Black-Box Adversarial Example Attacks on Machine Learning based Election Systems

arXiv:2611.02166v1 Announce Type: cross Abstract: Machine learning models have shown exceptional accuracy for ballot classification in election systems. Recent research has demonstrated that these ballot classification models are vulnerable to adversarial example attacks. This is a critical security issue because a successful attack could alter the outcome of an election and undermine the democratic process. However, all adversarial example attacks in the voting domain have assumed a white-box threat model, where the classifier parameters are known. In this work, we advance the field of machine learning in election systems by analyzing a realistic black-box adversary. We implement and evaluate eleven state-of-the-art black-box attacks: query based attacks ADBA, Square, SurFree, RayS, and SA-MOO. We also test adaptive transfer based black-box attacks with APGD-$l_\infty$, APGD-$l_2$, APGD-$l_1$, PGD $l_0$, PGD $l_0$+$l_\infty$, and PGD $l_0$+$\sigma$. Our attacks span multiple different norms ($l_\infty$, $l_2$, $l_1$, and $l_0$) and three different black-box adversarial threat models (decision based, score based and transfer based). In addition to digital analyses, we physically print and scan $20,000$ adversarial examples to evaluate the real-world performance of different black-box attacks. Our finding demonstrate an even larger physical-digital robustness gap exists for black-box adversarial examples than for white-box adversarial examples. Lastly, we conduct the first ever adversarial example transferability study in the voting domain and test adversarial training and barrier zones as two possible black-box defense strategies.