IEEE S&P Related Work

Use this when building the positioning sections. Security literature is scattered across four flagship conferences with staggered deadlines, so "prior work" at S&P means a moving window across venues — and the PC contains authors of the papers you are positioning against.

The coverage lanes an Oakland reviewer checks

Lane	Where it lives	Typical miss
Same attack/defense family	S&P, USENIX Security, CCS, NDSS — last ~3 years of each	Citing only "your" flagship
The system/protocol being attacked	Its home community (systems, networking, ML, crypto venues)	Attacking a strawman version already fixed upstream
Prior SoKs of the area	S&P especially (SoK lane since 2010)	Re-taxonomizing without citing the existing taxonomy
Defenses your attack bypasses / attacks your defense stops	Both academic and deployed (vendor advisories, OS release notes)	Ignoring deployed mitigations reviewers run daily
Measurement baselines	PAM/IMC + the flagships	Claiming novelty for a re-measurement

The staggered-deadline effect: by any S&P cycle's close, the previous USENIX Security and CCS programs are public. Reviewers will know the three-month-old paper adjacent to yours; sweep all four programs' accepted lists in registration week, not just indexed proceedings.

Positioning is a delta statement, not a list

For each close neighbor, write one sentence of the form "X does A under adversary B; we differ in C, which matters because D." Two S&P-specific rules:

• The delta must be a security delta — a stronger adversary handled, a weaker assumption needed, a class rather than an instance — not only performance. "Faster than X" is a systems claim; "works without X's root-access assumption" is an Oakland claim.
• Comparisons against deployed defenses state version and date ("bypasses as shipped in "), because deployed defenses move mid-review (ieeesp-reproducibility).

Concurrent work and arXiv

Security has an active preprint and embargoed-disclosure culture; collisions are common. Handle per the current CFP's wording (待核实 each cycle), with these stable norms:

• Work public after your submission date is concurrent; note it in the camera-ready without being forced to claim priority battles in review.
• Your own preprint: check the cycle's anonymity policy before linking anything; never cite your preprint in a way that deanonymizes.
• A vendor advisory or incident report covering "your" vulnerability is not a research paper, but reviewers expect it acknowledged and differenced.

The 40% rule creates a disclosure duty

S&P treats a submission overlapping a previously rejected S&P paper by roughly ≥40% as a resubmission bound by the one-year embargo (2027 CFP, checked 2026-07-08). When revising a previously rejected paper for a new cycle, the related-work pass must also cover your own prior submission: what changed, and does the current CFP require declaring the resubmission (待核实)? Silently resubmitting recognizable work is a chair-level problem.

Verify venue attribution before citing

Security bibliographies rot: arXiv versions, tech reports, and conference versions of the same title differ in content and year.

# For each load-bearing citation:
# 1. dblp is the venue authority for conf/sp and siblings
curl -s "https://dblp.org/search/publ/api?q=<title>&format=json" | jq '.result.hits.hit[].info | {title, venue, year}'
# 2. Cross-check pages/DOI on IEEE Xplore for S&P papers
# 3. Cite the peer-reviewed version; mention the preprint only if content differs

Common traps: attacks named after their website (cite the paper, not the logo site); "S&P" vs "EuroS&P" confusion; workshop versions (e.g., SPW workshops co-located with S&P) cited as main-conference papers.

Anonymous self-citation discipline

The CFP requires third-person self-citation. The related-work section is where most anonymity failures happen: "we extend our prior system [12]" plus reference [12] identifies the lab. Write "this work extends the system of [12]" and audit that the set of self-citations does not uniquely fingerprint the group (three papers from one niche lab cited together often do).

Output format

[Lane coverage] family / target-domain / SoKs / bypassed-deployed / baselines: ✓/✗ each
[Fresh sweep] last USENIX Sec + CCS + NDSS programs checked on <date>?
[Delta audit] <n> neighbors with security-delta sentences; <n> missing>
[Self-overlap] prior S&P rejection? overlap estimate <n>% vs 40% rule
[Attribution] <n> citations dblp/Xplore-verified; suspicious: <list>