Inquiry regarding researcher verification process for restricted datasets

[sisu67]

Thank you for your valuable work and for prioritizing security by carefully managing the release of sensitive data.

I have read the Security & Ethics statement. I am currently conducting academic research in the field of LLM package hallucinations, and I am highly interested in requesting access to the full results for academic use, specifically:

• The master list of hallucinated package names
• Per-prompt detailed results

I have already sent an email request from my academic email address(liqing@stu.xidian.edu.cn).

Could you please clarify the standard procedure to verify my identity as a researcher? Specifically, I would like to know:

1. What specific information or documentation is required for verification (e.g., academic email, faculty profile URL, brief research proposal)?
2. Is there a specific form I should fill out, or should I send my credentials to your email?
3. Whether there are any required Non-Disclosure Agreements (NDAs) or data usage agreements to sign (which I am fully prepared to do to ensure the information is strictly used for academic purposes).

I am ready to provide all necessary supplementary information via email.

Looking forward to your guidance.

[Spracks]

I haven't received any emails from that address, I'll keep an eye out. For verification, do you have any published papers you could link to or a Google Scholar page with your email linked?

[sisu67]

Thank you for getting back to me so quickly!

Regarding the email, I will resend it right away from my institutional address (liqing@stu.xidian.edu.cn) just in case it got lost or went to your spam folder.

To be completely transparent regarding verification: I am currently a PhD student. If this project goes smoothly, this research on LLM package hallucinations will actually lead to my very first publication. Because of this, I do not yet have published papers or a populated Google Scholar profile.

However, to verify my academic identity and the legitimacy of my research, I can offer the following alternatives:

1. ORCID Profile: You can find my ORCID profile here: [https://orcid.org/0009-0000-2765-8644].
2. Student ID/Enrollment Proof: I provide a scan of my university student ID or official enrollment certificate via email.

Would these alternative methods be acceptable for your verification process? I am very committed to following your security protocols.

Thank you again for your time and understanding!

[Spracks]

Please email me at joseph.spracken@my.utsa.edu, I didn't receive an email yet. Once I get your email I can respond with the requested files.

[sisu67]

Ah, that completely explains it! I was sending it to the email address currently listed on your GitHub [joseph.spracklen@utsa.edu], which must be outdated or incorrect.

I have just sent the email (along with my student ID and enrollment proof) to joseph.spracklen@my.utsa.edu. The subject line is: Request for Restricted Artifact Access — "We Have a Package for You!" (USENIX Security 2025) [GitHub Issue #3].

Thank you so much for your understanding and for agreeing to share the files upon verification. I really appreciate your help!

[sisu67]

Hi Joseph,

Just a quick follow-up — five days ago I sent the verification email liqing@stu.xidian.edu.cn to joseph.spracklen@my.utsa.edu, with the subject "Request for Restricted Artifact Access — 'We Have a Package for You!' (USENIX Security 2025) [GitHub Issue #3]." I wanted to check whether it reached you, since a couple of my earlier messages don't seem to have arrived.

If it's still not showing up, it's most likely a cross-institution spam-filtering issue with my university's outgoing mail — so I've just resent the same materials from my personal Gmail qlee8952@gmail.com to joseph.spracklen@my.utsa.edu as a backup. One thing to confirm: your earlier comment spelled the address "spracken" rather than "spracklen", so could you let me know the exact spelling to make sure it lands in the right inbox? It might also be worth a quick check of your spam/junk folder. Happy to use whichever channel is easiest for you going forward.

Thanks again for your patience and for being willing to share the materials.