分析对机器学习在选举系统中物理对抗示例威胁
Analyzing Physical Adversarial Example Threats to Machine Learning in Election Systems
AI总结：
研究分析了对抗示例对选举系统中机器学习模型的物理威胁，通过实验揭示数字与物理领域对抗攻击效果的差异。
摘要：
机器学习在选民领域的发展既显示了有希望的结果也带来了风险。训练好的模型在选票分类任务上表现良好（>99%准确率），但容易受到对抗示例攻击而产生误分类。本文分析了一个攻击者试图利用对抗示例攻击机器学习选票分类器以破坏美国选举的情况。我们首先推导出一个概率框架，用于确定必须打印多少对抗示例选票才能翻转选举，这取决于每个候选人的获胜概率和总选票数。其次，尚不清楚哪种类型的对抗示例在物理打印的选民领域中最有效。我们分析了六种不同的对抗示例攻击类型：l_infinity-APGD、l2-APGD、l1-APGD、l0 PGD、l0 + l_infinity PGD以及l0 + sigma-map PGD。我们的实验包括通过打印和扫描使用四种不同的机器学习模型实现144,000个对抗示例的物理实现。我们实证地展示了物理领域和数字领域之间的分析差距，其中在数字领域最有效的攻击（l2和l_infinity）与在物理领域最有效的攻击（l1和l2，取决于模型）不同。通过将概率选举框架与数字和物理对抗示例评估相结合，我们超越了以往的接近比赛分析，明确量化了何时以及如何通过对抗选票操纵来改变结果。
英文摘要：
Developments in the machine learning voting domain have shown both promising results and risks. Trained models perform well on ballot classification tasks (> 99% accuracy) but are at risk from adversarial example attacks that cause misclassifications. In this paper, we analyze an attacker who seeks to deploy adversarial examples against machine learning ballot classifiers to compromise a U.S. election. We first derive a probabilistic framework for determining the number of adversarial example ballots that must be printed to flip an election, in terms of the probability of each candidate winning and the total number of ballots cast. Second, it is an open question as to which type of adversarial example is most effective when physically printed in the voting domain. We analyze six different types of adversarial example attacks: l_infinity-APGD, l2-APGD, l1-APGD, l0 PGD, l0 + l_infinity PGD, and l0 + sigma-map PGD. Our experiments include physical realizations of 144,000 adversarial examples through printing and scanning with four different machine learning models. We empirically demonstrate an analysis gap between the physical and digital domains, wherein attacks most effective in the digital domain (l2 and l_infinity) differ from those most effective in the physical domain (l1 and l2, depending on the model). By unifying a probabilistic election framework with digital and physical adversarial example evaluations, we move beyond prior close race analyses to explicitly quantify when and how adversarial ballot manipulation could alter outcomes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
