Overview

Open arXiv preprints need a release decision for the whole source package, not just the rendered PDF. A minimum defensible gate inventories files, separates build-required inputs from intentional supplements, inspects metadata, parses irrelevant source content, reviews high-impact candidates, and compares rebuilt output. It reduces known exposure without proving perfect cleanliness; after upload, older versions may persist, so potentially exposed credentials and private links require containment.

Learning outcomes

Release readiness is a judgment about the complete arXiv package—files, metadata, source text, and retained state—not a certificate supplied by a clean PDF.
A minimum gate joins build observation with author intent, syntax-aware and metadata checks, contextual human review, and rendered-output comparison.
Selective openness preserves source and ancillary data needed for scholarship while excluding accidental working residue; after upload, containment must account for retained history.

Keywords

arXivpreprintsreleaseopennesscontainmentreproducibility

A Safer Boundary for Open Preprints

The final question for arXiv source archives is not whether open source publication is worth preserving. It is whether authors and repositories understand what they are publishing when a clean PDF is accompanied by a much larger package. This series has shown how file residue, metadata, irrelevant source text, and version history cross that boundary. The resulting judgment is precise: a PDF can be visually complete while the publication remains incomplete as a security decision.

The real publication boundary has three dimensions

A source archive is ready for public release only when its contents are intentional across three different dimensions. The file dimension asks what the package retains beyond the inputs observed in the build. The metadata dimension asks what the files reveal about their origin, handling, and embedded properties. The content dimension asks what source text exists even though it does not affect the rendered argument. These are not three names for the same problem. They are three interfaces through which the public archive can disclose information.

The distinction changes the meaning of a clean PDF. The PDF is evidence that a particular build produced a particular visible result. It does not tell us whether the package contains a backup, an old dataset, a collaboration artifact, or a version-control history. It does not reveal whether an image carries location data or whether file timestamps describe a private working pattern. It does not show a comment that the compiler ignored, a disabled branch, or an alternative passage retained in the source. Rendering is a statement about output; release readiness is a statement about the whole input package and its retained state.

The three dimensions also interact without collapsing into one another. A leftover file may contain a private link. The link may point to an editable document. The document may contain personal data or further links. A source comment may identify a person whose name also appears in metadata. A timestamp may make a set of documents easier to correlate. These combinations can increase risk, but finding one surface clean does not establish that the others are clean. The controls must preserve the separation long enough to inspect each one.

The consequences range from nuisance to immediate containment. An unused template can waste storage or hint at where a submission came from. A software identifier or timestamp can add a behavioral clue. A commented-out discussion can disclose disagreement, a review response, or a limitation that the authors decided not to publish. An image location can expose more personal information than its caption suggests. A private document link, password, token, or key can turn an archive oversight into an access-control incident. Treating all of these as equally severe would be as misleading as treating the low-severity cases as irrelevant.

Context determines what a finding means. A name in an author list is intentionally public; the same name in a discarded survey file may not be. A URL to a paper is different from an editable link shared for internal coordination. A high-entropy string can be a placeholder or an active credential. The studies therefore use patterns to identify candidates, structured methods to locate hidden regions, and human or contextual analysis to determine whether the candidate carries a meaningful risk. “Found” is not the same as “exploitable,” and “not proven active” is not the same as “safe to leave public.”

The two supplied studies reinforce this model while measuring different slices of it. Hidden Secrets examines 2.7 million submissions with available source files and reports that 88% contain at least one kind of interesting hidden information under its uniqueness-filtered definition. That is a broad lower-bound finding about unusual content across file, metadata, and text surfaces; it is not a claim that 88% contain confirmed secrets. LaTeXpOsEd analyzes a uniformly sampled 100,000 submissions and reports 9.9% with a sensitive detection from its prepared comment and unreferenced-file pipeline, producing 13,806 detections across multiple categories. That is evidence of a meaningful sensitive subset; it is not an estimate of all hidden content.

Those rates cannot be added, divided, or used to rank the studies. They have different denominators, preprocessing, definitions, units, and validation scopes.

Published by DeepMox

FAQ

What should a minimum arXiv source-release gate check?

It should inventory the complete archive, observe build inputs, review intentional ancillary files, inspect metadata, parse irrelevant source content, route high-impact candidates to human review, and compare rebuilt output before publication.

Does selective openness mean abandoning arXiv source publication?

No. It means publishing the source and ancillary data needed for the intended scholarly purpose while excluding accidental working residue such as temporary exports, debug logs, or private conversations.

Can an arXiv source audit prove that no disclosure mechanism remains?

No. Parser errors, uncompileable submissions, sampling limits, model mistakes, rare constructions, and inaccessible removed sources leave residual uncertainty; the gate reduces known exposure and makes the boundary explicit instead.

Previous9 minWhen arXiv Source Archives Become Public

All chaptersBack to Topic

A Safer Boundary for arXiv Source Archives

A Safer Boundary for Open Preprints

The real publication boundary has three dimensions

FAQ