A large-scale security analysis presented at the 47th IEEE Symposium on Security and Privacy (S&P 2026) found that the overwhelming majority of preprints on arXiv unintentionally expose information their authors never meant to publish — including passwords, API keys, GPS coordinates, and links to editable documents with live personal data. The finding matters for research offices and authors well beyond arXiv itself, because the underlying cause — publishing raw LaTeX source files alongside a compiled PDF — is common to most preprint infrastructure, not a quirk of one platform.
What the study analyzed
The paper, “Hidden Secrets in the arXiv: Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific Preprints” (arXiv:2604.20927, submitted April 22, 2026), was authored by Jan Pennekamp, Johannes Lohmöller, David Schütte, Joscha Loos, and Martin Henze of RWTH Aachen University’s Communication and Distributed Systems group, and presented at IEEE S&P 2026 in May 2026. The team systematically analyzed 2.7 million arXiv submissions with publicly available LaTeX source files, spanning 1991 through 2025, examining three categories of unintentional disclosure: unnecessary included files, embedded metadata, and irrelevant leftover content such as author comments.
What the study found
Per the authors’ published results, 88% of analyzed submissions contain some form of hidden information across at least one of those three categories. Specifically: 75% include unique author-specific comments that never appear in the compiled PDF, 56% contain unique embedded metadata, and 25% include unique “dangling” files — source material not actually referenced by the compiled paper. In aggregate, the authors extracted roughly 644 million pieces of such irrelevant content, including 127 million unique URLs referenced across 905,000 submissions.
Where the sensitive material shows up
Beyond routine clutter, the analysis surfaced concrete security and privacy exposures: 265 distinct API tokens across 128 submissions, 171 passwords across 82 submissions, and 4 private cryptographic keys. Embedded file metadata exposed system usernames in 11% of submissions. Location data was also common: 7,326 submissions contained GPS coordinates, with 2,238 of those referencing multiple distinct locations. Nearly 3,948 submissions linked out to editable Google Docs, of which at least 1,119 granted public viewing access and 699 granted public editing access — in 18 cases, those links exposed live survey data containing participant responses. The authors also found around 3,200 submissions containing review-related correspondence left in source comments, such as notes exchanged during peer review or internal revision rounds.
Why this keeps happening
arXiv, like several other preprint and journal production workflows, republishes the raw source files authors upload — typically a LaTeX project directory — rather than only the compiled PDF, so that the paper can be recompiled, translated, or reused. Authors frequently treat that source directory as a private working folder: draft notes, commented-out text, leftover images with embedded EXIF/location metadata, and links to shared documents used for internal coordination during drafting rarely get removed before submission. The RWTH Aachen team also tested existing LaTeX-cleaning tools against their dataset and found they “fail to reliably achieve the intended cleaning functionality,” meaning authors who believe they’ve already sanitized a submission may still be exposing data. To address the gap, the authors released a tool, ALC-NG, designed to more comprehensively strip files, metadata, and comments not required to compile the paper.
Authors mostly don’t know this is happening
As part of a responsible-disclosure effort, the researchers notified 2,660 authors whose submissions contained exposed sensitive data; 112 responded (a 5.3% response rate). Of those who responded, only 41% were aware that arXiv publishes source files at all, only 28% had previously heard of any LaTeX-cleaning tool, and just 11% said they regularly used one before submitting. That awareness gap is arguably the more actionable finding for research administration: this isn’t primarily a platform failure to fix, it’s a submission-hygiene practice most authors have never been taught.
What this means for research offices and authors
For institutions supporting research data management, the practical implications are straightforward. Authors and labs should treat a LaTeX source directory as publication material, not scratch space: remove commented-out drafts, credentials used for testing (API keys, database passwords), embedded document links with open sharing permissions, and images with location metadata before upload, rather than relying on any single automated cleaner to catch everything. Research offices advising on data sharing policy or reviewing data management plans that reference preprint deposit may want to fold source-file hygiene into existing preprint checklists, alongside the more familiar concerns covered in guidance on how to use arXiv preprints and on choosing a preprint server. Because the exposure mechanism — publishing author-supplied source alongside a compiled output — is not unique to arXiv, the same review habit is worth applying wherever a lab deposits source files on platforms compared in CASRAI’s arXiv vs. bioRxiv and arXiv vs. OSF overviews.
Sources
- Pennekamp, J., Lohmöller, J., Schütte, D., Loos, J., & Henze, M. “Hidden Secrets in the arXiv: Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific Preprints.” arXiv:2604.20927, submitted April 22, 2026; presented at the 47th IEEE Symposium on Security and Privacy (S&P 2026).
- RWTH Aachen Communication and Distributed Systems group, project summary and statistics: arxiv.comsys.rwth-aachen.de.
This CASRAI news piece reports the study’s methodology and findings as published by the authors; figures above are cited directly from the paper and the research group’s own project page, not independently re-derived.
