Jan Pennekamp, Johannes Lohmöller, David Schütte, Joscha Loos, and Martin Henze. 2026. Hidden Secrets in the arXiv: Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific Preprints. In Proceedings of the 47th IEEE Symposium on Security and Privacy (SP '26). IEEE.

Contents

• paper_issues.csv.gz
  Aggregated per-paper results of identified unintentional information disclosures. Paper identifiers are anonymized using HMAC-SHA256 as described below. Version 0 refers to s3-provided data that carries timestamps, but no exact version information.
• survey.md
  User study instrument as deployed via SoSci Survey, including question texts and response options.
• classification_prompt.txt
  Prompt used with Qwen2.5-72B to classify identified comments into disclosure categories.
• example.tex / example.bib
  Synthetic LaTeX file containing sanitization test cases covering representative disclosure patterns.

Anonymization Scheme

Paper identifiers in `paper_issues.csv` are anonymized using HMAC-SHA256 with a secret key.

import hmac

import hashlib

def anonymize_arxiv_id(arxiv_id):

    if '.' not in arxiv_id and '/' not in arxiv_id:

        hmac_hash = hmac.new(secret, arxiv_id.encode('utf-8'), hashlib.sha256).hexdigest()

        return f"{hmac_hash[:6]}"

    if '/' in arxiv_id:

        prefix, suffix = arxiv_id.split('/', 1)

    else:

        prefix, suffix = arxiv_id.split('.', 1)

    hmac_hash = hmac.new(secret, suffix.encode('utf-8'), hashlib.sha256).hexdigest()

    return f"{prefix}/{hmac_hash[:6]}"

The sanitizer tool (ALC-NG) used to prevent unintentional disclosure in LaTeX source files is available at: https://github.com/COMSYS/ALC-NG