CCS Review Process
Use this to reason about review-stage strategy. Reopen the current CFP, the cycle's HotCRP
site, the reviewer guidelines if posted, and the ethics policy before making process claims.
Process model
- CCS runs two review cycles per year on HotCRP, each with abstract registration, full-paper
submission, review, a rebuttal window, and notification.
- Reviewers assess threat-model soundness, novelty, technical correctness, evidence quality,
ethics and responsible disclosure, and significance to the security community.
- Decisions are not binary: CCS 2026 used accept, minor revision (authors revise for the same
cycle under a shepherd or check), and reject. A first-cycle reject cannot return that year.
- An ethics or disclosure concern can sink an otherwise strong paper; the ethics reviewer's
view carries weight independent of technical scores.
- Accepted papers publish in the ACM Digital Library proceedings, so camera-ready and metadata
compliance matter as much as the initial decision.
Who reviews here
- The pool is adversarial by training: expect at least one reviewer to attack your threat
model, look for the assumption that makes the attack easy, and probe whether the defense was
tested against an adaptive attacker.
- CCS is broad, so a paper may draw reviewers from an adjacent sub-area; the threat model and
intro must orient a web-security reviewer to a crypto result and vice versa.
- Borderline papers usually fall on one of three edges: an attacker assumption too strong to
be interesting, a defense never adapted against, or an ethics gap left unaddressed.
Scoring leverage table
| Review dimension |
What raises it |
What sinks it |
| Threat model |
A tight, realistic adversary stated up front |
Capabilities that quietly grow to make the attack work |
| Novelty |
An attack class or guarantee the literature lacked |
An increment over a cited paper with no new idea |
| Evidence |
End-to-end demonstration against a real target |
Lab-only results against a strawman |
| Ethics |
Disclosure done, harm minimized, reasoned in the paper |
Real-world harm with no disclosure or IRB reasoning |
Stage-by-stage realism
- Initial reviews: triage by what the meta-reviewer will weigh — threat model and evidence —
not by reviewer tone.
- Rebuttal: the window is short and structured; one crisp answer to the decision-critical
objection beats an exhaustive point-by-point.
- Decision: the meta-review synthesizes; one unresolved threat-model or ethics objection
outweighs several resolved clarity complaints.
- Minor revision: treat it as conditional acceptance with a checklist, not a debate; do
exactly what the shepherd asks within the cycle's timeline.
Output format
[Current stage] submitted / reviews / rebuttal / decision / revision / camera-ready
[Decision actors] <reviewers / ethics reviewer / meta-reviewer / chairs>
[Likely leverage] <threat model / novelty / evidence / ethics>
[Forbidden moves] <identity leak / new unsupported results / ignoring the shepherd>
[Next response move] <one action>
Source: brycewang-stanford/Awesome-Journal-Skills → ACM-CCS-Skills/skills/ccs-review-process/SKILL.md
1---2name: ccs-review-process3description: Use when explaining or planning around ACM CCS peer review, the two-cycle HotCRP workflow, decision categories including minor revision, the rebuttal window, the adversarial reviewer pool, ethics and disclosure scrutiny, meta-review dynamics, and ACM proceedings outcomes.4---567# CCS Review Process89Use this to reason about review-stage strategy. Reopen the current CFP, the cycle's HotCRP10site, the reviewer guidelines if posted, and the ethics policy before making process claims.1112## Process model1314- CCS runs two review cycles per year on HotCRP, each with abstract registration, full-paper15 submission, review, a rebuttal window, and notification.16- Reviewers assess threat-model soundness, novelty, technical correctness, evidence quality,17 ethics and responsible disclosure, and significance to the security community.18- Decisions are not binary: CCS 2026 used accept, minor revision (authors revise for the same19 cycle under a shepherd or check), and reject. A first-cycle reject cannot return that year.20- An ethics or disclosure concern can sink an otherwise strong paper; the ethics reviewer's21 view carries weight independent of technical scores.22- Accepted papers publish in the ACM Digital Library proceedings, so camera-ready and metadata23 compliance matter as much as the initial decision.2425## Who reviews here2627- The pool is adversarial by training: expect at least one reviewer to attack your threat28 model, look for the assumption that makes the attack easy, and probe whether the defense was29 tested against an adaptive attacker.30- CCS is broad, so a paper may draw reviewers from an adjacent sub-area; the threat model and31 intro must orient a web-security reviewer to a crypto result and vice versa.32- Borderline papers usually fall on one of three edges: an attacker assumption too strong to33 be interesting, a defense never adapted against, or an ethics gap left unaddressed.3435## Scoring leverage table3637| Review dimension | What raises it | What sinks it |38|---|---|---|39| Threat model | A tight, realistic adversary stated up front | Capabilities that quietly grow to make the attack work |40| Novelty | An attack class or guarantee the literature lacked | An increment over a cited paper with no new idea |41| Evidence | End-to-end demonstration against a real target | Lab-only results against a strawman |42| Ethics | Disclosure done, harm minimized, reasoned in the paper | Real-world harm with no disclosure or IRB reasoning |4344## Stage-by-stage realism4546- Initial reviews: triage by what the meta-reviewer will weigh — threat model and evidence —47 not by reviewer tone.48- Rebuttal: the window is short and structured; one crisp answer to the decision-critical49 objection beats an exhaustive point-by-point.50- Decision: the meta-review synthesizes; one unresolved threat-model or ethics objection51 outweighs several resolved clarity complaints.52- Minor revision: treat it as conditional acceptance with a checklist, not a debate; do53 exactly what the shepherd asks within the cycle's timeline.5455## Output format5657```text58[Current stage] submitted / reviews / rebuttal / decision / revision / camera-ready59[Decision actors] <reviewers / ethics reviewer / meta-reviewer / chairs>60[Likely leverage] <threat model / novelty / evidence / ethics>61[Forbidden moves] <identity leak / new unsupported results / ignoring the shepherd>62[Next response move] <one action>63```6465---6667**Source:** [`brycewang-stanford/Awesome-Journal-Skills`](https://github.com/brycewang-stanford/Awesome-Journal-Skills) → `ACM-CCS-Skills/skills/ccs-review-process/SKILL.md`
thedixitjain