Hidden Secrets in the arXiv

Three Ways Source Files Expose Hidden Content

arXiv publishes the LaTeX source files of submitted papers alongside the compiled PDF. This strategy is supposed to enable notation reuse and provide learning opportunities for the community. However, making sources publicly available simultaneously introduces three dimensions of unintentional information disclosure. To make matters worse, all submitted versions of an arXiv paper remain permanently accessible, along with their sources. Accordingly, uploading a cleaned replacement does not remove the original, and existing source mirrors (e.g., archive.org) make even author-requested takedowns largely ineffective.

All 2.7 Million arXiv Papers with Sources, Analyzed

We analyzed all arXiv submissions with available LaTeX source files from 1991 through December 2025: 2.7 million papers in total, covering 93% of all arXiv submissions. For each dimension of “hidden” information, we apply a dedicated detection method chosen for reliability over heuristics.

To focus on content that originates from a paper’s own authors rather than shared templates, we define “interesting” content as any item appearing in at most two submissions. We were able to successfully compile 85% of papers (2.32 million) in our TeX Live 2023 evaluation environment.

What We Found Across 2.7 Million Papers

Across all three dimensions, hidden information is widespread. Focusing on unique content likely originating from each paper’s own authors: 75% of submissions contain unique interesting comments, 56% contain unique metadata, and 25% have unique dangling files. Combined, 88% are affected in at least one dimension. The most common combination is comments and metadata (30%); 18% of submissions are affected in all three dimensions simultaneously.

Dangling Files: 12 Million Unnecessary Files

We identify 12 million dangling files across the dataset. Most are benign leftovers (template style files, unused images), but a long tail of rare file types is predominantly dangling and carries genuine risk:

Bibliography files are a special case. They are redundant once the compiled .bbl file exists, yet 93% of submitted .bib files contain entries not referenced in the compiled document. Of these: 8.4% of submissions reuse a bibliography from a prior paper verbatim; 5.5% include large community-wide bibliography databases with more than 500 entries. Beyond unused entries, .bib files also carry 42 million non-standard extra fields, of which 29 million appear unique to individual submissions, often containing author ratings, editorial notes, or local file paths.

Template files can reveal submission histories. Conference-specific style files (e.g., usenix.sty) in dangling positions might hint at where a paper was submitted before. In a sample of 115 submissions with dangling USENIX templates matched via dblp, 77% were ultimately published elsewhere. We identified 47 venues and 561 submissions potentially traceable this way.

Embedded Metadata: Timestamps, GPS, and Usernames

90% of submissions include files with modification timestamps. Of these, 72% show their most recent file modification within one hour of the arXiv-recorded submission time (35% within five minutes), revealing fine-grained working patterns. Additionally, 93% of all images and 93% of all included PDFs carry exiftool-extractable metadata. Key disclosures beyond what is already visible in the compiled PDF:

Irrelevant Content: 644 Million Comments Analyzed

Using our AST-based parser, we extract 644 million pieces of irrelevant content (comments, unused branches, post-document text) across 95% of all submissions. After filtering for uniqueness, 114 million “interesting” items remain, present in 75% of submissions. A locally-hosted LLM classifies 113 million of these (macro F1: 0.83) to reveal what authors actually leave behind. Our structured parsing approach constitutes a reliable lower bound: it minimizes false positives while covering all commonly used comment mechanisms.

Based on bootstrapping (95% CI), the LLM estimates that at least 3.6% of comments contain sensitive content. This statement should be treated carefully, though: sensitivity perception varies by individual, and the model is deliberately conservative to minimize false positives.

Pattern-Based Detection: Specific Sensitive Findings

Beyond semantic classification, targeted pattern matching (with manual validation) identifies concrete sensitive content:

Computer Science Papers Are Disproportionately Affected

Computer science (CS) papers contain significantly more “hidden” information than papers from other disciplines, even after normalizing for source file size (Mann-Whitney U, p < 0.0001). Within CS, security papers exceed the CS average, and A*/A-ranked security venue papers exceed lower-ranked ones. This finding likely reflects more elaborate source archives (more files, larger bibliographies, more co-authors) rather than greater carelessness.

Updating a Paper Does Not Fix the Problem

arXiv allows submitters to upload new versions of a paper over time. 1.1 million submissions in our dataset have multiple versions (4.3 million versions in total). One might hope that authors use version updates to remove accidentally disclosed content. At scale, however, we find no consistent indication that subsequent versions reduce the amount of hidden information. If anything, later versions tend to add new unique content first, and only remove it in the long tail.

Individual examples confirm this trend: one submission initially containing many valid OpenID tokens removed them in v2, yet the original v1 remains permanently accessible. Similarly, seven respondents to our survey reported uploading cleaned replacement versions without realizing that old versions and their sources remain downloadable.

Why Existing Cleaning Tools Fall Short

Several sanitization tools promise to “clean” LaTeX sources before arXiv submission. We test all of them against nine test cases covering relevant methods for embedding comments in LaTeX. None of the evaluated tools performs satisfactorily, and critically, all tools ignore the metadata dimension entirely.

The most widely used tool, arxiv_latex_cleaner (ALC), produces pixel-perfect PDFs in 88% of compilable cases; ALC-NG in 87%. Despite arXiv endorsing ALC since its release in 2018, we estimate only 538 submissions (0.10%) show evidence of having been run through it. ALC also leaves residual content: after cleaning, we still find 362 sensitive regex matches in underremoved comments, including links to Overleaf, illustrating that partial cleaning can create a false sense of security.

Storage Implications

Beyond privacy, unnecessarily submitted content costs arXiv permanent storage. Accurate sanitization of the latest versions alone could free 658 GB (22.9%) of their source storage. Considering all versions, the savings amount to 2,720 GB (23.3%), of which 97% stems from dangling files.

ALC-NG: Next-Generation LaTeX Sanitization

Given the systematic shortcomings of existing tools, we develop and open-source ALC-NG. To the best of our knowledge, it is the first tool to address all three dimensions of hidden information, combining established best practices for each.

ALC-NG can validate its own output: optionally, it compares the original and sanitized PDFs pixel-by-pixel using pdfium to confirm that no visible content was altered. It produces pixel-perfect output in 87% of compilable cases, benefits 98% of submissions, and breaks only 15% of sources, comparable to or better than all existing tools on each metric.

Notifying 2,660 Authors: What We Learned

We disclosed validated findings (exposed credentials, accessible documents) to 2,660 authors of affected papers and invited them to a survey on awareness and practices around arXiv source files. We received 112 complete responses (5.3% response rate). 29% identified as assistant professors, 16% full professors, 28% permanent research staff, and 18% postdocs and PhD students. 49% reported more than ten arXiv submissions.

We acknowledge potential response bias: participants were primed by our disclosure notice immediately before the survey, and authors who did not consider their findings sensitive were less likely to respond. All research was conducted under institutional ethics review. The LLM analysis used a locally-hosted model. Web resources were accessed read-only with strict rate limiting; no credentials were used or tested. We publish our findings without paper identifiers to protect affected individuals.