Crossover phenomenon in adversarial attacks on voter model

A recent study (Chiyomaru and Takemoto 2022 Phys. Rev. E 106 014301) considered adversarial attacks conducted to distort voter model dynamics in networks. This method intervenes in the interaction patterns of individuals and induces them to be in a target opinion state through a small perturbation ε. In this study, we investigate adversarial attacks on voter dynamics in random networks of finite size n. The exit probability P +1 to reach the target absorbing state and the mean time τ n to reach consensus are analyzed in the mean-field approximation. Given ε > 0, the exit probability P +1 converges asymptotically to unity as n increases. The mean time τ n to reach consensus scales as (lnϵn)/ϵ for homogeneous networks with a large finite n. By contrast, it scales as (ln(ϵμ12n/μ2))/ϵ for heterogeneous networks with a large finite n, where µ 1 and µ 2 represent the first and second moments of the degree distribution, respectively. Moreover, we observe the crossover phenomenon of τ n from a linear scale to a logarithmic scale and find nco∼ϵ−1/α above which the state of all nodes becomes the target state in logarithmic time. Here, α = 1 for homogeneous networks and α=(γ−1)/2 for scale-free networks with a degree exponent 2


Introduction
Individual interactions play a crucial role in social networks, affecting various phenomena such as information diffusion, opinion formation, collective decision-making, conflict, and polarization.Several models have been developed to study macroscopic behavior emerging from individual human interactions [1][2][3].One of the simplest is the voter model, in which a voter's opinion can be in one of two states, i.e. +1 or −1.A voter adopts the opinion of one of its nearest neighbors.There are two absorbing states, in which all voters have the same opinion.The mean time to reach consensus, which is denoted as τ n , is the primary feature of the voter model.For regular lattices in d dimensions, τ n scales as n 2 for d = 1, n ln n for d = 2, and n for d > 2, where n represents the number of voters [4].The voter model of complex networks has been analyzed.It was found that τ n scales as µ 2  1 n/µ 2 by using the kth moment µ k of the degree distribution p k [5][6][7].
The decision-making process of individuals can be influenced by their behaviors, beliefs, interaction patterns, etc.For instance, while most Americans prefer political decisions involving compromise to achieve results [8], stubborn individuals, such as zealots, have been observed within societies [9,10].In a recent study, information gerrymandering, which can be explained by game-theoretic analysis, was investigated through a social experiment [11].The structure of networks can affect voting processes, even though all voters have the same influence and the opinions they support are split 50/50 initially.Additionally, the presence of zealots and automated bots can promote such distortions.In theoretical studies, the effect of zealot presence on the voter model has been investigated [12][13][14][15][16][17].Recently, a variant of the voter model called the biased voter model has been proposed [18].This model considers that un and (1 − u)n agents are biased and unbiased, respectively.Biased agents have a single preferred state in common.In the voter dynamics, if a randomly selected agent i is biased, i copies the state of a random neighbor j of i with probability p(v), where v ∈ [0, 1] is a biased parameter.If j's state is the preferred state of i, then For unbiased agents, v = 0; that is, they copy the state of a random neighbor with a probability of 1/2.Czaplicka et al [18] has solved the biased voter model for networks in the mean-field and pair approximations and has shown that τ n scales as τ n ∼ (ln uvn)/uv.The probability of reaching the preferred state at the final state becomes unity for a sufficiently large n.The presence of biased agents drastically changes the behavior of voter dynamics.Some previous variants of the voter model have assumed that biased agents, including zealots or bots, are distributed in systems.In contrast, it has recently been shown that opinion dynamics can be distorted without assuming biased agents.Chiyomaru and Takemoto proposed adversarial attacks on voter dynamics inspired by attacks on neural networks [19].The attack is realized through intervention in a network structure (adjacency matrix) and manipulates the flow of information.In social media, for example, the attack corresponds to situations where contact frequencies between individuals are changed through manipulation of individual timelines.Because these interventions occur in the backgrounds of social media, they are difficult to detect compared with the presence of zealots or automated bots.In [19], under assigned a target state s * i = 1 to all nodes i ∈ {1, 2, . . ., n}, the problem that nodes take the target state in voter dynamics as much as possible is considered.Let E(t) = − ∑ i s * i s i (t)/n be an energy in a network, which represents the extent to which the target state is realized in the network.Since E(t) monotonically decreases with increasing the fraction of nodes with the target state, minimizing E(t) solves the problem above.Chiyomaru and Takemoto [19] has considered that a perturbation is added to the adjacency matrix using the gradient descent to minimize E(t).By assuming mean-field time evolution and adopting the fast gradient sign method [20], the problem is reduced to a voter model on a network with w adv ij (t) = a ij + ϵs * i s j (t).Here, ϵ represents a perturbation (the strength of attack), a ij is the element of the adjacency matrix A, and w adv ij is the element of the weighted adjacency matrix W adv with adversarial attacks.Each node receives more influence from the nearest neighbors with a targeted state than those with a nontargeted state.By investigating the effect of adversarial attacks on the voter model numerically, [19] found that the average population of nodes with a targeted state at the final state is a rapidly increasing function of both the perturbation ϵ and the network size n and that τ n is reduced by adversarial attacks compared with the case without perturbation (i.e.ordinary voter model).Thus, the voter dynamics of complex networks are quickly distorted by the introduction of small perturbations.Further, [21] focused on the effects of adversarial attacks on voter dynamics for different network structures.One of the primary conclusions was that degree inhomogeneity mitigates the effect of adversarial attacks on voter dynamics.However, there is no quantitative understanding of the mean time to reach consensus or the probability of reaching the target state for voter models with adversarial attacks.Thus, it is unknown to what degree of perturbation ϵ that adversarial attacks sufficiently distort the opinion dynamics for a given network of finite size n, or whether a finite network reaches the targeted state, given that a finite perturbation ϵ exists.Because the voter model is the simplest model of opinion dynamics, it is essential to further deeply understand adversarial attacks on the voter model to provide insights into real social media.
In this study, we treat the voter model with adversarial attacks in the mean-field theory, showing that the model is mathematically identical to the biased voter model [18].In the same manner as [18], we obtain the exit probability of reaching the target state and the mean time to reach a consensus.The exit probability asymptotically reaches unity with an increase in the system size n given ϵ > 0. While the time to reach consensus scales as (ln ϵn)/ϵ for homogeneous networks, such that the fluctuation of degree can be ignored, it scales as (ln(ϵµ 2  1 n/µ 2 ))/ϵ for heterogeneous networks in the large-size limit.Moreover, we find the crossover of τ n from (sub)linear to logarithmic dependence.From the crossover behavior, we find that the crossover size n co is characterized by the perturbation ϵ in power.By comparing the n co 's of random scale-free and non-scale-free networks, we find that the scale-free ones are more robust against adversarial attacks than the non-scale-free.
The remainder of this paper is organized as follows.In section 2, we introduce voter dynamics in a weighted network and adversarial attacks on the voter dynamics.Section 3 presents a mean-field analysis of the voter model with an adversarial attack.We report the crossover phenomenon in section 4. Section 5 presents discussions and conclusions.

Voter model
We consider a voter model on a weighted network with n nodes.w ij (⩾ 0) denotes the weight of the edge between nodes i and j.Node i can be in one of two opinion states, i.e. s i : {+1, −1}, where i = 1, 2, • • • , n.In the initial state, each node is assigned to +1 with probability σ and −1 otherwise.The update rule for the voter model is as follows: first, at each time interval ∆ t = 1/n, node i is selected randomly.Next, a neighboring node j of node i is selected with probability Then, node i adopts the state s j of node j.These steps are repeated until the system reaches a consensus.

Adversarial attacks
We briefly review adversarial attacks on the voter model of the networks introduced in [19].Adversarial attacks attempt to distort voter dynamics to a predetermined target state.In this study, we set the target state to s * i = 1 for all i.We consider an attack such that the state of each node i at each time t is s i (t) = 1 as possible.To realize the attack, by adding a perturbation using gradient descent, we consider minimizing the energy defined as Here, the elements of the adjacency matrix with perturbation are given as where a perturbation ϵ(> 0) is a small positive value, and w ij (t = 0) = a ij is the element of the adjacency matrix A for the network (a ij = 1 if the edge exists between nodes i and j and a ij = 0 otherwise).Perturbation is added to the existing edges.To treat the gradient ∂E ∂w ij , the mean-field time evolution is assumed.By using the average rate p i to flip the state of node i, i.e.
the state s i (t + ∆ t ) at the next timestep is determined as follows: From equations ( 4) and ( 5), the gradient can be rewritten as Inspired by the fast gradient sign method [20] for adversarial attacks on neural-network tasks, the authors of [19] considered that the weight w ij is perturbed by the sign of ∂E ∂w ij : Here, sign( ∂E ∂w ij ) = −s * i s j (t) is obtained using equation (6).Note that W adv is asymmetric.Consequently, we treat a voter model on networks in which the weights of the edges change with time.In the original paper [19], the voter model was treated as a synchronous update in which the state of all nodes flips with probability given by equation ( 4) and time proceeds +1.In contrast, we consider it in the asynchronous updating introduced in section 2. We confirmed that the results between the different update rules were qualitatively the same (not shown).

Homogeneous networks
We consider adversarial attacks on voter dynamics in a homogeneous network such that the degree fluctuation is absent or can be ignored.We introduce the fraction σ = ∑ N i =1 (s i + 1)/2N of the nodes with state +1.The mean-field approximation assumes that the conditional probability P(s j = 1|s i = ±1) [P(s j = −1|s i = ±1)], where a random neighbor j of node i with state s i = ±1 has state s j = 1 [−1], is given by P(s j = 1) [P(s j = −1)].Here, P(s i = +1) [P(s i = −1)] represents the probability that a randomly selected node i is in state +1 [−1], and Focusing on node i, the weight of the edges is w ij = 1 + ϵ if neighboring nodes j's are in the target state and is w ij = 1 − ϵ otherwise, regardless of the state of node i.Because the total edge weight of focal node i is f(σ) = σ(1 + ϵ) + (1 − σ)(1 − ϵ), the average rate P ij of node i and its neighbor j is given as For a given variable σ, let R + (σ) and R − (σ) be the probabilities that the system drifts σ → σ + ∆ σ and σ → σ − ∆ σ , where ∆ σ = 1/n.These drifts are induced by an event in which a randomly selected node i adopts the state of a neighboring node j selected at the rate P ij (or directly obtained from equation ( 4)): and Using these transition probabilities, the evolution of the variable σ can be treated as a random walk.This random walk system coincides with the system of a biased voter model [18] (see appendix for the equivalence).In the same manner as [18], thus, we obtain the exit probability P +1 (σ) that a network with n nodes reaches consensus to state +1 (targeted state) and the time τ n (σ) to reach consensus in the continuous approximation with second order as and respectively.Here Ei(x) = − ´∞ −x exp(−z)/zdz denotes the exponential integral, and γ e is the Euler-Mascheroni constant.Equation (11) reaches unity for ϵn ≫ 1, implying that networks with a large size limit converge to the target state for a finite ϵ.Since Ei(x) → exp(x)(x −1 + O(x −2 )) in x → ∞, for sufficiently large networks (ϵn → ∞) with a given perturbation ϵ, the time to reach a consensus scales asymptotically, as follows: It should be noted that P +1 converges to unity, and the time to reach the consensus of state +1 is ln ϵn for ϵn → ∞, implying that adversarial attacks distort the voter dynamics to the target state in logarithmic time in homogeneous networks.
Next, we consider heterogeneous networks in which the degree fluctuation cannot be ignored.In the mean-field approximation (see appendix) and the pair approximation (see [18]), P +1 and τ n are given as the same forms of equations ( 11) and ( 13) with an effective size µ 2 1 µ2 n are given as and Let us assume scale-free networks whose degree distribution is p k ∼ k −γ with degree exponent 2 < γ < 3.
Because the second moment µ 2 scales as µ 2 ∼ n (3−γ)/2 when we employ the structural cutoff k cut ∼ O( √ n), the time to reach consensus τ n behaves as τ n ∼ ln n α with α = (γ − 1)/2.If we employ a power-law distribution with degree exponent γ > 3, which has a finite µ 2 , τ n ∼ ln n is recovered.As a result, τ n scales as a logarithmic time of the system size n irrespective of the strength of degree heterogeneity.

Comparison with simulations
Figure 1 compares simulation results with the analytical treatments presented in the previous two subsections.In panels (a) and (b), we confirm equations ( 11) and (13).In panel (a), the simulation results agree with equation (11).In panel (b), for a large n, τ n increases linearly for n in the semi-log plot, indicating that equation ( 13) holds.Analytical prediction (12) deviates from the numerical results because the analysis stands on the complete graphs and neglects the time evolution of σ.In addition, we checked equations ( 14) and ( 15), as shown in panels (c) and (d), respectively.Here, we numerically calculated the moments µ 1 (n) and µ 2 (n) for size n to evaluate equation ( 14).This equation matches the simulation results.In (d), we find that τ n is a logarithmic function of n for large sizes as expected in equation ( 15) (Here, we replace n by µ 2  1 n/µ 2 in equation ( 12)).

Crossover phenomenon
We report the crossover behavior of the time to reach consensus τ n (n, ϵ) from a linear scale to a logarithmic scale.We propose the scaling ansatz: where g(x) ∼ x for x ≪ 1 and g(x) ∼ ln x for x ≫ 1. α is the exponent introduced above; that is, α = (γ − 1)/2 for 2 < γ < 3 and α = 1 for γ > 3. Figure 2 shows the scaled time required to reach consensus ϵτ n with respect to the scaled network size ϵn α .The results for z-regular random networks with z = 6 and scale-free networks with degree exponent γ = 2.5 are presented in panels (a) and (b), respectively.In both panels, all symbols collapse to the same curve.As indicated by the guidelines, ϵτ n increases linearly with respect to ϵn α in the region where ϵn α ≪ 1.In contrast, in the region ϵn α ≫ 1, ϵτ n has a logarithmic dependence on ϵn α (see the insets of figure 2).
The results indicate that under a given perturbation ϵ, there exists a size n co above which the systems reach the targeted state in logarithmic time; that is, opinion dynamics are distorted quickly.We expect that the characteristic size n co (ϵ) is given by n co ∼ ϵ −1/α from ϵn α ∼ const.To confirm this, we examine the perturbation ϵ dependence of the network size n co at the crossover point, as shown in figure 3.For the z-regular random network (filled black squares) and scale-free network with γ = 2.5 (filled red circles), we find n co (ϵ) ∼ ϵ −1 and n co (ϵ) ∼ ϵ −4/3 , respectively, which indicate the relationship n co ∼ ϵ −1/α .Consequently, we obtain the following scaling: where n co ∼ ϵ −1/α .The difference of the scaling exponent α between scale-free and non-scale-free networks indicates that scale-free ones are more robust against adversarial attacks than non-scale-free ones when comparing networks of the same size.In other words, a required perturbation ϵ to distort the voter dynamics on scale-free networks is higher than on non-scale-free networks.Besides that, when taking the same strength of perturbation, the crossover size above which adversarial attacks distort the voter dynamics is large in scale-free networks compared with non-scale-free networks.

Discussion and conclusions
We investigated the effects of adversarial attacks on a voter model in complex networks.The attack causes a node to receive more influence from neighbors in the target state than those in a non-target state.The perturbation ϵ characterizes the strength of the attacks.In the mean-field approximation, we found that the adversarial attack on voter dynamics is identical to the biased voter model [18].In the same manner as [18], we analyzed the exit probability P +1 to reach the target state and the time to reach consensus τ n for degree-homogeneous and heterogeneous networks of finite size n.For homogeneous networks, the exit probability reaches unity, that is, P +1 → 1, and the time to reach consensus τ n scales as (ln ϵn)/ϵ in the limit ϵn → ∞.For heterogeneous networks such that the degree fluctuation cannot be ignored, the exit probability reaches unity, and the time to reach consensus τ n scales as (ln ϵ µ2 n → ∞.For scale-free networks with degree exponent 2 < γ < 3, µ 2 scales as µ 2 ∼ n (3−γ)/2 when considering the structural cutoff for the maximum degree.Then, we have τ n ∼ (ln ϵn α )/ϵ with α = (γ − 1)/2.In summary, adversarial attacks distort the voter dynamics to the target state in a logarithmic time when ϵn → ∞ for homogeneous networks and ϵ µ 2 1 µ2 n → ∞ for heterogeneous networks.Moreover, we addressed the problem of whether networks with a finite n are distorted by adversarial attacks with a given perturbation ϵ by determining the crossover phenomenon of the time to reach consensus (equation ( 17)).From the relationship between the characteristic size n co and perturbation ϵ, we found n co ∼ ϵ −1/α (or ϵ ∼ n −α co ).Let us focus on the relation between the voter model with adversarial attacks and the biased voter model.We can discuss the equivalence of two models from the average probability P ij that a randomly selected node i copies the state of its random neighbor j (equation ( 8)).In the mean-field theory for the biased voter model, if the state of a random neighbor is the (un)preferred state of biased agents.Here, the (un)preferred state corresponds to the (non-)target state in adversarial attacks.For adversarial attacks on the voter dynamics, on the other hand, P ij ∝ 1 ± ϵ (equation ( 8)).Thus, uv acts in the same manner as ϵ.A node refers to a neighbor with probability depending on edge weights and copies the neighbor's state in voter dynamics of the present model.In contrast, a node refers to a neighbor uniformly at random and copies the neighbor's state with biased probability in the biased voter model.The equivalence of the two models comes from that these two processes are equivalent.
In [19], which theoretically showed that an adversarial attack on voter dynamics can be realized efficiently, it was found that the voter dynamics in modeled and real-world complex networks are quickly distorted by the addition of small perturbations in computer simulations.In addition, [21] numerically found that degree inhomogeneity mitigates the effects of adversarial attacks on voter dynamics.In this study, we investigated adversarial attacks on the voter model in random networks, analytically obtaining the probability P +1 to distort the dynamics and the consensus time τ n for random networks with size n and a perturbation ϵ in the mean-field approximation.Moreover, we elucidated the crossover behavior of consensus time τ n and determined the relation between the crossover size n co and perturbation ϵ, i.e. n co ∼ ϵ −1/α .The theoretical findings of this study provide quantitative understanding of previous studies [19,21].
The relation n co ∼ ϵ −1/α suggests that for given networks of size n, perturbation ϵ to distort opinion dynamics scale-free networks with degree exponent 2 < γ < 3 exceeds that in non-scale-free networks because α = (γ − 1)/2 < 1 (figure 3).(Note that [21] has pointed out the tendency by numerical simulations.)Considering the heterogeneity of social interactions in most social media [24][25][26], this result is not unfavorable for users of such services.Setting large perturbations is expensive for interventionists and increases the possibility that the intervention will be detected.However, it is essential to note that the perturbation ϵ required for quickly distorting the opinion dynamics decreases with an increase in the system size n in power.
This study only addressed adversarial attacks on the voter model in random networks.The effects of correlated structures, such as degree correlation, community structures, and higher-order structures, on this model, are left topics for future research as [21] has reported the impact of clustering and degree correlation in real-world networks.In addition, it is essential to investigate whether there are efficient ways to attack more complex opinion dynamics models that reflect reality and evaluate the network robustness against such attacks.and respectively.
We denote the initial condition as {σ k }(= σ 1 , σ 2 , . . ., σ k , . . ., σ kmax ).We obtain the recursion formula for P +1 ({σ k }): Here, ∆ k = 1/(Np k ) represents the change in σ k in the flipping of the state of a degree-k node, and {σ k } ±∆ k ′ = σ 1 , σ 2 , . . ., σ k ′ ± ∆ k ′ , . . ., σ kmax .By expanding the above to the second order, we obtain 2n dP +1 dσ where By following the results of the voter model on heterogeneous networks in [5,6], in which σ k for all k approaches σ in a time of order one, we assume σ k = σ for all k.Under this assumption, we have The mean time to reach consensus τ n ({σ k }) is given in a manner similar to equation (A3), as follows: with boundary conditions τ n ({0}) = 0 and τ n ({1}) = 0.The expansion of equation (B7) to the second order is given as Under the assumption that σ k = σ for all k, the equation can be rewritten as Equations (B9) and (B6) have the same forms as equations (A4) and (A2), respectively.

Figure 1 .
Figure 1.Numerical checks for the mean-field approximation in homogeneous [(a) and (b)] and heterogeneous [(c) and (d)] networks.Panels (a) and (c) [(b) and (d)] show the exit probability P +1 [the mean time to reach consensus τ n] with respect to the network size n.In (a) [(c)], the curves are based on equation (11) [equation (12)].Panels (a) and (b) show results for z-regular random networks with z = 6 and z = 10.Panels (c) and (d) show results for random scale-free networks with degree exponent γ = 2.5.To generate singly connected and degree uncorrelated networks from the configuration model, minimum degree k min = 3 and structural cutoff kcut =√ n are employed, respectively[22,23].All data points start from σ = 0.2 and are averaged over 10 3 realizations.

Figure 2 .
Figure 2. Data collapse of τn(n, ϵ) for different values of ϵ and n.Plots of the scaled mean time to reach consensus ϵτn(n, ϵ) with respect to the scaled network size ϵn for (a) z-regular random networks with z = 6 and (b) scale-free networks with the degree exponent γ = 2.5.The simulation conditions are identical to those for figure 1.

Figure 3 .
Figure3.Scaling of the characteristic size nco with the perturbation ϵ.The solid and dashed lines are for visual guidance.The slopes of the lines are −1 (solid) and −4/3 (dashed).In these plots, we utilize the data nearest points at ϵn = 2.5 for z-regular random networks and ϵn α = 1 for scale-free networks.The results (slopes) are insensitive to the choice of values around the bend (not shown).