Generalization of Neural Combinatorial Solvers Through the Lens of Adversarial Robustness

1 INTRODUCTION . Combinatorial Optimization covers some of the oldest and most studied computational problems . Well-known examples are the study of the NP-complete SATisfiability problem for boolean statements or the Traveling Salesperson Problem ( TSP ) . Today , these problems can be solved efficiently with approximate solvers that have been crafted over the previous decades ( Festa , 2014 ) . As an alternative to engineered , application-specific heuristics , learning seems to be a good candidate ( Bengio et al. , 2021 ) and was studied as a component in traditional solvers ( e.g . Haim & Walsh ( 2009 ) ; Singh et al . ( 2009 ) ) . Recently , end-to-end deep learning for NP-hard combinatorial optimization has gained attention , triggered by the widespread success of ( geometric ) deep learning . Nevertheless , it is still an open question if and to what extent end-to-end deep learning can effectively and efficiently approximate such NP-hard combinatorial optimization problems . Moreover , there is a “ Catch-22 “ ; even if neural networks could approximate the solutions for NP-hard problems , generating the training data is either ( a ) incomplete but efficient or ( b ) complete but inefficient/approximate . An incomplete data generator ( a ) crafts the problem instances s.t . their labels are know and a complete data generator ( b ) solves the NP-hard problem instances to obtain the labels . Moreover , regardless of case ( a ) or ( b ) , it is intractable to obtain a dense sample even for moderate problem sizes due to the large problem space . For the special case of ( a ) exact polynomial-time data-generators , Yehuda et al . ( 2020 ) detail two challenges as a result of the NP-hardness : ( 1 ) Easier subproblem : a dataset from an efficient data generator only captures a strictly easier subproblem . ( 2 ) Spurious features : due to the lack of completeness , the resulting dataset can be trivially solvable due to superficial/spurious features . These findings extrapolate to case ( b ) for a sufficiently sparse sample ( i.e . the data could have been generated by an efficient data generator ) . As a consequence , it is even more concerning that often the same ( potentially flawed or biased ) data generator is used for training and evaluation . At best , neural solvers are additionally evaluated on small independent datasets ( e.g . from benchmarks ) . We propose to study neural combinatorial optimization through the lens of adversarial robustness . It is a challenging generalization property that offers a way of fixing the too optimistic model performance estimates that are the result of evaluations on incomplete datasets . We illustrate in Fig . 1 how adversarial attacks practically address the aforementioned challenges for two relevant cases in neural combinatorial optimization : ( a ) to the left we discuss an incomplete , efficient data generator and ( b ) to the right we discuss a sparse sample of a potentially complete data generator . With a suitable choice of perturbation model , we ( a ) possibly extend the reachable space by an efficient data generator or ( b ) cover the space around each instance in the sparse dataset . In other words , such adversarial attacks aim to find the intersection of the uncovered regions and hard , model-specific samples . Therefore , it is possible to detect the described defects . Adversarial robustness more realistically evaluates a model ’ s generalization ability instead of simply testing on the same data generation procedure or a sparse external dataset . Adversarial robustness is a desirable property for neural combinatorial optimization , since , in contrast to general learning tasks , in combinatorial optimization we do not have an accuracy robustness trade-off in the sense of Suggala et al . ( 2019 ) . This means , there exists a model with high accuracy and high robustness . One key factor to avoid the accuracy robustness trade-off is choosing a perturbation model that guarantees the correct label of the perturbed sample ( we call them sound ) . This is in stark contrast to other domains where one relies on imperceptible/unnoticeable perturbations . We instantiate our adversarial attack framework for the NP-complete SAT and TSP . Nevertheless , most of the principles can be transferred to other combinatorial optimization problems . Note that often such problems can be even reduced onto one another , as is the case for e.g . SAT and the maximum independent set . Having said this , we select SAT because of its general applicability and the notoriously challenging TSP due to its practical importance ( e.g . for supply chain optimization ) . We then use our attacks to show that the evaluated neural SAT and TSP solvers are highly non-robust . Contributions . ( 1 ) We bring the study of adversarial robustness to the field of neural combinatorial solvers to tackle fundamental problems in the evaluation of neural solvers . ( 2 ) We propose perturbation models for SAT and TSP s.t . we efficiently determine the updated solution . ( 3 ) We show that the models for SAT and TSP can be easily fooled with small perturbations of the problem instance and ( 4 ) that adversarial training can improve the robustness and generalization . 2 BACKGROUND ON NEURAL SOLVERS . Intuitively , combinatorial optimization is the task of finding an optimal element from the finite set of possible solutions ( e.g . the truth assignment for a boolean statement ) . We formalize this as Y = arg minY ′∈g ( x ) c ( x , Y ′ ) where x is a problem instance , g ( x ) = Y the finite set of feasible solutions , and c ( · ) a cost function . Typically , there is also an associated binary decision problem y , such as finding the optimal route vs. checking whether a route of at most cost c0 exists ( see § 4 and § 5 ) . Then , for example , a neural solver ŷ = fθ ( x ) learns a mapping fθ : X → { 0 , 1 } to approximate the decision problem . In this work , θ are the parameters , x ∈ X is the problem instance , and ŷ ( or Ŷ ) the prediction . In case of supervised learning , we then optimize the parameters θ w.r.t . a loss ` ( fθ ( x ) , y ) over a finite set of labeled training instances ( x , y ) . However , to obtain the exact labels y for a given x is intractable for larger problem instances due to the exponential or worse runtime . The two important strategies are mentioned in the introduction and visualized in Fig . 1 : ( a ) an efficient but incomplete data generator ( b ) using a solver to obtain the labels for random samples . 3 ADVERSARIAL ROBUSTNESS . Adversarial robustness refers to the phenomenon that machine learning models can be fooled by small perturbations of the input instance ( Szegedy et al. , 2014 ) . We define an adversarial attack in Eq . 1 , where the parameters θ are constant and G denotes the perturbation model that describes the possible perturbed instances x̃ around the clean sample x ( i.e . the perturbation space ) given the original solution Y . We introduce the term h ( x̃ , x , Y ) since Ỹ 6= Y in the general case . ` adv , G ( x , Y ) = max x̃ ` ( fθ ( x̃ ) , Ỹ ) s.t . x̃ ∈ G ( x , Y ) ∧ Ỹ = h ( x̃ , x , Y ) ( 1 ) Sound and efficient perturbation model . Our framework for a neural combinatorial solver fθ stands out from many other works on adversarial robustness since we choose the perturbation model G s.t . we provably know a solution Ỹ = h ( x̃ , x , Y ) for all possible x̃ . We call such a perturbation model sound . This stands in contrast to other domains , where we usually hope to preserve the label using the subjective concept of imperceptible/unnoticable perturbations ( Szegedy et al. , 2014 ) . While we can naively obtain a sound perturbation model for combinatorial optimization using a solver , this is intractable for realistic problem sizes . We therefore propose to use perturbation models that are efficient and sound . That is , we can determine Ỹ without applying a solver on the perturbed instance x̃ . For example , if we add a node to a TSP instance , the optimal route including the new node will change , but we can efficiently determine Ỹ for the chosen G. Important technical details arise due to ( a ) the potentially non-unique Y and ( b ) non-constant Ỹ while perturbing the input . One way to handle both effects is through the choice of the loss ` . ( a ) We can deal with the ambiguity in Y if the loss is equal for any two optimal solutions/predictions . This can be achieved naturally through incorporating the cost c ( Y ) of the combinatorial optimization problem . ( b ) Since the solution Y can change throughout the optimization , it is important to choose a loss that assesses the difference between prediction fθ ( x̃ ) and ground truth Ỹ . For example , a viable loss for TSP is the optimality gap ` OG ( Ŷ , Y ) = |c ( Ŷ ) −c ( Y ) |/c ( Y ) ) that is normalized by c ( Y ) . Perturbation strength . With a sound perturbation model , all generated instances x̃ are valid problem instances regardless of how much they differ from x . Hence , in the context of combinatorial optimization , the perturbation strength/budget models the severity of a potential distribution shift between training data and test data . This again highlights the differences to other domains . For example in image classification with the common Lp perturbation model ‖x − x̃‖p ≤ r , the instance changes its true label or becomes meaningless ( e.g . a gray image ) for a large enough r. Generalization . Specifically , adversarial robustness is one way to measure the generalization over perturbed instances x̃ is in the proximity of x. Adversarial robustness is important in the context of neural combinatorial solvers since training and validation/test distribution differ from the actual data distribution p ( x ) . First , the data distribution p ( x ) is typically unknown and highly application-specific . Second , due to theoretical limitations of the data generation process the train and validation/test distribution only captures a simpler sub-problem likely suffering from spurious features ( Yehuda et al. , 2020 ) . Third , we ultimately desire a general-purpose solver that performs well regardless of p ( x ) ( in the limits of a polynomial approximation ) . We stress that in the context of combinatorial optimization , adversarial examples are neither anomalous nor statistical defects since all generated instances correspond to valid problem instances . In contrast to other domains , the set of valid problems is not just a low-dimensional manifold in a high-dimensional space . Thus , the so-called manifold hypothesis ( Stutz et al. , 2019 ) does not apply for combinatorial optimization . Or in other words , it is critical for neural solvers to perform well on adversarial examples when striving for generalization . Accuracy robustness trade-off . A trade-off between adversarial robustness and standard generalization was reported for many learning tasks ( Tsipras et al. , 2019 ) . That is , with increasing robustness the accuracy on the test data decreases . Interestingly , with a sound perturbation model and the purely deterministic labels in combinatorial optimization ( the solution is either optimal or not ) , no such trade-off exists . Hence , if the model was expressive enough and we had sufficient compute , there would exist a model with high accuracy and robustness ( see § A for more details ) . Adversarial training . In adversarial training , we leverage adversarially perturbed instances with the desire of training a robust model with improved generalization . For this , adversarial attacks reveal the regions that are both difficult for the model and not covered by training samples ( see Fig . 1 ) . Hence , adversarial training can be understood as a powerful data augmentation using hard modelspecific samples . Though it is not the main focus of this work , in § 6 , we show that adversarial training can be used to improve the robustness and generalization of a neural combinatorial solver . Remarks on decision problems . For the binary decision problems , we typically are not required to know Ỹ ; it suffices to know ỹ . Moreover , for such binary problems , we keep the solution constant y = ỹ . Nevertheless , there also exist practical perturbations that change decision the label . For example for SAT , we can add a set of clauses that are false in isolation which makes ỹ = 0 . Requirements for neural solvers . We study neural combinatorial solvers fθ that are often a Graph Neural Network ( GNN ) . We then solve Eq . 1 using different variants of Projected Gradient Descent ( PGD ) and therefore assume the model to be differentiable w.r.t . its inputs ( see § D ) . For nondifferentiable models , one can use derivative-free optimization ( Yang & Long , 2021 ) .

Summary: Motivated by the emergence and fast development of the area of neural optimisation solvers having been proposed for a vast number of combinatorial problems, this paper is devoted to studying the adversarial robustness of such solvers. In particular, given the intractability of the target combinatorial problems, the paper proposes to evaluate neural solvers based on adversarial robustness. As an example, the authors aim at perturbing SAT and TSP problems and evaluating the robustness of the corresponding state-of-the-art neural solvers on the perturbed problem instances. The paper shows that the existing solvers are susceptible to adversarial attacks. Moreover, the paper claims that the issue may be alleviated if additional training of the solvers is performed on the perturbed instances.