Invisible Input Channels in Constrained Human–Machine Interfaces: A Manipulability Theorem for Button-Based Voting, ATM, PIN, and Industrial-Control Systems

Closed-firmware human–machine interfaces that expose only a small number of physical push-buttons — Electronic Voting Machines (EVMs), Automated Teller Machines (ATMs), industrial PIN-entry pads, and process-control panels — share a common structural property: their firmware can observe several rich properties of every button event (hold duration, press count over a window, concurrent presses, timed sequences) that are not externally observable by the user, by oversight cameras, or by audit procedures currently in routine use. This paper introduces these as the four primitives of side-channel input on constrained HMIs and proves a Manipulability Theorem under the malicious-firmware threat model: any such device whose firmware behaviour is not independently observable, nor exhaustively verified across the full input-state space, cannot prove the absence of hidden trigger logic. We instantiate the theorem on the EVM domain by cataloguing ten manipulation patterns spanning four operational roles — voter, booth agent, recounting staff, and symbol-upload technician — and supplying a working open simulator (the MVM Simulator) that reproduces all ten patterns end-to-end. We then show the same primitives generalise to ATMs, PIN systems, and industrial controls, making the analysis materially broader than elections. We close with a precise mitigation: closed-firmware constrained HMIs are auditable only when independently-verifiable physical evidence outside the firmware is routinely produced and counted; for elections this is the Voter-Verifiable Paper Audit Trail (VVPAT) when its slips are voter-confirmed and statistically — or fully — hand-counted.