The USENIX Security Symposium brings together researchers, practitioners, system programmers, and others interested in the latest advances in the security and privacy of computer systems and networks. The 34th USENIX Security Symposium will be held on August 13–15, 2025, in Seattle, WA, USA.
Summary of main changes from previous editions
- Two submission cycles instead of three.
- New open science policy: Research results should be available to the public or explain why this is not possible. The artifact evaluation process is adjusted to accommodate this.
- New guidelines for ethics considerations.
- Extra page to discuss ethics considerations and compliance with open science policy.
- Revisions are reviewed within the same submission cycle instead of the next.
- New approach to presenting accepted papers (see the public RFC about the plans for this new model).
Important Dates
New in 2025, there will be two submission cycles.
Cycle 1
- Paper submissions due: Wednesday, September 4, 2024
- Early reject notification: Tuesday, October 15, 2024
- Rebuttal period: November 18–25, 2024
- Notification to authors: Wednesday, December 11, 2024
- Shepherding/revision period: Thursday, December 12, 2024–Thursday, January 16, 2025
- Artifacts due for availability verification: Thursday, January 16, 2025
- Shepherding/revision author notification: Thursday, January 23, 2025
- Final papers due: Thursday, January 30, 2025
Cycle 2
- Paper submissions due: Wednesday, January 22, 2025
- Early reject notification: Tuesday, March 4, 2025
- Rebuttal period: April 7–14, 2025
- Notification to authors: Wednesday, April 30, 2025
- Shepherding/revision period: Thursday, May 1, 2025–Thursday, May 29, 2025
- Artifacts due for availability verification: Thursday, May 29, 2025
- Shepherding/revision author notification: Thursday, June 5, 2025
- Final papers due: Thursday, June 12, 2025
Symposium Topics
Refereed paper submissions are solicited in all areas relating to systems research in security and privacy. This topic list is not meant to be exhaustive; USENIX Security is interested in all aspects of computing systems security and privacy. Papers without a clear application to security or privacy of computing systems, however, will be considered out of scope and may be rejected without full review.
- System security
- Operating systems security
- Web security
- Mobile systems security
- Distributed systems security
- Cloud computing security
- Network security
- Intrusion and anomaly detection and prevention
- Network infrastructure security
- Denial-of-service attacks and countermeasures
- Wireless security
- Analysis of network and security protocols
- Software analyses
- Malware analysis
- Forensics and diagnostics for security
- Automated security analysis of source code and binaries
- Program analysis
- Fuzzing and vulnerability discovery
- ML and AI security and privacy
- ML and AI applications to security and privacy
- Privacy risks in ML and AI
- Security of AI
- Data-driven security and measurement studies
- Measurements of fraud, malware, spam
- Measurements of human behavior and security
- Privacy
- Privacy metrics
- Anonymity
- Web and mobile privacy
- Privacy-preserving computation
- Privacy attacks
- Usable security and privacy
- User studies related to security and privacy
- Human-centered security and privacy design
- Formal methods and language-based security
- Hardware security
- Secure computer architectures
- Embedded systems security
- Cyber-physical systems security
- Methods for detection of malicious or counterfeit hardware
- Side channels
- Automated security analysis of hardware designs and implementation
- Surveillance and censorship
- Social issues and security
- Security and privacy law and policy
- Information manipulation, misinformation, and disinformation
- Protecting and understanding at-risk users
- Emerging online threats, harassment, extremism, and abuse
- Applications of cryptography
- Analysis of deployed cryptography and cryptographic protocols
- Cryptographic implementation analysis
- New cryptographic protocols with real-world applications
- Blockchains and distributed ledger security
- Meta-science in security and privacy
- Ethics of computer security research
- Security education and training
- Replication and reproduction
- Attacks with novel insights, techniques, or results
New Topics: Meta-science in Security and Privacy
Meta-science, or the study of scientific research itself, aims to enhance the efficiency, quality, and outcomes of research activities in our community. Submissions in this broad topic should focus on evaluations of research practices, replicability/reproducibility, ethics, research methodologies, data transparency, and peer-review processes.
Contributions should extend beyond analysis, aiming to influence future research practices.
Replication and Reproduction: Contributions to this sub-topic should primarily consist of studies that verify, refute, or refine prior technical results or widely-held beliefs. We encourage submissions that not only replicate studies but also offer meta-analyses that assess the replicability of research. Additionally, while replication studies often replicate original findings, we also value novel investigations into why certain studies fail to replicate. Papers that critically examine the conditions under which replication is feasible, or those that propose innovative methods to enhance the reliability of scientific findings, are especially welcome.
Systematization of Knowledge
USENIX Security solicits the submission of Systematization of Knowledge (SoK) papers, which have been very valuable to help our community to clarify and put into context complex research problems.
It is important to stress that SoK papers go beyond simply summarizing previous research (like in a survey); they also include a thorough examination and analysis of existing approaches, identify gaps and limitations, and offer insights or new perspectives on a given, major research area.
While both SoK and survey papers may involve summarizing existing research, the key difference is that an SoK paper provides a more structured and insightful overview, which might also involve new experiments to replicate and compare previous solutions. For examples, please see the list of SoK papers that recently appeared at the IEEE Symposium on Security and Privacy at https://oaklandsok.github.io/.
The titles of SoK submissions should be prefixed with "SoK:".Research Ethics
Authors of all submissions must consider the ethics of their work even if, a priori, they do not think that this section on ethical considerations applies to them.
Without sufficient precautions, research endeavors can lead to negative outcomes. People or other entities, like companies, might experience negative outcomes during the research process itself, immediately after the research is published, or in the future. These negative outcomes might be in the form of tangible harms (e.g., financial loss or exposure to psychologically disturbing content). Or, these negative outcomes could be violations of human rights even if there are no directly tangible harms (e.g., the violation of a participants' right to informed consent or the violation of users' right to privacy via the study of data that users expect and desire to be private). Further, due to the complexity of today's computing systems, people could experience these negative outcomes either directly or indirectly in unexpected ways (see The Menlo Report).
We expect authors to carefully and proactively consider and address potential negative outcomes associated with carrying out their research, as well as potential negative outcomes that could stem from publishing their work. Failure to do so may result in rejection of a submission regardless of its quality and scientific value.
Although causing negative outcomes is sometimes a necessary and legitimate aspect of scientific research in computer security and privacy, authors are expected to document how they have addressed and mitigated the risks. This includes, but is not limited to, considering the impact of the research on deployed systems, understanding the costs the research imposes on others, safely and appropriately collecting data, considering the well-being of the research team, and following ethical disclosure practices.
Reviewers will be asked to evaluate the ethics of every submission. To facilitate their review, all papers must include a discussion of ethics and an argument for how their full research and publication process was ethical. For more information, see the submission policies and instructions and the ethics guideline document. Authors should understand that, sometimes, the right ethical decision is not to do a project or to change how a project is done. Thus, authors are encouraged to read the ethics portion of the submission instructions and the ethics guidelines document as early as possible in their research process, ideally before initiating their research, though it is understood that some projects may have been started before this CFP has been posted. Authors are further encouraged to revisit these guidelines throughout the research, publication, and post-publication processes.
Open Science
This year, USENIX Security introduces a new open science policy, aiming to enhance the reproducibility and replicability of scientific findings: Authors are expected to openly share their research artifacts by default. This initiative is part of a broader commitment to foster open science principles, emphasizing the sharing of artifacts such as datasets, scripts, binaries, and source code associated with research papers. If, for some reason (such as licensing restrictions), artifacts cannot be shared, a detailed justification must be provided. Artifacts need to be available for the Artifact Evaluation committee after paper acceptance and before the final papers are due.
Artifact Evaluation
Artifact evaluation will take place in two phases: Artifacts will be evaluated for availability after paper acceptance and before the final papers are due; artifacts will be evaluated for functionality and reproducibility after final papers are due. All artifacts mentioned in accepted papers will be checked for availability. Authors of accepted papers are encouraged to register their artifacts to also be checked for functionality and reproducibility.
Artifacts should be submitted in the same cycle as the accepted paper. Each submitted artifact will be reviewed by the Artifact Evaluation Committee (AEC).
The Call for Artifacts will be available soon.
Conference Attendance and Publishing Accepted Papers
Papers that have been formally reviewed and accepted will be presented during the Symposium and published in the Symposium Proceedings. By submitting a paper, you agree that at least one of the authors will attend the conference to present it. If the conference registration fee will pose a hardship for the presenter of the accepted paper, please contact conference@usenix.org.
A major mission of the USENIX Association is to provide for the creation and dissemination of new knowledge. USENIX allows authors to retain ownership of the copyright in their works, requesting only that USENIX be granted the right to be the first publisher of that work. See our sample consent form for the complete terms of publication.
Papers accepted during the first reviewing cycle will be published on the USENIX Security website shortly after the conclusion of the first reviewing cycle. Papers accepted during the second reviewing cycle will be published on the first day of the symposium.
See the Paper Submission Policies and Instructions page for more information.
New Approach to Presentation of Papers
Motivated by rising conference costs and increasing numbers of submitted and accepted papers, USENIX Security '25 will implement a new approach to presenting accepted papers and fostering interactions at the conference. Some accepted papers will be presented as longer talks, tentatively 15 minutes long; others will be shorter presentations, tentatively between 30 seconds and one minute long. Accepted papers will additionally be presented as posters, during thematically organized discussion sessions that will run in parallel with talk sessions. Finally, authors of accepted papers will be invited to upload pre-recorded 15-to-20-minute video presentations, which will be published on the USENIX Security website. Preparation of posters and uploaded videos will not be mandatory.