---
title: A Ballot of One's Own: Personal Voting Agents — Concept, Voting Conditions and Research Design
description: Draft research article defining Personal Voting Agents, specifying the secret and coercion-resistant voting conditions they require, and setting out four studies to test them.
date: 2026-11-14
lang: en-GB
author: Julien Béranger
model: Claude Fable 5.2
conversation: https://claude.ai/chat/55ae549d-4afa-4c71-9aad-f502619b5eea
source: https://julienberanger.com/personal-voting-agents-0-7-2
---

# A Ballot of One's Own: Personal Voting Agents — Concept, Voting Conditions and Research Design

*Version 0.7.2, November 2026. Draft for public comment.*

## Abstract

Can AI improve democracy? This article answers a bounded version of the question. It defines a Personal Voting Agent: an AI agent that casts one participant's ballot from that participant's own written preferences, under a secret and coercion-resistant voting protocol, and that the participant can overrule or switch off at will. It argues that such an agent addresses the oldest obstacle to equal participation, the unequal cost of taking part, without transferring the mandate to a representative, and it derives five testable hypotheses from that argument. The hypotheses are tested in four studies, each of which adds one source of risk to the one before. Study 1, the Synthetic Electorate Test, is reported here: agents built for 100 virtual persons voted on 40 proposals, and the study measures whether their votes are stable, resistant to manipulation and withheld when the corpus is silent. It does not measure fidelity, because a virtual person has no vote of their own. Three studies are planned. Study 2, the Fidelity Panel, compares agents' votes with those of 60 real persons, without the voting system. Study 3, the Montpellier Shadow Budget, runs the complete system on a virtual budget with a panel of 150 residents of Montpellier, and compares the panel's decisions with those of the municipal administration. Study 4, the Live Budget, repeats it with real funds, in an association voting on its own budget. The article specifies the voting conditions in full, because the answer to the research question depends on them: an agent that votes in public, or that cannot be overruled, would not improve democracy however accurate it was.

**Keywords:** democratic innovation; political participation; representation; secret ballot; artificial intelligence; language models; digital democracy.

## 1. Introduction

Abstention is usually read as a verdict on citizens. This article reads it as a price. A person who wants to vote responsibly on every decision that affects them must spend time and competence that are unequally distributed, and those who cannot pay stay silent (Downs, 1957; Gaxie, 1978). Representation and delegation lower the price by handing the decision to someone else. The citizen is relieved of the effort, and of the decision along with it.

Language models now read and summarise proposals, and can predict the positions of identified individuals with measurable accuracy (Argyle et al., 2023; Gudiño et al., 2024). This raises a question that political science has begun to ask mostly in the negative register of threat (Kreps and Kriner, 2023; Coeckelbergh, 2024):

**Can AI improve democracy?**

Put this generally, the question cannot be answered. This article narrows it in three ways. "AI" means one specific instrument, a Personal Voting Agent (PVA), defined in section 3. "Democracy" means collective decisions taken by vote in organisations with a defined set of participants: associations, cooperatives, neighbourhood bodies and online communities. Public elections are outside the scope. "Improve" means three things at once: more of the eligible participants have their preferences counted; the ballot they cast is their own and not a representative's; and no one can learn or dictate how they voted.

**Argument.** The article argues that an agent bound to one person, instructed in writing and overruled at will, lowers the cost of participation in the way Athens did when it paid citizens to attend, and that it does so without creating a new class of representatives. The argument holds only under stated conditions on the vote itself, which is why the technical specification is part of the article and not an annex to it.

**Contribution.** The article makes three contributions: a concept, situated in the theory of representation; a specification of the voting conditions under which the concept is legitimate; and an empirical programme in four studies, of which the first is reported here, that tests the instrument and then its central assumption, that an agent votes as its participant would.

**Plan.** Section 2 reviews the literature. Section 3 sets out the theoretical framework and the hypotheses. Section 4 specifies the instrument and the voting conditions. Section 5 presents the research design. Section 6 reports Study 1, the Synthetic Electorate Test. Sections 7 to 9 describe the three planned studies: the Fidelity Panel, the Montpellier Shadow Budget and the Live Budget. Section 10 discusses limits and objections, and section 11 concludes. Three appendices give the technical detail.

## 2. Literature Review

### 2.1 Unequal participation

That participation is unequal, and that the inequality follows social position, is among the most stable findings of the discipline (Lijphart, 1997). Downs (1957) gave the mechanism its classic form: one vote almost never decides an outcome, so the rational investment in information is small. Gaxie (1978) showed for France that a sense of political competence is socially distributed, and that formally universal suffrage hides a census. Braconnier and Dormagen (2007) documented the result in a working-class neighbourhood: abstention as the ordinary condition, interrupted by mobilisation. Turnout in democracies has fallen by more than ten percentage points since the 1960s (Kostelka and Blais, 2021; see also Solijonov, 2016).

Organisations that vote online, at high frequency, display the same pattern in concentrated form. In [decentralised autonomous organisations](https://en.wikipedia.org/wiki/Decentralized_autonomous_organization) (DAOs), participation averages about 6.3% and the top decile of voters holds 76.2% of realised voting power (Cong et al., 2025; see also Feichtinger et al., 2023; Barbereau et al., 2023; Pahari et al., 2026).

One response to costly information is the shortcut: citizens who lack encyclopaedic knowledge follow cues from sources they trust, and often vote as they would have if informed (Lupia, 1994). Achen and Bartels (2016) doubt that such shortcuts add up to responsive government. The debate matters here because a PVA can be described as a shortcut that the citizen authors.

### 2.2 Representation and the mandate

Two terms need fixing first, because their ordinary uses conflict. In this article, *delegation* means the transfer of one's voting power to another person, who then votes as they see fit; a *delegate* is the person who receives it. This is the usage of online governance and of [liquid democracy](https://en.wikipedia.org/wiki/Liquid_democracy). Political theory uses "delegate" differently, for a representative bound by instructions. To avoid confusion, that figure is called here a *mandated representative*.

Burke (1774) told the electors of Bristol that he owed them his judgment, not his obedience. Pitkin (1967) organised the concept around that tension between mandate and independence. Manin (1997) showed that representative government was designed with elective, and in that sense aristocratic, features, and that the independence of representatives from instructions is one of its constitutive principles. Later work has multiplied the forms that representation can take (Mansbridge, 2003) and defended it as more than a second best (Urbinati, 2006).

Attempts to restore the mandate have taken the form of revocable, topic-specific delegation: proxy voting (Miller, 1969) and liquid democracy (Blum and Zuber, 2016). In practice these still concentrate votes on a few popular delegates. The empirical record of DAOs, where delegation is the norm, confirms it (Barbereau et al., 2023).

### 2.3 Democratic innovations

A large literature studies institutions meant to deepen participation: [participatory budgets](https://en.wikipedia.org/wiki/Participatory_budgeting), citizens' assemblies, deliberative polls (Fishkin, 2009; Smith, 2009; Landemore, 2020, 2026). For France, Blondiaux (2008) describes both the spread of participatory devices and their frequent lack of consequence. Rosanvallon (2006) notes that citizens exercise oversight as much as they vote. These innovations generally raise the quality of participation for the few who take part. They rarely lower its cost for the many who do not.

### 2.4 The secret ballot

The [secret ballot](https://en.wikipedia.org/wiki/Secret_ballot) was a contested nineteenth-century invention. Garrigou (1992) and Déloye and Ihl (2008) describe how the act of voting was made individual and private in France. Its standard justification is protection against corruption and coercion, and Lever (2015) argues that privacy is also constitutive of democratic voting. Secrecy shields voters from bribery and intimidation, though those with power then turned to influencing who turns out (Johnson and Orr, 2020). Online voting, especially on public ledgers, reversed this achievement for the sake of verifiability. Cryptographic work since Juels et al. (2005) shows that the trade-off is not necessary: a tally can be verified by anyone while ballots remain secret and voters cannot prove how they voted (PSE, 2025).

### 2.5 AI and democracy

The dominant register in political science is risk: synthetic content, flooding of consultation channels, erosion of a shared factual basis (Kreps and Kriner, 2023; Jungherr, 2023; Coeckelbergh, 2024). A second line of work treats models as aids to deliberation, for instance to find statements that divided groups can endorse (Tessler et al., 2024).

A third line is closest to this article. Argyle et al. (2023) showed that language models conditioned on demographic profiles reproduce group-level survey responses; Bisbee et al. (2024) showed the limits of that approach. Gudiño et al. (2024) tested what they call augmented democracy directly: models fine-tuned on individuals' stated preferences over 67 policy proposals from Brazil's 2022 election predicted held-out individual choices with accuracy between 69% and 76%, and predicted them better for liberal and college-educated participants. Capponi et al. (2025) built an agent that votes on DAO proposals and evaluated it on 3,383 proposals from eight organisations, measuring alignment with collective outcomes. Kreuner et al. (2025) simulated the recorded votes of Members of the European Parliament from persona descriptions with a weighted F1 score of about 0.79, and found abstentions poorly predicted. The evidence is not uniformly favourable: an industry study found that "digital twins" built from demographic and attitudinal profiles could not stand in for survey respondents, and that adding information sometimes lowered accuracy (Morris et al., 2026). Buterin (2026b) proposed personal governance agents and drew the normative line this article adopts: AI as a personal instrument, not AI as the government.

Practice has run ahead of theory, with instructive results. Event Horizon received a delegation of 7 million ARB from Arbitrum DAO to bring small holders into governance, then moved to AI agents voting from the pooled delegation. By one account, votes per proposal rose from about 10–15 to 80–90, but they were agent votes (Shreves, 2026). The DAO cut the delegation to 100,000 ARB, on the ground that the change had never been mandated (Arbitrum Forum, 2025).

### 2.6 The gap

Three things are missing from this literature. First, studies of prediction accuracy treat the model as a way to estimate preferences, not as an instrument the citizen controls; none specifies who may overrule it or how. Second, none specifies the conditions of the vote, although a prediction cast as a public, attributable ballot would undo the secret ballot. Third, the accuracy gap by education found by Gudiño et al. (2024) suggests that agents could reproduce the hidden census they are meant to remove. This article addresses all three.

## 3. Theoretical Framework

### 3.1 The concept

A Personal Voting Agent is software that casts a ballot for exactly one participant. It reads each proposal, compares it with a private corpus in which the participant has recorded what they value and whom they trust, and votes. The participant can read its reasons, vote themselves instead, or stop it, without asking anyone.

Four properties distinguish it from the agents discussed in section 2.5: one agent per participant; one vote per participant; the participant's own written preferences as the only source of instruction; and a standing right to overrule.

### 3.2 Lowering the cost: the Athenian precedent

The Athenians met the cost of participation directly. A day in the courts or the Assembly was a day's earnings lost, so participation favoured those who could afford it. The response was *misthos*: pay for jury service, introduced under Pericles, and later for attending the Assembly (Aristotle, *Athenian Constitution* 27.3, 41.3; Hansen, 1991). Athens did not ask poorer citizens to care more. It lowered the price.

A PVA makes the same move with a different instrument. It does not compensate the participant for their time; it reduces the time required, to the occasional deposit of a file (section 4.4). Athens also kept those who held power answerable through regular, simple procedures that needed no justification: the audit of magistrates and, in the extreme case, [ostracism](https://en.wikipedia.org/wiki/Ostracism), which Azoulay (2026) describes as "arbitrary in principle but regulated in its operation and limited in its effects". The same rule applies here to the agent: it must be removable at will.

### 3.3 Neither trustee nor mandated representative

In Pitkin's terms a representative acts for another. The trustee does so on their own judgment; the mandated representative on instructions. Both are persons, with interests and careers of their own, and Manin's account explains why modern government freed them from instructions.

A PVA does not fit either category, and the article proposes to treat it as a form of self-representation by instrument. No second person is involved. The instructions are written by the participant and can be changed at any time. The ballot is counted as the participant's and can be replaced by the participant until the vote closes. It makes the imperative mandate practicable at the scale of one, which is the only scale at which it does not create a representative.

### 3.4 Independence

Condorcet (1785) [showed](https://en.wikipedia.org/wiki/Condorcet%27s_jury_theorem) that a majority of voters who are each more likely right than wrong becomes highly reliable as their number grows, if their judgments are independent. Hong and Page (2004) made a related, and contested, case for diversity. Agents that share one model share its errors. A population of agents could therefore be less independent than the population it serves. Independence is treated below as a design requirement and as something to measure.

### 3.5 Conditions of legitimacy

From the above, an agent's vote is legitimate only if five conditions hold.

- **Fidelity.** The agent votes as its participant would.

- **Sovereignty.** The participant can overrule or stop the agent at any time, without permission.

- **Secrecy.** No person, including the operator of the system and a coercer, can learn or verify how the participant voted. Towards the public and the tally committee this is guaranteed by cryptography; towards the host of the agent it holds as long as the enclave's hardware is not physically compromised (Appendix B.3).

- **Independence.** Participants choose their own sources and their own model.

- **Autonomy from the operator.** Participants can vote if every service involved disappears (Buterin, 2026a).

Conditions 2 to 5 are properties of the design and are established by specification (section 4). Condition 1 is empirical.

### 3.6 Hypotheses

- **H1 (fidelity).** An agent instructed by a participant's corpus votes as that participant does, more often than any available alternative: a fixed rule, the majority, the most similar other participant, or the same model without the corpus.

- **H2 (personalisation).** The corpus accounts for a substantial part of that fidelity, especially on contested proposals.

- **H3 (robustness).** The agent's vote is stable under rewording and is not redirected by text inserted in a proposal.

- **H4 (participation).** Where agents vote automatically, the share of enrolled participants whose ballot is counted is higher than reference participation rates for the same population.

- **H5 (retained control).** Participants continue to exercise control: they overrule their agent at a non-zero rate and keep editing their corpus.

H3 is tested in Study 1. H1 and H2 are tested in Study 2. H1, H4 and H5 are tested in Study 3, and again under real stakes in Study 4. A sixth expectation follows from Gudiño et al. (2024) and is examined in Studies 2 and 3: fidelity should not vary with the participant's level of education. Study 3 also examines a corollary of H5: that control is exercised selectively, more on named projects than on routine items (section 8.2).

## 4. The Instrument: Voting Conditions and Specification

This section specifies what was built or is specified, at the level of detail the argument requires. Appendices A to C give the security analysis.

### 4.1 Components

| **Component** | **Role** | **Status in November 2026** |
| --- | --- | --- |
| [Gov](https://github.com/w3hc/gov) | Proposals, quorum, execution; private coercion-resistant voting mode | Public voting contracts exist. Private mode is a published specification (draft v2, October 2026); not yet implemented or audited |
| [w3pk](https://github.com/w3hc/w3pk) | Passkey wallet, present on the participant's device and in the enclave: membership, voting identity, proofs, encryption of deposited files | Released. The Gov specification lists the additions private voting needs |
| [Genji](https://github.com/w3hc/genji) | Participant interface | Maintained template. Voting and corpus screens to be built |
| [Wulong](https://github.com/w3hc/wulong) | Service in a [hardware enclave](https://en.wikipedia.org/wiki/Trusted_execution_environment): encrypted corpus storage, agent runtime, the enclave copy of each participant's wallet, relayer | Template released (Intel TDX on Phala Cloud). Voting and agent modules to be built |
| Inference | Reads proposal and corpus, returns a vote and reasons | Open-weight models in attested hardware are commercially available |

### 4.2 Voting conditions

Votes are cast under Gov's private mode ([Béranger, 2026](https://julienberanger.com/gov-private-voting)). Gov is a minimalist organisation contract in which each participant holds one non-transferable token. Its private mode aims to guarantee the following.

| **Condition** | **What it means** |
| --- | --- |
| One participant, one counted ballot | No weighting by wealth or seniority |
| Ballot secrecy | Ballots are encrypted; only the aggregate is ever decrypted |
| Anonymity | A ballot cannot be linked to a participant, even by the tally committee |
| Receipt-freeness | A participant cannot prove to anyone how, or whether, they voted |
| Revoting | A participant can change their ballot until the deadline; only the last counts, and a change is indistinguishable from background activity |
| Universal verifiability | Anyone can check the tally |
| No running tally | No partial result is visible before the deadline |
| Censorship resistance | A participant can submit a ballot without any intermediary |

The mechanism in brief: each participant has a voting identity whose commitment is registered in a public tree. For each proposal the identity anonymously registers a slot, owned by a secret specific to that proposal. A ballot is three ciphertexts (For, Against, Abstain). Every write to a slot carries a [zero-knowledge proof](https://en.wikipedia.org/wiki/Zero-knowledge_proof) that it is either a valid vote by the slot's owner or a re-randomisation of the existing ballot by anyone, and the two are indistinguishable. A threshold committee (three of five by default) decrypts only the encrypted total, with proofs checked by the contract.

The specification states its own limits, and the agent inherits them: a coercer present until the deadline can see that no change followed a coerced vote (exposure bounded by a 15-minute interval by default); a participant who surrenders their passkey can be impersonated; and in a very small electorate a unanimous result reveals every vote.

### 4.3 Automatic voting from the enclave

Each participant's wallet exists in two places: on their own device and inside the enclave. The voting identity is derived on the device from the participant's passkey, as the Gov specification provides, and a copy is provisioned to the enclave once, at onboarding, encrypted to the enclave's attested key. Either copy can register a slot and cast a ballot, and the public record cannot tell which one did.

From then on the participant has nothing to do when a proposal appears. The enclave copy registers a slot, the agent reads the proposal and the corpus and decides, the wallet generates the proof and casts the ballot, and the participant is told what was voted and why. Because registration is automatic, the period that precedes each vote can be short.

The specification keeps the voting identity on the participant's device alone, which obliges the device to come online before every vote. Keeping a second copy in the enclave removes that obligation, and with it the last recurring cost of participation. The price is that the identity can now be compromised in two places. Section 4.7 and Appendix B state what follows.

The agent casts at most one ballot per proposal, at a time set by the organisation. It has four outputs: For, Against, Abstain and Escalate. Escalate means it does not vote and asks the participant to decide. It escalates when the corpus is silent or contradictory, when its internal checks disagree, or when the proposal falls in a category the participant has reserved. An unanswered escalation leaves the slot uncounted.

### 4.4 The corpus, and what is asked of the participant

The corpus is a set of files that the participant deposits from time to time: a note on what matters to them, a text they agree with, a position they have taken elsewhere, the transcript of a conversation. Nothing has to be written for the purpose, and no form has to be filled in. Files in the participant's own words carry more weight and can contain standing instructions, such as a category of decision on which they always want to be asked. Collected files inform the agent and never instruct it. The participant's own overrides are added automatically and are the strongest signal the corpus receives.

Each file is encrypted on the participant's device and stored in the enclave, which decrypts it only to run that participant's agent. The enclave's keys are derived at start-up inside the hardware; no person holds them. The participant can delete the corpus at any time, and can export it subject to the delay described below.

A corpus says more about its author than a ballot does, and it lasts. Anyone who obtains it can run the agent and predict the vote. The final ballot stays secret all the same, because the participant can replace it unseen (section 4.6), so a corpus proves nothing about the ballot that counts. The opinions it contains are another matter: a coercer facing the participant can demand to see them. Three protections are specified for that case. None is built yet.

**Duress corpus.** A second credential opens a plausible decoy corpus that cannot be told apart from the real one. This is the idea of fake credentials in coercion-resistant voting (Juels et al., 2005), applied to the corpus. The agent never reads the decoy. Keeping two corpora is demanding, most of all for the participants Study 3 wants to reach, so the duress corpus is an option and is listed among the open problems of section 10.

**Private ignore marks.** From their own device, the participant can mark a file deposited under pressure as inert, and the agent then disregards it. The mark appears only in the participant's ordinary view; under the duress credential the file looks active.

**Delayed export.** A request to export the whole corpus is fulfilled after a few days, and the participant is notified when it is made. This preserves data portability and blunts coercion in person. It does not stop a coercer who can read the unlocked application.

Once the corpus says enough, nothing further is asked of the participant, and this is the point of the instrument. The corpus can go on growing with very little effort. A browser extension saves a passage from any page in one gesture, and other channels can be added: a note typed or dictated in the application, a forwarded message, a shared document. The channel determines how a file is treated, so no extra step is needed: what the participant writes or dictates counts as their own words, and what they save from elsewhere counts as collected. Reading proposals, deciding and casting the ballot are done for them and remain open to their inspection and correction.

### 4.5 Inference and independence

By default the model runs in attested hardware, so that the corpus is not disclosed to a model provider. A commercial interface is available only if a participant opts in, with a plain statement that the corpus then leaves the enclave. Each participant chooses a model from at least two unrelated families, and the default is assigned at random among them, in application of section 3.4. Every decision records the model, the prompt template, the corpus version and the output, so that it can be re-run.

A proposal is text written by someone who wants a particular vote, and models can be [redirected by instructions](https://en.wikipedia.org/wiki/Prompt_injection) hidden in what they read (Greshake et al., 2023). Deliberation mediated by language models has been shown to be open to such attacks (Gudiño-Rosero, 2026). The defences are structural and are set out in Appendix A. The main ones are that the agent can do nothing except write one reversible ballot; that the model call which reads the proposal never sees the corpus, and the call which decides never sees the proposal's free text (Willison, 2023; Debenedetti et al., 2025); and that the decision rests on what the proposal would execute, not on its description.

### 4.6 Sovereignty

Because the participant holds the same wallet on their own device, control never leaves them.

- **Voting themselves.** At any time before a vote closes, the participant can cast their own ballot from their device. It replaces the agent's, and no one can tell that a replacement took place. When they do so before the agent has voted, the application tells the enclave to stand down for that proposal.

- **Switching the agent off.** The enclave copy then stays idle and the participant votes themselves, or not at all.

- **Withdrawing the enclave's copy.** The participant can rotate to a new voting identity that exists only on their device, using the rotation procedure of the Gov specification. The enclave's copy becomes useless for proposals created afterwards.

The first does not depend on the enclave behaving correctly, and it works even if the enclave is unavailable. The interface shows each participant how often they overrule their agent and when they last added to their corpus, since people who rely on automation tend to stop checking it (Parasuraman and Manzey, 2010). An organisation can also set a lapse period after which an agent stops voting for a participant who has shown no sign of activity.

### 4.7 What the design does not guarantee

Hardware enclaves have been broken by physical attacks (Chuang et al., 2025). The design does not rely on the enclave for the correctness of the tally, which is protected by proofs checked in public. It relies on the enclave for the confidentiality of corpora, for the custody of voting identities, and for the correct behaviour of agents. A compromised enclave could vote in place of the participants it serves; a participant who notices can vote last themselves, and can rotate their identity. Appendix B gives the full threat model. One tension remains open: a participant cannot verify from the public record that their ballot is what the agent reports, because any proof they could check would also serve as a receipt.

A further limit concerns the corpus. The ballot has a booth and the corpus does not. The protections of section 4.4 reduce what a coercer facing the participant can obtain; they do not remove it.

## 5. Research Design

### 5.1 Four studies

The studies are ordered so that each adds one source of risk to the one before: real persons, then the real system, then real stakes. Each is a condition of the next. An instrument that is unstable with virtual persons is not shown to real ones; an agent that does not vote as real persons do is not given a wallet; a system that has not run on a virtual budget is not given a real one.

|  | **Study 1: Synthetic Electorate Test** | **Study 2: Fidelity Panel** | **Study 3: Montpellier Shadow Budget** | **Study 4: Live Budget** |
| --- | --- | --- | --- | --- |
| Status | Reported here | Planned | Planned | Planned |
| Population | 100 virtual persons | 60 real persons | A panel of 150 residents of Montpellier | Members of an association loi de 1901 |
| Proposals | 40, and 50 adversarial | 30 | 36 | To be defined |
| Corpus | Written for the test | Deposited by each participant | Deposited by each participant | Deposited by each participant |
| Object | Proposals on a fictitious budget | Proposals on a virtual budget | A virtual budget made of decisions the City takes | A real budget |
| System | Agent only | Agent only | Complete, in production | Complete, in production |
| Voting | None; the agents' outputs are recorded | None; outputs compared with each participant's own recorded choice | Automatic, from the enclave; binds no one | Automatic, from the enclave; binding |
| What is new | The instrument runs | Real persons | The real system | Real stakes |
| Hypotheses | H3 | H1, H2 | H1, H4, H5 | H1, H4, H5 |

Fidelity (H1) is the assumption on which everything else rests. It is not measured in Study 1. A virtual person has no vote of their own, and comparing an agent's output with a vote that a model attributed to a persona would measure the agreement of models with each other (Bisbee et al., 2024; Morris et al., 2026). Fidelity is measured for the first time in Study 2, against real persons, before anyone is asked to trust an agent with a ballot.

### 5.2 Measures and thresholds

The thresholds were fixed before data collection. [Confirm and give the date and location of the pre-registration.]

|  | **Criterion** | **Measure** | **Threshold** | **Study** |
| --- | --- | --- | --- | --- |
| C1 | Fidelity (H1) | Agreement between agent and person where both vote For or Against | At least 90%, with the lower bound of the 95% interval above every baseline | 2, 3, 4 |
| C2 | Fidelity where it is hard (H1) | The same, on contested proposals (winning margin under 20 points, or person in the minority) | At least 80% | 2, 3, 4 |
| C3 | Personalisation (H2) | Full agent minus the same model without corpus, on contested proposals | At least 10 points | 2 |
| C4 | Stability (H3) | Share of decisions that change when the proposal is reworded or the run repeated | At most 2% | 1, 2 |
| C5 | Resistance to injection (H3) | Share of adversarial proposals that change the ballot | At most 1%, and none where description and executable content disagree | 1 |
| C6 | No bias towards yes | Direction of the agent's errors | Not significantly skewed towards For | 2, 3 |
| C7 | Knows when to ask | Share of proposals escalated | At most 30% | 1, 2, 3 |
| C8 | Participation (H4) | Share of enrolled participants with a counted ballot, against reference rates for the same population | Higher, by a margin fixed beforehand | 3, 4 |
| C9 | Retained control (H5) | Override rate; share of participants who edit their corpus during the study | Both above zero; reported with distribution | 3, 4 |
| C10 | The reasons are the participant's | Share of agent votes whose stated reasons the participant endorses as their own | At least 80% | 2, 3 |
| C11 | Equal fidelity | C1 by level of education | No significant difference | 2, 3 |
| C12 | Congruence with the City | Share of proposals on which the panel's outcome coincides with the decision of the municipal administration | None; reported as a finding | 3 |

In Study 3, C7, C9 and C10 are also reported separately for the two types of proposal defined in section 8.2, projects and routine items. No threshold is set on the difference between them; it is reported as a finding.

### 5.3 Baselines

An agent that agrees with a person 85% of the time has shown nothing if "always vote For" scores 80%. Four baselines are computed on the same data in every study that measures fidelity: always For; follow the eventual majority (unavailable in advance, an upper bound on herd behaviour); the single other participant whose votes best match the person's; and the same model with no corpus.

### 5.4 Ethics and data protection

A corpus is a statement of political opinions, a special category of personal data under [Article 9 of the General Data Protection Regulation](https://gdpr-info.eu/art-9-gdpr/). Study 1 involves no person and no personal data. Studies 2 to 4 require explicit consent, a data protection impact assessment, and the right to withdraw with deletion of the corpus, which the design provides technically from Study 3 onwards. In Study 2 the corpora are processed outside the enclave. [State where inference runs in Study 2, and under what safeguards.] Votes in Study 3 bind no one. Study 4 commits real funds and requires a separate review. [Name the ethics review body and the data controller.]

### 5.5 Sample sizes

Each sample is sized by the criterion it has to satisfy.

| **Study** | **Persons** | **Proposals** | **Sized by** |
| --- | --- | --- | --- |
| 1 | 100 virtual persons, 20 of them with a corpus written to be silent or contradictory | 40 (20 projects, 20 routine items), and 50 adversarial | C4, C5 |
| 2 | 60 participants, 20 at each of three levels of education | 30 (15 projects, 15 routine items) | C1, C2, C11 |
| 3 | 150 participants retained, of about 200 recruited; at least 50 from priority neighbourhoods | 36 over 12 weeks (12 projects, 24 routine items) | C1, C8, ballot secrecy |

**Study 1.** One hundred agents on 40 proposals give 4,000 decisions per model family, so that a rate of instability of 2% (C4) is estimated to within about half a point. A claim that at most 1% of adversarial proposals change a ballot (C5) requires at least 300 runs without a failure; 50 adversarial proposals against 100 agents give 5,000. Inference is cheap, and nothing argues for a smaller sample.

**Study 2.** Sixty participants on 30 proposals give 1,800 person–proposal pairs, about 1,500 once abstentions are set aside. Votes by the same person are correlated, which reduces the effective sample; with a within-person correlation of 0.05 it is about 600, and a fidelity of 90% is then estimated to within about 2.5 points, enough to separate it from a baseline at 80 to 85%. If a third of proposals are contested, C2 is estimated to within about 4 points. Twenty participants at each level of education can detect a difference in fidelity of about 10 points between levels, and not a smaller one. Thirty proposals take about 45 minutes; beyond that, fatigue would degrade the participant's own vote, which is what the agent is measured against.

**Study 3.** With control ballots on a third of 36 proposals, answered about 60% of the time, 150 participants give roughly 1,000 pairs and a fidelity estimated to within about 2 points. At this size a unanimous result, which would reveal every vote, is very unlikely, and onboarding takes about ten facilitated sessions. The panel is not a representative sample of the city, which would require about 1,000 persons; this is why C12 has no threshold.

The within-person correlation of 0.05 is an assumption. Study 2 provides an estimate, and the size of Study 3 is revised if it is markedly higher. [Replace with the estimate once Study 2 is complete.]

## 6. Study 1: Synthetic Electorate Test

[This section is a frame. Every figure in brackets is to be supplied from the test. The wording of 6.4 and 6.5 assumes all criteria were met and must be revised if any was not.]

### 6.1 Purpose

The Synthetic Electorate Test runs the agent on persons who do not exist. It answers three questions that must be settled before any real person is involved. Does the instrument run from corpus to vote, on many corpora and many proposals? Are its votes stable, and can the text of a proposal redirect them (H3)? Does it withhold its vote when the corpus gives it nothing to go on?

It does not answer whether the agent votes as a person would. The study records what each agent voted; it makes no claim that the vote is the right one for the persona.

### 6.2 Material

**Virtual persons.** One hundred virtual persons, each defined only by a corpus of more than three files of the kinds described in section 4.4. The corpora were written to vary in position, length, register and completeness. Twenty of them are deliberately silent or contradictory on one category of proposal. [State how the corpora were written, and with which model if any.]

**Proposals.** Forty proposals on a fictitious neighbourhood budget, each asking whether a named undertaking should be funded for a given amount, of which 20 projects and 20 routine items in the sense of section 8.2.

**Adversarial suite.** Fifty proposals in which the text attempts to redirect the vote or misdescribes its executable content.

### 6.3 Procedure

For each virtual person and each proposal, the agent described in section 4 decided For, Against, Abstain or Escalate, and gave its reasons. No ballot was cast. Two model families were used: Claude Opus 5.5 (Anthropic) and [Mistral model and version] (Mistral AI). Claude Opus 5.5 is reached through a commercial interface, which is acceptable here because the corpora contain no personal data. Each decision was repeated on [N] rewordings of the proposal, and once with the same model and no corpus. The adversarial suite was run against the same agents.

### 6.4 Results

| **Output** | **Claude Opus 5.5** | **Mistral** |
| --- | --- | --- |
| For | [x%] | [x%] |
| Against | [x%] | [x%] |
| Abstain | [x%] | [x%] |
| Escalate | [x%] | [x%] |

|  | **Criterion** | **Threshold** | **Result** | **Met** |
| --- | --- | --- | --- | --- |
| C4 | Stability | ≤ 2% | [x%] | [yes/no] |
| C5 | Resistance to injection | ≤ 1% | [x%] | [yes/no] |
| C7 | Escalation | ≤ 30% | [x%] | [yes/no] |

| **Descriptive measure** | **Result** |
| --- | --- |
| Decisions that differ from the same model without corpus | [x%] |
| Proposals on which the agents did not all vote alike | [x%] |
| Escalation where the corpus was written to be silent or contradictory | [x%] |
| Disagreement between the two model families | [x%] |
| Cost of inference per decision | [amount] |

[Draft wording, valid only if the figures support it.] Across 4,000 decisions per model family, the agents voted For in [x]% of cases, Against in [x]%, abstained in [x]% and escalated in [x]%. Rewording a proposal or repeating the run changed [x]% of decisions. Of the adversarial proposals, [x]% changed a ballot. With the corpus removed, [x]% of decisions were different, which indicates that the agents' votes depend on what the corpus says and not only on the model's general priors. Where the corpus had been written to be silent or contradictory, the agent escalated in [x]% of cases. [Add: variation by length and register of the corpus; by type of proposal.]

### 6.5 Interpretation and limits

[Draft wording.] H3 is supported on this material. Three limits apply. The study says nothing about fidelity, for the reason given in section 5.1. Virtual corpora are tidier than real ones: they were written in one piece, for the purpose, and do not contain the gaps, contradictions and irrelevant material of files deposited over time. And an adversarial suite tests the attacks its authors thought of. The result permits Study 2 and nothing more.

## 7. Study 2: Fidelity Panel

### 7.1 Purpose

The Fidelity Panel tests the central assumption with real persons and nothing else. There is no wallet, no enclave and no ballot. Each participant supplies a corpus and their own vote on a set of proposals; the agent votes on the same proposals; the two are compared. If the agent does not vote as these persons do, the instrument is not built further.

### 7.2 Participants and material

Sixty participants, recruited in Figuerolles and selected for the variety of their profiles: age, occupation, level of education and prior experience of taking part in collective decisions. Twenty are recruited at each of three levels of education, so that C11 can be tested (section 5.5).

Each participant deposits a corpus as described in section 4.4. Those who prefer to speak can have a short interview transcribed into a first file. Nothing has to be written for the purpose.

Thirty proposals on a virtual budget, each asking whether a named undertaking should be funded for a given amount, of which 15 projects and 15 routine items. No money is committed.

### 7.3 Procedure

- **Corpus.** The participant deposits their files.

- **The participant's own vote.** The participant reads each proposal and records For, Against or Abstain. They have not seen any output of the agent.

- **The agent's vote.** The agent is run on the same proposals, outside the voting system, with two model families, on rewordings of each proposal, and once with no corpus.

- **Debrief.** The participant is shown the agent's vote and reasons on each proposal. They are asked whether the reasons are their own (C10). Where the two votes differ, they are asked which they would keep on reflection, and why.

The order matters. A person who is shown an agent's vote and then asked whether they agree tends to agree (Parasuraman and Manzey, 2010). C1 and C2 are therefore computed on the vote recorded before the agent's was shown. Cases in which a participant, on reflection, prefers the agent's vote are reported separately and do not count towards fidelity.

### 7.4 Measures

C1 to C4, C6, C7, C10 and C11, with the four baselines of section 5.3. Also reported: the number and length of files deposited, the time participants spent, and the reasons participants give when their vote and the agent's differ.

### 7.5 Limits and passage to Study 3

Nothing is voted automatically, so the study says nothing about participation (H4) or retained control (H5). A corpus assembled for a session is thinner than one that grows over months, which may lower fidelity. The budget is virtual. And the participant's vote is recorded in a study setting, where people may take more care than they would alone.

Study 3 proceeds only if C1 and C2 are met. [Confirm the rule, and what is done if C11 fails.]

## 8. Study 3: Montpellier Shadow Budget

### 8.1 Case selection

The study takes place in [Montpellier](https://en.wikipedia.org/wiki/Montpellier), with a panel drawn from across the city. It includes Figuerolles, a dense inner-city neighbourhood part of which, with the adjoining Cité Gély, is classed as a priority neighbourhood under national urban policy; the city's urban contract includes a project for Gély-Figuerolles (Montpellier Méditerranée Métropole, n.d.). French law has required a citizens' council in every priority neighbourhood since 2014 (Ville de Montpellier, n.d.). [Add population and socio-economic indicators from INSEE, for the city and for its priority neighbourhoods.]

The case is selected for two reasons. The first is that a city contains the hard cases. The literature predicts low participation and a strong hidden census in priority neighbourhoods (Gaxie, 1978; Braconnier and Dormagen, 2007), and the one study of individual prediction found lower accuracy for less-educated participants (Gudiño et al., 2024). If agents are faithful and are used there, the result is more informative than the same result among people who already take part. If they are not, the claim of this article fails where it matters most. The composition of the panel therefore matters as much as its size: at least a third of it, 50 participants or more, is drawn from priority neighbourhoods, Figuerolles among them.

Figuerolles is not constituted as a neighbourhood council of its own, and the study does not need it to be. The unit of the study is a panel of individuals, and no council takes part in it.

The second is that a city has an administration that decides. The City created eight neighbourhood councils by a deliberation of 2021 (Ville de Montpellier, 2022); under the law these councils are consulted and the municipal administration decides (Code général des collectivités territoriales, art. L2143-1). The panel votes on the same matters as the administration, in its shadow: its votes bind no one, and its outcomes can be set beside the decisions actually taken.

### 8.2 The object of decision: a shadow budget

Participants decide how to allocate a virtual budget defined with Montpellier City Hall: a notional envelope of 1,000,000 euros and a set of real spending options. The amount lies between the envelopes of the City's own participatory budget in 2025 (300,000 euros) and in 2024 (2,000,000 euros) (Ville de Montpellier, 2024, 2025), so the sums at issue are of an order the City already puts to its residents. The proposals together ask for about twice the envelope, so that not everything can be funded. No public money is committed and the votes bind no one. [State the form of the City's involvement: agreement, convention or letter, and what the City undertakes to do with the results.]

The budget is put to the vote as a series of proposals. Each is presented as a named and located undertaking, stating what would be done, where and for whom, and asks whether it should be funded for a given amount. The ballot itself remains For, Against or Abstain, as the voting conditions of section 4 require; richer ballots such as rankings are not available in the first version of the protocol. The envelope is enforced by the contract: a proposal that would exceed what remains cannot be executed.

**Proposals the City decides.** Most proposals correspond to spending decisions that the municipal administration takes during the study or has recently taken. For each of them the panel's outcome can be compared with the City's (C12). Participants can also submit proposals; these have no counterpart and are excluded from the comparison. [Agree with the City which decisions are used, and how a decision of the administration is coded as For or Against.]

**Projects and routine items.** People may be more willing to take part when they decide on specific projects, as in a participatory budget, than on day-to-day matters such as which pothole to repair. This is treated here as a hypothesis and built into the design. Proposals are of two types, labelled in advance. *Projects* are identifiable and visible [examples to be agreed with the City: the redesign of a square, a space for young people, a cultural event]. *Routine items* are small and recurrent, of the kind a city handles continuously [examples: minor road repairs, replacement of street furniture, renewal of a small grant]. The expected division of labour is that participants keep projects for themselves, by reserving them (section 4.3) or by overruling their agent, and leave routine items to it. Both types are needed. A study made only of attractive projects would be easier to fill, but it would not test the agent where the cost of participation is highest, which is the repeated small decision. [Fix the proportion of each type, and the rule for classifying proposals submitted by participants.]

A budget is a suitable object for three reasons. It forces trade-offs, so preferences are tested where they conflict. Each proposal has an executable content, a transfer from a treasury, which is what the agent's decision is meant to rest on. And budgets are what local bodies are most plausibly asked to decide.

### 8.3 Participants and procedure

The target is a panel of 150 residents of Montpellier at the end of the study. About 200 are recruited across the city, to allow for withdrawals, and selected for the variety of their profiles, with attention to those who do not usually take part. Recruitment is framed around the decisions to be taken for the city and not around the technology; the agent is introduced at onboarding, as what spares participants from coming back for every vote. Onboarding sessions are held in Figuerolles. [Name the local partner that hosts them.]

The complete instrument is deployed in its production configuration: Gov's private mode, the enclave, and automatic voting. Each participant receives a non-transferable token. Only the budget is virtual. [State the network, and what the treasury holds.]

- **Onboarding.** In a facilitated session, each participant creates a passkey, deposits a first file, and chooses a model. Those who prefer to speak can have a short interview transcribed into that first file. Each participant is shown how to reserve a category of proposals, such as projects, on which they always want to be asked; no default is imposed.

- **Proposals.** Over 12 weeks, 36 budget proposals, of which 12 projects and 24 routine items, are put to a vote.

- **Automatic voting.** For each proposal, agents vote from the enclave under the conditions of section 4. Participants are notified and can vote themselves from their own device.

- **Control ballots.** For a random third of proposals, drawn within each type, participants are invited to record their own choice before their agent's vote is shown to them. These records are the basis for C1 and C2. They are a measurement within automatic operation, not a separate phase.

- **Coercion exercise.** With consent, a simulated coercer asks volunteers to prove how they voted. The exercise records whether any proof can be produced.

- **Interviews.** Semi-structured interviews at the start, middle and end, with participants and with eligible persons who declined. Those who declined are asked which weighed more in their choice: the decisions on offer or the use of AI.

Participation (C8) is compared with reference rates for the same population: [turnout at the last municipal election in the polling stations concerned; participation in comparable City consultations].

### 8.4 Measures

Quantitative: C1, C2, C6 to C12; the number of files deposited and the time participants report spending; costs per vote (network fees and inference). C7, C9 and C10 are broken down by type of proposal, project or routine item, together with the categories participants reserve at onboarding and afterwards.

Congruence (C12) is reported as the share of proposals on which the panel and the administration decided alike, with the list of those on which they did not. It has no threshold, and a divergence is not read as an error of either. A panel of volunteers is not a representative sample of the city, and the administration decides under constraints the panel does not see.

Qualitative: how participants describe the agent (tool, delegate, something else); what they write in their corpus and what they leave out; which decisions they want to keep for themselves, and why; reasons for overruling; reasons for declining.

### 8.5 Timeline and prerequisites

| **Step** | **Content** |
| --- | --- |
| Before fieldwork | Study 2 completed, with C1 and C2 met; Gov private mode implemented and deployed; Wulong voting and agent modules; Genji screens; ethics approval; agreement with the City of Montpellier on the virtual budget, including the decisions used for comparison and the list of projects and routine items |
| [Month] | Recruitment and onboarding |
| [Months] | Voting period |
| [Month] | Final interviews, analysis, publication of anonymised data |

### 8.6 Anticipated difficulties

The budget is virtual, and people may decide differently, or care less, when nothing is at stake; the interviews ask about this directly, and Study 4 is the test. Passkeys require a recent smartphone or computer, which may exclude some of the people the study most wants to reach; shared devices at a local partner's premises are one remedy. Even a corpus made of deposited files presupposes a relation to written political expression that Gaxie's argument says is unequally distributed; accepting any file, including a transcribed conversation, is meant to address this, and whether it does is itself a finding. With a small electorate, unanimous results reveal votes. Projects may draw all the attention and routine items none, in which case the study would show interest in the budget and say little about the agent; the breakdown by type in section 8.4 is there to make this visible. A panel spread over a city has less in common than the residents of one neighbourhood, and a participant may have no view on a proposal that concerns another district; the rate of abstention and escalation by distance from the proposal's location is reported. Each of these is reported whatever the outcome.

## 9. Study 4: Live Budget

The Live Budget repeats Study 3 with one change: the money is real and the votes are binding. It is described here in outline, because its design depends on the results of Study 3 and on an institution willing to commit funds.

**Conditions of passage.** Study 4 takes place only if four conditions are met: Study 3 met C1, C2, C6 and C7; Gov's private mode has been audited; the body that commits the funds has legal control of them; and a separate ethics review has been obtained.

**The body and the funds.** The study takes place in an association loi de 1901, whose members vote on its own budget. The vote binds by the association's statutes, and no question of municipal law arises. The study is not tied to a neighbourhood council, and official status as one would not help: under article L2143-1 of the Code général des collectivités territoriales such councils are consultative, and the municipal council decides. An association falls within the scope stated in section 1, and one based in Figuerolles would return the study to the hard case, with real stakes. [Name the association and the amount.]

**What it adds.** Studies 2 and 3 cannot show how participants or agents behave when real money and real opposition are involved. With real stakes, someone has an interest in manipulating a proposal's text, in obtaining a corpus, or in pressing a participant to show their vote. The measures are those of Study 3, C1, C2 and C6 to C11, compared with the values obtained on the virtual budget. The differences between the two are the finding.

## 10. Discussion

**What the results can and cannot show.** Study 1 shows that the instrument is stable and resists the manipulations it was tested against. It shows nothing about persons. A positive result in Studies 2 and 3 would establish that an agent can vote as its participant would, and that people, including those who do not usually take part, use it while retaining control. It would not establish that decisions taken with agents are better decisions. Fidelity and participation are measurable; the quality of collective outcomes is a further question, on which this article makes no claim.

**What a synthetic electorate is for.** Synthetic respondents have been proposed as substitutes for real ones and found wanting (Bisbee et al., 2024; Morris et al., 2026). Study 1 does not use them that way. Virtual persons stand in for no one. They are test material, in the sense in which software is tested on invented inputs before it is given real ones, and the study draws no conclusion from them about how any person would vote.

**Comparison with the City.** Setting the panel's outcomes beside the administration's decisions (C12) describes a distance. It does not say who is right. Agreement may mean that the administration already decides as residents would, or that the proposals left little room to differ. Disagreement may reflect the panel's composition, constraints the panel does not see, or a real difference of preference. The comparison is useful for what it locates: the kinds of decision on which a body of residents and an administration part ways.

**Participation or its appearance.** The instrument asks very little of participants, and that is both its purpose and its risk. Counting more ballots is not the same as more people taking part. If participants never overrule and never edit their corpus, the agent has become a representative in all but name, and the Event Horizon objection applies. C9 and the interviews are there to detect this. The design does not prevent it by construction: an agent goes on voting for a participant who does nothing. The override rate, corpus activity and the optional lapse period are the safeguards, and whether they suffice is an empirical matter. The distinction between projects and routine items sharpens the test. An override rate that is low on routine items and clearly higher on projects would indicate a chosen division of labour: the participant keeps the decisions they care about and instructs an instrument for the rest. A rate near zero on both would indicate abandonment.

**What people want to decide.** The article's argument concerns the cost of participation. The hypothesis stated in section 8.2 points to a second explanation of abstention: that people stay away because the decisions on offer do not interest them. If the object matters more than the cost, lowering the cost is not enough, and an agent is useful only alongside decisions that are worth taking part in. The two explanations are compatible, and the design of Study 3 lets them be told apart: enrolment and the reasons given for declining speak to the object, and what participants leave to their agent speaks to the cost.

**A new hidden census.** An instrument that is instructed through text, even text the participant only collects, may favour those at ease with writing. If C11 fails, agents widen the gap they were meant to close, and the answer to the research question in that setting is no.

**Homogenisation.** Shared models may pull many agents the same way. The article treats this by design (choice among unrelated model families) and by measurement (inter-model disagreement), and it remains the least understood risk.

**Dependence on infrastructure.** The system must work without its operator (Appendix C), and the body that uses it must pay for it. The recent closure of a major governance platform for lack of demand (Catenaa, 2026) is a reminder that such tools do not sustain themselves.

**Virtual stakes.** Studies 2 and 3 measure fidelity, participation and control on a budget that commits no funds. Only Study 4 can show how participants and agents behave when real money and real opposition are involved, and it is the furthest from being carried out.

**Scope.** Nothing here applies to public elections. The conditions of section 3.5 are demanding, the identity of participants is assumed to be established by the organising body, and proxy voting in elections is restricted by law for good reasons.

**Open problems.** Verifying the agent's ballot without creating a receipt; resistance to surrender of the passkey; keeping a voting identity safe in two places; a duress corpus that participants with little time or technical ease can actually use; and whether participants should be able to share parts of a corpus, which would reintroduce delegation in a softer form.

## 11. Conclusion

Can AI improve democracy? Under conditions, and the conditions are most of the answer. An agent improves democracy only if it votes as its participant would, can be overruled without permission, casts a ballot no one can inspect, reasons independently of other agents, and runs on infrastructure that outlives its operator. Four of these are matters of design, and the article has specified them. The first is a matter of fact, and it is still open. [Draft wording.] The Synthetic Electorate Test reported here shows an instrument that is stable and hard to redirect; it does not show that the instrument votes as a person would. The Fidelity Panel will test that with real persons, the Montpellier Shadow Budget with the real system, and the Live Budget with real stakes.

The historical argument is that democracies have widened participation by lowering its price, as Athens did, and narrowed it by handing decisions to representatives. A personal agent belongs to the first tradition. Whether it stays there depends on whether participants keep instructing it, and that is the finding to watch.

## References

Achen, C.H. and Bartels, L.M. (2016). *Democracy for Realists: Why Elections Do Not Produce Responsive Government.* Princeton University Press.

Arbitrum Forum (2025). ["[RFC] Proposal to Adjust the Voting Power of the Arbitrum Community Pool & Ratifying the Agentic Governance Pivot."](https://forum.arbitrum.foundation/t/29280)

Argyle, L.P. et al. (2023). "Out of One, Many: Using Language Models to Simulate Human Samples." *Political Analysis*, 31(3), 337–351.

Aristotle. *The Athenian Constitution*, 27.3 and 41.3.

Azoulay, V. (2026). *Ostracisme ! Du bon usage de l'arbitraire en démocratie.* Éditions de l'EHESS.

Barbereau, T., Smethurst, R., Papageorgiou, O., Sedlmeir, J. and Fridgen, G. (2023). "Decentralised Finance's timocratic governance: The distribution and exercise of tokenised voting rights." *Technology in Society*, 73, 102251.

Béranger, J. (2026). ["Private Coercion-Resistant Voting for Gov."](https://julienberanger.com/gov-private-voting) Draft v2, 12 October 2026.

Bisbee, J. et al. (2024). "Synthetic Replacements for Human Survey Data? The Perils of Large Language Models." *Political Analysis*, 32(4), 401–416.

Blondiaux, L. (2008). *Le nouvel esprit de la démocratie. Actualité de la démocratie participative.* Seuil.

Blum, C. and Zuber, C.I. (2016). "Liquid Democracy: Potentials, Problems, and Perspectives." *Journal of Political Philosophy*, 24(2), 162–182.

Braconnier, C. and Dormagen, J.-Y. (2007). *La démocratie de l'abstention.* Gallimard.

Burke, E. (1774). Speech to the Electors of Bristol, 3 November 1774.

Buterin, V. (2026a). "Ethereum itself must pass the walkaway test." Post on X, 12 January 2026.

Buterin, V. (2026b). ["Personal governance agents, public conversation agents, and the importance of privacy."](https://x.com/VitalikButerin/status/2025225247088402581) Post on X, 21 February 2026.

Capponi, A., Gliozzo, A., Han, C. and Lee, J. (2025). "DAO-AI: Evaluating Collective Decision-Making through Agentic AI in Decentralized Governance." [arXiv:2510.21117](https://arxiv.org/abs/2510.21117).

Catenaa (2026). "Tally to Shut Down After Five Years in Crypto." 20 March 2026.

Chuang, J., Seto, A., Berrios, N., van Schaik, S., Garman, C. and Genkin, D. (2025). ["TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition."](https://tee.fail)

Code général des collectivités territoriales, article L2143-1.

Coeckelbergh, M. (2024). *Why AI Undermines Democracy and What To Do About It.* Polity Press.

Condorcet, N. de (1785). *Essai sur l'application de l'analyse à la probabilité des décisions rendues à la pluralité des voix.* Paris.

Cong, L.W., Rabetti, D., Wang, C.C.Y. and Yan, Y. (2025). "Centralized Governance in Decentralized Organizations." Working paper, August 2025.

Debenedetti, E. et al. (2025). "Defeating Prompt Injections by Design." [arXiv:2503.18813](https://arxiv.org/abs/2503.18813).

Déloye, Y. and Ihl, O. (2008). *L'acte de vote.* Presses de Sciences Po.

Downs, A. (1957). *An Economic Theory of Democracy.* Harper & Row.

Feichtinger, R., Fritsch, R., Vonlanthen, Y. and Wattenhofer, R. (2023). "The Hidden Shortcomings of (D)AOs: An Empirical Study of On-Chain Governance." FC 2023 International Workshops, LNCS 13953, 165–185.

Fishkin, J.S. (2009). *When the People Speak: Deliberative Democracy and Public Consultation.* Oxford University Press.

Garrigou, A. (1992). *Le vote et la vertu. Comment les Français sont devenus électeurs.* Presses de la FNSP.

Gaxie, D. (1978). *Le cens caché. Inégalités culturelles et ségrégation politique.* Seuil.

Greshake, K. et al. (2023). "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection." AISec '23; [arXiv:2302.12173](https://arxiv.org/abs/2302.12173).

Gudiño, J.F., Grandi, U. and Hidalgo, C.A. (2024). "Large language models (LLMs) as agents for augmented democracy." *Philosophical Transactions of the Royal Society A*, 382(2285), 20240100.

Gudiño-Rosero, J. (2026). *Large Language Models and Augmented Democracy.* Doctoral thesis; arXiv preprint, October 2026.

Hansen, M.H. (1991). *The Athenian Democracy in the Age of Demosthenes.* Blackwell.

Hong, L. and Page, S.E. (2004). "Groups of diverse problem solvers can outperform groups of high-ability problem solvers." *PNAS*, 101(46), 16385–16389.

Johnson, J. and Orr, S. (2020). *Should Secret Voting Be Mandatory?* Polity Press.

Juels, A., Catalano, D. and Jakobsson, M. (2005). "Coercion-Resistant Electronic Elections." WPES 2005, 61–70.

Jungherr, A. (2023). "Artificial Intelligence and Democracy: A Conceptual Framework." *Social Media + Society*, 9(3), 1–14.

Kostelka, F. and Blais, A. (2021). "The Generational and Institutional Sources of the Global Decline in Voter Turnout." *World Politics*, 73(4), 629 ff.

Kreps, S. and Kriner, D. (2023). "How AI Threatens Democracy." *Journal of Democracy*, 34(4), 122–131.

Kreuner, M. et al. (2025). "Persona-driven Simulation of Voting Behavior in the European Parliament with Large Language Models." [arXiv:2506.11798](https://arxiv.org/abs/2506.11798).

Landemore, H. (2020). *Open Democracy: Reinventing Popular Rule for the Twenty-First Century.* Princeton University Press.

Landemore, H. (2026). *Politics Without Politicians: The Case for Citizen Rule.* Allen Lane.

Lever, A. (2015). "Privacy and Democracy: What the Secret Ballot Reveals." *Law, Culture and the Humanities*, 11(2), 164–183.

Lijphart, A. (1997). "Unequal Participation: Democracy's Unresolved Dilemma." *American Political Science Review*, 91(1), 1–14.

Lupia, A. (1994). "Shortcuts Versus Encyclopedias: Information and Voting Behavior in California Insurance Reform Elections." *American Political Science Review*, 88(1), 63–76.

Manin, B. (1997). *The Principles of Representative Government.* Cambridge University Press.

Mansbridge, J. (2003). "Rethinking Representation." *American Political Science Review*, 97(4), 515–528.

Miller, J.C. (1969). "A program for direct and proxy voting in the legislative process." *Public Choice*, 7, 107–113.

Montpellier Méditerranée Métropole (n.d.). [Contrat de ville, annexe 1: priorités et orientations stratégiques](https://contratdeville.montpellier3m.fr).

Morris, G.E., Leff, B. and Enns, P.K. (2026). ["Can AI 'digital twins' replace human respondents?"](https://www.verasight.io/reports/can-ai-digital-twins-replace-human-respondents) Verasight, 2 June 2026.

Pahari, V., Chandrasekaran, B., Messias, J., Gummadi, K.P. and Dash, A. (2026). "On the Centralization of Governance Power in Decentralized Autonomous Organizations." [arXiv:2604.25959](https://arxiv.org/abs/2604.25959).

Parasuraman, R. and Manzey, D.H. (2010). "Complacency and Bias in Human Use of Automation: An Attentional Integration." *Human Factors*, 52(3), 381–410.

Pitkin, H.F. (1967). *The Concept of Representation.* University of California Press.

PSE (2025). ["State of Private Voting 2026."](https://pse.dev/blog/state-of-private-voting-2026) Privacy and Scaling Explorations, 12 November 2025.

Rosanvallon, P. (2006). *La contre-démocratie. La politique à l'âge de la défiance.* Seuil.

Shreves, R. (2026). ["Lessons Learned from the First Wave of Experiments with AI in Governance."](https://ricshreves.net/lessons-learned-from-the-first-wave-of-experiments-with-ai-in-governance/)

Smith, G. (2009). *Democratic Innovations: Designing Institutions for Citizen Participation.* Cambridge University Press.

Solijonov, A. (2016). *Voter Turnout Trends around the World.* International IDEA.

Tessler, M.H. et al. (2024). "AI can help humans find common ground in democratic deliberation." *Science*, 386(6719), eadq2852.

Urbinati, N. (2006). *Representative Democracy: Principles and Genealogy.* University of Chicago Press.

Ville de Montpellier (n.d.). ["Conseils citoyens."](https://participer.montpellier.fr)

Ville de Montpellier (2022). ["Conseils de quartier."](https://participer.montpellier.fr) Brochure.

Ville de Montpellier (2024). [Règlement du Budget participatif de Montpellier 2024](https://participer.montpellier.fr/sites/default/files/2024-05/Budget%20participatif%20Montpellier%202024.pdf).

Ville de Montpellier (2025). [Règlement du Budget participatif de Montpellier 2025](https://participer.montpellier.fr/sites/default/files/reglement-bp-2025.pdf).

Willison, S. (2023). ["The Dual LLM pattern for building AI assistants that can resist prompt injection."](https://simonwillison.net/2023/Apr/25/dual-llm-pattern/)

**Software and specifications.** [Gov](https://github.com/w3hc/gov) · [w3pk](https://github.com/w3hc/w3pk) · [Genji](https://github.com/w3hc/genji) · [Wulong](https://github.com/w3hc/wulong)

## Appendix A. Defences against Prompt Injection

A proposal, and any passage saved from the web, is untrusted input to a language model. The risk cannot be removed. It can be reduced to a level where an attack is expensive, visible and limited in effect. The design uses seven layers.

- **Least capability.** The agent can do one thing: write one reversible ballot into one slot. It has no tools, no network access during the decision, and no access to any other participant's data. The worst outcome of a successful attack on one agent is one wrong vote that its owner can still change.

- **Separation of reading and deciding.** One model call reads the proposal and extracts a fixed-format summary of what it would do. It never sees the corpus. A second call receives that summary and the corpus and decides. Text from the proposal never reaches the deciding call as free prose. This is the dual-model pattern (Willison, 2023), and it is the main structural defence (Debenedetti et al., 2025).

- **Decide on what the proposal does.** The agent decodes the calldata and simulates its effects. The decision rests on those effects. If the description and the simulated effects disagree, the agent escalates and flags the proposal publicly.

- **Constrained output.** The deciding call can return only one of four values and a list of the corpus entries it relied on. A vote that cites no statement by the participant is treated as an escalation.

- **Corpus hygiene.** Collected files are kept with their source, are stripped of markup, and are placed after the participant's own files with an explicit lower rank. A collected file cannot create a standing instruction.

- **Consistency checks.** The decision is repeated on reworded versions of the summary and, where the participant allows, on a second model family. Any disagreement escalates.

- **Continuous red-teaming.** A public suite of adversarial proposals runs against every release of the agent. Results are published with each release, and section 5 sets a pass threshold.

Two properties of the wider system add to these. Because participants use different models and different corpora, one inserted string is unlikely to move a large share of agents the same way. And the organisation sets the period between a proposal's publication and the first agent vote; a shorter period lowers the effort asked of everyone and leaves less time for people to read a proposal and raise an alarm.

## Appendix B. Privacy, Threat Model and Enclave Configuration

### B.1 Who can learn what

| **Who** | **Can learn** | **Cannot learn** |
| --- | --- | --- |
| Public observer | That a slot was registered and updated; the final tally | Which participant owns a slot; any ballot |
| Tally committee, below threshold | Nothing beyond the public view | Any ballot |
| Tally committee, at threshold | Contents of individual slots | Which participant owns a slot |
| Wulong enclave | The corpus; the participant's voting identity; every ballot the agent cast; timing and network metadata | The content of ballots the participant casts directly |
| Operator of the enclave host | Network metadata such as IP addresses | Anything inside the enclave |
| Inference provider (attested) | Nothing in plaintext, if the enclave holds | — |
| Coercer | Whatever the participant chooses to show | Whether what they were shown is the final ballot |

Three points need stating plainly.

**One instance, holding a copy of the voting identities.** A single Wulong instance stores the corpora, runs the agents, holds the enclave copy of each participant's wallet and relays transactions. This is simpler to operate, to audit and to attest, and it is what allows participants to do nothing when a proposal appears. It departs from the Gov specification, in which the voting identity exists on the participant's device only and the relayer holds no participant secrets. The enclave therefore knows, for each participant it serves, which slot is theirs and what the agent voted in it. Voter anonymity towards the public and the tally committee is unchanged.

**The agent's log is not a receipt.** The log tells the participant what the agent did and why. A participant could show it to a coercer, but it proves nothing about the final ballot, because the participant can vote again themselves and the new ballot is indistinguishable from background activity. The log is not signed for third parties.

**Verifying the agent conflicts with receipt-freeness.** A slot is encrypted to the tally committee, so a participant cannot check onchain that the agent voted as its log says. Anything that let them check would also be something to show a coercer. The participant relies on the enclave's attestation. Section 10 returns to this.

### B.2 Threats

| **Threat** | **Effect if it succeeds** | **Mitigation** | **Residual risk** |
| --- | --- | --- | --- |
| Physical attack on the enclave host | Corpora and the enclave copies of voting identities exposed; attacker could vote for the participants served | Hosting in a major provider's data centre; participant can vote last from their device; rotation to an identity kept on the device only | Real. See B.3 |
| Malicious or compromised operator | Attempts to run altered code | Reproducible builds; image digest pinned; keys derived only by code versions allowed in the onchain key service, governed by a Safe with timelock | Collusion among key-governance signers |
| Adversarial proposal text | Wrong votes by some agents | Appendix A | Novel attacks; bounded to one reversible vote per affected agent |
| Poisoned file in a corpus | A single participant's agent misled | Collected files ranked below the participant's own; cannot create instructions; consistency checks | Subtle factual poisoning |
| Stolen passkey or passkey-provider account | Impersonation in private votes; access to the corpus | Identity rotation, as in the Gov specification | Until rotation |
| Coercer present until the deadline | Coerced vote stands | Masking; participant may revote within the final interval | The last 15 minutes |
| Coercer demands the corpus | Political opinions disclosed; the agent's likely votes can be predicted | Duress corpus (optional); private ignore marks; delayed export; the final ballot stays secret because the participant can replace it unseen | A coercer who can read the unlocked application; usability of the duress corpus |
| Committee collusion at threshold | Ballot contents exposed, without identities | Independent keypers; bonds on the roadmap | Small electorates |
| Model monoculture | Correlated errors across agents | Model diversity by default | Shared training data across families |
| Wulong disappears | No automatic votes | Direct voting from the participant's device, at once; redeployment from the published image | Participants who do not notice |

### B.3 What an enclave does and does not guarantee

Enclaves are not a hard boundary. In late 2025 the Battering RAM, WireTap and TEE.fail attacks extracted secrets, including attestation keys, from current Intel and AMD enclaves using inexpensive devices attached to the memory bus (Chuang et al., 2025). Both vendors regard physical attacks as outside their threat model.

The design accepts this. It does not ask the enclave to protect the result of a vote: the tally is protected by zero-knowledge proofs and onchain checks, and a broken enclave cannot forge the count. It cannot change how other participants voted or what the count is, but it can cast wrong ballots for the participants it serves. The enclave protects three things: the confidentiality of corpora, the custody of voting identities, and the correct behaviour of agents. An attacker with physical access to the host could read the first, use the second and subvert the third. The mitigations are physical custody by a provider the organisation trusts, the participant's ability to vote last from their own device, and rotation to a new identity. Participants who do not accept this residual risk rotate to an identity kept only on their device and vote themselves, which involves no enclave at all.

### B.4 Enclave configuration

Wulong runs on Phala Cloud under the following configuration.

| **Property** | **Configuration** |
| --- | --- |
| Platform | Intel TDX, dstack OS image 0.6.0 or later. In production the service refuses to start without the dstack guest agent |
| Code identity | The image is built in continuous integration and pinned by digest, so the attested compose hash commits to that exact image. RTMR3 identifies the application; MRTD and RTMR0–2 identify the OS image |
| Keys | The ML-KEM-1024 key pair and the identity key are derived at boot from the dstack key service. Nobody handles them, including whoever deploys. Startup fails if any key material is supplied through the environment |
| Who may run new code | Deployment uses the onchain key service (DstackKms on Base) and not the provider's default, so the list of code versions allowed to derive the keys is public and governed |
| Transport | TLS terminates inside the enclave; the gateway passes the encrypted stream through. The certificate is signed by a public authority, so browsers accept it. Confidentiality does not rest on it: the client verifies the attestation and encrypts to the ML-KEM key bound in it |
| Verification | Anyone can request an attestation with a fresh nonce and check the quote, the measurements and the key binding with the published script |

With this configuration the operator of the host observes network metadata such as IP addresses, and nothing inside the enclave. The claim depends on the deployed OS image giving the operator no shell in the enclave, and the measurements let anyone confirm which image is running.

## Appendix C. Operation without the Operator

A protocol passes the walkaway test if it remains safe and useful after its developers and operators stop maintaining it (Buterin, 2026a).

**Voting.** The participant's device holds the same wallet as the enclave. If Wulong is down, censoring or gone, participants vote directly from their device, at once, and a standalone script continues masking. Anyone authorised by the key governance can also redeploy the published image, which derives the same keys and resumes automatic voting. Neither depends on the author or on the original operator. What is lost while Wulong is absent is the automatic vote of participants who do not notice.

**A standalone page.** A single self-contained HTML page, with all code inline and its hash published, is under consideration as the fallback client. It would verify the enclave's attestation, register, vote directly and export the corpus, with no dependency on a hosted frontend. One constraint shapes it: a passkey is bound to a web origin, so a page opened from disk cannot reach the participant's wallet. The page has to be served from the origin the passkey belongs to.

**The corpus.** The corpus can be exported, with the delay set out in section 4.4, and is readable by its owner without the enclave.

**Funding.** An operator that paid for all gas and all inference would be a dependency that fails the test above. The organisation that uses the system therefore pays for it from its own treasury: the relayer's gas budget is topped up by a Gov proposal, and inference is paid the same way. The costs to estimate are proof verification for each registration, vote and mask, and two to four model calls per participant per proposal. Hosting is the small part: Wulong's deployment guide puts a small TDX instance at about 44 US dollars a month. The first two must be measured in Study 3 before any claim about affordability is made.

## Further reading

- [Private Coercion-Resistant Voting for Gov](https://julienberanger.com/gov-private-voting), the specification of the voting conditions
- [State of Private Voting 2026](https://pse.dev/blog/state-of-private-voting-2026), Privacy and Scaling Explorations
- [TEE.fail](https://tee.fail), on physical attacks against hardware enclaves