CCS Writing Style
Use this when revising the main paper. CCS papers must state who the attacker is, what the
contribution defends or breaks, and enough measured evidence that an adversarial reviewer
cannot poke the central claim.
Revision rules
- Put the security contribution on the first page: the problem, the attacker, the gap in
existing defenses or attacks, the mechanism, and the evidence that it works.
- Make the threat model explicit and early. State attacker capabilities, knowledge, position,
and goal before results; CCS reviewers reject on hidden or shifting adversary assumptions.
- Pair every claim with proof, measurement, exploit demonstration, or a cost number. A
security claim without a bound on the adversary or a measured cost reads as marketing.
- Use the 12-page body for the core argument; move protocol transcripts, extra measurements,
and formal proofs to appendices without making the body unintelligible.
- Do not overstate exploitability beyond the conditions tested; scope every "practical" claim
to the environment, versions, and configuration measured.
- Keep double-blind wording in self-citations, tool names, acknowledgements, and artifact
descriptions.
Threat-model discipline
- Give the adversary a named model with capabilities enumerated once and referenced by name;
CCS readers audit whether every attack step stays inside those capabilities.
- Separate what the attacker knows from what it can do from where it sits in the system; a
conflated model is the most common source of "the attack assumes too much" reviews.
- State the security goal as a property (confidentiality, integrity, availability,
unlinkability) and say what "broken" means quantitatively.
- When a defense is evaluated, name the adaptive attacker it was tested against; a defense
measured only against the attack it was designed to stop is a standing CCS complaint.
- Label conjecture, heuristic argument, and proved result distinctly; mixing them near a
security claim is a credibility leak at this venue.
Sentence-level rewrites
| Draft pattern |
CCS-safe rewrite |
| "Our attack is highly effective..." |
"recovers the key in N queries against library X vY on platform Z" |
| "Under realistic assumptions..." |
"Under threat model T (network MITM, no host access)..." |
| "Our defense is secure..." |
"resists the adaptive attacker of Section 5 at C% overhead" |
| "We significantly reduce risk..." |
Claim scoped to the deployment and versions measured |
Vignette: compressing into twelve two-column pages
A draft with a full protocol description, four attack variants, a formal proof, and six
measurement figures: keep the threat model, the strongest attack variant end to end, one
proof sketch, and the two decision-critical figures (leakage rate and defense overhead);
push the other variants, the full proof, and raw measurement tables to appendices with
forward references. The test of a good cut: a reviewer should be able to judge novelty and
soundness of the attack without opening the appendix.
Output format
[Writing diagnosis] clear / under-specified threat model / overclaimed / overloaded
[First-page fix] <new framing>
[Claim discipline] <claim -> proof/measurement/exploit/cost>
[Compression cuts] <move/delete/merge>
[Anonymity edits] <phrases to rewrite>
1---2name: ccs-writing-style3description: Use when revising an ACM CCS paper for a precise threat model, calibrated attack/defense claims, 12-page ACM sigconf compression, double-blind wording, adaptive-evaluation honesty, and the security house style that survives an adversarial SIGSAC program committee.4---56# CCS Writing Style78Use this when revising the main paper. CCS papers must state who the attacker is, what the9contribution defends or breaks, and enough measured evidence that an adversarial reviewer10cannot poke the central claim.1112## Revision rules1314- Put the security contribution on the first page: the problem, the attacker, the gap in15 existing defenses or attacks, the mechanism, and the evidence that it works.16- Make the threat model explicit and early. State attacker capabilities, knowledge, position,17 and goal before results; CCS reviewers reject on hidden or shifting adversary assumptions.18- Pair every claim with proof, measurement, exploit demonstration, or a cost number. A19 security claim without a bound on the adversary or a measured cost reads as marketing.20- Use the 12-page body for the core argument; move protocol transcripts, extra measurements,21 and formal proofs to appendices without making the body unintelligible.22- Do not overstate exploitability beyond the conditions tested; scope every "practical" claim23 to the environment, versions, and configuration measured.24- Keep double-blind wording in self-citations, tool names, acknowledgements, and artifact25 descriptions.2627## Threat-model discipline2829- Give the adversary a named model with capabilities enumerated once and referenced by name;30 CCS readers audit whether every attack step stays inside those capabilities.31- Separate what the attacker knows from what it can do from where it sits in the system; a32 conflated model is the most common source of "the attack assumes too much" reviews.33- State the security goal as a property (confidentiality, integrity, availability,34 unlinkability) and say what "broken" means quantitatively.35- When a defense is evaluated, name the adaptive attacker it was tested against; a defense36 measured only against the attack it was designed to stop is a standing CCS complaint.37- Label conjecture, heuristic argument, and proved result distinctly; mixing them near a38 security claim is a credibility leak at this venue.3940## Sentence-level rewrites4142| Draft pattern | CCS-safe rewrite |43|---|---|44| "Our attack is highly effective..." | "recovers the key in N queries against library X vY on platform Z" |45| "Under realistic assumptions..." | "Under threat model T (network MITM, no host access)..." |46| "Our defense is secure..." | "resists the adaptive attacker of Section 5 at C% overhead" |47| "We significantly reduce risk..." | Claim scoped to the deployment and versions measured |4849## Vignette: compressing into twelve two-column pages5051A draft with a full protocol description, four attack variants, a formal proof, and six52measurement figures: keep the threat model, the strongest attack variant end to end, one53proof sketch, and the two decision-critical figures (leakage rate and defense overhead);54push the other variants, the full proof, and raw measurement tables to appendices with55forward references. The test of a good cut: a reviewer should be able to judge novelty and56soundness of the attack without opening the appendix.5758## Output format5960```text61[Writing diagnosis] clear / under-specified threat model / overclaimed / overloaded62[First-page fix] <new framing>63[Claim discipline] <claim -> proof/measurement/exploit/cost>64[Compression cuts] <move/delete/merge>65[Anonymity edits] <phrases to rewrite>66```
brycewang-stanford