Recommender Systems for Democracy: Toward Adversarial Robustness in Voting Advice Applications

IJCAI 2025

F. Berdoz, D. Brunner, Y. Vonlanthen, R. Wattenhofer

ETH Zurich, Switzerland

voting-adviceadversarial-robustnesscomputational-social-choicedemocracy
arXiv Paper

Abstract

Voting advice applications (VAAs) help millions of voters understand which political parties or candidates best align with their views. This paper explores the potential risks these applications pose to the democratic process when targeted by adversarial entities. In particular, we expose 11 manipulation strategies and measure their impact using data from Switzerland’s primary VAA, Smartvote, collected during the last two national elections. We find that altering application parameters, such as the matching method, can shift a party’s recommendation frequency by up to 105%. Cherry-picking questionnaire items can increase party recommendation frequency by over 261%, while subtle changes to parties’ or candidates’ responses can lead to a 248% increase. To address these vulnerabilities, we propose adversarial robustness properties VAAs should satisfy, introduce empirical metrics for assessing the resilience of various matching methods, and suggest possible avenues for research toward mitigating the effect of manipulation.

Overview

Voting advice applications (VAAs) help millions of voters understand which political parties or candidates best align with their views. Despite their growing influence on democratic processes, these applications have received limited scrutiny regarding their vulnerability to manipulation. This paper systematically exposes 11 manipulation strategies and measures their impact using data from Switzerland’s primary VAA, Smartvote, collected during the 2019 and 2023 national elections.

Threat model

We identify three types of adversaries, each with distinct attack surfaces:

  1. Candidates and parties: Can optimize their responses to maximize visibility in voter recommendations, adopt moderate answering strategies to appear closer to the median voter, or coordinate diversification among party candidates.
  2. Platform operators: Can influence outcomes through the choice of matching method, weight selection criteria, and similarity score calculations.
  3. Question designers: Can favor specific parties through question selection or exploit correlations between questions.

Key findings

Comparison of party visibility changes under moderate answering strategies across different distance metrics.
Figure 1: Effect of answer calibration (moderate answering strategy) on party visibility. Using L2 distance (Smartvote's default), parties can increase their recommendation frequency by up to 248%. L1 distance is substantially more robust to this attack.

Impact of manipulation strategies

  • Answer calibration: Parties adopting moderate answering strategies can increase visibility by up to 248% under L2 distance.
  • Answer optimization: Simulated annealing on candidate responses places optimized candidates in the top-k recommendations for over 50% of voters.
  • Question favoritism: Cherry-picking questionnaire items can increase party recommendation frequency by over 261%.
  • Matching method choice: Simply switching the distance metric can shift a party’s recommendation frequency by up to 105%.
  • Candidate diversification: Coordinated spreading of candidate positions yields up to 345% visibility gains.
Question favoritism analysis showing how selecting specific subsets of questions can dramatically shift party recommendations.
Figure 2: Question favoritism analysis for the canton of St. Gallen. Each point represents a random subset of questions; the relative change in party visibility varies widely, demonstrating that question selection alone can significantly influence outcomes.

Toward robustness

We propose a set of adversarial robustness properties that VAAs should satisfy, introduce 9 empirical metrics for assessing the resilience of various matching methods, and evaluate 7 distance functions. Our analysis shows that L1 and Angular distances offer better robustness than L2 (currently used by Smartvote) without sacrificing recommendation accuracy.

Effect of weight selection on party visibility across the political spectrum.
Figure 3: Relative change in party visibility under different weight selection strategies. The choice of how to weight questions has a differential impact across the political spectrum, with some strategies systematically favoring left- or right-leaning parties.
Key takeaway: VAAs are vulnerable to a range of adversarial manipulation strategies that can significantly distort democratic recommendations. Adopting more robust matching methods, such as L1 or Angular distance, can substantially reduce these vulnerabilities while maintaining recommendation quality.

Citation

@inproceedings{berdoz2025recommender,
  author = {Berdoz, F. and Brunner, D. and Vonlanthen, Y. and Wattenhofer, R.},
  title = {{Recommender Systems for Democracy: Toward Adversarial Robustness in Voting Advice Applications}},
  booktitle = {{International Joint Conference on Artificial Intelligence (IJCAI)}},
  year = {2025}
}