---
title: 'Raccoon: Diverse Research Applications'
url: https://www.emergentmind.com/topics/raccoon
type: topic
---

# Raccoon: Diverse Research Applications

In contemporary research literature, **“raccoon”** is a markedly polysemous term. It names domain-specific software and benchmarks, denotes an established cryptographic attack family, and appears as a substantive object of study in both avatar-mediated HCI and wildlife disease modeling. Recent work uses the term for a JWST/NIRSpec IFU spectral-cleaning package, a text-to-video diffusion framework with curated training data, and a benchmark for prompt extraction against LLM-integrated applications; separately, the **Raccoon attack** refers to Diffie–Hellman shared-secret length leakage, while **raccoon** also designates an animal avatar in emotion-perception experiments and the host species in a Connecticut rabies spread case study [2507.13341] [2502.21314] [2406.06737] [2101.01077] [2508.01743] [2306.04696].

## 1. Astronomical data reduction: `raccoon` for JWST/NIRSpec IFU wiggle removal

In astronomy, `raccoon` is a Python package for removing **resampling noise**, commonly called **“wiggles,”** from spaxel-level spectra in JWST NIRSpec integral field spectroscopy datacubes. The artifact arises when 2D detector data are resampled into 3D cubes while the NIRSpec point spread function is undersampled; the standard JWST pipeline does not correct this effect, even though it can distort spectral shape, bias line measurements, and compromise kinematic analyses at single-spaxel resolution. The package addresses this by fitting an empirical but physically motivated multiplicative model over the **entire wavelength range**, using a local aperture-summed spectrum as a proxy for the underlying wiggle-free spectrum and optionally supplementing it with an annular shell spectrum to capture local line-shape variation [2507.13341].

The wiggle model is parameterized as a sinusoidal chirp,
$$
W(\lambda)=1+A(\lambda)\left[\sin\phi(\lambda)+a_1\sin^2\phi(\lambda)+a_2\sin(3\phi(\lambda))\right],
$$
with
$$
\phi(\lambda)=\lambda\,k(\lambda)+\phi_0.
$$
The observed spaxel spectrum is modeled as
$$
M(\lambda)=W(\lambda)\,T(\lambda),
$$
where the template is
$$
T(\lambda)=c_1C(\lambda)+c_2S(\lambda)+c_3\lambda^b+\sum_{n=0}^{N}p_n\lambda^n.
$$
Here \(C(\lambda)\) is a circular-aperture-summed spectrum, \(S(\lambda)\) is an optional shell or annulus spectrum, and the power-law plus polynomial terms absorb continuum mismatches between the target spaxel and its local environment. The wavelength-dependent amplitude \(A(\lambda)\) and wavenumber \(k(\lambda)\) are represented with B-splines, with user-adjustable knot counts selected using either the Bayesian information criterion or \(\chi^2_{\rm MAP}\). Fitting minimizes
$$
\chi^2=\sum_i \frac{(D_i-M_i)^2}{\sigma_i^2},
$$
and supports masking, sigma-clipping, or false discovery rate outlier rejection following Benjamini and Hochberg (1995).

Operationally, the workflow begins from a standard JWST-reduced NIRSpec datacube, constructs per-spaxel aperture and optional shell spectra, fits the full multiplicative model, evaluates a user-defined wiggle detection threshold, and applies the correction only where the wiggle signal is significant. The package propagates associated uncertainties through the cleaning step. Its limitations are those typical of empirical correction: performance depends on the local template being representative, on scientifically sensible choices of aperture and shell geometry, and on the wiggle pattern being sufficiently coherent to constrain. The paper emphasizes visual validation and notes that the method has already been used in published science applications, including robust stellar-kinematic measurements.

## 2. Cryptography: the Raccoon attack and its microarchitectural realization

In cryptography, **Raccoon** denotes an attack pattern against Diffie–Hellman key exchange that exploits leakage induced by **leading-zero handling** of the shared secret. As summarized in subsequent work, the original attack targets TLS 1.2 and below, where standards “dictate stripping leading zero bytes from the shared DH key.” If the shared secret begins with one or more zero bytes, the implementation processes a shorter big-endian value, and this specification-level normalization induces measurable timing differences in downstream components such as hash-function compression routines. Repeated chosen-input queries can then turn this tiny predicate—essentially whether the secret is “short”—into a hidden-number/lattice problem whose solution yields the target secret [2101.01077].

The 2021 HyperDegrade work revisits Raccoon by grounding it in a concrete microarchitectural side channel and demonstrating an **end-to-end** attack with real traces and real protocol messages. Its concrete exploit is not against TLS itself, but against OpenSSL 1.1.1h’s DH shared-key derivation code as invoked by `cms` and `smime`, thereby extending the attack pattern to **PKCS #7 / CMS-style encrypted content**. The leakage source is a branch on whether the DH shared secret must be padded back to the byte length of the modulus; the attacker monitors the cache line around the `memmove` call used in the padding path, so the attack becomes a branch-or-no-branch oracle indicating whether the shared secret has at least eight leading zero bits. To amplify the extremely small timing difference, the paper introduces **HyperDegrade**, which degrades the victim from the sibling SMT core by repeatedly flushing a shared instruction-cache line. In the reported microbenchmark, `L1-icache-load-misses` rise from \(4{,}115\) with no degradation to \(992{,}074\) under Hyper; `cycles` rise from \(1{,}252{,}211\) to \(504{,}395{,}314\); and `machine_clears.smc` rise from \(<1\) to \(983{,}348\). For the CMS/OpenSSL instantiation, the best parameter sets require \(651{,}510\) traces with no degradation, \(181{,}189\) with classical Degrade, and \(53{,}721\) with Hyper. The lattice phase uses a Nguyen–Shparlinski construction with BKZ block size \(\beta=60\), weight effectively set to \(W=2^{\ell+1}\), and dimension \(d=173\), corresponding to \(173\) useful leakage samples. In the real-data experiment, \(60{,}000\) traces were collected with Hyper, majority voting reduced initial false positives, and the first of \(24\) lattice instances recovered the target session key in **one hour and five minutes**. The paper also gives the defense: OpenSSL was patched so that `dh->meth->compute_key` always returns a fixed-length array in constant time, removing the leaky padding path; the fix was merged in **OpenSSL 1.1.1j**.

This line of work also clarifies scope and limits. The demonstrated attack assumes co-location on the sibling logical core, shared library pages for Flush+Reload, repeated chosen-ciphertext decryptions, and legacy **1024/160-bit RFC 5114** DH parameters. The authors explicitly note that \(2048/256\)-bit DH remains out of reach with the available leakage.

## 3. Human–computer interaction: the raccoon avatar as a mid-human-likeness case

In avatar research, the **raccoon avatar** is treated as a central intermediate case between highly human-like and highly abstract visual self-representations. A 2025 study on emotion perception and emotion elicitation used the raccoon in a preliminary three-avatar design—human, raccoon, banana—and then in a five-avatar follow-up—human, pig, raccoon, shark, banana. Throughout, the emotion set was **Ekman’s six basic emotions**: anger, disgust, fear, happiness, sadness, and surprise. The raccoon was selected because it was available in **Animaze by Facerig**, represented a midpoint in human-likeness, preserved relatively rich facial features while remaining clearly nonhuman, and was recognizable in social-media and streaming contexts. The paper describes it as having a characteristic **hairy back**, relatively rich facial features, and hair that makes the eyebrows harder to recognize [2508.01743].

The paper quantifies the raccoon’s human-likeness with the **ABOT human-likeness estimator**. Its score is **48.07**, with **Body-Manipulators = 0.2**, **Surface-Look = 0.43**, and **Facial Features = 1**. In the preliminary comparison, human scored **74.56**, raccoon **48.07**, and banana **9.03**; in the follow-up, pig scored **65.96**, raccoon **48.07**, shark **37.26**, and banana **9.03**. The preliminary study analyzed **4 raters** after one exclusion, while the follow-up used **11 new participants** with mean age **26.64** and standard deviation **3.497**. Stimuli were generated by transferring prerecorded acted expressions from the YouTube channel **“Science of People”** onto the avatars; source clips lasted **1–2 seconds**, were replayed **6–8** times, and final avatar videos lasted **8 to 12 seconds**. Participants completed both an **emotion perception** task and an **emotion elicitation** task.

The raccoon is reported as the strongest performer in the preliminary study. The paper explicitly states that participants had substantial agreement with the raccoon avatar, with **Fleiss’ kappa \(=0.81\)**, while also containing an internally inconsistent statement that all Fleiss’ kappa values were below \(0.4\). In the same preliminary analysis, **surprise** expressed by the raccoon and human avatars was said to be **perfectly recognized**. In the follow-up study, repeated-measures ANOVA yielded a main effect of avatar,
$$
F(8,78)=2.616,\; p=.014,\; \Lambda=0.622,\; \eta_p^2=.21,
$$
and an emotion-by-avatar interaction,
$$
F(40,398)=2.727,\; p<.001,\; \Lambda=0.616,\; \eta_p^2=.22.
$$
For perception confidence, the raccoon was judged significantly more confidently than **banana** (\(p=.013\)), **pig** (\(p=.011\)), and **shark** (\(p=.028\)); differences between human and the other avatars did not reach significance, with all \(p>.082\).

The main interpretive result is that higher human-likeness did **not** linearly improve emotion communication. The raccoon repeatedly showed a **positive elicitation bias**: it tended to shift nominally negative displayed expressions toward more positive felt responses, with disgust often eliciting **happiness** or **surprise**, and the raccoon and shark generally eliciting more **happiness** than the other avatars. The authors attribute this partly to **cuteness** and partly to **natural facial status**, contrasting the raccoon with the pig, which was interpreted as having a naturally sad face. The discussion relates the raccoon’s performance to **Uncanny Valley** reasoning: the raccoon is sufficiently structured for emotional expressivity while sufficiently nonhuman to avoid the discomfort associated with an imperfectly human avatar. A plausible implication is that raccoon-like avatars may be advantageous in settings such as counseling, business communication, and privacy-preserving online interaction when warmth and approachability are valued more than exact transmission of aversive affect.

## 4. Wildlife disease modeling: raccoon rabies as a spatio-temporal invasion process

In applied spatio-temporal statistics, raccoons appear as the host species in a case study on **raccoon rabies spread in Connecticut, USA**. The data, originating from Smith et al. (2002) and gridded following Hooten and Wikle (2010), record **when the first occurrence of rabies was discovered in the different counties of Connecticut**. In the gridded representation used for modeling, the state is represented by **109 regularly gridded cells approximating the counties**, observed over **48 months**. The authors fit their model on the **first 30 time steps** and forecast the next step, treating each cell–time observation as binary presence or absence of rabies [2306.04696].

The methodological framework is a **Bayesian ensemble echo state network-enhanced stochastic cellular automaton** for binary spatio-temporal data. The observation model is
$$
y_{it}\mid p_{it}\sim indep.\; Bern(p_{it}),
$$
and the full model uses a logistic link with latent ESN augmentation,
$$
\logit(\mathbf p_t)=\alpha+\mathbf X_t\beta+\mathbf V\mathbf h_t.
$$
For the raccoon application, the principal CA-style input is the **number of counties in a queen’s neighborhood with recorded rabies**, representing local infection pressure. Additional covariates indicate whether a cell bordered the ocean, was directly east or west of the Connecticut River, or was **not on the river**. The ESN hidden state follows the standard reservoir recursion
$$
\mathbf h_t=g_h\bigg(\frac{\nu}{|\lambda_w|}\mathbf W\mathbf h_{t-1}+\mathbf U\mathbf z_t\bigg),
$$
with sparse random \(\mathbf W\) and \(\mathbf U\), while the ESN output matrix \(\mathbf V\) is given a **regularized horseshoe prior** to shrink many reservoir-output coefficients toward zero while allowing a smaller subset to remain important. Rather than selecting a single reservoir realization, the authors fit an **ensemble** \(H^{(1)},\ldots,H^{(K)}\) and combine predictive probabilities using constrained weights that minimize Bernoulli log-loss.

The paper’s clearest raccoon-specific scientific result concerns the role of rivers. After combining posterior draws across the weighted ensemble, the coefficient for the indicator that a county was **not bordering the river** was reported as **significant at the 95% level and negative**. Under the model’s coding, this is interpreted to mean that **if a county is bordering the river, the probability of rabies presence is decreased**, equivalently that **the rate of rabies spread decreases in the presence of a river**. This aligns with prior work finding that rivers slow rabies propagation. The paper also presents maps of observed spread, mean transition probabilities, and 95% highest posterior density bounds for the forecast.

At the same time, the raccoon application is methodologically illustrative rather than exhaustively benchmarked. The paper does **not** provide a raccoon-specific Brier score, nor a comparative score table against simpler logistic-only or ESN-only baselines. Its strongest support for the approach is therefore qualitative forecasting plus recovery of a biologically meaningful river effect, rather than a detailed predictive-metric comparison.

## 5. Generative modeling: RACCOON for text-to-video diffusion

In generative modeling, **RACCOON** is a text-to-video diffusion framework coupled to a curated video–text corpus, **CFC-VIDS-1M**. The system is motivated by two stated bottlenecks in text-to-video generation: poor training data quality and the high computational cost of jointly learning semantics, spatial detail, and temporal dynamics. RACCOON addresses both by combining a **coarse-to-fine curation pipeline** with a **transformer-based architecture** trained through a **four-stage progressive strategy** [2502.21314].

The dataset pipeline begins from **HD-VILA**, described as containing **3.8M high-resolution videos**, which are segmented into **108M video clips** using **PySceneDetect** to isolate single-scene shots. Coarse curation evaluates each clip along five axes: **LAION Aesthetics** for visual quality, **PP-OCR** for text overlay detection, **CLIP** cosine similarity between initial and final frames for temporal consistency, **RAFT** optical flow for motion quality, and a **CLIP-based categorization system** for balancing category distribution. The final curated dataset contains **14 categories** and, after fine-grained curation, **1M** video–text pairs with **10.6s** average duration, **89.3 words** average text length, and **720p** resolution. Fine curation uses **ViLA** to generate detailed captions and **LLAMA** to filter captions that indicate scene transitions, degenerate into frame-wise image-caption lists, or end with repetitive phrases. Relative to Panda-70M, the paper reports **VN/DN = 20.3\%** versus **16.1\%**, **VV/DV = 41.1\%** versus **19.2\%**, **22.5** average nouns per video versus **4.3**, and **15.9** average verbs per video versus **1.9**.

The model itself is a latent diffusion transformer built on a **3D Causal VAE**. An input video
$$
x\in\mathbb{R}^{(1+T)\times H\times W\times C}
$$
is encoded to a latent
$$
z\in\mathbb{R}^{(1+t)\times h\times w\times c},
$$
with spatial and temporal compression factors
$$
f_s=H/h=W/w,\qquad f_t=T/t.
$$
A key design choice is that the **first frame is encoded independently**, which the paper says creates a unified latent space bridging image and video domains. The transformer uses **decoupled spatial-temporal attention**: spatial attention operates within each frame on tokens of dimension \(1\times h_p\times w_p\), while temporal attention is introduced progressively, beginning at window size \((t\times 1\times 1)\) and growing toward \((t\times h_p\times w_p)\). The training curriculum has four stages: **semantic learning** from text-to-image tasks, **temporal learning** at \(256\times256\), **resolution and duration enhancement** with larger local 3D windows where \(h_w=w_w=8\), and **quality refinement** on a stricter subset of **50K videos** and **100K images** filtered by aesthetic thresholds of **video aesthetic score \(>5.5\)** and **image aesthetic score \(>7.0\)**. The optimizer is **AdamW**, the learning rate is constant at \(2\times10^{-4}\), data augmentation is limited to horizontal flipping, and reported results use an EMA model with decay **0.9999**.

Empirically, the paper argues that data curation and staged training both matter. In ablations, **Stage 2 only** at \(256\times256\times17\) yields **FVD 267**, whereas **Stage 1 + Stage 2** yields **FVD 144**; at \(512\times512\times33\), **Stage 3 only** yields **478**, while **Stage 1 + Stage 2 + Stage 3** yields **313**. On UCF-101, RACCOON at \(512\times512\times17\) reports **FVD 437**, compared with **463** for Latte and **1274** for OpenSora v1.2. At \(512\times512\times33\), the paper reports **469** for **RACCOON, 1B, 1M curated**, **705** for **RACCOON, 1B, 1.5M uncurated**, **435** for **RACCOON, 1B, 4M curated**, and **412** for **RACCOON, 3B, 4M curated**, while OpenSora v1.2 is reported at **1355**. The paper interprets these results as evidence that **curated data substantially outperforms larger uncurated data** and that curriculum-style progressive training improves convergence and final quality.

## 6. LLM security: Raccoon as a prompt extraction benchmark

In LLM security, **Raccoon** is a benchmark for evaluating the susceptibility of **LLM-integrated applications** to **prompt extraction attacks**, i.e., attacks that induce a model to reveal its hidden system or instruction prompt. The benchmark is designed to compare models in both **defenseless** and **defended** settings, using **14 categories of singular attacks**, **10 compound attacks**, **14 defense templates**, **197 real instruction prompts** collected from deployed GPT-like applications, and evaluation on **7 major LLMs**. Its central empirical conclusion is that **without defenses, all tested models are vulnerable to prompt theft**, while with defenses some models—especially **GPT-4-1106**—become substantially more robust [2406.06737].

The attack taxonomy includes categories such as **Context Ignoring**, **Prefix Injection**, **Distractor Instructions**, **Special Case**, **Payload Splitting**, **Obfuscation**, and **Translation**. Each category contains three representative attacks, yielding **42 singular attacks** in total. Compound attacks combine two categories and are intended to mimic attackers who iteratively refine prompts. The instruction prompt set was built by scraping over **48k GPTs**, uniformly subsampling **200**, and successfully recovering **197** instruction prompts. The benchmark’s evaluation metric is **Attack Success Rate**,
$$
\text{ASR}(M,a,\text{dt})=\frac{1}{|D|}\sum_{d_i\in D}\text{Eval}(d_i,f_M(\text{Combine}(d_i,\text{dt}),a)),
$$
where success is determined by **ROUGE-L recall** against the true hidden prompt, using threshold
$$
\text{thresh}=0.8.
$$
Model-level aggregation uses three variants of **ModelSusceptibility**, including a worst-case maximum, an average of the best attack per category, and the fraction of “working” categories with success rate above \(k=0.5\).

The main quantitative table shows severe worst-case vulnerability in the absence of defenses. In the **defenseless singular** setting, **GPT-4-1106** has **max 0.99**, **avg 0.54**, **WA 0.53**; **Llama-2-70b-chat** has **max 0.95**, **avg 0.70**, **WA 0.87**; and **Mixtral-8X7B-v0.1** has **max 0.94**, **avg 0.62**, **WA 0.73**. Compound attacks are likewise effective: in the **defenseless compound** setting, GPT-4-1106 has **max 0.96** and **avg 0.66**. Under defenses, model behavior diverges sharply by family. **GPT-4-1106** drops to **singular max 0.03**, **singular avg 0.01**, **compound max 0.05**, **compound avg 0.01**, and **WA 0.00** in both defended settings, whereas **Llama-2-70b-chat** remains at **defended singular max 0.90** and **avg 0.57**. The paper highlights **Prefix Injection** and **Distractor Instructions** as especially strong attacks across models. It also reports that **longer defense templates** improve robustness more than shorter ones, and that **compound attacks** become particularly useful when defenses are present.

A notable conceptual result is the reported **linear correlation** between model capability, measured using **AlpacaEval 2.0**, and prompt extraction susceptibility. The paper interprets this as evidence that stronger instruction-following can increase prompt-theft risk unless accompanied by stronger alignment. Its stated practical implication is that developers should not treat hidden prompts as secure secrets by default, should avoid embedding sensitive data in prompts unless necessary, and should expect defenses based on prompt text alone to be incomplete.

Source: https://www.emergentmind.com/topics/raccoon