IEEE S&P Submission
Use this as the final audit before a paper enters an S&P cycle on HotCRP.
S&P's desk-reject rules are unusually mechanical — page counts, ORCID
matching, and registration completeness are enforced without review — so
most preventable losses happen in the upload week, not in review.
The two-deadline structure
An S&P cycle has a registration deadline and a paper deadline about a
week apart, and the registration is binding: title, full abstract, complete
author list, ORCIDs, and conflicts are frozen when registration closes
(cycle1.sp2027.ieee-security.org/deadlines, checked 2026-07-08). Audit
registration as its own deliverable:
- Every author has an ORCID whose email and name match the HotCRP record
— the 2027 CFP desk-rejects papers that violate this.
- The abstract entered at registration is the real abstract, not a
placeholder; it routes reviewers and cannot be swapped later.
- Conflicts are declared per the current CFP's conflict definition; both
missing and fabricated conflicts are chair-level problems.
- The Ethics Considerations field is filled with substance at
registration time (see
ieeesp-review-process for how the REC uses it).
- SoK papers have the
SoK: title prefix and the SoK checkbox — one
without the other misroutes reviewing.
Format gate
| Rule (2027 CFP, checked 2026-07-08) |
Enforcement |
| ≤ 13 pages of body text |
Over-length ⇒ rejected without review |
| ≤ 5 further pages, references + appendices only |
Same |
| Hard ceiling 18 pages total |
Same |
| Everything past page 13 clearly marked as appendix |
Reviewer-visible violation |
| IEEE "compsoc" conference-proceedings LaTeX template |
Tampering ⇒ desk-level flag |
| Anonymized submission |
Identity leak ⇒ desk reject |
Two S&P-specific implications. Reviewers are not required to read
appendices, so a proof, an ablation, or the adaptive-attack evaluation that
the acceptance case depends on must live in the first 13 pages. And the
compsoc template's two-column layout eats wide tables and long listings —
compress artifacts early, not on deadline night.
Anonymization with security-paper edges
Security submissions leak identity in ways generic checklists miss:
- Disclosure trails — "we reported this to Vendor X in March" plus a CVE
number can uniquely identify the reporting group; write disclosure evidence
in venue-neutral terms ("the affected vendors were notified on ;
identifiers omitted for anonymity") unless the current CFP says otherwise.
- Artifact hostnames and scan origins — measurement infrastructure IPs,
institutional network names in traces, and cloud project IDs in scripts.
- Self-citations go in the third person, per the CFP.
- PDF metadata, embedded fonts from institutional templates, and figure
source paths (
/home/<user>/...) all deanonymize.
# Mechanical pass before upload
pdfinfo paper.pdf | grep -iE 'author|creator' # metadata
pdftotext paper.pdf - | grep -inE 'our (prior|previous) work|we reported|CVE-20'
grep -rniE '(\.edu|\.ac\.|corp)/|/home/[a-z]' figures/ scripts/ || true
Upload-week order of operations
- Freeze the threat model and claims; no new results after this point.
- Run the anonymization sweep above on the PDF and any linked artifact.
- Verify page arithmetic: body ends on or before p.13, total ≤ 18, appendix
pages labeled.
- Complete registration: authors, ORCIDs, conflicts, abstract, Ethics
Considerations, SoK checkbox if applicable.
- Upload the paper; re-download from HotCRP and re-check the rendered PDF —
font substitution has broken compsoc submissions before.
- Confirm the HotCRP abstract matches the PDF abstract.
Desk-reject triage
| Trigger |
Repairable after deadline? |
| Missing/mismatched ORCID for any author |
No — desk reject |
| Body text past page 13 or total > 18 |
No — rejected without review |
| Author list change after registration |
No — frozen |
| Identity leak in PDF or artifact |
No |
| Weak Ethics Considerations entry |
No new entry; damage lands in review/REC |
| Thin adaptive-attack evaluation |
Review-stage damage; fix before, not after |
Output format
[S&P upload readiness] Ready / Needs fixes / Not ready
[Registration] authors+ORCIDs ✓/✗ · abstract ✓/✗ · conflicts ✓/✗ · ethics field ✓/✗
[Format] body ≤13 ✓/✗ · total ≤18 ✓/✗ · compsoc ✓/✗ · appendix marked ✓/✗
[Anonymity] pdf metadata / disclosure trail / artifact origins: <findings>
[Highest desk-reject risk] <one item>
[Fix order] <ordered list before the registration deadline>
1---2name: ieeesp-submission3description: Use when auditing an IEEE S&P (Oakland) submission for HotCRP readiness, including the registration freeze with ORCID matching, the 13-page/18-page compsoc format, anonymization, the Ethics Considerations field, SoK checkbox, conflict declarations, and the desk-reject triggers specific to S&P cycles.4---56# IEEE S&P Submission78Use this as the final audit before a paper enters an S&P cycle on HotCRP.9S&P's desk-reject rules are unusually mechanical — page counts, ORCID10matching, and registration completeness are enforced without review — so11most preventable losses happen in the upload week, not in review.1213## The two-deadline structure1415An S&P cycle has a **registration deadline** and a **paper deadline** about a16week apart, and the registration is binding: title, full abstract, complete17author list, ORCIDs, and conflicts are frozen when registration closes18(cycle1.sp2027.ieee-security.org/deadlines, checked 2026-07-08). Audit19registration as its own deliverable:2021- Every author has an ORCID whose **email and name match the HotCRP record**22 — the 2027 CFP desk-rejects papers that violate this.23- The abstract entered at registration is the real abstract, not a24 placeholder; it routes reviewers and cannot be swapped later.25- Conflicts are declared per the current CFP's conflict definition; both26 missing and fabricated conflicts are chair-level problems.27- The **Ethics Considerations** field is filled with substance at28 registration time (see `ieeesp-review-process` for how the REC uses it).29- SoK papers have the `SoK:` title prefix **and** the SoK checkbox — one30 without the other misroutes reviewing.3132## Format gate3334| Rule (2027 CFP, checked 2026-07-08) | Enforcement |35|---|---|36| ≤ 13 pages of body text | Over-length ⇒ rejected without review |37| ≤ 5 further pages, references + appendices only | Same |38| Hard ceiling 18 pages total | Same |39| Everything past page 13 clearly marked as appendix | Reviewer-visible violation |40| IEEE "compsoc" conference-proceedings LaTeX template | Tampering ⇒ desk-level flag |41| Anonymized submission | Identity leak ⇒ desk reject |4243Two S&P-specific implications. Reviewers are **not required to read44appendices**, so a proof, an ablation, or the adaptive-attack evaluation that45the acceptance case depends on must live in the first 13 pages. And the46compsoc template's two-column layout eats wide tables and long listings —47compress artifacts early, not on deadline night.4849## Anonymization with security-paper edges5051Security submissions leak identity in ways generic checklists miss:5253- **Disclosure trails** — "we reported this to Vendor X in March" plus a CVE54 number can uniquely identify the reporting group; write disclosure evidence55 in venue-neutral terms ("the affected vendors were notified on <date>;56 identifiers omitted for anonymity") unless the current CFP says otherwise.57- **Artifact hostnames and scan origins** — measurement infrastructure IPs,58 institutional network names in traces, and cloud project IDs in scripts.59- Self-citations go in the **third person**, per the CFP.60- PDF metadata, embedded fonts from institutional templates, and figure61 source paths (`/home/<user>/...`) all deanonymize.6263```bash64# Mechanical pass before upload65pdfinfo paper.pdf | grep -iE 'author|creator' # metadata66pdftotext paper.pdf - | grep -inE 'our (prior|previous) work|we reported|CVE-20'67grep -rniE '(\.edu|\.ac\.|corp)/|/home/[a-z]' figures/ scripts/ || true68```6970## Upload-week order of operations71721. Freeze the threat model and claims; no new results after this point.732. Run the anonymization sweep above on the PDF **and** any linked artifact.743. Verify page arithmetic: body ends on or before p.13, total ≤ 18, appendix75 pages labeled.764. Complete registration: authors, ORCIDs, conflicts, abstract, Ethics77 Considerations, SoK checkbox if applicable.785. Upload the paper; re-download from HotCRP and re-check the rendered PDF —79 font substitution has broken compsoc submissions before.806. Confirm the HotCRP abstract matches the PDF abstract.8182## Desk-reject triage8384| Trigger | Repairable after deadline? |85|---|---|86| Missing/mismatched ORCID for any author | No — desk reject |87| Body text past page 13 or total > 18 | No — rejected without review |88| Author list change after registration | No — frozen |89| Identity leak in PDF or artifact | No |90| Weak Ethics Considerations entry | No new entry; damage lands in review/REC |91| Thin adaptive-attack evaluation | Review-stage damage; fix before, not after |9293## Output format9495```text96[S&P upload readiness] Ready / Needs fixes / Not ready97[Registration] authors+ORCIDs ✓/✗ · abstract ✓/✗ · conflicts ✓/✗ · ethics field ✓/✗98[Format] body ≤13 ✓/✗ · total ≤18 ✓/✗ · compsoc ✓/✗ · appendix marked ✓/✗99[Anonymity] pdf metadata / disclosure trail / artifact origins: <findings>100[Highest desk-reject risk] <one item>101[Fix order] <ordered list before the registration deadline>102```
brycewang-stanford