arXiv Source Archives: Hidden Disclosure and Safer Release

Overview

An arXiv source archive exposes more than its PDF: dangling files, metadata, hidden source text, and version history can carry disclosure. The series distinguishes broad hidden-information prevalence from narrower sensitive detections, explains why single cleaners miss coverage, and defines a layered, human-owned gate for intentional release and post-publication containment.

Learning outcomes

A clean PDF shows that a particular build produced a particular visible result; it does not show that the source archive is private or release-ready.
File residue, metadata, and irrelevant source text are separate exposure surfaces, so cleaning one does not establish that the others are clean.
The two studies show widespread hidden material and a recurring sensitive subset, but their rates cannot be combined because denominators, definitions, units, preprocessing, and validation scopes differ.
A defensible release gate combines build evidence, metadata and syntax-aware checks, contextual human review, output comparison, and post-publication containment.

Keywords

arXivpreprintsLaTeXsource archivemetadatacommentsdangling filesprivacycredentialsrelease gate

Chapters

arXiv PDF vs Source Archive

What a successful build does—and does not—make public

10 min · What a successful build does—and does not—make public

10 min

Three Hidden Surfaces in arXiv Source Archives

How build graphs, metadata, and source structure separate audit tasks

10 min · How build graphs, metadata, and source structure separate audit tasks

10 min

Reading arXiv’s 88% and 9.9% Findings

Different denominators, populations, filters, and validation scopes

12 min · Different denominators, populations, filters, and validation scopes

12 min

arXiv Source Cleaning: Coverage and Failure Modes

Why build, metadata, parsing, and output checks must work together

13 min · Why build, metadata, parsing, and output checks must work together

13 min

When arXiv Source Archives Become Public

Pre-upload ownership and post-publication containment

9 min · Pre-upload ownership and post-publication containment

9 min

A Safer Boundary for arXiv Source Archives

Release checks that preserve openness beyond the PDF

11 min · Release checks that preserve openness beyond the PDF

11 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-6 Premium

FAQ

Why is a clean arXiv PDF not enough to protect the source archive?

A clean arXiv PDF proves only that a particular build produced the visible pages; it does not reveal unused files, metadata, hidden source text, or older public versions.

What can an arXiv source-archive audit find?

It can identify dangling files, embedded and archive metadata, and source text that does not render, then flag links, credentials, personal data, or confidential discussion for contextual review.

How should the 88% and 9.9% arXiv findings be interpreted?

The 88% figure is a broad lower-bound estimate of submissions with uniqueness-filtered interesting hidden information, while 9.9% is the sampled rate with a sensitive detection; their denominators and outcomes differ, so they cannot be combined.

What should authors do if an arXiv source archive exposes a credential or private link?

Treat it as public, revoke or rotate credentials, restrict linked resources, notify the relevant owners, and issue a corrected version if useful; do not assume revision or withdrawal erases older sources.