The copy of “Attention Is All You Need” on arXiv, the 2017 paper behind today’s chatbots, still records that five of its figures were drawn in Adobe Illustrator CS6 on a Mac, on 19 May 2017 between 9:56 and 10:09 in the morning, seven hours behind UTC, and kept in a folder called vis. None of that shows on any page. It sits in the file, attached to each figure, and a PDF reader’s Properties window doesn’t show it either.
That is PDF metadata at its most revealing, and the author’s name is often the least of it. We opened ten real PDFs on 24 September 2026 to see what each app writes into the files it makes, then ran them through our own Remove PDF metadata tool to see what was left. The test found two faults in that tool. Both are fixed, and both are described below.
Ten PDFs, and what each one said
Eight came from the public web: two IRS forms, two NIST reports, the arXiv paper, the C2PA technical specification, an old W3C test file and a small sample PDF with an owner password, which comes up later. Two we made on a Mac: one printed from headless Chromium, one through macOS’s own PDF writer.
| File | Made with | What it gave away |
|---|---|---|
| NIST Cybersecurity Framework 2.0 (32 pages) | Word, then Acrobat PDFMaker 23 | A GrammarlyDocumentId, a SharePoint content-type ID, a “Publication Date” still reading “Month DD, 2024”, and a last change on 4 June 2025 |
| Attention Is All You Need (arXiv, 15 pages) | LaTeX, pdfTeX 1.40.25, TeX Live 2023 | Exact TeX version, five blocks of private app data, and the Illustrator details of five figures |
| NIST AI Risk Management Framework (48 pages) | LaTeX, pdfTeX 1.40.24, TeX Live 2022 | Created 24 January 2023, changed 4 June 2025, keywords, and a summary of the report as its subject |
| IRS Form W-9 and Form 1040 | Adobe LiveCycle Designer 6.5 | Author fields that read SE:W:CAR:MP and C:DC:TS:CAR:MP, which look like internal office codes |
| C2PA specification (226 pages) | Asciidoctor PDF 2.3.17 on Prawn 2.4.0 | The exact versions of both, and the date it was built |
| Test file from W3C (2007) | OpenOffice.org 2.1 Writer | A person’s full name in the Author field, still there 19 years later |
| Our page printed from Chromium | Chromium, Skia/PDF m153 | The page’s <title> as the PDF title, plus the browser engine version |
| Our text file printed by macOS | Quartz PDFContext | macOS Version 27.0, build 26A428, and the time to the second |
The NIST framework is the one to look at twice. It went from Word through Adobe’s PDFMaker, which copies the Word document’s custom properties into the PDF. So the published file names the Grammarly add-in someone had running, carries an ID from the SharePoint library the draft lived in (the 0x0101 at its start is SharePoint’s code for a document), and keeps a template field nobody filled in. Nothing there is secret. It is still a record of an office’s tools and habits that the authors never chose to publish, and a Word file of yours would carry your office’s version of the same.
The dates matter more than they look. Both NIST reports say they were last changed on 4 June 2025, long after their publication dates. A “last changed” date tells anyone holding two copies whether they are looking at the same revision, and on a contract, a CV or a leaked memo, that can be the point.
Browsers and operating systems write less, but they are exact. The Chromium file named its engine build; the macOS file named the OS build. Neither named a person. We only tested headless Chromium, not Chrome’s print dialog with a signed-in profile, so we can’t say whether ordinary Chrome writes anything more.
Where the details hide
A PDF keeps this kind of information in four places, and most “clear the author” advice covers one.
- The document info dictionary: title, author, subject, keywords, the app that made the file, the app that saved it, two dates, and any custom fields like the Grammarly ID. It is what a reader’s Properties window shows.
- XMP metadata, an XML block that often repeats the same fields and adds more. It can sit on the whole document and on single pictures and fonts inside it. The IRS forms and both NIST files had it.
- Private app data (
PieceInfo) that Illustrator and Acrobat keep so they can re-edit the file later. - Details stored on embedded objects, like pdfTeX’s record of each figure’s file name, page and the figure’s own info dictionary. That is where the Illustrator dates in the arXiv paper live.
Adobe Acrobat Pro has a separate command for this, Remove Hidden Information (in newer versions, Sanitize document under Redact), because editing the fields in Document Properties leaves the rest.
What our tool missed, and what we changed
The first run left the arXiv paper’s figure records in place. Our remover cleared the document info, XMP blocks and private app data, but it had no rule for pdfTeX’s PTEX.InfoDict, so the Illustrator version, the two timestamps per figure and the ./vis/ file names survived the clean. Since 24 September 2026 it removes them and lists them as “Figure file details”.
The second fault was in the message. The sample PDF has an owner password: it opens without one, but it is encrypted. Our tools told you it was damaged. The library we build on flags encrypted files with its own error type, and a check on that type was failing, so every encrypted PDF fell through to the wrong message. The tools now say the file is password protected. They still can’t edit it.
Worth checking before you send
A PDF you made in Word from a work template is the likeliest to carry more than you meant: custom properties survive the trip, and they come from people and systems you never see. Open it in our remover first; the list shows every field it found before anything is saved. If a PDF was made by an AI tool, it may also carry Content Credentials, the same C2PA record AI images carry, and the remover takes those off as well.