{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/busting-the-paper-ballot-voting-meets","title":"Busting the Paper Ballot: Voting Meets Adversarial Machine Learning","arxiv_id":"2506.14582","date":"2025-06-17","proceeding":null,"authors":["Kaleel Mahmood","Caleb Manicke","Ethan Rathbun","Aayushi Verma","Sohaib Ahmad","Nicholas Stamatakis","Laurent Michel","Benjamin Fuller"],"abstract":"We show the security risk associated with using machine learning classifiers in United States election tabulators. The central classification task in election tabulation is deciding whether a mark does or does not appear on a bubble associated to an alternative in a contest on the ballot. Barretto et al. (E-Vote-ID 2021) reported that convolutional neural networks are a viable option in this field, as they outperform simple feature-based classifiers. Our contributions to election security can be divided into four parts. To demonstrate and analyze the hypothetical vulnerability of machine learning models on election tabulators, we first introduce four new ballot datasets. Second, we train and test a variety of different models on our new datasets. These models include support vector machines, convolutional neural networks (a basic CNN, VGG and ResNet), and vision transformers (Twins and CaiT). Third, using our new datasets and trained models, we demonstrate that traditional white box attacks are ineffective in the voting domain due to gradient masking. Our analyses further reveal that gradient masking is a product of numerical instability. We use a modified difference of logits ratio loss to overcome this issue (Croce and Hein, ICML 2020). Fourth, in the physical world, we conduct attacks with the adversarial examples generated using our new methods. In traditional adversarial machine learning, a high (50% or greater) attack success rate is ideal. However, for certain elections, even a 5% attack success rate can flip the outcome of a race. We show such an impact is possible in the physical domain. We thoroughly discuss attack realism, and the challenges and practicality associated with printing and scanning ballot adversarial examples.","url_abs":"https://arxiv.org/abs/2506.14582v1","url_pdf":"https://arxiv.org/pdf/2506.14582v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"busting-the-paper-ballot-voting-meets","repo_url":"https://github.com/votercenter/busting-the-ballot","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[{"method_slug":"flip","method_name":"FLIP"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2506.14582","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2506.14582"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/VoterCenter/Busting-the-Ballot","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/votercenter/busting-the-ballot","reach":null}],"summary":{"ran_fixture":4},"by_repo_kind":{"official":{"samples":4,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"30f145cbbf56449f","entry":"SimpleCNN","repo":"votercenter/busting-the-ballot","repo_kind":"official","path":"Models/SimpleCNN.py","file_url":"https://github.com/votercenter/busting-the-ballot/blob/HEAD/Models/SimpleCNN.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"30f145cbbf56449f"}},{"code_sha256_prefix":"3db9538f1b20fbeb","entry":"resnet164","repo":"VoterCenter/Busting-the-Ballot","repo_kind":"official","path":"Models/ResNet.py","file_url":"https://github.com/VoterCenter/Busting-the-Ballot/blob/HEAD/Models/ResNet.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"3db9538f1b20fbeb"}},{"code_sha256_prefix":"12689be989900b1f","entry":"resnet20","repo":"VoterCenter/Busting-the-Ballot","repo_kind":"official","path":"Models/ResNet.py","file_url":"https://github.com/VoterCenter/Busting-the-Ballot/blob/HEAD/Models/ResNet.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"12689be989900b1f"}},{"code_sha256_prefix":"2d34d118097b87ab","entry":"resnet56","repo":"VoterCenter/Busting-the-Ballot","repo_kind":"official","path":"Models/ResNet.py","file_url":"https://github.com/VoterCenter/Busting-the-Ballot/blob/HEAD/Models/ResNet.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-3-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"2d34d118097b87ab"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}