What is the relationship between conference and workshop papers?

I wrote this description recently to a student, and a colleague suggested I make a persistent public page for it, so here you go. It is written with the ML privacy and security in mind, but I expect it to broadly reflect norms in both the ML and privacy/security community, but probably not far beyond that.

Question: I see a paper at a workshop, (when) should I expect to see it at a conference?
Answer: There isn't one clear answer. People submit their work to workshops and conferences for different reasons. Here are three common cases:

• The most common case is that people submit preliminary work to a workshop and a full version later to a conference. This case is commonly used to get early feedback on the work, or just as an excuse to go to a conference. The full version might appear soon after the workshop version, or it could be a while, depending on how long it takes to write the full version. I have a workshop paper from PPML 2020 whose full version is still not online!
• Sometimes people just submit to a workshop, and don't submit anywhere else. This case can happen if it's a good workshop (the venue I have in mind is AISec, please submit!). It can also happen if they decide it's not worth the time (the paper keeps getting rejected, gets scooped, the authors are in industry, etc.). For example, ChatGPT's release meant this paper should have more experiments to be interesting enough for a conference, and we decided to let the paper remain a workshop paper.
• Sometimes the paper is already submitted or accepted to a conference, and the authors submit an abridged version to a workshop. Common reasons are to get the work in front of a specific community, or, again, to have an excuse to go to a conference. I see this case frequently at community-oriented workshops, like TPDP or GenLaw.

Not all venues have the same rules, so make sure you check you're not violating any rules (e.g. concurrent submissions) when you submit!

Question: This paper has a workshop version, a conference version, and six arxiv versions! Which version should I read? Which version do I cite?
Answer: No answer to this question can avoid an argument. Here are some considerations:

• The most uncontroversial part of this: you can't go wrong with citing the conference version. I like arxiv and don't mind citing arxiv versions, but some people strongly disagree.
• I almost always prefer to read the arxiv version. People are generally good about making that the most up-to-date version of the paper, they're not forced to follow arbitrary formatting requirements, and there are no paywalls.
• Defaulting to arxiv does incentivize flag planting. Flag planting is when someone quickly posts a paper to ``claim'' an idea, but the work is not of high enough quality to warrant a full conference paper (although they may later update it with a more worked-out paper). You feel free to judge how big a problem you think this is.

For your own papers, I recommend putting the paper on arxiv once you're happy with it, rather than when it's a minimal coherent paper. People generally only read papers once, so don't expect the changes you make in your v2 (or v6!) to be widely read.