The widespread use of preprint repositories such as arXiv has accelerated the communication of scientific results but also introduced overlooked security risks. Beyond PDFs, these platforms provide unrestricted access to original source materials, including LaTeX sources, auxiliary code, figures, and embedded comments. In the absence of sanitization, submissions may disclose sensitive information that adversaries can harvest using open-source intelligence. In this work, we present the first large-scale security audit of preprint archives, analyzing more than 1.2 TB of source data from 100,000 arXiv submissions. We introduce LaTeXpOsEd, a four-stage framework that integrates pattern matching, logical filtering, traditional harvesting techniques, and large language models (LLMs) to uncover hidden disclosures within non-referenced files and LaTeX comments. To evaluate LLMs' secret-detection capabilities, we introduce LLMSec-DB, a benchmark on which we tested 25 state-of-the-art models. Our analysis uncovered thousands of PII leaks, GPS-tagged EXIF files, publicly available Google Drive and Dropbox folders, editable private SharePoint links, exposed GitHub and Google credentials, and cloud API keys. We also uncovered confidential author communications, internal disagreements, and conference submission credentials, exposing information that poses serious reputational risks to both researchers and institutions. We urge the research community and repository operators to take immediate action to close these hidden security gaps. To support open science, we release all scripts and methods from this study but withhold sensitive findings that could be misused, in line with ethical principles. The source code and related material are available at the project website https://github.com/LaTeXpOsEd

翻译：预印本仓库（如arXiv）的广泛使用加速了科学成果的传播，但也引入了被忽视的安全风险。除了PDF文件，这些平台还提供对原始源材料（包括LaTeX源文件、辅助代码、图表及嵌入注释）的无限制访问。在缺乏净化机制的情况下，提交内容可能泄露敏感信息，攻击者可通过开源情报手段获取这些信息。本研究首次对预印本仓库进行大规模安全审计，分析了来自10万份arXiv提交、总计超过1.2 TB的源数据。我们提出LaTeXpOsEd框架——一个融合模式匹配、逻辑过滤、传统信息提取技术和大语言模型（LLM）的四阶段框架，旨在发现非引用文件与LaTeX注释中隐藏的泄露信息。为评估大语言模型的秘密检测能力，我们构建了LLMSec-DB基准测试集，并对25个最新模型进行测试。分析揭示了数千例个人身份信息泄露、带GPS标签的EXIF文件、公开的Google Drive和Dropbox文件夹、可编辑的私有SharePoint链接、暴露的GitHub与谷歌凭证以及云API密钥。我们还发现了机密作者通信、内部学术分歧及会议投稿凭证，这些信息对研究人员和机构构成严重声誉风险。我们敦促研究社区与仓库运营商立即采取行动，填补这些隐蔽的安全漏洞。为支持开放科学，我们公开本研究的全部脚本与方法，但根据伦理原则保留可能被滥用的敏感发现。源代码及相关材料发布于项目网站：https://github.com/LaTeXpOsEd