Analyzing Physical Adversarial Example Threats to Machine Learning in Election Systems

Khaleque Md Aashiq Kamal; Surya Eada; Aayushi Verma; Subek Acharya; Adrian Yemin; Benjamin Fuller; Kaleel Mahmood

cs.LGFeb 28, 2026

Analyzing Physical Adversarial Example Threats to Machine Learning in Election Systems

Authors: Khaleque Md Aashiq Kamal, Surya Eada, Aayushi Verma, Subek Acharya, Adrian Yemin, Benjamin Fuller, Kaleel Mahmood

Organizations: Department of Electrical, Computer and Biomedical Engineering, University of Rhode Island, Kingston, RI, USA · Voting Technology Center, University of Connecticut, Storrs, CT, USA · Department of Computer Science and Statistics, University of Rhode Island, Kingston, RI, USA

Abstract

Developments in the machine learning voting domain have shown both promising results and risks. Trained models perform well on ballot classification tasks (> 99% accuracy) but are at risk from adversarial example attacks that cause misclassifications. In this paper, we analyze an attacker who seeks to deploy adversarial examples against machine learning ballot classifiers to compromise a U.S. election. We first derive a probabilistic framework for determining the number of adversarial example ballots that must be printed to flip an election, in terms of the probability of each candidate winning and the total number of ballots cast. Second, it is an open question as to which type of adversarial example is most effective when physically printed in the voting domain. We analyze six different types of adversarial example attacks: l_infinity-APGD, l2-APGD, l1-APGD, l0 PGD, l0 + l_infinity PGD, and l0 + sigma-map PGD. Our experiments include physical realizations of 144,000 adversarial examples through printing and scanning with four different machine learning models. We empirically demonstrate an analysis gap between the physical and digital domains, wherein attacks most effective in the digital domain (l2 and l_infinity) differ from those most effective in the physical domain (l1 and l2, depending on the model). By unifying a probabilistic election framework with digital and physical adversarial example evaluations, we move beyond prior close race analyses to explicitly quantify when and how adversarial ballot manipulation could alter outcomes.

Figures & tables

Figure 1: U.S. Election Pipeline: First officials define a ballot layout which is then sent for printing. During the printing step, an attacker could potentially compromise ballot printers and add adversarial examples to the ballots. The ballots are then distributed to voters on election day and tabulation can be done by a ballot classifier.

Model (Trained On)	Training Accuracy		Validation Accuracy
Model (Trained On)	Bubbles	Combined	Bubbles	Combined
SVM-B	1.0000	.8992	1.0000	.9026
VGG-16-B	1.0000	.9205	1.0000	.9247
ResNet-20-B	1.0000	.9147	1.0000	.9155
CaiT-B	1.0000	.8955	1.0000	.8992
SVM-C	.9989	.9824	.9989	.9784

Table 1: Clean training and validation accuracies on the Bubble and Combined dataset for all models.

Figure 2: Physical Adversarial examples with varying $\epsilon$ or $k$ for all attacks on the CaiT-C model.

Model	$l_{\infty}$ -APGD	$l_{1}$ -APGD	$l_{2}$ -APGD	$l_{0}$ PGD	$l_{0}{+}l_{\infty}$ PGD	$l_{0}{+}\sigma$ PGD
	$\epsilon{=}16/255$	$\epsilon{=}20$	$\epsilon{=}2$	$k{=}1$	$\epsilon{=}64/255$	$k{=}1$
SVM-B	1.000	1.000	1.000	1.000	1.000	1.000
SVM-C	0.500	0.500	0.500	1.000	1.000	1.000
VGG16-B	0.000	0.498	0.000	1.000	1.000	0.774
VGG16-C	0.000	0.500	0.000	0.889	0.537	0.500
ResNet20-B	0.219	0.027	0.260	1.000	1.000	1.000

Table 2: Robust accuracy for each attack using the selected imperceptible perturbation parameters. For the ”-C” models, we bold the attack that is the most effective (lowest robustness).

Model	Clean	Clean+AE	$l_{\infty}$ -APGD	$l_{1}$ -APGD	$l_{2}$ -APGD	$l_{0}$ PGD	$l_{0}{+}l_{\infty}$ PGD	$l_{0}{+}\sigma$ PGD
	$0/255$	$0/255$	$\epsilon{=}16/255$	$\epsilon{=}20$	$\epsilon{=}2$	$k{=}1$	$\epsilon{=}64/255$	$k{=}1$
SVM-C	0.936	0.977	0.583	0.603	0.552	1.000	0.960	1.000
VGG-16-C	0.971	0.972	1.000	0.708	0.946	1.000	1.000	0.999
ResNet20-C	0.972	0.976	1.000	0.971	0.989	1.000	1.000	0.975
CaiT-C	0.969	0.994	0.540	0.501	0.503	1.000	0.919	0.963

Table 3: Physical world robust accuracy for the Combined models for each of the six norm attacks.

Figure 3: Digital and printed physical adversarial examples for the CaiT-C model. Each attack uses the imperceivable parameters determined in Section 5 .

	$l_{\infty}$	$l_{1}$	$l_{2}$	$l_{0}$	$l_{0}+l_{\infty}$	$l_{0}+\sigma$ -map
RMSE	0.062	0.069	0.058	0.054	0.078	0.068
KL	5.71	12.18	0.52	22.70	22.49	22.71
SSIM	0.442	0.415	0.474	0.481	0.250	0.455

Table 4: Root Mean Square Error (RMSE), Kullback–Leibler divergence (KL) and Structural Similarity Index Measure (SSIM) between the printed perturbation

\delta_{print}

and the digital perturbation

\delta_{digital}

for each norm attack.

Figure 4: Histograms for a digital clean ballot (left), its corresponding $l_{1}$ digital adversarial example (center) and the physically printed and scanned adversarial example (right).

Appendix figures & tables28 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: UConn Bubbles with Marginal Marks dataset.

Model	Hyperparameters
Model	LR	DR	Epochs	WD	BS
CaiT-B	0.00005	0.1	200	0.0	128
ResNet20-B	0.1	0.0	60	0.0001	64
VGG16-B	0.001	0.0	40	0.0	64
CaiT-C	0.00005	0.1	200	0.0	128
ResNet20-C	0.1	0.0	100	0.0001	128

Appendix

Table 5: Hyperparameter settings for the various grayscale models. Abbreviations: LR = learning rate, DR = dropout rate, WD = weight decay, and BS = batch size.

Mark Type	Total Samples	Correct Predictions	Accuracy
Empty Bubbles	5327	5327	100.00%
Filled Bubbles	1810	1810	100.00%
Penrest	703	703	100.00%
Checkmark	703	701	99.72%
Crossmark	703	675	96.02%
Left right synthetic	703	703	100.00%

Appendix

Table 6: ResNet20-C Classification results for different mark types on the dataset.

Mark Type	Total Samples	Correct Predictions	Accuracy
Empty Bubbles	5327	5327	100.00%
Filled Bubbles	1810	1810	100.00%
Penrest	703	702	99.86%
Checkmark	703	701	99.72%
Crossmark	703	664	94.45%
Left right synthetic	703	703	100.00%

Appendix

Table 7: CaiT-C classification results for different mark types on the dataset.

Mark Type	Total Samples	Correct Predictions	Accuracy
Empty Bubbles	5327	5319	99.85%
Filled Bubbles	1810	1810	100.00%
Penrest	703	690	98.15%
Checkmark	703	665	94.59%
Crossmark	703	532	75.68%
Left right synthetic	703	703	100.00%

Appendix

Table 8: SVM-C classification results for different mark types on the dataset.

Mark Type	Total Samples	Correct Predictions	Accuracy
Empty Bubbles	5327	5327	100.00%
Filled Bubbles	1810	1810	100.00%
Penrest	703	703	100.00%
Checkmark	703	701	99.72%
Crossmark	703	675	96.02%
Left right synthetic	703	703	100.00%

Appendix

Table 9: VGG16-C classification results for different mark types on the dataset

Figure 6: Physical Adversarial examples with varying $\epsilon$ or $k$ for all attacks on the ResNet20-C model.

Figure 7: Physical Adversarial examples with varying $\epsilon$ or $k$ for all attacks on the VGG16-C model.

Figure 8: Physical Adversarial examples with varying $\epsilon$ or $k$ for all attacks on the SVM-C model.

Model	Expert	$l_{\infty}$ -APGD	$l_{1}$ -APGD	$l_{2}$ -APGD	$l_{0}$ PGD	$l_{0}{+}l_{\infty}$ PGD	$l_{0}{+}\sigma$ -map PGD
CaiT-C	Expert 1	4	4	1	1	32	1
	Expert 2	8	4	3	1	64	1
	Expert 3	4	4	4	1	64	1
	Expert 4	8	4	3	1	64	1
	Expert 5	4	4	2	1	64	10
	Expert 6	8	2	1	10	64	1

Appendix

Table 10: Election security expert selected imperceptible values for each attack and model. For

l_{\infty}

-APGD and

l_{0}{+}l_{\infty}

PGD, values denote the numerator of

\epsilon/255

. For

l_{1}

-APGD and

l_{2}

-APGD, values are

\epsilon

. For

l_{0}

-based attacks, values are

k

Model	Step size init	# Steps	Random start
SVM/VGG16/ResNet20	$2\epsilon$	500	False
CaiT	$0.05\epsilon$	1500	False

Appendix

Table 11:

l_{\infty}

-APGD hyperparameters.

Model	Step size init	# Steps	Random start
ResNet20-B	$1.0\epsilon$	500	False
ResNet20-C	$0.05\epsilon$	500	False
CaiT-B	$0.05\epsilon$	500	False
CaiT-C	$0.10\epsilon$	1250	False
SVM-B	$0.05\epsilon$	500	False
SVM-C	$0.10\epsilon$	500	False

Appendix

Table 12:

l_{1}

-APGD hyperparameters.

Model	Step size init	# Steps	Random start
ResNet20-B	$2\epsilon$	100	False
ResNet20-C	$2\epsilon$	150	False
CaiT-B	$2\epsilon$	100	False
CaiT-C	$2\epsilon$	750	False
SVM-B	$2\epsilon$	100	False
SVM-C	$2\epsilon$	100	False

Appendix

Table 13:

l_{2}

-APGD hyperparameters.

Model	# Steps	# Step size	# Restarts	Random start
ResNet20-B	25	15	10	True
ResNet20-C	30	15	10	True
CaiT-B	25	15	10	True
CaiT-C	30	15	10	True
SVM-B	25	15	10	True
SVM-C	25	15	10	True

Appendix

Table 14:

l_{0}

-PGD hyperparameters.

Model	# Steps	Step size	$\kappa$	# Restarts	Random start
ResNet20-B	75	15	10	10	True
ResNet20-C	75	15	10	10	True
CaiT-B	500	15	30	1	True
CaiT-C	500	15	30	1	True
SVM-B	500	15	30	1	True
SVM-C	75	15	10	10	True

Appendix

Table 15:

l_{0}{+}\sigma

-map PGD hyperparameters.

Model	Robust acc. ( $\epsilon{=}255/255$ )
ResNet20-B	0.000
ResNet20-C	0.000
CaiT-B	0.000
CaiT-C	0.017
SVM-B	0.000
SVM-C	0.000

Appendix

Table 16: Digital robust accuracy at the maximum budget for

l_{\infty}

-APGD using cross-entropy (CE) loss.

Model	$4/255$	$8/255$	$16/255$	$32/255$	$64/255$
ResNet20-B	1.000	0.493	0.219	0.000	0.000
ResNet20-C	0.404	0.002	0.000	0.000	0.000
CaiT-B	1.000	1.000	1.000	1.000	0.614
CaiT-C	0.983	0.501	0.500	0.498	0.492
SVM-B	1.000	1.000	1.000	1.000	0.113
SVM-C	0.500	0.500	0.500	0.385	0.000

Appendix

Table 17: Digital robust accuracy for

l_{\infty}

-APGD (DLR loss) at different

\epsilon

budgets.

Model	$2$	$4$	$8$	$20$	$200$
ResNet20-B	1.000	0.516	0.497	0.027	0.000
ResNet20-C	0.499	0.454	0.088	0.000	0.000
CaiT-B	1.000	1.000	1.000	0.496	0.000
CaiT-C	1.000	0.513	0.500	0.499	0.418
SVM-B	1.000	1.000	1.000	1.000	0.000
SVM-C	1.000	0.508	0.500	0.500	0.000

Appendix

Table 18: Digital robust accuracy for

l_{1}

-APGD (DLR loss) at different

\epsilon

budgets.

Model	$\epsilon{=}1$	$\epsilon{=}2$	$\epsilon{=}3$	$\epsilon{=}5$	$\epsilon{=}15$
ResNet20-B	0.475	0.260	0.000	0.000	0.000
ResNet20-C	0.000	0.000	0.000	0.000	0.000
CaiT-B	1.000	0.999	0.482	0.000	0.000
CaiT-C	0.498	0.498	0.492	0.395	0.100
SVM-B	1.000	1.000	1.000	0.991	0.000
SVM-C	0.500	0.500	0.484	0.000	0.000

Appendix

Table 19: Digital robust accuracy for

l_{2}

-APGD (DLR loss) at different

\epsilon

budgets.

Model	$k{=}1$	$k{=}10$	$k{=}20$	$k{=}200$	$k{=}500$
ResNet20-B	1.000	0.998	0.871	0.500	0.383
ResNet20-C	0.998	0.500	0.500	0.500	0.500
CaiT-B	1.000	1.000	1.000	1.000	0.655
CaiT-C	1.000	0.998	0.952	0.500	0.493
SVM-B	1.000	1.000	1.000	1.000	0.739
SVM-C	1.000	0.910	0.590	0.489	0.000

Appendix

Table 20: Digital robust accuracy for

l_{0}

PGD (DLR loss) at different sparsity budgets

k

Model	$4/255$	$8/255$	$16/255$	$32/255$	$64/255$	$255/255$
ResNet20-B	1.000	1.000	1.000	1.000	1.000	0.871
ResNet20-C	1.000	0.955	0.527	0.501	0.500	0.500
CaiT-B	1.000	1.000	1.000	1.000	1.000	1.000
CaiT-C	1.000	1.000	1.000	1.000	0.997	0.952
SVM-B	1.000	1.000	1.000	1.000	1.000	1.000
SVM-C	1.000	1.000	1.000	1.000	1.000	0.590

Appendix

Table 21: Digital robust accuracy for

l_{0}{+}l_{\infty}

PGD (DLR loss) with fixed sparsity

k{=}20

at different

\epsilon

budgets.

Model	$k{=}1$	$k{=}10$	$k{=}20$	$k{=}200$	$k{=}500$	$k{=}2000$
ResNet20-B	1.000	1.000	1.000	0.500	0.456	0.000
ResNet20-C	0.558	0.500	0.500	0.500	0.500	0.000
CaiT-B	1.000	1.000	1.000	1.000	0.901	0.477
CaiT-C	0.930	0.624	0.535	0.507	0.425	0.000
SVM-B	1.000	1.000	1.000	0.999	0.505	0.372
SVM-C	1.000	0.999	0.990	0.496	0.352	0.000

Appendix

Table 22: Digital robust accuracy for

l_{0}{+}\sigma

-map PGD (DLR loss) at different sparsity budgets

k

Model	$4/255$	$8/255$	$16/255$	$32/255$	$64/255$	$255/255$
ResNet20-C	1.000	1.000	1.000	0.988	0.556	0.500
CaiT-C	0.999	0.970	0.540	0.500	0.500	0.500
SVM-C	1.000	1.000	0.583	0.500	0.121	0.000
VGG16-C	1.000	1.000	1.000	0.960	0.607	0.500

Appendix

Table 23: Physical robust accuracy for

l_{\infty}

-APGD on Combined-trained models at different

\epsilon

budgets.

Model	$\epsilon{=}2$	$\epsilon{=}4$	$\epsilon{=}8$	$\epsilon{=}20$	$\epsilon{=}200$	$\epsilon{=}2000$
ResNet20-C	1.000	1.000	1.000	0.971	0.500	0.500
CaiT-C	1.000	0.746	0.540	0.501	0.500	0.500
SVM-C	1.000	1.000	0.963	0.603	0.005	0.003
VGG16-C	0.999	0.993	0.944	0.708	0.500	0.500

Appendix

Table 24: Physical robust accuracy for

l_{1}

-APGD on Combined-trained models at different

\epsilon

budgets.

Model	$\epsilon{=}1$	$\epsilon{=}2$	$\epsilon{=}3$	$\epsilon{=}5$	$\epsilon{=}15$	$\epsilon{=}45$
ResNet20-C	1.000	0.989	0.816	0.510	0.500	0.500
CaiT-C	0.813	0.503	0.500	0.466	0.317	0.198
SVM-C	1.000	0.552	0.500	0.466	0.001	0.000
VGG16-C	1.000	0.946	0.626	0.511	0.500	0.500

Appendix

Table 25: Physical robust accuracy for

l_{2}

-APGD on Combined-trained models at different

\epsilon

budgets.

Model	$k{=}1$	$k{=}10$	$k{=}20$	$k{=}200$	$k{=}500$	$k{=}2000$
ResNet20-C	1.000	0.899	0.644	0.500	0.500	0.500
CaiT-C	1.000	0.995	0.938	0.501	0.500	0.500
SVM-C	1.000	0.927	0.764	0.502	0.412	0.000
VGG16-C	1.000	0.901	0.594	0.500	0.500	0.500

Appendix

Table 26: Physical robust accuracy for

l_{0}

PGD on Combined-trained models at different sparsity budgets

k

. We use

\epsilon=1

for the per-pixel bound.

Model	$4/255$	$8/255$	$16/255$	$32/255$	$64/255$	$255/255$
ResNet20-C	1.000	1.000	1.000	1.000	1.000	0.742
CaiT-C	0.907	0.907	0.899	0.909	0.919	0.877
SVM-C	0.992	0.988	0.967	0.960	0.960	0.833
VGG16-C	1.000	1.000	1.000	1.000	1.000	0.645

Appendix

Table 27: Physical robust accuracy for

l_{0}{+}l_{\infty}

PGD on Combined-trained models at different

\epsilon

budgets (with fixed sparsity

k{=}20

Model	$k{=}1$	$k{=}10$	$k{=}20$	$k{=}200$	$k{=}500$	$k{=}2000$
ResNet20-C	0.975	0.975	0.875	0.500	0.500	0.500
CaiT-C	0.963	0.650	0.559	0.523	0.519	0.297
SVM-C	1.000	1.000	1.000	0.664	0.506	0.188
VGG16-C	0.999	0.999	0.952	0.504	0.500	0.500

Appendix

Table 28: Physical robust accuracy for

l_{0}{+}\sigma

-map PGD on Combined-trained models at different sparsity budgets

k

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

Approaching the Harm of Gradient Attacks While Only Flipping Labels
Feb 28, 2025Abdessamad El-Kabid, El-Mahdi El-MhamdiFederated Learning Aggregation Adversarial Attacks
École Polytechnique
Identifying Adversary Characteristics from an Observed Attack
Mar 5, 2026Soyon Choi, Scott Alfeld, Meiyi MaQuery Identifiability Adversarial Attacks
Vanderbilt University Nashville, TN 37240 · Amherst College Amherst, MA 01002
A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection
Jul 22, 2026Ali BorjiAdversarial Robustness Adversarial Examples
BrainChip Inc., Laguna Hills, CA, USA

Feb 28, 2025J/K move · Enter open · S save

Approaching the Harm of Gradient Attacks While Only Flipping Labels

Abdessamad El-Kabid, El-Mahdi El-Mhamdi

École Polytechnique

Federated Learning Aggregation Adversarial Attacks Distributed Training Data Poisoning Attacks

Open paper AskPDF arXiv

Machine learning systems deployed in distributed or federated environments are highly susceptible to adversarial manipulations, particularly availability attacks -- rendering the trained model unavailable. Prior research in distributed ML has demonstrated such adversarial effects through the injection of gradients or data poisoning. In this work, we ask whether comparable degradation is still possible under a substantially more constrained action space: the adversary may only flip a limited number of labels of existing training examples, without modifying features, injecting samples, or directly controlling gradients. We analyze the extent of damage caused by constrained label flipping attacks against distributed learning under mean aggregation -- the dominant baseline in research and production. Focusing on classification problems, (1) we propose a novel formalization of label flipping attacks as a per-round constrained optimization problem, derive a greedy label-selection rule for logistic regression, and empirically evaluate it beyond its derivation setting, including on MLPs and robust aggregators. The rule is provably per-epoch optimal for the attacker under the mean aggregator. (2) Empirically, we show that optimized label flipping can cause substantial accuracy degradation while outperforming random label flipping under similar budgets. (3) We shed light on an interesting interplay between what the attacker gains from more write-access versus what they gain from more flipping budget. (4) Finally, although the attack is derived for mean aggregation, we find that it can transfer empirically to the coordinate-wise median and trimmed mean aggregators, where its effectiveness approaches that of the Little-is-Enough gradient attack. This demonstrates that even highly constrained label-flipping adversaries can pose a significant availability threat to distributed learning.

Abstract

Adversarial Attacks

Explore similar work

Approaching the Harm of Gradient Attacks While Only Flipping Labels

Identifying Adversary Characteristics from an Observed Attack

A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection