Presentation at IEEE S&P and More

COMSYS researcher Jan Pennekamp presented recent work on identifying and assessing “hidden” information in arXiv source files at IEEE S&P ‘26 in San Francisco, CA.


This work, a joint effort with COMSYS researcher Johannes Lohmöller, highlights the risks of making LaTeX projects publicly accessible (as required by the preprint repository arXiv). We host a dedicated website to inform about our findings in more detail. Most importantly, we caution authors to apply a sanitization tool (“cleaner”), such as our artifact ALC-NG, before sharing sources with third parties. Keep in mind that these tools are far from perfect (check our paper)—they may alter the output or leave (traces of) “hidden” information, so double-checking the output of these tools is certainly recommended. David Schütte has implemented ALC-NG and is still actively maintaining it.

ALC-NG Logo

At the 47th IEEE Symposium on Security and Privacy, the talk was well attended, and the subsequent poster gallery attracted crowds to discuss this broad topic further and to figure out next steps, both for resolving the situation and for mitigating future issues. Our work has also been picked up by ACM TechNews in May 2026.

Beyond attending the conference, Jan traveled across the U.S. for research visits to deepen existing collaborations, to discuss ongoing research activities, and to initiate new collaborations. His journey took him to the DAS Lab at George Mason University (GMU) in Fairfax, VA, the Florida Institute for Cybersecurity Research (FICS Research) at University of Florida (UF) in Gainesvilles, FL, and the Knight Foundation School of Computing and Information Sciences at Florida International University (FIU) in Miami, FL, before returning to Aachen. Jan gave a research talk at every institution and was warmly welcomed by the respective faculty and students, despite the summer break.

A big shoutout to Prof. Sanchari Das, Prof. Kevin Butler, Prof. Patrick Traynor, Prof. Selcuk Uluagac, Prof. Ruimin Sun, Prof. Arjun Arunasalam, and Prof. Weidong Zhu, among others, for hosting Jan, giving him insights into your labs, and for the fruitful exchange in general. Jan receives funding from the Klaus Tschira Boost Fund, a joint initiative of GSO — Guidance, Skills & Opportunities e.V. and Klaus Tschira Stiftung.