Fact-based Deception in Coercion-Resistant Systems

• The paper introduces a cryptographic system using indistinguishable real and fake credentials to enable voters to deceive coercers while ensuring vote integrity.
• It employs rigorous experimental evaluation with 150 participants, revealing a 48% deception success rate and highlighting key usability and error metrics.
• The study outlines design trade-offs and limitations, underscoring the need for improved error mitigation and integrated policy measures for practical deployment.

Fact-based deception under coercion refers to security mechanisms wherein users are provided with artifacts—such as credentials or tokens—that are cryptographically indistinguishable to an adversary but have differentiated system effects. This approach allows targets of coercion to satisfy a coercer's demands with false but speciously valid data: for example, "fake" voting credentials that can be handed over to an adversary, producing verifiable but ultimately ineffective actions that do not affect final outcomes. This class of mechanisms is primarily motivated by the need to mitigate coercion and vote-buying risks in online voting, but generalizes to other domains involving authentication and private action under surveillance (Merino et al., 2024).

1. Threat Models and Cryptographic Design

Fact-based deception in online voting—exemplified by systems enabling "fake credentials"—addresses adversaries capable of exerting either coercion or inducement over voters. Adversary capabilities include observing credentials presented by the user, supervising or accompanying the user except in supervised privacy booths, confiscating or examining any device or credential after registration, and compelling the user to reveal credentials or receipts. Side-channel attacks within protected booths and invasive post-voting actions (e.g., strip-search) are out of scope, mitigated instead by policy and physical measures.

The cryptographic design centers on a credential set $C = \{c_1, \ldots, c_n\}$, created by each voter, with exactly one real credential $c_{real}$ and up to $n-1$ fake credentials $c_{fake,i}$. Both types of credentials are cryptographically indistinguishable and functionally identical for any external observer or adversary; only the voter's private markings distinguish them. Votes cast with $c_{real}$ are included in the tally, while those with $c_{fake}$ are recorded but omitted silently from the final tally, yielding no observable difference to a coercer.

The tally function is defined via indicator and ballot mappings:

• $V(c)$: the vote content cast under credential $c$.
• $I_{real}(c) = 1$ if $c = c_{real}$, else $c_{real}$0.

The system computes

$c_{real}$1

so that votes cast with fake credentials ($c_{real}$2) never influence the outcome.

2. Implementation in Human Subjects Studies

The most comprehensive evaluation of fact-based deception under coercion has been conducted in the context of online voting usability and efficacy (Merino et al., 2024). In an experimental setting, N=150 participants aged 19–83 (mean 44, median 36.5), with diverse demographic representation, participated in a mock election deploying these fact-based deception procedures.

Participants were divided into five groups by experimental condition (30 each): Control (real credential only), Fake Credential (real plus fake, basic instructions), Malicious Kiosk (misordered interface issuing only fakes), Security-Primed Fake (explicit security warnings), and Security-Primed Malicious (malicious and primed). The protocol required registration via a kiosk, credential generation, voting (exactly one real vote), and post-hoc survey. Key usability and correctness outcomes were assessed through in-system quizzes and end-to-end voting success metrics.

3. Quantitative Outcomes and Deception Probabilities

Experimental results demonstrated high comprehension of the fake credential concept, with 96% of subjects understanding their use. Among those exposed to the possibility, 53% reported willingness to use fake credentials if subjected to real coercion. However, observable user errors included a 10% rate of accidentally voting with the fake credential.

Formally:

• $c_{real}$3
• $c_{real}$4
• $c_{real}$5

From an adversary’s perspective, the deception success probability is $c_{real}$6, meaning nearly half of coerced voters could successfully deceive an adversary using this protocol.

Participants rated the system's usability with a mean System Usability Scale (SUS) score of 70.4 (industry average: 68) in the Fake Credential group. End-to-end task success (creation, activation, correct use) was 83%.

Measure	Value	95% CI
Fake concept understood	96%	±3%
Willing to use fakes under coercion	53%	–
Mistaken use of fake	10%	–
Registration success (no help)	87%	–
End-to-end correct use	83%	–
SUS score (Fake group)	70.4	–

4. Efficacy, Trust, and Practical Adoption

Among participants with direct or known experience of coercion or vote-buying (22%, $c_{real}$7), trust ratings in the coercion-resistant system (IR-Online) were statistically on par with in-person hand-marked paper ballots and higher than for remote voting methods without such defenses. This suggests the system's approach to fact-based deception was perceived as highly trustworthy within this high-risk subgroup.

Despite this, the per-user deception probability ceiling ($c_{real}$8) is nontrivial but insufficient alone for complete coercion resistance. The deployment of fake credential systems is therefore most effective when combined with deniable re-voting procedures, multi-credential protocols, or layered organizational policies.

5. Usability Barriers and Error Characterization

Usability analysis identified several recurring error modes undermining the practical effectiveness of fact-based deception schemes:

• Receipt manipulation: 6% of users tore receipts prematurely or incorrectly.
• Envelope/activation selection: 6% made errors when scanning or selecting correct objects.
• Activation errors: 19% reported difficulty with QR code scanning; 8% required facilitator assistance.
• Credential mismanagement: At least one participant discarded their real credential, precluding valid voting.
• Instructional errors: Skipping on-screen guidance resulted in workflow deadlocks or missteps.

Recommended mitigations include kiosk-side detection of premature receipt tearing, incremental (one-at-a-time) QR scanning, instructional reminders, animation-guided activation, and pre-printed distinct shapes or colors for clearer private marking of credentials. Reducing $c_{real}$9 is presented as critical for practical deployment (Merino et al., 2024).

6. Generalization Beyond Voting

The paradigm of fact-based deception using indistinguishable but functionally differentiated tokens extends naturally beyond online voting. Proposed generalizations include two-factor authentication systems with decoy accounts, payment systems issuing zero-balance decoy cards, messaging platforms allowing decoy chat threads for plausible deniability, and document systems with "honey" credentials that yield null results to adversaries. The underlying principle is the indistinguishability of real versus decoy artifacts, with system-side enforcement of effect only for authentic tokens.

A plausible implication is that advances in user interface design and policy integration will determine the viability of fact-based deception for scalable, practical coercion resistance across domains.

7. Outlook and Limitations

Empirical evidence demonstrates that ordinary users can comprehend and enact fact-based deception at a meaningful scale, underpinning its relevance for coercion resistance in digital systems. However, the observably imperfect error rates—especially mistaken activation of fake credentials—constrain the standalone robustness of these schemes. Systematic reduction of user-facing error rates, along with integration of complementary technical and organizational measures, is required for reliable, end-to-end coercion-resistant processes in both electoral and broader authentication contexts (Merino et al., 2024).