Preregistration means writing down what you are going to measure, on which population, and how you will analyse it, and depositing that document somewhere immutable and timestamped before you look at the data. It is a normal expectation in psychology and clinical trials. In web measurement it is almost unheard of, and this page exists because “almost” is doing real work: it has been done, the form fits, and the one paper that did it for a crawl-based study left its registration public so you can copy the shape.

The page is about measurement studies. If you are running a survey or a lab experiment, the psychology literature already tells you what to do and the templates already fit; skip to Mechanics: OSF and AsPredicted. If you are crawling a million sites, the templates do not fit, nobody in your field has an example to show you, and no reviewer will ask — that is the gap this page is for. See User studies for the human-subjects side.

• Chameleon Channels [1Cuevas, Alejandro; Ribeiro, Manoel Horta; Christin, Nicolas (2026): "Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Security 2026) — the only preregistered measurement study in this corpus, and the one to imitate. Read the paper's Appendix B and then read the registration itself side by side. It is the whole worked example this page is built on; see The One Worked Example.
• Where Are the Red Lines? [2Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] (IEEE S&P 2024) — the field's own proposal for preregistering measurements, and it is not about statistics at all. It proposes a pre-registration board run by a trusted third party for server-side scanning, so that researchers have documented proof of intent before they touch someone else's server. This is the argument for preregistration that fits crawling, and it is an ethics and liability argument.
• Transparency in Usable Privacy and Security Research [3Klemmer, Jan H.; Schmüser, Juliane; Lowens, Byron M.; Fischer, Fabian; Schmüser, Lea; Schaub, Florian; Fahl, Sascha (2025): "Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] (IEEE S&P 2025) — 24 interviews with researchers in this community about exactly this. Its recommendation is conditional in a way that tells you where the field is: “If a venue adopted registered reports, consider submitting a preregisterd [sic] study proposal.”
• HARK No More [4Cockburn, Andy; Gutwin, Carl; Dix, Alan (2018): "HARK No More: On the Preregistration of CHI Experiments", in: Proceedings of the CHI Conference on Human Factors in Computing Systems. (DOI)] (CHI 2018) — the canonical CS-side argument, and the reference the one SoK in this corpus that recommends preregistration [5Wei, Miranda; Mink, Jaron; Eiger, Yael; Kohno, Tadayoshi; Redmiles, Elissa M.; Roesner, Franziska (2024): "SoK (or SoLK?): On the Quantitative Study of Sociodemographic Factors and Computer Security Behaviors", in: Proceedings of the USENIX Security Symposium. (Link)] points at.
• The past, present and future of Registered Reports [6Chambers, Christopher D.; Tzavella, Loukia (2022): "The past, present and future of Registered Reports", Nature Human Behaviour 6(1):29-42. (DOI)] (Nature Human Behaviour 2022) — what a Registered Report is, as distinct from a preregistration, and why the distinction matters when you are choosing which one to do.

The textbook argument for preregistration is about HARKing: you run twenty tests, one comes out at p < 0.05, and you write the paper as though that had been the hypothesis all along. That argument transfers to measurement, but it is not the strongest one, because most papers in these venues are descriptive: of the 5,456 with any statistics tuple at all, 3,694 (67.7%) report nothing beyond descriptive statistics. If your study has no hypothesis, there is nothing to HARK.

The decisions that actually go soft in a measurement study are these, and preregistration is a commitment device for all of them.

Two of these are not about p-values at all, and they are the ones the field's own proposal picks up. Hantke et al. [2Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] interviewed German legal experts, research-ethics committee members and server operators about server-side scanning, then surveyed 119 more operators. Their proposal is a pre-registration process run by a trusted third party that would “review submitted research proposals that should outline the research question, expected outcomes, and the chosen study design, as well as a discussion on why alternative methods are not feasible”, assign scanning time slots, and “maintain a publicly available list of all ongoing scans, the associated IP addresses, and points of contact”. It is a preregistration whose audience is the measured party, not the reviewer.

It moves operators. Asked in the abstract how comfortable they were with server-side scanning research, 36.1% of the 119 surveyed operators said comfortable and 21.8% somewhat comfortable; asked the same question with the pre-registration process in place, that became 37.8% and 35.3% — from 57.9% to 73.1% at comfortable-or-better.²⁾ Asked who should run it, they rated NGOs and white-hat organisations most competent (mean 4.15 of 5, sd 1.1) ahead of academic institutions (3.79, sd 1.13).

Chameleon Channels [1Cuevas, Alejandro; Ribeiro, Manoel Horta; Christin, Nicolas (2026): "Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit", in: Proceedings of the USENIX Security Symposium. (Link)] measured YouTube channels that are sold and repurposed: a daily scrape of the Fameswap marketplace, a ~1.4M-channel random sample from Social Blade as a baseline, LLM annotation of channel topics validated against hand-coded gold-standard labels, and a design-based supervised-learning logistic regression. No human subjects. It preregistered on OSF on 2025-04-16, about sixteen months before the paper appeared, and the registration is public and readable.

That is what makes it useful: you can open osf.io/fg9pm and see exactly how a crawl-shaped study answers a psychology-shaped form. Eleven of the template's 22 question fields are answered and eleven are left blank, and the whole document is 1,005 words. The answers land on research questions and hypotheses, study type, blinding, study design, foreknowledge of the data and its explanation, data collection procedures, sample size, sample size rationale, measured variables and statistical models. The other half of the form — randomisation, manipulated variables, transformations and the rest of the experiment-shaped questions — is empty. That is the expected shape for an observational study, not a failure to fill it in.³⁾

The four answers worth copying:

Note what the registration also does that the paper's text does not: it states four hypotheses, in advance, with the outcome variable and the model named. Since the registration is public, anyone can diff it against the published analysis themselves. That is the entire mechanism, and it costs you a URL in an appendix.

The paper does not tell the reader whether it followed its plan. Neither do the other six “silent” papers among the fifteen. If you preregister, say in the paper whether you deviated — otherwise the registration is a link nobody follows and the preregistration bought your reader nothing.

Two registries account for every checkable preregistration in this corpus — 14 of the 15: OSF (11 papers) and AsPredicted (3). One paper — MACA [7Seong, Youn Jun; Oh, Ha Young (2026): "MACA: A Multi-Agent Cognitive Adaptation Framework for Human-Agent Collaborative Decision Making", in: Proceedings of the ACM Web Conference. (DOI)], TheWebConf 2026 — says “We pre-registered the primary comparison as Multi-Adaptive versus Single-Fixed” and names no registry, no identifier and no date anywhere in the text, which makes the claim unfalsifiable. Do not do that. Everything in this section was checked against the live services on 2026-08-13 via api.osf.io and the rendered AsPredicted pages; the commands are in external_checks_preregistration.sh and the raw output is on the provenance page.

Which template. The general OSF Preregistration is what all the corpus papers used and it is built for an experiment. If your study reanalyses an existing dataset — a public crawl, a CDN log, an archived corpus, someone else's scan — Secondary Data Preregistration is a much better fit: its questions are Datasets used, Data availability, Data access, Data identifiers, Access date, Codebook, Unit of analysis, Sampling weights, Prior knowledge. Nobody in this corpus has used it. Open-Ended Registration has no template questions at all and is the right escape hatch if neither fits: an immutable timestamped document beats no document.

AsPredicted's eight questions, verbatim from the live form:

1. Have any data been collected for this study already?
2. What's the main question being asked or hypothesis being tested in this study?
3. Describe the key dependent variable(s) specifying how they will be measured.
4. How many and which conditions will participants be assigned to?
5. Specify exactly which analyses you will conduct to examine the main question/hypothesis.
6. Describe exactly how outliers will be defined and handled, and your precise rule(s) for excluding observations.
7. How many observations will be collected or what will determine sample size?
8. Anything else you would like to pre-register?

Question 4 is the one people assume rules them out, and it usually does not: it assumes human participants, but if your crawl has arms — consent-accept versus consent-reject, stateful versus stateless, several vantage points, several browser profiles — that is what goes in question 4. A multi-arm crawl that leaves its arms out of the registration has preregistered nothing about the comparison it will actually report. Questions 6 and 7 are the two a crawl most needs. Several third-party guides describe AsPredicted as asking nine questions; the live form as of 2026-08-13 identifies itself as “Version of AsPredicted Questions: 2.00” and asks eight.⁴⁾

Checking takes one request against the public OSF API, so a reviewer can do it and so can you before you submit:

check_prereg_link.py

#!/usr/bin/env python3
"""Is that "preregistration" link actually a preregistration?
 
An osf.io URL proves nothing on its own: OSF hosts mutable *projects* and
immutable *registrations* under the same osf.io/<guid> namespace, and both
return HTTP 200. Two of the ten OSF links cited as preregistrations by papers
in the measuretheweb corpus are projects, which the authors could have edited
after seeing their data.
 
    python3 check_prereg_link.py https://osf.io/fg9pm/ osf.io/q4rj3 5pywm
    python3 check_prereg_link.py --file urls.txt
 
Reads nothing but the public OSF API; no key needed. Exit status is 1 if any
input is not an immutable, non-withdrawn registration, so it can gate a
submission checklist.
"""
import argparse
import json
import re
import sys
import urllib.error
import urllib.request
 
API = "https://api.osf.io/v2"
# Anchored on "osf.io/" so a bare ^ alternative cannot match the "https" of the
# scheme — which it does, silently, and then reports HTTP 404 for a live link.
IN_URL_RE = re.compile(r"osf\.io/([a-z0-9]{5})\b", re.IGNORECASE)
BARE_RE = re.compile(r"^([a-z0-9]{5})$", re.IGNORECASE)
 
 
def guid_of(s):
    """Pull the 5-character GUID out of a URL, a DOI or a bare identifier.
 
    Handles https://osf.io/fg9pm/, osf.io/fg9pm?view_only=...,
    https://doi.org/10.17605/OSF.IO/FG9PM and a bare fg9pm.
    """
    s = s.strip()
    m = IN_URL_RE.search(s) or BARE_RE.match(s)
    if not m:
        raise ValueError(f"no OSF guid in {s!r}")
    return m.group(1).lower()
 
 
def get(url):
    req = urllib.request.Request(url, headers={"Accept": "application/json"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.load(r), r.url
 
 
def classify(ident):
    guid = guid_of(ident)
    try:
        # /guids/ redirects to the typed endpoint, and the endpoint it lands on
        # is itself the answer: /registrations/ or /nodes/.
        payload, final = get(f"{API}/guids/{guid}/")
    except urllib.error.HTTPError as e:
        if e.code in (401, 403):
            return guid, "PRIVATE", "not public — reviewers cannot read it without a view-only link"
        return guid, "ERROR", f"HTTP {e.code}"
    kind = final.replace(API + "/", "").split("/")[0]
    a = payload["data"]["attributes"]
    if kind != "registrations":
        return guid, "NOT-A-REGISTRATION", f"this is an OSF {kind[:-1]} ({a['title']!r}) — editable at any time"
    if a["withdrawn"]:
        return guid, "WITHDRAWN", "registration exists but has been withdrawn"
    when = (a["date_registered"] or "")[:10]
    embargo = " (embargoed)" if a["embargoed"] else ""
    return guid, "REGISTRATION", f"{a['registration_supplement']}, registered {when}{embargo}"
 
 
def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("idents", nargs="*")
    ap.add_argument("--file", help="one identifier per line")
    args = ap.parse_args()
    idents = list(args.idents)
    if args.file:
        idents += [l.strip() for l in open(args.file) if l.strip()]
    if not idents:
        ap.error("give at least one OSF URL, DOI or guid")
 
    bad = 0
    for ident in idents:
        try:
            guid, verdict, detail = classify(ident)
        except ValueError as e:
            print(f"{'SKIP':<18} {ident}  ({e})")
            bad += 1
            continue
        if verdict != "REGISTRATION":
            bad += 1
        print(f"{verdict:<18} osf.io/{guid}  {detail}")
    return 1 if bad else 0
 
 
if __name__ == "__main__":
    sys.exit(main())

Run over every OSF link cited as a preregistration by a paper in this corpus, on 2026-08-13:

$ python3 check_prereg_link.py https://osf.io/fg9pm/ https://doi.org/10.17605/OSF.IO/ZQY7B \
    "osf.io/q4rj3/?view_only=1a4616ad672e4303986a9584e4ff74c9" 5pywm \
    https://osf.io/d6h7b/ https://osf.io/5jd8a/ https://aspredicted.org/HXF_Z92
REGISTRATION       osf.io/fg9pm  OSF Preregistration, registered 2025-04-16
REGISTRATION       osf.io/zqy7b  OSF Preregistration, registered 2024-09-27
NOT-A-REGISTRATION osf.io/q4rj3  this is an OSF node ('Visual analogies and metaphors for conveying privacy information') — editable at any time
NOT-A-REGISTRATION osf.io/5pywm  this is an OSF node ('Revisiting the IUIPC-10 Factor Structure') — editable at any time
PRIVATE            osf.io/d6h7b  not public — reviewers cannot read it without a view-only link
REGISTRATION       osf.io/5jd8a  Preregistration Template from AsPredicted.org, registered 2019-08-08
SKIP               https://aspredicted.org/HXF_Z92  (no OSF guid in 'https://aspredicted.org/HXF_Z92')
$ echo $?
1

Every public registration behind a paper in this corpus, with the gap to publication. The point of the table is the gap: you register long before you know whether the paper will land, and at a different venue from the one you eventually hit. Plan for the registration to outlive several submission cycles.

Three practical notes fall out of the table.

The gap runs from about one year to five — the PoPETs 2024 paper registered in 2019 — and OSF's maximum embargo is four years, so the observed worst case is longer than the longest embargo you can buy. Plan for the registration to become public before the paper does, and decide what that costs you: every venue in the table above reviews anonymously, so a public registration carrying your names is a deanonymisation channel, and it also tells anyone watching the registry what you are about to measure.

The workflow that squares this with double-blind review is the one the corpus papers actually use, and it is worth copying rather than inventing. On OSF: register, embargo, and give reviewers the anonymised view-only link — that is exactly what the IEEE S&P 2025 client-side-scanning paper did, which is why osf.io/d6h7b returns HTTP 401 to everyone else. Lift the embargo when the paper is accepted. On AsPredicted the equivalent is the anonymous share link.

Then actually lift it. The AsPredicted registration behind the IEEE S&P 2023 paper is still marked “currently anonymous to enable blind peer-review” today, three years after publication — the content is readable but the authors are not shown, so nobody who does not already have the URL can connect it to the paper. A registration nobody can find is worth about as much as one that was never made.

A Registered Report is a stronger thing than a preregistration: you submit the protocol as a paper, it is peer-reviewed before you collect the data, and acceptance is granted in principle on the strength of the question and the method, regardless of how the results come out [6Chambers, Christopher D.; Tzavella, Loukia (2022): "The past, present and future of Registered Reports", Nature Human Behaviour 6(1):29-42. (DOI)]. It is the mechanism that actually fixes publication bias, because it removes the incentive to only write up the crawls that found something.

No venue in this corpus runs one. The seven corpus venues, plus SOUPS — which is not in the corpus but is where this community's usable-privacy work goes — checked against their current calls for papers on 2026-08-13:

IMC's Replicability Track is not a Registered Report and it is the easiest thing on this list to mistake for one. It is two-phase — a one-page expression of interest, then a full submission — but the phases are about replicating a previously published result, not about registering a new study's protocol before data collection. It is a valuable track and it answers a different question.

The nearest thing to a Registered Report anywhere adjacent to this literature is the International Fuzzing Workshop (FUZZING), which has run one since its first edition: phase 1 reviews “a full-length preregistered report” on “(i) the significance and novelty of the hypotheses or techniques, and (ii) the soundness and reproducibility of the methodology specified to validate the claims or hypotheses — but explicitly not based on the strength of the (preliminary) results”, and accepted reports get in-principle acceptance for a journal version (an SE special issue in 2022, ACM TOSEM Registered Papers from 2023). It shows up in this corpus only as a citation: five papers — all of them fuzzing papers, at NDSS 2023, CCS 2024, NDSS 2024, IEEE S&P 2026 and NDSS 2026 — cite a FUZZING paper that carries “Registered Report” in its title, and none of the seven venues has copied the mechanism. Software engineering has adopted the mechanism where security has not: MSR and ESEM run conference Registered Reports tracks, and the EMSE journal has taken their stage-2 submissions “since 2019”. CHI has not, as of 2026: its 2026 contribution-types page lists neither registered reports nor preregistration.⁵⁾

This is the open lever. Klemmer et al. [3Klemmer, Jan H.; Schmüser, Juliane; Lowens, Byron M.; Fischer, Fabian; Schmüser, Lea; Schaub, Florian; Fahl, Sascha (2025): "Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] found that “More than half of our participants felt that preregistration and registered reports might enable null result publication” in usable privacy and security — a community that believes it has a publication-bias problem and has no venue mechanism to fix it, sitting next to a workshop in an adjacent field that has run the mechanism successfully since 2022. Whoever pitches a Registered Reports track to a PETS or IMC steering committee has the FUZZING precedent to point at.

Every figure here comes from the extraction over 5,859 papers from CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, plus a regex sweep over the 5,869 paper.cols.txt full texts. The script is report_preregistration.mjs, the sense classification is prereg_fold.mjs, and both live with the full query log on study_preregistration.

This is the first thing that goes wrong if you query for preregistration in a security corpus. 62 of 5,869 full texts (1.1%) contain pre-regist*. In most of them it describes a pre-registered domain (defenders racing a DGA), a pre-registered redirect URI (OAuth), a pre-registered device (FIDO2, provisioning profiles), a pre-registered account (a crawler's login), or a pre-registered command (a chat bot). Any count that does not separate the senses is wrong by a factor of four.

The three meta papers are worth knowing: Hantke et al. [2Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] propose a pre-registration board, Klemmer et al. [3Klemmer, Jan H.; Schmüser, Juliane; Lowens, Byron M.; Fischer, Fabian; Schmüser, Lea; Schaub, Florian; Fahl, Sascha (2025): "Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] interview researchers about the practice, and Wei et al. [5Wei, Miranda; Mink, Jaron; Eiger, Yael; Kohno, Tadayoshi; Redmiles, Elissa M.; Roesner, Franziska (2024): "SoK (or SoLK?): On the Quantitative Study of Sociodemographic Factors and Computer Security Behaviors", in: Proceedings of the USENIX Security Symposium. (Link)] recommend it (“Consider study pre-registration”) in a systematisation of sociodemographic research.

Of the fifteen, fourteen recruited human participants and one ran a crawl; none did neither. Preregistration in these venues is, to a first approximation, something the usable-privacy-and-security community brought with it from psychology.

IMC has none, which is the single most telling cell in the table: it is the venue with the lowest share of human-subjects papers (10.5%, against 42.2% at PoPETs) and the highest share of empirical ones (98.0%). The venue that measures the most and surveys the least has never seen a preregistration.

Worth knowing if you plan to query this dataset yourself. The extraction has two fields that should catch a preregistration: statistics[].kind == “preregistration” and artifacts.links[].kind == “preregistration”. They fire on 7 and 12 papers respectively, 14 as a union, and 5 on both.

The false positive is instructive rather than embarrassing. Tang et al. [19Tang, Jenny; Shoemaker, Hannah; Lerner, Ada; Birrell, Eleanor (2021): "Defining Privacy: How Users Interpret Technical Terms in Privacy Policies", in: Proceedings on Privacy Enhancing Technologies. (DOI)] write “In an effort to limit the number of Type I errors, we committed to an analysis plan prior to analyzing the responses from our main study” — a genuine pre-specified analysis plan, with no registry, no link and no timestamp. The extractor scored it as preregistration and it is not one. A commitment nobody else can check is not a preregistration, and the distinction is the whole point of the practice. It is also the cheapest thing to fix: that paper was one OSF form away.

Searching for the word finds 15 papers. Searching for the thing finds a little more. A completeness sweep for /\banalysis plan/ over all 5,869 full texts returns 12 papers, 8 of them outside the 62 pre-regist* hits; five of those eight are section headings or incidental (“we discussed our analysis plan with peers”), and three are real pre-committed analysis plans with no registry at all — Tang et al. [19Tang, Jenny; Shoemaker, Hannah; Lerner, Ada; Birrell, Eleanor (2021): "Defining Privacy: How Users Interpret Technical Terms in Privacy Policies", in: Proceedings on Privacy Enhancing Technologies. (DOI)] above, plus two PoPETs 2024 papers. All three are PoPETs, all three justify the plan by Type I error, and none of them uses the word “preregistration” anywhere:

• “We created an analysis plan to reduce the number of Type I errors in our analysis”, and for the second study “We followed our previously created analysis plan to limit any false positives (Type I errors)”.
• A significant result declined because “this was outside our analysis plan. We had no priors on which directions we should expect a change.” That is exactly the discipline preregistration exists to enforce, exercised on the honour system.

If you already write an analysis plan, you are most of the way there and the remaining step is a form and a timestamp. That is the practical finding of this whole page.

Five other probes were run and returned nothing: pre-specified (77 papers, all of it a technical term — prespecified timestamps, prespecified sanitizers), a priori hypothes (0), registered (our|the) (study|hypotheses|analysis|protocol) (0), confirmatory (study|analysis) (1, and it means a follow-up interview round), and the non-OSF registries clinicaltrials.gov, socialscienceregistry and aearegistry (2 papers, neither registering anything). The full probe list with its reasons is in prereg_fold.mjs.

The three that report a deviation are the best-behaved papers here, not the worst. Chen et al. [18Chen, Xiaowei; Distler, Verena; Gordon, Chloe; Yao, Yaxing; Teuber, Ziwen (2025): "Empowering Parents to Support Children's Online Security and Privacy: Findings from a Randomized Controlled Trial", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]: “In the preregistration, we initially planned to use analysis of variance (ANOVA) with repeated measures. Instead, we decided to use generalized linear regressions…” Elbitar et al. [14Elbitar, Yusra; Hart, Alexander; Bugiel, Sven (2025): "The Power of Words: A Comprehensive Analysis of Rationales and Their Effects on Users' Permission Decisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]: “We deviated from our preregistration for permissions and chose to treat them as random effects rather than fixed effects with difference coding.” Frank et al. [13Frank, Joel; Herbert, Franziska; Ricker, Jonas; Schönherr, Lea; Eisenhofer, Thorsten; Fischer, Asja; Dürmuth, Markus; Holz, Thorsten (2024): "A Representative Study on Human Detection of Artificially Generated Media Across Countries", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]: “…differing from our preregistration, only run a regression analysis on the latter.” Akgul et al. [15Akgul, Omer; Roberts, Richard; Shroyer, Emma; Levin, Dave; Mazurek, Michelle L. (2025): "As Advertised? Understanding the Impact of Influencer VPN Ads", in: Proceedings of the USENIX Security Symposium. (Link)] state the negative: “our final analysis did not deviate from our original plan.” One sentence each.

The four that separate confirmatory from exploratory results do the next-best thing, and Roch et al. [20Roch, Neele; Sievers, Hannah; Zufferey, Noé; Zimmermann, Verena (2026): "You Know Why, but Still Rely: The Impact of Explainable AI on Trust, Task Load, and Performance in Cybersecurity Decision-Making", in: Proceedings of the USENIX Security Symposium. (Link)] show the pattern most cleanly: “we first present the results in line with our research questions and hypotheses from the pre-registration. Then, we report on additional exploratory analyses.” Their registration covers “the hypotheses, the data analysis plan, and the power analysis” — registering the power analysis is the detail worth stealing, because it is the number a reviewer will otherwise assume you computed afterwards.

Preregistration is not uniquely neglected here. Of the 1,762 papers that ran inference beyond descriptive statistics:

Narrowed to the population that needs them — the 1,025 papers that ran a hypothesis test — 24.5% report a multiple-comparison correction and 7.0% report a power analysis. Among the 1,357 papers that recruited participants, 35.5% ran a hypothesis test, 5.5% report a power analysis and 1.0% preregistered. If you are arguing for preregistration in a review or a lab meeting, these are the numbers that make it a proportionate ask rather than an exotic one. See Pvalue corrections and Hypothesis testing.

• Two independent sources, kept apart. The schema fields and a regex sweep over full text disagree in both directions, so the report prints the disagreement instead of a union. The population of 15 is the full-text sweep's study sense, hand-classified.
• The sense classification is a hand list, not a regex. “Pre-registered” has a homograph in security writing and no surface feature separates the senses — only the sentence does. Every one of the 62 hits was read and classified with the deciding phrase recorded in prereg_fold.mjs. The residue is 0 and the script prints it; a paper added to a future corpus that matches the regex and is not in the list will print as unclassified rather than silently joining a bucket.
• So is the adherence classification, for the same reason: a rule matching /deviat/ labelled “our final analysis did not deviate from our original plan” a deviation, and a rule matching /as pre-registered/ labelled a method descriptor an adherence statement.
• A paper counts once, never once per mention.
• Denominators are named on every table and are never “of 5,859 papers” unless the row says so.
• Quotes were checked against the source. Eighteen quotes were verified against paper.cols.txt; 16 matched verbatim or through an 8-word run and 2 were present but spliced across a column break — the known reading-order artefact — and were confirmed fragment by fragment.
• Venue coverage. Seven venues. EuroS&P, ACSAC, RAID, AsiaCCS, WPES, CHI and SOUPS are absent, and SOUPS matters most here: it is the venue where usable-privacy work with preregistrations is most likely to appear, so the 15 is a lower bound on the practice in the field, and probably a substantial one.
• 138 of the 5,859 records are posters and 251 are four pages or shorter. A poster has its methodology compressed out, so it depresses every reporting figure slightly. It does not affect the count of 15, which came from full text.
• 2025 and 2026 are provisional. See the box above.
• Every external claim was re-fetched on 2026-08-13, not recalled. The full query log, the unedited script output, the fold with its residue, the sources rejected and what could not be established are on study_preregistration; corpus-level caveats are on Corpus.

If you preregister a measurement study, these are the things that make the registration worth writing.

1. The registry and the immutable identifier. https://doi.org/10.17605/OSF.IO/FG9PM, not “our materials are on OSF”. Run check_prereg_link.py on your own link before you submit.
2. The template you used, because it tells the reader which questions you were asked and therefore which silences are yours and which are the form's.
3. The date you registered, and what you had already seen. “Registration prior to analysis of the data” is a legitimate answer and the honest one for a crawl; say what your team had touched during collection.
4. The population, its list, its version and the rank cut, in the registration and again in the paper. This is the decision that most often moves after the data arrive.
5. The exclusion rule and the denominator, in advance, in the same words you will use in the paper.
6. The classifier, its version and its threshold if you have one.
7. Which analyses are confirmatory and which are exploratory. Label them in the paper's section headings, not only in the registration.
8. Whether you deviated, and how. One sentence. Only four of the fifteen papers here state it either way, and without it the registration does nothing for a reader who does not open it.
9. If your study is a reanalysis of an existing dataset, use the Secondary Data Preregistration template and answer its Access date and Prior knowledge questions rather than forcing a reanalysis into the experiment template.
10. If you cannot register, say so and say why, and pin what you can: an ethics-board submission with a date, a Git commit of the analysis script before the data land, an archived crawl configuration. A dated commit hash is weaker than a registration and much stronger than nothing.

• Hypothesis testing and P-value corrections — the practices a preregistration commits you to in advance.
• Biases — what a fixed population and a fixed exclusion rule protect you from.
• User studies — where preregistration is already normal, and where all but one of the corpus papers here live.
• Website selection and Representative sampling methods — the population decision the registration has to pin down.
• Automated measurements and Stateful vs stateless crawling — the crawl configuration a measurement registration would have to name.
• Ethics — the other pre-commitment, and the one venues do ask for.
• Artifacts — the thing preregistration is repeatedly confused with, and which the venues do run machinery for.
• Provenance of this page's figures.

[1]

Cuevas, Alejandro; Ribeiro, Manoel Horta; Christin, Nicolas (2026): "Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit", in: Proceedings of the USENIX Security Symposium. (Link)

[2]

Hantke, Florian; Roth, Sebastian; Mrowczynski, Rafael; Utz, Christine; Stock, Ben (2024): "Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[3]

Klemmer, Jan H.; Schmüser, Juliane; Lowens, Byron M.; Fischer, Fabian; Schmüser, Lea; Schaub, Florian; Fahl, Sascha (2025): "Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[4]

Cockburn, Andy; Gutwin, Carl; Dix, Alan (2018): "HARK No More: On the Preregistration of CHI Experiments", in: Proceedings of the CHI Conference on Human Factors in Computing Systems. (DOI)

[5]

Wei, Miranda; Mink, Jaron; Eiger, Yael; Kohno, Tadayoshi; Redmiles, Elissa M.; Roesner, Franziska (2024): "SoK (or SoLK?): On the Quantitative Study of Sociodemographic Factors and Computer Security Behaviors", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Chambers, Christopher D.; Tzavella, Loukia (2022): "The past, present and future of Registered Reports", Nature Human Behaviour 6(1):29-42. (DOI)

[7]

Seong, Youn Jun; Oh, Ha Young (2026): "MACA: A Multi-Agent Cognitive Adaptation Framework for Human-Agent Collaborative Decision Making", in: Proceedings of the ACM Web Conference. (DOI)

[8]

Groß, Thomas (2021): "Validity and Reliability of the Scale Internet Users' Information Privacy Concerns (IUIPC)", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[9]

Zimmermann, Verena; Toth, Adrienn; Sievers, Hannah; Fanconi, Linda; Isenring, Yanis; Henz, Mona; Stöver, Alina; Gerber, Nina (2025): "Let's Get Visual - Testing Visual Analogies and Metaphors for Conveying Privacy Policies and Data Handling Information", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[10]

Crowder, Rachel; Price, George; Groß, Thomas (2024): "Simply tell me how—On Trustworthiness and Technology Acceptance of Attribute-Based Credentials", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[11]

Story, Peter; Smullen, Daniel; Chen, Rex; Yao, Yaxing; Acquisti, Alessandro; Cranor, Lorrie Faith; Sadeh, Norman; Schaub, Florian (2022): "Increasing Adoption of Tor Browser Using Informational and Planning Nudges", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Lee, Hao-Ping (Hank); Logas, Jacob; Yang, Stephanie S.; Li, Zhouyu; Barbosa, Natã M.; Wang, Yang; Das, Sauvik (2023): "When and Why Do People Want Ad Targeting Explanations? Evidence from a Four-Week, Mixed-Methods Field Study", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[13]

Frank, Joel; Herbert, Franziska; Ricker, Jonas; Schönherr, Lea; Eisenhofer, Thorsten; Fischer, Asja; Dürmuth, Markus; Holz, Thorsten (2024): "A Representative Study on Human Detection of Artificially Generated Media Across Countries", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[14]

Elbitar, Yusra; Hart, Alexander; Bugiel, Sven (2025): "The Power of Words: A Comprehensive Analysis of Rationales and Their Effects on Users' Permission Decisions", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[15]

Akgul, Omer; Roberts, Richard; Shroyer, Emma; Levin, Dave; Mazurek, Michelle L. (2025): "As Advertised? Understanding the Impact of Influencer VPN Ads", in: Proceedings of the USENIX Security Symposium. (Link)

[16]

Petelka, Justin; Berens, Benjamin; Sugatan, Carlo; Volkamer, Melanie; Schaub, Florian (2025): "Restricting the Link: Effects of Focused Attention and Time Delay on Phishing Warning Effectiveness", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[17]

Hsieh, Jhih-Yi; Raghunathan, Aditi; Shah, Nihar B. (2025): "Vulnerability of Text-Matching in ML/AI Conference Reviewer Assignments to Collusions", in: Proceedings of the USENIX Security Symposium. (Link)

[18]

Chen, Xiaowei; Distler, Verena; Gordon, Chloe; Yao, Yaxing; Teuber, Ziwen (2025): "Empowering Parents to Support Children's Online Security and Privacy: Findings from a Randomized Controlled Trial", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[19]

Tang, Jenny; Shoemaker, Hannah; Lerner, Ada; Birrell, Eleanor (2021): "Defining Privacy: How Users Interpret Technical Terms in Privacy Policies", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[20]

Roch, Neele; Sievers, Hannah; Zufferey, Noé; Zimmermann, Verena (2026): "You Know Why, but Still Rely: The Impact of Explainable AI on Trust, Task Load, and Performance in Cybersecurity Decision-Making", in: Proceedings of the USENIX Security Symposium. (Link)