USENIX Security Submission

Final gate before a paper enters a USENIX Security cycle. The numbers below are the '26 and '27 cycle values read from usenix.org pages on 2026-07-08 (direct fetches of usenix.org returned 403 in the verification environment, so pages were read through search-engine renderings and cross-checked against the per-cycle HotCRP deadline pages). Reopen the live CFP before trusting any date or cap.

Two dates per cycle, and the first one bites

Every USENIX Security cycle opens with a mandatory paper registration roughly one week ahead of the submission deadline. Registration creates the HotCRP record — title, abstract, authors, topics, conflicts — and a paper that was never registered cannot be uploaded later, no matter how finished the PDF is.

Each cycle runs its own HotCRP instance (the '26 sites were sec26cycle1.usenix.hotcrp.com and sec26cycle2.usenix.hotcrp.com). Registering on the wrong cycle's site is a real failure mode when both are open in overlapping windows — confirm the URL against the CFP, not against a browser bookmark.

The page geometry is unusual — learn it before the deadline

The '26 CFP fixed a structure that trips authors arriving from ACM venues:

1. Main body: at most 13 pages in the unaltered USENIX Security LaTeX template.
2. Immediately after the body, before the references: a mandatory appendix titled "Ethical Considerations" and a mandatory appendix titled "Open Science", each allowed up to one page.
3. References, then any optional appendices, with no page cap.

Both named appendices are required content, not decoration. A submission whose Open Science appendix does not state where the artifacts supporting the paper live (or justify why they cannot be shared) is out of policy, and paper acceptance is later made conditional on the availability actually checking out (see usenixsec-artifact-evaluation). Squeezing whitespace or altering the template is explicitly forbidden.

Anonymity, in USENIX Security's own terms

The '26 CFP names the leak vectors directly: author names, self-references phrased as "we previously showed", funding acknowledgements, and GitHub repositories that identify the group. Sweep for each of them plus the mechanical ones:

# Run on the exact PDF you intend to upload
pdftotext sub.pdf - | grep -nEi 'our (prior|previous) work|as we showed' | head
pdftotext sub.pdf - | grep -nEi 'github\.com/|gitlab\.|acknowledg|funded by' | head
pdfinfo sub.pdf | grep -Ei 'author|creator|producer'
grep -rEl 'institution|\\author' *.tex   # stray identity in source before rebuild

Artifacts referenced in the Open Science appendix must be reachable anonymously at submission time — an anonymized mirror (e.g., a stripped repository on an anonymous hosting service) rather than the lab's named organization.

Early reject makes sloppy uploads expensive

USENIX Security notifies a first wave of rejections mid-cycle (Oct 7, 2025 and Mar 17, 2026 in the '26 cycles). A submission that reads as unfinished, violates format, or ducks the ethics discussion can exit at that gate without ever reaching full committee discussion, and second-cycle rejects face resubmission restrictions set by the next year's chairs. The audit below is cheaper than a lost cycle.

Pre-upload audit order

1. Registration record complete and frozen: title, abstract (the real one — it drives reviewer bidding), all authors, topics, conflicts.
2. Rebuild the PDF from clean sources; confirm 13-page body, the two named appendices in position, references after them.
3. Run the anonymity greps above; treat every hit as a blocker.
4. Open every artifact URL from a logged-out browser session.
5. Confirm no concurrent submission of the same work elsewhere, in writing from every coauthor.
6. Upload early enough to re-download the PDF from HotCRP and read it cold.

Reverify each cycle

• Registration/upload dates and the AoE convention (待核实 for '27 until the final CFP text is fetched directly).
• The 13-page cap and the one-page allowances for the two named appendices.
• The per-cycle HotCRP hostnames.
• Any new AI-assistance disclosure or submission-count rule (none confirmed for '27 as of 2026-07-08 — 待核实).

Output format

[Cycle] target cycle + HotCRP URL confirmed against CFP
[Registration] complete / missing fields: <list>
[Format] body pages, appendix order, template integrity
[Anonymity] clean / blockers: <grep hits, artifact URLs>
[Ethics + Open Science] both appendices substantive: yes / no
[Verdict] upload / hold — with the fix list