Raccoon: Diverse Research Applications

• Raccoon is a polysemous term representing specialized software for JWST data correction, cryptographic attack patterns, anthropomorphic avatars, wildlife modeling cases, generative diffusion frameworks, and LLM security benchmarks.
• Its applications span astrophysical data cleaning using sinusoidal chirp models, microarchitectural side-channel exploitation in Diffie–Hellman schemes, and emotion perception studies via human-likeness estimators in avatars.
• Practical implications include enhanced spectral analysis and kinematic measurements, improved digital security through timely cryptographic patches, refined human–computer interaction, robust spatio‐temporal wildlife modeling, and advances in text‐to‐video generative modeling and prompt extraction defenses.

In contemporary research literature, “raccoon” is a markedly polysemous term. It names domain-specific software and benchmarks, denotes an established cryptographic attack family, and appears as a substantive object of study in both avatar-mediated HCI and wildlife disease modeling. Recent work uses the term for a JWST/NIRSpec IFU spectral-cleaning package, a text-to-video diffusion framework with curated training data, and a benchmark for prompt extraction against LLM-integrated applications; separately, the Raccoon attack refers to Diffie–Hellman shared-secret length leakage, while raccoon also designates an animal avatar in emotion-perception experiments and the host species in a Connecticut rabies spread case study (Shajib, 17 Jul 2025, Tan et al., 28 Feb 2025, Wang et al., 2024, Aldaya et al., 2021, Zhang et al., 3 Aug 2025, Grieshop et al., 2023).

1. Astronomical data reduction: raccoon for JWST/NIRSpec IFU wiggle removal

In astronomy, raccoon is a Python package for removing resampling noise, commonly called “wiggles,” from spaxel-level spectra in JWST NIRSpec integral field spectroscopy datacubes. The artifact arises when 2D detector data are resampled into 3D cubes while the NIRSpec point spread function is undersampled; the standard JWST pipeline does not correct this effect, even though it can distort spectral shape, bias line measurements, and compromise kinematic analyses at single-spaxel resolution. The package addresses this by fitting an empirical but physically motivated multiplicative model over the entire wavelength range, using a local aperture-summed spectrum as a proxy for the underlying wiggle-free spectrum and optionally supplementing it with an annular shell spectrum to capture local line-shape variation (Shajib, 17 Jul 2025).

The wiggle model is parameterized as a sinusoidal chirp,

$$W(\lambda)=1+A(\lambda)\left[\sin\phi(\lambda)+a_1\sin^2\phi(\lambda)+a_2\sin(3\phi(\lambda))\right],$$

with

$\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$

The observed spaxel spectrum is modeled as

$M(\lambda)=W(\lambda)\,T(\lambda),$

where the template is

$$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$

Here $C(\lambda)$ is a circular-aperture-summed spectrum, $S(\lambda)$ is an optional shell or annulus spectrum, and the power-law plus polynomial terms absorb continuum mismatches between the target spaxel and its local environment. The wavelength-dependent amplitude $A(\lambda)$ and wavenumber $k(\lambda)$ are represented with B-splines, with user-adjustable knot counts selected using either the Bayesian information criterion or $\chi^2_{\rm MAP}$. Fitting minimizes

$\chi^2=\sum_i \frac{(D_i-M_i)^2}{\sigma_i^2},$

and supports masking, sigma-clipping, or false discovery rate outlier rejection following Benjamini and Hochberg (1995).

Operationally, the workflow begins from a standard JWST-reduced NIRSpec datacube, constructs per-spaxel aperture and optional shell spectra, fits the full multiplicative model, evaluates a user-defined wiggle detection threshold, and applies the correction only where the wiggle signal is significant. The package propagates associated uncertainties through the cleaning step. Its limitations are those typical of empirical correction: performance depends on the local template being representative, on scientifically sensible choices of aperture and shell geometry, and on the wiggle pattern being sufficiently coherent to constrain. The paper emphasizes visual validation and notes that the method has already been used in published science applications, including robust stellar-kinematic measurements.

2. Cryptography: the Raccoon attack and its microarchitectural realization

In cryptography, Raccoon denotes an attack pattern against Diffie–Hellman key exchange that exploits leakage induced by leading-zero handling of the shared secret. As summarized in subsequent work, the original attack targets TLS 1.2 and below, where standards “dictate stripping leading zero bytes from the shared DH key.” If the shared secret begins with one or more zero bytes, the implementation processes a shorter big-endian value, and this specification-level normalization induces measurable timing differences in downstream components such as hash-function compression routines. Repeated chosen-input queries can then turn this tiny predicate—essentially whether the secret is “short”—into a hidden-number/lattice problem whose solution yields the target secret (Aldaya et al., 2021).

The 2021 HyperDegrade work revisits Raccoon by grounding it in a concrete microarchitectural side channel and demonstrating an end-to-end attack with real traces and real protocol messages. Its concrete exploit is not against TLS itself, but against OpenSSL 1.1.1h’s DH shared-key derivation code as invoked by cms and smime, thereby extending the attack pattern to PKCS #7 / CMS-style encrypted content. The leakage source is a branch on whether the DH shared secret must be padded back to the byte length of the modulus; the attacker monitors the cache line around the memmove call used in the padding path, so the attack becomes a branch-or-no-branch oracle indicating whether the shared secret has at least eight leading zero bits. To amplify the extremely small timing difference, the paper introduces HyperDegrade, which degrades the victim from the sibling SMT core by repeatedly flushing a shared instruction-cache line. In the reported microbenchmark, L1-icache-load-misses rise from $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$0 with no degradation to $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$1 under Hyper; cycles rise from $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$2 to $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$3; and machine_clears.smc rise from $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$4 to $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$5. For the CMS/OpenSSL instantiation, the best parameter sets require $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$6 traces with no degradation, $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$7 with classical Degrade, and $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$8 with Hyper. The lattice phase uses a Nguyen–Shparlinski construction with BKZ block size $\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.$9, weight effectively set to $M(\lambda)=W(\lambda)\,T(\lambda),$0, and dimension $M(\lambda)=W(\lambda)\,T(\lambda),$1, corresponding to $M(\lambda)=W(\lambda)\,T(\lambda),$2 useful leakage samples. In the real-data experiment, $M(\lambda)=W(\lambda)\,T(\lambda),$3 traces were collected with Hyper, majority voting reduced initial false positives, and the first of $M(\lambda)=W(\lambda)\,T(\lambda),$4 lattice instances recovered the target session key in one hour and five minutes. The paper also gives the defense: OpenSSL was patched so that dh->meth->compute_key always returns a fixed-length array in constant time, removing the leaky padding path; the fix was merged in OpenSSL 1.1.1j.

This line of work also clarifies scope and limits. The demonstrated attack assumes co-location on the sibling logical core, shared library pages for Flush+Reload, repeated chosen-ciphertext decryptions, and legacy 1024/160-bit RFC 5114 DH parameters. The authors explicitly note that $M(\lambda)=W(\lambda)\,T(\lambda),$5-bit DH remains out of reach with the available leakage.

3. Human–computer interaction: the raccoon avatar as a mid-human-likeness case

In avatar research, the raccoon avatar is treated as a central intermediate case between highly human-like and highly abstract visual self-representations. A 2025 study on emotion perception and emotion elicitation used the raccoon in a preliminary three-avatar design—human, raccoon, banana—and then in a five-avatar follow-up—human, pig, raccoon, shark, banana. Throughout, the emotion set was Ekman’s six basic emotions: anger, disgust, fear, happiness, sadness, and surprise. The raccoon was selected because it was available in Animaze by Facerig, represented a midpoint in human-likeness, preserved relatively rich facial features while remaining clearly nonhuman, and was recognizable in social-media and streaming contexts. The paper describes it as having a characteristic hairy back, relatively rich facial features, and hair that makes the eyebrows harder to recognize (Zhang et al., 3 Aug 2025).

The paper quantifies the raccoon’s human-likeness with the ABOT human-likeness estimator. Its score is 48.07, with Body-Manipulators = 0.2, Surface-Look = 0.43, and Facial Features = 1. In the preliminary comparison, human scored 74.56, raccoon 48.07, and banana 9.03; in the follow-up, pig scored 65.96, raccoon 48.07, shark 37.26, and banana 9.03. The preliminary study analyzed 4 raters after one exclusion, while the follow-up used 11 new participants with mean age 26.64 and standard deviation 3.497. Stimuli were generated by transferring prerecorded acted expressions from the YouTube channel “Science of People” onto the avatars; source clips lasted 1–2 seconds, were replayed 6–8 times, and final avatar videos lasted 8 to 12 seconds. Participants completed both an emotion perception task and an emotion elicitation task.

The raccoon is reported as the strongest performer in the preliminary study. The paper explicitly states that participants had substantial agreement with the raccoon avatar, with Fleiss’ kappa $M(\lambda)=W(\lambda)\,T(\lambda),$6, while also containing an internally inconsistent statement that all Fleiss’ kappa values were below $M(\lambda)=W(\lambda)\,T(\lambda),$7. In the same preliminary analysis, surprise expressed by the raccoon and human avatars was said to be perfectly recognized. In the follow-up study, repeated-measures ANOVA yielded a main effect of avatar,

$M(\lambda)=W(\lambda)\,T(\lambda),$8

and an emotion-by-avatar interaction,

$M(\lambda)=W(\lambda)\,T(\lambda),$9

For perception confidence, the raccoon was judged significantly more confidently than banana ($$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$0), pig ($$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$1), and shark ($$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$2); differences between human and the other avatars did not reach significance, with all $$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$3.

The main interpretive result is that higher human-likeness did not linearly improve emotion communication. The raccoon repeatedly showed a positive elicitation bias: it tended to shift nominally negative displayed expressions toward more positive felt responses, with disgust often eliciting happiness or surprise, and the raccoon and shark generally eliciting more happiness than the other avatars. The authors attribute this partly to cuteness and partly to natural facial status, contrasting the raccoon with the pig, which was interpreted as having a naturally sad face. The discussion relates the raccoon’s performance to Uncanny Valley reasoning: the raccoon is sufficiently structured for emotional expressivity while sufficiently nonhuman to avoid the discomfort associated with an imperfectly human avatar. A plausible implication is that raccoon-like avatars may be advantageous in settings such as counseling, business communication, and privacy-preserving online interaction when warmth and approachability are valued more than exact transmission of aversive affect.

4. Wildlife disease modeling: raccoon rabies as a spatio-temporal invasion process

In applied spatio-temporal statistics, raccoons appear as the host species in a case study on raccoon rabies spread in Connecticut, USA. The data, originating from Smith et al. (2002) and gridded following Hooten and Wikle (2010), record when the first occurrence of rabies was discovered in the different counties of Connecticut. In the gridded representation used for modeling, the state is represented by 109 regularly gridded cells approximating the counties, observed over 48 months. The authors fit their model on the first 30 time steps and forecast the next step, treating each cell–time observation as binary presence or absence of rabies (Grieshop et al., 2023).

The methodological framework is a Bayesian ensemble echo state network-enhanced stochastic cellular automaton for binary spatio-temporal data. The observation model is

$$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$4

and the full model uses a logistic link with latent ESN augmentation,

$$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$5

For the raccoon application, the principal CA-style input is the number of counties in a queen’s neighborhood with recorded rabies, representing local infection pressure. Additional covariates indicate whether a cell bordered the ocean, was directly east or west of the Connecticut River, or was not on the river. The ESN hidden state follows the standard reservoir recursion

$$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$6

with sparse random $$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$7 and $$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$8, while the ESN output matrix $$T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.$$9 is given a regularized horseshoe prior to shrink many reservoir-output coefficients toward zero while allowing a smaller subset to remain important. Rather than selecting a single reservoir realization, the authors fit an ensemble $C(\lambda)$0 and combine predictive probabilities using constrained weights that minimize Bernoulli log-loss.

The paper’s clearest raccoon-specific scientific result concerns the role of rivers. After combining posterior draws across the weighted ensemble, the coefficient for the indicator that a county was not bordering the river was reported as significant at the 95% level and negative. Under the model’s coding, this is interpreted to mean that if a county is bordering the river, the probability of rabies presence is decreased, equivalently that the rate of rabies spread decreases in the presence of a river. This aligns with prior work finding that rivers slow rabies propagation. The paper also presents maps of observed spread, mean transition probabilities, and 95% highest posterior density bounds for the forecast.

At the same time, the raccoon application is methodologically illustrative rather than exhaustively benchmarked. The paper does not provide a raccoon-specific Brier score, nor a comparative score table against simpler logistic-only or ESN-only baselines. Its strongest support for the approach is therefore qualitative forecasting plus recovery of a biologically meaningful river effect, rather than a detailed predictive-metric comparison.

5. Generative modeling: RACCOON for text-to-video diffusion

In generative modeling, RACCOON is a text-to-video diffusion framework coupled to a curated video–text corpus, CFC-VIDS-1M. The system is motivated by two stated bottlenecks in text-to-video generation: poor training data quality and the high computational cost of jointly learning semantics, spatial detail, and temporal dynamics. RACCOON addresses both by combining a coarse-to-fine curation pipeline with a transformer-based architecture trained through a four-stage progressive strategy (Tan et al., 28 Feb 2025).

The dataset pipeline begins from HD-VILA, described as containing 3.8M high-resolution videos, which are segmented into 108M video clips using PySceneDetect to isolate single-scene shots. Coarse curation evaluates each clip along five axes: LAION Aesthetics for visual quality, PP-OCR for text overlay detection, CLIP cosine similarity between initial and final frames for temporal consistency, RAFT optical flow for motion quality, and a CLIP-based categorization system for balancing category distribution. The final curated dataset contains 14 categories and, after fine-grained curation, 1M video–text pairs with 10.6s average duration, 89.3 words average text length, and 720p resolution. Fine curation uses ViLA to generate detailed captions and LLAMA to filter captions that indicate scene transitions, degenerate into frame-wise image-caption lists, or end with repetitive phrases. Relative to Panda-70M, the paper reports VN/DN = 20.3\% versus 16.1\%, VV/DV = 41.1\% versus 19.2\%, 22.5 average nouns per video versus 4.3, and 15.9 average verbs per video versus 1.9.

The model itself is a latent diffusion transformer built on a 3D Causal VAE. An input video

$C(\lambda)$1

is encoded to a latent

$C(\lambda)$2

with spatial and temporal compression factors

$C(\lambda)$3

A key design choice is that the first frame is encoded independently, which the paper says creates a unified latent space bridging image and video domains. The transformer uses decoupled spatial-temporal attention: spatial attention operates within each frame on tokens of dimension $C(\lambda)$4, while temporal attention is introduced progressively, beginning at window size $C(\lambda)$5 and growing toward $C(\lambda)$6. The training curriculum has four stages: semantic learning from text-to-image tasks, temporal learning at $C(\lambda)$7, resolution and duration enhancement with larger local 3D windows where $C(\lambda)$8, and quality refinement on a stricter subset of 50K videos and 100K images filtered by aesthetic thresholds of video aesthetic score $C(\lambda)$9 and image aesthetic score $S(\lambda)$0. The optimizer is AdamW, the learning rate is constant at $S(\lambda)$1, data augmentation is limited to horizontal flipping, and reported results use an EMA model with decay 0.9999.

Empirically, the paper argues that data curation and staged training both matter. In ablations, Stage 2 only at $S(\lambda)$2 yields FVD 267, whereas Stage 1 + Stage 2 yields FVD 144; at $S(\lambda)$3, Stage 3 only yields 478, while Stage 1 + Stage 2 + Stage 3 yields 313. On UCF-101, RACCOON at $S(\lambda)$4 reports FVD 437, compared with 463 for Latte and 1274 for OpenSora v1.2. At $S(\lambda)$5, the paper reports 469 for RACCOON, 1B, 1M curated, 705 for RACCOON, 1B, 1.5M uncurated, 435 for RACCOON, 1B, 4M curated, and 412 for RACCOON, 3B, 4M curated, while OpenSora v1.2 is reported at 1355. The paper interprets these results as evidence that curated data substantially outperforms larger uncurated data and that curriculum-style progressive training improves convergence and final quality.

6. LLM security: Raccoon as a prompt extraction benchmark

In LLM security, Raccoon is a benchmark for evaluating the susceptibility of LLM-integrated applications to prompt extraction attacks, i.e., attacks that induce a model to reveal its hidden system or instruction prompt. The benchmark is designed to compare models in both defenseless and defended settings, using 14 categories of singular attacks, 10 compound attacks, 14 defense templates, 197 real instruction prompts collected from deployed GPT-like applications, and evaluation on 7 major LLMs. Its central empirical conclusion is that without defenses, all tested models are vulnerable to prompt theft, while with defenses some models—especially GPT-4-1106—become substantially more robust (Wang et al., 2024).

The attack taxonomy includes categories such as Context Ignoring, Prefix Injection, Distractor Instructions, Special Case, Payload Splitting, Obfuscation, and Translation. Each category contains three representative attacks, yielding 42 singular attacks in total. Compound attacks combine two categories and are intended to mimic attackers who iteratively refine prompts. The instruction prompt set was built by scraping over 48k GPTs, uniformly subsampling 200, and successfully recovering 197 instruction prompts. The benchmark’s evaluation metric is Attack Success Rate,

$S(\lambda)$6

where success is determined by ROUGE-L recall against the true hidden prompt, using threshold

$S(\lambda)$7

Model-level aggregation uses three variants of ModelSusceptibility, including a worst-case maximum, an average of the best attack per category, and the fraction of “working” categories with success rate above $S(\lambda)$8.

The main quantitative table shows severe worst-case vulnerability in the absence of defenses. In the defenseless singular setting, GPT-4-1106 has max 0.99, avg 0.54, WA 0.53; Llama-2-70b-chat has max 0.95, avg 0.70, WA 0.87; and Mixtral-8X7B-v0.1 has max 0.94, avg 0.62, WA 0.73. Compound attacks are likewise effective: in the defenseless compound setting, GPT-4-1106 has max 0.96 and avg 0.66. Under defenses, model behavior diverges sharply by family. GPT-4-1106 drops to singular max 0.03, singular avg 0.01, compound max 0.05, compound avg 0.01, and WA 0.00 in both defended settings, whereas Llama-2-70b-chat remains at defended singular max 0.90 and avg 0.57. The paper highlights Prefix Injection and Distractor Instructions as especially strong attacks across models. It also reports that longer defense templates improve robustness more than shorter ones, and that compound attacks become particularly useful when defenses are present.

A notable conceptual result is the reported linear correlation between model capability, measured using AlpacaEval 2.0, and prompt extraction susceptibility. The paper interprets this as evidence that stronger instruction-following can increase prompt-theft risk unless accompanied by stronger alignment. Its stated practical implication is that developers should not treat hidden prompts as secure secrets by default, should avoid embedding sensitive data in prompts unless necessary, and should expect defenses based on prompt text alone to be incomplete.