CCS Author Response
Use this after CCS reviews are released. Reopen the current HotCRP rebuttal instructions and
any length or format limits before drafting, because response mechanics are set per cycle.
Triage
- Answer concerns that affect the decision: threat-model soundness, novelty, correctness,
evidence quality, ethics, and disclosure. Skip cosmetic complaints unless space allows.
- Use evidence already in the submission: sections, appendices, measurement tables, and the
ethics section. The rebuttal clarifies the submitted paper; it does not add a new paper.
- Keep the reply anonymous. Do not reveal institution, authorship, private URLs, or the
identity of a disclosed vendor if that would deanonymize you.
- Correct factual misreadings first, then address the strongest objection to the attacker
model or the adaptive evaluation.
- Do not promise experiments you cannot run before camera-ready; promise only edits that add
no unsupported claim.
Drafting pattern
- State the decision-critical correction or concession in the first line.
- Point to exact submitted evidence (section, figure, appendix).
- Explain the security consequence — why the attack still holds, or the defense still binds.
- Offer a scoped camera-ready edit only where it clarifies without over-claiming.
Adversarial reviewer pushback patterns
| Pushback |
What it signals |
CCS-ready fix |
| "The attacker assumes too much" |
The threat model looks unrealistic |
Point to where the capability is justified, or scope the claim to the realistic subset and concede the rest |
| "You never tested an adaptive attacker" |
The defense evaluation looks incomplete |
Reference the adaptive experiment if present; if absent, concede and commit to a bounded camera-ready addition only if honestly feasible |
| "This is already a known CVE" |
A prior-art gap |
Distinguish root cause, scope, or impact from the CVE, with the specific technical delta |
| "The ethics of this are unaddressed" |
Disclosure or harm concern |
State the disclosure timeline, the harm-minimization steps, and the reasoning, quoting the ethics section |
Response micro-example
Reviewer objection: the key-recovery attack assumes co-located measurement that real
attackers cannot achieve. Reply skeleton:
- Concede the strongest form needs co-location; scope the practical claim to that setting.
- Point to Section 6 where a remote variant with degraded rate is already measured.
- Note the defense in Section 7 blocks both variants, so the contribution stands.
- Offer one camera-ready sentence making the co-location assumption explicit in the intro.
Rebuttal calibration
- One decision-critical point per reviewer beats an exhaustive rebuttal; CCS meta-reviewers
read for whether the central threat-model or ethics objection was actually resolved.
- Never paste new experimental results the reviewers cannot verify; describe what exists and
anchor it in the submission.
- Answer the ethics reviewer directly and early; an unaddressed disclosure concern outweighs
resolved technical nits at decision time.
Output format
[Priority issue] <reviewer concern>
[Decision dimension] threat model / novelty / correctness / evidence / ethics
[Draft response] <CCS-ready anonymous text>
[Evidence anchor] <section / figure / appendix item>
[Forbidden content removed] <identity leaks, unverifiable new results, over-promises>
1---2name: ccs-author-response3description: Use when drafting an ACM CCS rebuttal during the HotCRP author-response window, covering threat-model defenses, adaptive-attack objections, ethics and disclosure questions, anonymity constraints, adversarial reviewer pushback patterns, and decision-focused replies aimed at the meta-reviewer.4---56# CCS Author Response78Use this after CCS reviews are released. Reopen the current HotCRP rebuttal instructions and9any length or format limits before drafting, because response mechanics are set per cycle.1011## Triage1213- Answer concerns that affect the decision: threat-model soundness, novelty, correctness,14 evidence quality, ethics, and disclosure. Skip cosmetic complaints unless space allows.15- Use evidence already in the submission: sections, appendices, measurement tables, and the16 ethics section. The rebuttal clarifies the submitted paper; it does not add a new paper.17- Keep the reply anonymous. Do not reveal institution, authorship, private URLs, or the18 identity of a disclosed vendor if that would deanonymize you.19- Correct factual misreadings first, then address the strongest objection to the attacker20 model or the adaptive evaluation.21- Do not promise experiments you cannot run before camera-ready; promise only edits that add22 no unsupported claim.2324## Drafting pattern25261. State the decision-critical correction or concession in the first line.272. Point to exact submitted evidence (section, figure, appendix).283. Explain the security consequence — why the attack still holds, or the defense still binds.294. Offer a scoped camera-ready edit only where it clarifies without over-claiming.3031## Adversarial reviewer pushback patterns3233| Pushback | What it signals | CCS-ready fix |34|---|---|---|35| "The attacker assumes too much" | The threat model looks unrealistic | Point to where the capability is justified, or scope the claim to the realistic subset and concede the rest |36| "You never tested an adaptive attacker" | The defense evaluation looks incomplete | Reference the adaptive experiment if present; if absent, concede and commit to a bounded camera-ready addition only if honestly feasible |37| "This is already a known CVE" | A prior-art gap | Distinguish root cause, scope, or impact from the CVE, with the specific technical delta |38| "The ethics of this are unaddressed" | Disclosure or harm concern | State the disclosure timeline, the harm-minimization steps, and the reasoning, quoting the ethics section |3940## Response micro-example4142Reviewer objection: the key-recovery attack assumes co-located measurement that real43attackers cannot achieve. Reply skeleton:44451. Concede the strongest form needs co-location; scope the practical claim to that setting.462. Point to Section 6 where a remote variant with degraded rate is already measured.473. Note the defense in Section 7 blocks both variants, so the contribution stands.484. Offer one camera-ready sentence making the co-location assumption explicit in the intro.4950## Rebuttal calibration5152- One decision-critical point per reviewer beats an exhaustive rebuttal; CCS meta-reviewers53 read for whether the central threat-model or ethics objection was actually resolved.54- Never paste new experimental results the reviewers cannot verify; describe what exists and55 anchor it in the submission.56- Answer the ethics reviewer directly and early; an unaddressed disclosure concern outweighs57 resolved technical nits at decision time.5859## Output format6061```text62[Priority issue] <reviewer concern>63[Decision dimension] threat model / novelty / correctness / evidence / ethics64[Draft response] <CCS-ready anonymous text>65[Evidence anchor] <section / figure / appendix item>66[Forbidden content removed] <identity leaks, unverifiable new results, over-promises>67```
brycewang-stanford