasing, and if so, on which margin. The signature payload is already present in the corpus: git stores it in the gpgsig header, which our commit extractor preserves in the message field of c2datFull. Scanning all 128 shards, 1,031,721,316 of the 5,866,595,698 V2604 commits carry a signature, a corpus rate of 17.59% (PGP 98.96%, SSH 1.02%, X.509/sigstore 0.02%; new axis c2sigFull, one commit;sigtype row per signed commit). Prevalence alone is a completeness fact, not an aliasing one. The aliasing question is who signs: if signatures were spread uniformly across the id population they would offer no discriminating signal. They are not. Mapping the distinct signing ids on a representative shard through the Exp. 18 class table A2clsFull (Table ??), 99.52% of signers fall in the good class against a corpus baseline of 94.37%, and every low-quality class is under-represented: bad-by-attribute 0.36% vs. 2.48%, and local 0.005% vs. 2.40%, a roughly 500× gap. The whole non-good tail is 0.37% of signers against 5.11% of the corpus, so signed ids are about 14× cleaner than ids at large. This is the opposite of a tail-recall instrument: signatures do not reach the hard-to-alias local and generic ids that Exp. 18’s within-project pass targets. What they provide is a high-precision core. An attested id is one we can trust is a single real actor, which makes it a natural anchor for a match against a noisy free-text id and a natural evaluation set for auditing the production map without hand-labeling. The over-merge risk is the same one the record has met at every stage, in a new guise. A signing key is not one-to-one with a person: platform web-flow keys (the shared GitHub key 4AEE18F83AFDEB23), organizational CI keys, and bot keys each sign for many actors, so welding all ids that share a key would recreate the mega-cluster the whole methodology is built to avoid. The defense is the gate this record has used repeatedly: as name-spread flags a bad attribute (Exp. 8) and node degree flags a shared account (Exp. 4), key fan-out

Scaling Author Identity Disambiguation to the World of Code: A Methodology

flags a shared key, and a key above a fan-out threshold is dropped as an attestation edge rather than allowed to merge. Extracting the key handle itself (the PGP issuer packet and the SSH public key) to build the key2A/A2key maps and calibrate that gate is the next experiment; here we establish only that the signing population is clean enough to be worth anchoring on, and that platform-asserted ghid edges (Exp. 17) are the precedent for treating a verifiable external assertion as evidence the attribute-based classifier cannot see.

2.13

Key Fan-out and the Attestation Gate (Exp. 20)

Exp. 19 measured that a commit is signed; the aliasing payoff needs who holds the key. We parse the OpenPGP signature packet to recover the issuer handle, the fingerprint from subpacket 33 or the 8-byte key id from subpacket 16, and normalize both to the 16-hex key id (the fingerprint’s low 8 bytes), which is the common denominator of the two forms. A perl packet parser reads the armored block already present in the message field, resolves an issuer for 99.92% of PGP-signed commits, and its output agrees with gpg –list-packets on audited samples. The first finding reframes the prevalence number. Across the full corpus, 39,077,350 distinct authors carry a signature, associated with 586,011 keys through 44,871,077 author–key pairs. The concentration is extreme: GitHub’s web-flow key 4AEE18F83AFDEB23, which signs every commit authored through the web interface, alone spans 30,440,944 distinct author ids, and one further platform key 12,592,731; the two together account for 95.9% of all author– key associations, and the 2,651 keys with fan-out above 50 (0.45% of keys) for 97.6%. Most “signed” authorship is thus a shared key authenticating a web action, not a personal attestation. Merging ids that share a key, the naive use of this signal, would weld tens of millions of unrelated people into one cluster, the same over-merge failure that degree (Exp. 4) and name-spread (Exp. 8) defend against, now in a cryptographic guise. The defense is identical in form: a key fan-out gate drops any key whose distinct-author count exceeds a threshold. Removing the 2,651 keys above fan-out 50 leaves 583,360 personal keys (99.55% of all keys), of which 72.20% (423,095) sign for exactly one author. The gated personal keys are the aliasing signal. A personal key that signs commits attributed to two or more distinct canonical ids is direct cryptographic evidence that the alias map split one person: the same private key attests to both. Corpus-wide, 156,397 personal keys with fan-out 2–20 link 549,388 identity associations, that is 392,991 candidate same-person merges, a recallrepair set the attribute-based map does not see, obtained without any hand labeling. It complements rather than overlaps Exp. 18: signatures reach the good-class developers who rotate emails across machines, whereas the within-project pass reaches the generic and machine-local ids that never sign. The key2AFull / A2keyFull / key2fanoutFull maps (586,011 keys over the 128-shard build) are the released artifacts; the SSH pubkey handle (the 1.02% SSH share is self-anchoring, the key travels inside the signature) and the sigstore certificate identity are the remaining handle families.

Conference’17, July 2017, Washington, DC, USA

2.14

Engineering Lessons

Two infrastructure findings shaped the experiments and are recorded for replication.

• Memory of the cluster pass. The naive representative pass materializes per-cluster member arrays; with many unions this reaches ∼122 GB per process. Running six sweep points concurrently silently OOM-killed all of them (no distribution line written). The fix is a streaming statistics pass that tallies cluster size and best representative without storing member lists, plus sequential (≤3-wide) scheduling. • Deforking is mandatory for the spread signal. Because forks share commit history, raw-project spread inflates the count for authors of popular projects; only the fork-collapsed 𝑃 map yields a usable bot signal. • Sort-key spans break join. Tables sorted with sort -t’;’ -k1,2 are not ordered by field 1 alone: the key span includes the literal ; (0x3B), so an id that is a prefix of another id sorts after it whenever the longer id continues with a byte below ; (digits, space, most punctuation). join -1 1 then aborts with “input is not sorted,” but only on shards where a prefix collision happens to occur (3 of 32 here), so the bug passes most tests silently. The fix is -k1,1 -k2,2, which compares fields separately and is otherwise equivalent (fields cannot contain the separator, so -u semantics are unchanged); it was applied at all 234 sort sites across the six pipeline scripts. • join buffers whole equal-key groups; pipefail does not cover process substitutions. The first commit-tagging implementation (Exp. 18 phase 2) joined the author-to-commit table with the alias map. GNU join holds the full run of equal-key lines in memory, so a single mega-author id (tens of millions of commits in one shard) drove RSS to 13.7 GB and the job was OOM-killed. Worse, the sort feeding join ran inside a process substitution <(...), whose failure set -o pipefail does not propagate: join saw truncated input, exited 0, and the log printed COMPLETED over a silently incomplete output. The fix replaces sort+join with a streaming hash lookup that exploits the table’s sHash(author) sharding to load only the matching 1/32 slice of the map (tagProv.perl), and chains every pipeline stage with explicit || exit 1. • When identical jobs OOM, check the node before the code. The streaming rewrite still OOM-killed 12 of 32 shards at 11–13 GB MaxRSS within ∼3 minutes, even though the tagger’s hash measures only 0.64 GB and the surviving shards peaked at 5–7 GB in 7–10 minutes. The decisive diagnostic was sacct -o NodeList: every failed job had run on one node and every job on any other node completed; the failure set was the scheduler’s node assignment, not a property of the shards (the largest input completed; failed inputs were average). Resubmitting the 12 shards with –exclude=node fixed them without any code change. Memory accounting under cgroups includes page cache and dirty buffers, so a node with a slow or backlogged filesystem path can roughly double a job’s apparent RSS; per-node failure clustering distinguishes this from a genuine leak.

Conference’17, July 2017, Washington, DC, USA

Audris Mockus

• Generic gate-file interface. Both bridge signals are loaded own account assertions finished the job (gold 0.44 → 0.70; GitHubas a generic “value;id” table and compared against a single scale benchmark 0.43 → 0.60; 66% → 74% of all six billion commits threshold, so spread and degree (and any future per-id signal) resolved into a multi-id identity) while precision rose (Exps. 13–17). reuse one gating code path; only the input file changes. Several lessons appear general. Structural certificates do not trans• Bridge signals are cheap preprocessing. Degree is a single fer: a cut computed on one edge set silently fails on an augmented sort–uniq–count pass over the link list (48.0M ids in ∼80 s), one; every new edge source must re-earn the clean-histogram proporders of magnitude cheaper than the ∼122 GB union pass. erty end-to-end. Constructed labels embed shortcuts: gradient boostBridge detection can therefore run as a preprocessing filter, ing read the label-construction artifact out of a string-similarity decoupled from the expensive global union. feature and collapsed on human labels (0.999 in-distribution AUC, • uniq -c padding silently corrupts keys. uniq -c right0.56 transfer) where a linear model using the same feature was justifies the count in a fixed-width field, so the line begins benign; in-distribution accuracy selected exactly the wrong model. with leading spaces. Recovering the value with a fixed offset Bad values split by intent: privacy masks and homonym defaults (substr($0,length($1)+2)) instead of stripping ^ *[0-9]+ man-demand the same non-merge action for opposite reasons, and only gles every key by the width of the padding: here it prepended the latter may ever be re-linked. Benchmarks are directional: a recallthe count’s trailing digits to each identity, so the gate file only ground truth priced a 3M-id mega at zero and ranked the maps matched nothing (zero overlap with 30M GitHub-id’d nodes) in reverse of a precision audit on the same day; resolvers must be while the degree values looked correct. The bug was caught graded on both axes simultaneously or the grading itself will drive only by an overlap sanity check; per-id signal files must be over- or under-merging. The remaining gap to within-repository validated against the canonical id strings before use. resolvers is the evidence a global map forgoes by design (local context and mined anonymized ids), and the remaining misses (same • Silently-truncated feature sources. The v1 classifier’s project-spread feature read a table that only listed ids with person, disjoint rare emails) are the classic territory of behavioral ≥20 projects, so the feature was 0 for 99.4% of ids and trained fingerprints [1], the natural next layer over this map. to a near-zero weight that was misread as “spread is uninformative.” Coverage of every feature source must be checked Acknowledgments against the full id universe; a censored feature does not fail The twenty experiments in this record were designed, executed, loudly, it just goes quiet. and written up by Claude (Anthropic) over more than a week of • Right-size batch-queue memory requests. The 48-shard continuous interactive sessions, beginning with Claude Opus 4.8 re-scoring asked for 48 GB per task while shards peak at and concluding with claude-fable-5, directed throughout by the 5.3 GB; on a fairshare queue the inflated request throttled author’s prompts: the author set the goals, supplied the domain scheduling to 2–3 concurrent tasks. Measuring one shard hypotheses (project-spread gating, bad high-quality attributes, the (sacct MaxRSS) and lowering pending tasks to 8 GB (scontrol privacy/homonym distinction, the evaluation datasets), challenged update) unlocked backfill; a 16-way run on a single largeintermediate claims, and made the production decisions; the model memory host outran the queue entirely. proposed and implemented the analyses, ran and monitored the computations, and maintained this document as the experiments unfolded. The resulting design is deployed as the production author3 Conclusions identity map of World of Code version V2604. Eighteen experiments separate the first ungated union of V2604 from its deployed identity map, and the shape of the record is itself the main finding: at 108 identities, de-aliasing is two different problems that must be solved in the right order. The precision problem (dissolving mega-clusters) resisted every mechanism that acts on nodes or values. Information-score cutoffs destroyed recall (Exp. 2); project-spread and link-degree gates preserved recall but slow-peeled, each threshold exposing the next moderate bridge (Exps. 3–4); even the exhaustive neutralization of every detectable bad attribute value left the mega 94% intact, because a redundant mesh of moderately-bad values re-closes around each removed weld (Exps. 8–10). What worked was changing the object of analysis twice: from nodes to topology (a sampled-betweenness cut of the exact union graph found the 2,000 load-bearing ids, 98% of them attribute-clean and invisible to any value rule; Exp. 11), and from values to edges, a classifier trained on 2.6M free GitHub-id labels pruning the residual homonym fragments the cut had isolated (Exps. 6, 12). Only then was the recall problem safe to attack: the same classifier, filtering the pairwise expansion of the dormant cross-project shingle layer, recovered in one experiment more recall than the entire record had spent, and composing it with GitHub’s

Data and replication. All input tables (CmtV2604.split, a2PFull/P2aFull, frequency and bad-id tables) and the resulting maps are part of the World of Code V2604 release. The replication package accompanying this paper contains the complete script set referenced in the experimental record: link generation and gating (c2ta.slurm, selectRepSpread.perl, degreeCalc.sh, gate files), bad-attribute detection (badAttr*.pl, fastSpread.sh, classifyBad*.pl, blankBad*.pl), the structural toolchain (bridge.cpp, tarjan.cpp, cutSweep.pl), the classifier pipeline (mkLabeled.sh, buildEdgeFeatures.py, trainEdge.py, trainEdge2.py, ablate2.py, edgeModel.py, scoreShingles2.py, extractA2P.sh, fieldSpread.sh), the union and map builders (runShingleUnion2.sh, runMap09.sh, filterAlias.pl), and the evaluation harness (gold*.pl, evalGH.pl, mapJoin.pl, mapAgree.pl, histMap.pl).

References [1] Sadika Amreen, Yuxia Zhang, Chris Bogart, Russell Zaretzki, and Audris Mockus. 2019. ALFAA: Active Learning Fingerprint Based Anti-Aliasing for correcting developer identity errors in version control systems. Empirical Software Engineering 25, 2 (2019), 1136–1167. https://doi.org/10.1007/s10664-019-09786-7

Scaling Author Identity Disambiguation to the World of Code: A Methodology

[2] Thomas Bock, Aakanksha Agarwal, Mitchell Atkisson, Audris Mockus, and Bogdan Vasilescu. 2025. Between Accuracy and Privacy: Rethinking Developer-Identity De-Aliasing in Git Repositories. Empirical Software Engineering (2025). Under submission. Tool: GitAuthority, https://github.com/bockthom/gitauthority. [3] Tanner Fry, Tapajit Dey, Andrey Karnauch, and Audris Mockus. 2020. A dataset and an approach for identity resolution of 38 million author ids extracted from 2B git commits. In Proceedings of the 17th International Conference on Mining

Conference’17, July 2017, Washington, DC, USA

Software Repositories (MSR), Data Showcase. 518–522. https://doi.org/10.1145/ 3379597.3387500 [4] Yuxing Ma, Chris Bogart, Sadika Amreen, Russell Zaretzki, and Audris Mockus. 2019. World of Code: An Infrastructure for Mining the Universe of Open Source VCS Data. In Proceedings of the 16th International Conference on Mining Software Repositories (MSR). 143–154. https://doi.org/10.1109/MSR.2019.00031

Conference’17, July 2017, Washington, DC, USA

Audris Mockus

Table 7: Experiment log for over-merge suppression in WoC V2604 aliasing (continued). #

Approach

Hypothesis / setup

Outcome

St.

19

Cryptographic signatures as an identity anchor

A signed commit binds the free-text author string to a key the committer controls, so a shared signing key could supply verified alias edges independent of the ghid (Exp. 5) and ALFAA (Exp. 13) evidence, and signing could serve as a positive trust signal for the bad-id detector (Exp. 8). Every signature already sits, unparsed, in the gpgsig block that the committable generator appends to the message field, so extraction is an isaac scan over c2datFull (128 shards, no object-database pass) yielding c2sigFull (commit;sigtype). Measure the corpus prevalence, the family split, and, the question that decides whether signatures can move the map, the id-class composition of signers: does signing reach the bad/local tail that Phase-1 cannot resolve (Table ??)?

A precision and trust anchor, not a tailrecall fix. 1,031,721,316 of the 5,866,595,698 commits are signed (17.59%, exact over all 128 shards), PGP 98.96% / SSH 1.02% / X.509-sigstore 0.02%. But signing concentrates in the population Rules 1–2 already merge: on a representative commit-hash shard (1/128), of 3,775,298 distinct signing ids 99.52% are good-class, while the hardto-alias tail is far under-represented against the A2clsFull baseline (bad-attr 0.36% vs. 2.48%; local 0.004% vs. 2.40%, a 500× gap; overall ∼14× cleaner). So a signature verifies identities that are already resolvable and rarely touches the root@localhost/generic-name welds; its value to aliasing is an independent evaluation instrument and a per-id trust tier, not recall on the tail. The shared-key fanout gate (person vs. org/CI keys, seeded by the web-flow key 4AEE18F83AFDEB23) mirrors the Exp. 8 namespread gate and is the next step.

✓

20

Key fan-out and the attestation gate

A raw signed rate of 17.59% (Exp. 19) counts every commit whose message carries a gpgsig block, but many of those keys are shared platform or automation keys that bind to thousands of authors and would over-merge if trusted as alias edges. Parse the OpenPGP signature packet to its issuer (subpacket 33 fingerprint, else subpacket 16 key-id, normalized to keyid16), build the key↔author bipartite graph, and apply a fan-out gate (>50 distinct canonical authors ⇒ shared, the crypto analogue of Exp. 8): does a per-key attestation isolate a near-injective personal-key population, and do any of those personal keys span two or more canonical ids that the map split apart (a recall-repair edge)?

✓

21

Signature-attested alias gold + map calibration

Treat each person-key’s co-signed raw strings as same-person gold; map them through a2AFullSUG and measure recall (co-signed pairs the map already merges), triaging misses into genuine recall gaps vs. shared-key false positives. A cryptographic gold larger than ALFAA and free of hand labeling.

22

Impersonation / vanity-id detection via key-dispersion

Invert the fan-out gate: per author string, count distinct signing keys. One keyholder maps to few keys; a string signed by many keys is shared, mirrored, or impersonated. A signature-derived alternative to the hardcoded bad-author list.

23

Identity trust tiers (A2trustFull)

Assign every canonical author a tier: T0 unsigned; T1 signed by some key; T2 signed by a person-key (fan-out-gated ≤50, i.e. individual control, not a shared web-flow/CI key). Publish as a sibling of the A2cls classification, a principled confidence axis.

24

Bibliography bridge: cryptographic attestation of same_as

For each cross-corpus same_as edge (WoC author ↔ scholarly author) in the cite-study graph, look up the WoC endpoint’s trust tier (Exp. 23): a T2 person-key backs the identity, so the name/DOI-matched link becomes cryptographically attested (attested_by the key). Those authors reach T3 (cross-corpus attested).

Shared keys dominate the raw rate; the gate isolates a large injective personal layer. pgpissuer.pl (gpg-validated) resolves an issuer for 99.92% of parsed PGP signatures. Corpus-wide, 39,077,350 signed authors associate with 586,011 keys (44,871,077 author–key pairs); the two heaviest keys carry 95.9% of those associations: the GitHub web-flow key 4AEE18F83AFDEB23 alone spans 30,440,944 authors and one second platform key 12,592,731. The fan-out gate (>50) drops the 2,651 shared keys (0.45%, carrying 97.6% of associations), leaving 583,360 personal keys, 72.20% (423,095) bound to a single author. The aliasing payoff is broad: 156,397 personal keys (fan-out 2–20) link 549,388 raw author strings, i.e. 392,991 candidate same-person associations that Exp. 21 calibrates against the map. Recall is real but partial, and signatures alone are not a clean gold. On the clean fanout-2 tier (86,929 keys) the map already unifies 63.0%; recall falls monotonically with fan-out (0.63 → 0.01 over 2 → 21–50), the shared-key confound made visible. Of the 32,192 fan-out-2 splits, only 9,036 (28.1%) carry a corroborating attribute (shared localpart / non-generic domain / name token) = genuine recall-repair edges; the other 71.9% are two people on one key, correctly unmerged. Signatures need attribute corroboration to serve as same-person gold; corroborated, they yield 9,036 high-precision repair edges. High dispersion is vanity/mirroring, not bots. Of the 39,077,350 signed strings, 87.5% have one key; 43,443 have ≥6, of which 99.7% (43,329) are human names, only 114 bots. At >100 keys, 761 human vs 15 bot: the extreme tail is real people whose commits are cherry-picked and re-signed downstream (Linus Torvalds 938 keys; LineageOS developers) plus a few megabots (dependabot 7,246). 5,711 human strings signed by ≥20 keys form a signature-derived vanity/bad-attribute set, no hand curation. Separating genuine impersonation from mirror resigning needs the dominant-key test (next). Author-level “signed” is a platform artifact; true personal attestation is rare. Of the 62,579,994 canonical authors: T0 30,638,625 (49.0%), T1 31,475,971 (50.3%), T2 465,398 (0.74%). The 51% author-level signed rate is dominated by T1 platform web-flow signing; only 0.74% hold a personal key. T2 is the high-trust anchor set the bibliography bridge (Exp. 24) and any trust-weighted analysis should build on; the tier is a monotone evidence field on A2cls. A high-precision attested calibration seed. Of 10,021 same_as edges (98.8% of 10,143 join A2trustFull): T0 866 (8.6%), T1 7,948 (79.3%), T2 1,207 (12.0%). So 1,207 identity links gain an attested_by provenance, upgrading them from name-heuristic to key-anchored, and 966 distinct authors reach T3. Signatures calibrate rather than cover: 12% of the science↔software links are person-key attested, a defensible cryptographic

✓

✓

✓

✓

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Table 11: Exp. 8: bad high-quality email attributes, detected by distinct-name spread (one exact email string tying together many distinct ⟨𝑓 , 𝑙⟩ names) and classified by intent. A genuine personal email attaches to ≈ 1 name; a placeholder bridges hundreds. Counts are the recall-safe blocklist (91,432 emails): lexical placeholders admitted at ≥ 3 names, form-only signals (github-noreply, ≥ 6-digit numeric, bare spread) only at ≥ 10 to spare real 𝑛-digit QQ accounts. “𝑑” = names/rows (1.0 = every commit a different person). Privacy and homonym welds must both be barred, but for opposite reasons: privacy is anonymity chosen, homonym is a default inherited. intent

top exemplar

names

none@none deliretzua@. . . noreply.github

13,334 11,991

𝑑

Conference’17, July 2017, Washington, DC, USA

Table 14: Exp. 12: the ten residual mega fragments (≥ 1,000 ids) left by the 𝐾=2,000 betweenness cut, refined by the Exp. 6 per-edge classifier within each fragment (𝜏=0.5; unscored edges kept). “identity” from member samples; “scored” = fraction of internal edges found in the scored-link table; “top” = largest surviving sub-component; “freed” = ids left in components ≤ 100. Given-name homonym blocks shatter readily; the Kim/RIT blocks resist because shared exact emails and institutional domains legitimately score high; the Gerrit-relay fragment is dense (11,887 edges on 2,389 ids) and mostly unscorable.

dominant reasons (𝑛)#

identity

github-noreply (531), 1 David 2 Michael numeric (2.3k), hash-relay (164) 3 Daniel [email protected] 69,291 .94 default-host (30.6k), homonym 4 Kim (surname) [email protected] 3,512 .89 default-id (27.4k), git-template (8.7k) 5 Gerrit relays [email protected] 4,104 .96 high-spread (11.3k), 6 Thomas ambiguous [email protected] 1,998 .98 fake-dom (3.2k), no-tld 7 (4.7k) James 8 RITstoplist. students Total blocklist 91,432: privacy 5,551, homonym 66,670, ambiguous 19,211; 90,011 new vs. manual 9 Jan 10 Chris privacy

.92 .99

Table 12: Exp. 9: blank all 91,432 bad emails (Exp. 8) in the commit table, re-run Rule 2 on the blanked input, and recompute the global union (alias1 ∪ alias2′ ∪ shingles, no gate). Blanking voids 1,074,504 email fields and drops 403,635 Rule-2 welds that existed only via a shared bad email. Contrast with Exp. 7: source-blanking is recall-positive (size-2 rises) yet, unlike the threshold, still does not dissolve the mega, which is welded redundantly through names/usernames, not email alone. run baseline email-blanked Δ

size-2

11–100

101–1k

1k–10k

>10k

9,304,193 9,307,723

182,700 180,909

520 499

4 3

1 1

+3,530

−1,791

−21

−1

0

Table 13: Exp. 11: remove the top-𝐾 mega nodes by sampled betweenness and recompute connected components of the mega subgraph (170,431 nodes, 347,008 edges). “freed” = surviving nodes left in components of size ≤ 100 (escaped the over-merge). Removing 1.2% of nodes (𝐾=2,000) collapses the largest component below the >10k bin, a dissolution no attribute gate or blocklist achieved (best prior: top = 25,957 with 42,110 gated ids; Exp. 10 blanking 5.46M fields left 159,483). Of the top 2,000, 98.4% carry no blocklisted attribute: hubs like = <=>, Gerrit relay ids, and common-surname homonym chains (kim/lee/smith/unknown) that no per-value rule can block without destroying recall. 𝐾 cut

edges dropped

components

largest

freed (≤100)

0 100 500 1,000 2,000 5,000 10,000

0 5,949 12,711 19,092 28,880 55,115 90,512

1 3,612 5,842 7,595 11,026 19,268 29,056

170,431 141,720 75,787 49,306 7,268 1,813 840

0% 11.5% 20.9% 29.7% 46.9% 89.5% 96.8%

End-to-end confirmation: gating the top-2,000 ids in the production union (same value;id gate interface as Exps. 3–4, cut = 1) reproduces the local prediction exactly: top cluster = 7,268, >10k bin 1 → 0, 1k–10k 4 → 14 (mega fragments), while size-2 rises 9,304,193 → 9,305,460 and only 5,722 ids drop to singletons. The exact match also confirms the union graph is driven by Rules 1–2 alone (the shingle pseudo-pairs are inert).

size

scored

top (𝜏=.5)

freed

7,268 6,201 3,035 2,558 2,389 1,739 1,610 1,582 1,502 1,431

69% 72% 65% 65% 16% 73% 69% 56% 55% 73%

1,942 1,488 1,226 1,063 661 507 567 1,170 1,015 343

50% 56% 48% 27% 41% 51% 45% 26% 32% 69%

Table 15: Production design shoot-out: end-to-end STATS unions. “mega top” = largest cluster descending from the former mega; Δsize-1/2 relative to baseline. betw5000 again reproduces the local cut-sweep prediction exactly (1,813); its remaining 1k–10k entries are the four pre-existing non-mega clusters plus that one fragment. Composed = betw2000 gate + the 18,599 fragment-internal edges with classifier 𝑝 < 0.5 removed from the Rule 1–2 link files before the union. The two mechanisms are complementary: the deeper gate shatters positionally but leaves its fragments internally welded by false name edges; the prune splits on per-edge evidence but leaves residues held by unscored edges. Production combines both. design baseline betw2000 betw5000 composed (2k+prune) production (5k+prune)

mega top

1k–10k

Δsize-2

Δsize-1

gated

170,431 7,268 1,813 ∼1,942 <1,000

4 14 5 10 4†

— +1,267 +2,201 +2,240 +3,240

— +5,722 +11,684 +10,748 +16,741

0 2,000 5,000 2,000 5,000

† The four surviving 1k–10k clusters of the production run are exactly the four pre-existing non-mega clusters (largest 2,891); every cluster descending from the former 170,431-id mega is below 1,000. Production map: a2AFullB.V2604.s.gz (106,824,568 rows = 101,056,344 author ids + 5,768,224 bad ids mapped to self; member;canonical;type, C-collation sorted).

Conference’17, July 2017, Washington, DC, USA

Audris Mockus

Table 18: Exp. 14: end-to-end 𝜏-sweep of classifier-filtered shingle expansion. Every Rule-3 shingle group is expanded into member pairs and scored by the Exp. 6 classifier; pairs with 𝑝 ≥ 𝜏 join the production union (betweenness-5000 gate + Exp. 12 fragment pruning) as ordinary edges. Production baseline (no expansion) in the last row. The 𝜏=0.5 failure is structural, not statistical: the betweenness cut was computed on the pre-expansion graph, so low-confidence expansion edges re-weld the mega around the 5,000 gated bridges. 𝜏

edges

unioned ids

size-2

>10k

top

0.5 0.7 0.9

66.46M 24.3M 30.8M†

176,958,812 158,856,230 141,391,899

— — 10,189,048

≥1 2 0

2,292,596 — 3,862

prod.

0

110,624,639

9,307,433

0

2,891

† Score histogram of the 66,459,771 unique expansion edges: [0.5, 0.6)=10.88M, [0.6, 0.7)=7.25M, [0.7, 0.8)=6.75M, [0.8, 0.9)=10.76M, [0.9, 1)=30.81M, bimodal, with 46% of the mass in the top bin; the 𝜏=0.7 edge count is the two top bins less duplicates. At 𝜏=0.9 the 1k–10k band holds 14 clusters (vs. 4 in production) and the largest cluster is an AkalUstat noreply group; the +881,615 size-2 clusters are the largest recall gain in the record. On the ALFAA gold pairs the final 𝜏=0.9 map scores recall 0.6454 / precision 0.8820 (TP 1,061, FN 583, FP 142) vs. production 0.4361 / 0.8733: 344 of the 778 in-shingle misses are recovered at 𝜏=0.9 confidence while precision improves: the welds the expansion might have re-introduced score below 0.9.

Table 19: Exp. 15: enriched per-pair classifier (23 features: 15 numeric, standardized, heavy tails log(1+𝑥)-transformed; 8 binary). New over v1: true deforked-project IoU and intersection (exact 𝑛𝑃 and capped-100 hashed sets from a2PFull; the v1 𝑛𝑃 came from a ≥20-project table and was 0 for 99.4% of ids), per-value spread of each matched attribute (𝑠 𝑓 , 𝑠𝑙 , 𝑠𝑢 , 𝑠𝑒 ), name↔local-part patterns (flLp: first.last-style match; tokInLp: name token in handle), and a Wiktionary givenname flag. Train 300k / test 2.34M ghid-labeled links (as Exp. 6); “gold” = zero-shot transfer to the 264,346 humanrated ALFAA pairs. model

test acc

test AUC

gold AUC

logistic v1 (Exp. 6, 16 feat.) logistic v2.1 (23 feat.) LGBM v2.1 (23 feat.) LGBM v2.1 w/o rawJac3

0.9841 0.9791 0.9935 —

0.9837 0.9841 0.9990 0.9870

0.9861 0.9910 0.5597 0.9813

The LGBM gold collapse is shortcut learning: rawJac3 (trigram Jaccard over the full id strings) carries 74% of its split gain because every ghid-labeled pair shares the long users.noreply.github.com substring, a label-construction leak that trees exploit by thresholding and a linear model uses benignly (𝛽=+0.78, comparable to uMatch/eMatch). Removing the feature recovers transfer but still trails the logistic, which is retained as the production scorer. Weight readout: domMatch +0.80, rawJac3 +0.78, uMatch/eMatch +0.76, tokInLp +0.41, degMin/Max −0.36/−0.35, sprEm/sprUm +0.30, givenF +0.17, projJac −0.01 (inert: ghid pairs nearly all co-occur in projects regardless of label; the feature’s value is on the cross-project expansion pairs it will score). Map-level epilogue: re-scoring all 256,703,339 expansion pairs with v2.1 emits 54,012,834 unique pairs 𝑝 ≥ 0.5 (𝜏 ≥0.9: 26,148,990; v1: 66,459,771 and 30,808,067). The resulting 𝜏=0.9 map (S2) is structurally cleaner (1k–10k = 9 vs. 14; largest 4,747; >10k = 0) and nudges gold recall (0.6490/0.8789 vs. 0.6454/0.8820), but loses 0.077 recall on the GitHub GT (Table 20): the in-distribution AUC gain does not survive contact with the out-of-distribution pair mass, and v1 scoring is retained.

Table 20: Exp. 16: recall-only evaluation on the GitHub singleauthor-repository ground truth of Bock et al. [2] (9,568,385 handles, 21,477,370 aliases; an alias absent from a map clusters to itself). Per-handle pairwise recall is macro-averaged with singleton handles scoring 1; “multi” restricts to handles with ≥ 2 aliases; FM = fraction of handles fully merged into one cluster; ES = same over multi-alias handles. max𝑁 drops handles with more than 𝑁 aliases. Published reference points (their Table, same GT family, WoC V2409 and their GitAuthority tool): at max9, V2409 recall 0.450 / FM 0.411 / ES 0.271; GitAuthority full 0.771/0.736/0.675; GitAuthority privacy-mode 0.478/0.430/0.298. map

cap

FM

ES

recall

recallmulti

V3 V3 V3

max3 max9 all

0.4739 0.4418 0.4414

0.3354 0.3120 0.3116

0.4993 0.4869 0.4865

0.3674 0.3675 0.3672

V2604 V2604 V2604

max3 max9 all

0.4247 0.3945 0.3941

0.2732 0.2536 0.2533

0.4471 0.4330 0.4327

0.3015 0.3011 0.3008

+shingle 𝜏=0.9 (S) +shingle 𝜏=0.9 (S) +shingle 𝜏=0.9 (S)

max3 max9 all

0.5716 0.5403 0.5398

0.4588 0.4334 0.4329

0.5994 0.5886 0.5883

0.4940 0.4929 0.4926

+shingle v2.1 (S2) +shingle v2.1 (S2) +shingle v2.1 (S2)

max3 max9 all

0.4983 0.4658 0.4653

0.3662 0.3415 0.3410

0.5253 0.5118 0.5115

0.4003 0.3982 0.3980

v2.1 𝜏=0.8 (S2t08) S + ghid (SG) [email protected] + ghid (SG8)

max9 max9 max9

0.5354 0.5516 0.5460

0.4273 0.4473 0.4403

0.5828 0.5995 0.5931

0.4858 0.5064 0.4984

SUG (production) SUG (production) SUG (production)

max3 max9 all

0.5867 0.5558 0.5553

0.4779 0.4525 0.4520

0.6140 0.6035 0.6031

0.5123 0.5113 0.5109

False positives are invisible by construction (only within-handle pairs are scored), so this benchmark prices V3’s mega at zero: V3 leads the production map despite resolving only 19,191,846 of the aliases (89.4%; the unresolved cluster to themselves) vs. V2604’s 21,471,954 (>99.97%). 30% of the GT aliases are GitHub noreply ids. The production map trails its predecessor for the same reason it beats it on ALFAA precision (Table ??): Exps. 1–12 removed pair mass, and the dormant Rule-3 layer (Exp. 13) is exactly the within-handle, cross-project mass this GT counts. The Exp. 14 expansion map (+shingle 𝜏=0.9) confirms it: +0.156 recall over production, ahead of mega-carrying V3 (+0.10) and the published V2409 (0.450) on every metric while keeping the largest cluster at 3,862, and ahead of GitAuthority’s privacy-preserving mode (0.478); the gap to full GitAuthority (0.771) is the within-repository context (and the noreply mining its privacy mode refuses) that a global map forgoes. The v2.1-rescored S2 rows close the Exp. 15 question: the better-calibrated classifier admits 4.7M fewer 𝜏 ≥0.9 pairs, and the pairs it drops are disproportionately the within-handle mass scored here ( −0.077 recall at max9), while gold barely moves (0.6490/0.8789 vs. 0.6454/0.8820), so the v1-scored map kept the candidate slot on this benchmark’s testimony. The Exp. 17 rows then recover what each variant gives up: relaxing v2.1 to 𝜏=0.8 buys back most of the GH loss and lifts gold recall to 0.7019; the GitHub-asserted same-ghid edges add recall the classifier cannot see (+0.011 over S, gold unchanged); and the triple union SUG ([email protected] ∪ [email protected] ∪ ghid) dominates every candidate on both benchmarks at once (gold 0.7026/0.8790, GH max9 recall 0.6035). SUG is the deployed production map.

Scaling Author Identity Disambiguation to the World of Code: A Methodology

Table 23: Exp. 5: false-link rate validated against GitHub ground truth. A Phase-1 link is labeled when both endpoints carry a GitHub numeric id (mined from the raw [email protected] prefix; 29.95M ids); it is false when those ids conflict. Overall 11.4% of 2.64M labeled links are false, but the rate is an almost step-function of endpoint degree max(𝑑 1, 𝑑 2 ): nearly every link touching a degree-100–499 identity joins two distinct accounts. The 𝑑 ≥ 500 band carries no labels because the top-degree bridges are non-GitHub template strings (Table ??), caught by degree directly. This independently confirms the Exp. 4 hypothesis and supplies the classifier’s training labels. max(𝑑 1 , 𝑑 2 )

labeled links

false rate

𝑑 < 10 𝑑 [10, 49] 𝑑 [50, 99] 𝑑 [100, 499] 𝑑 ≥ 500

2,357,413 117,168 74,144 87,157 0

0.057 0.466 0.334 0.998 —

overall

2,635,882

0.114

Table 24: Exp. 4: degree bridge-gate sweep. A pair unions only if both endpoints are non-bad, non-multi-name, and have degree 𝑑 < D. Lower D gates more ids. Baseline (ungated) top = 111,926; the best spread-gate floored at 25,959 (Table ??). Goal: top → small while size-2 stays near 9.60M. D

gated

union%

clusters

size-2

top

1000 500 100 50

54 296 19,265 56,987

94.0 93.7 90.5 87.9

70,453,724 70,454,334 70,474,813 70,516,477

9,598,777 9,598,830 9,599,178 9,599,841

71,172 68,677 50,780 20,635

Combined union-of-gates: 𝑑 ≥100 ∨ 𝑛𝑃 ≥100, SPREADCUT= 1 ∪ 42,110 90.3 70,524,455 9,603,987 25,957 The combined gate peels every high-degree service-bot and high-spread bot mega with minimal collateral (42k ids; recall the best of any run, size-2 = 9.60M), driving >10k clusters from 2–3 down to a single residual. But it cannot dissolve that last mega (top = 25,957): once all noreply.github.com service accounts are gated, the survivor is a Cloudflare email-relay hash string (harley+f57b. . . @cloudflare.com), moderate degree and moderate spread, below every node threshold. No union of node-gates reaches it.

Conference’17, July 2017, Washington, DC, USA

Table 25: Exp. 6: per-edge classifier on the 2,635,882 ghidlabeled links (88.56% true, 11.44% false). Left: false rate stratified by two features: the over-merge axis (max endpoint degree) and the true-link axis (matchScore). Right: standardized logistic-regression coefficients (300k train / 2.34M test; test acc 0.952 vs. 0.886 baseline, AUC 0.956). Degree pushes a link toward false; component matches and matchScore toward true; project-spread is near-zero (censored at 𝑛𝑃 <20). stratified false rate bin

logreg coef.

𝑛

false

feature

𝑑 max <10 [10, 50) [50, 100) [100, 500)

2,357,413 117,168 74,144 87,157

0.057 0.466 0.334 0.998

uMatch eMatch domMatch matchScore

+0.68 +0.68 +0.58 +0.48

ms<5 [5, 15) [15, 30) [30, 50) ≥ 50

149,443 116,785 307,499 1,832,957 229,198

0.887 0.781 0.205 0.004 0.032

degMax degMin infoMin fMatch nP (min/max)

−0.31 −0.30 −0.23 +0.14 ≈0

𝛽