When a preprint server publishes the sources a paper was built from, it publishes strictly more than the paper. The leakage sorts into three dimensions that need three different detectors: dangling files, which are present in the submission but never read during the build and are found by starting from the root file and following inclusions, or better, by recording which files the compiler actually opened; embedded metadata, the key-value pairs that image and PDF producers write into their output; and content present in the sources but absent from the rendering, above all comments, which must be located by parsing the document into a syntax tree rather than by pattern-matching text. Measured across a whole corpus, the disclosure is near-universal rather than exceptional, and it is not self-correcting: posting a cleaned revision does not retract the earlier version's sources. What leaks ranges from harmless to severe - private keys, API tokens, credentials, participant data, coordinates, links to editable internal documents, whole version-control histories - and grading severity is itself contested, since perceptions of sensitivity vary between people. Mitigation is a build-fidelity problem as much as a detection problem: a sanitizer must be judged both on how much it removes and on whether the document still compiles to a pixel-identical result, and tools that are safe on the second count are usually weak on the first.
Pennekamp, Lohmoeller, Schuette, Loos and Henze (IEEE S&P 2026) measure how much unintended information authors disclose by way of the LaTeX sources that arXiv publishes alongside the PDF - sources e…