Artifact: Hidden Secrets in the arXiv Publication Jan Pennekamp, Johannes Lohmöller, David Schütte, Joscha Loos, and Martin Henze. 2026. Hidden Secrets in the arXiv: Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific Preprints. In Proceedings of the 47th IEEE Symposium on Security and Privacy (SP '26). IEEE. Contents paper_issues.csv.gzAggregated per-paper results of identified unintentional information disclosures. Paper identifiers are anonymized using HMAC-SHA256 as described below. Version 0 refers to s3-provided data that carries timestamps, but no exact version information. survey.mdUser study instrument as deployed via SoSci Survey, including question texts and response options. classification_prompt.txtPrompt used with Qwen2.5-72B to classify identified comments into disclosure categories. example.tex / example.bibSynthetic LaTeX file containing sanitization test cases covering representative disclosure patterns. Anonymization Scheme Paper identifiers in `paper_issues.csv` are anonymized using HMAC-SHA256 with a secret key. The scheme preserves the arXiv identifier structure (category prefix and numeric suffix) while replacing the numeric part with a 6-character hex digest. import hmac import hashlib def anonymize_arxiv_id(arxiv_id): if '.' not in arxiv_id and '/' not in arxiv_id: hmac_hash = hmac.new(secret, arxiv_id.encode('utf-8'), hashlib.sha256).hexdigest() return f"{hmac_hash[:6]}" if '/' in arxiv_id: prefix, suffix = arxiv_id.split('/', 1) else: prefix, suffix = arxiv_id.split('.', 1) hmac_hash = hmac.new(secret, suffix.encode('utf-8'), hashlib.sha256).hexdigest() return f"{prefix}/{hmac_hash[:6]}" Sanitizer The sanitizer tool (ALC-NG) used to prevent unintentional disclosure in LaTeX source files is available at: https://github.com/COMSYS/ALC-NG