Elektrine lite

← Feed

@mrtnhnz@infosec.exchange

2026-04-28 19:17 UTC

Have you ever wondered what happens with the LaTeX sources that you submit to arXiv? In joint work with Jan, Johannes, David, and Joscha, we had a look at exactly that! Shout out to Johannes for taming 2.7 Million arXiv submissions. Jan will present the paper of our assessment of "hidden" information in arXiv source files at the IEEE Symposium on Security and Privacy 2026 (May 19, Session 3, Track 3), the leading venue for cybersecurity research (acceptance rate ~12.7%). Our analysis highlights the prevalence of dangling files (unnecessary to create the final PDF), sensitive information in metadata (e.g., GPS locations), and a lot of irrelevant content in the form of LaTeX comments that reveals passwords, access tokens, credit card numbers, author conversations, profanity, and many more insights that were likely intended to remain private. Many authors are unfortunately unaware that source files for arXiv submissions are in fact publicly accessible.Your submission may also be affected given that 88% feature some kind of unique details and 18% even simultaneously expose unique dangling files, unique metadata, and unique comments. Since existing sanitization tools all have blindspots, we propose ALC-NG. It utilizes pdflatex's recorder option and a tree-sitter grammar to improve the cleaning reliability, providing a tool that helps combat "hidden" information in new arXiv submissions (or elsewhere). Paper: https://arxiv.org/abs/2604.20927 Executive Summary: https://arxiv.comsys.rwth-aachen.de/ ALC-NG: https://github.com/COMSYS/ALC-NG/

Replies (0)

No replies.