{"id":"c51c05c1-87d1-47dc-9aed-0cf1ef79cb8a","arxiv_id":"2601.01665","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A preference-based adversarial attack generates hard multi-objective instances, and dynamic preference-augmented adversarial training improves neural solvers' out-of-distribution robustness.","lead":"This paper proposes an adversarial attack that tweaks multi-objective optimization instances to find hard ones, and a defense that retrains neural solvers on those hard instances. It tests both on multi-objective traveling salesman, vehicle routing, and knapsack problems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (4) maximizes a non-positive sample objective L/b·log p, not the expected subproblem loss; gradient ascent on it has no proven connection to harder instances, and its direct term can even push toward lower L.","rationale":"The reader's identified weakness—the undefined projection Π_N in Eq. (5) and the resulting feasibility risk for MOCVRP/MOKP—is real and worth testing. However, the single most load-bearing concern is upstream of that: Eq. (4) defines the attack objective as a sample REINFORCE-like loss, but the paper never shows that gradient ascent on this objective maximizes the expected solver loss or degrades Pareto-front quality. Because log p is non-positive, the direct-cost term in the gradient has the wrong sign, and the paper's empirical attack results could stem from the min-max projection or from incidental scaling rather than from the claimed mechanism. This concern spans all three problem families, including MOTSP, so it is more fundamental than the projection issue. The proposed test—comparing the paper's gradient to a correct Monte Carlo estimate of ∇_x E[L]—would settle whether Eq. (4) is a valid attack objective. If the test shows the gradients disagree, the paper needs to revise the attack objective and re-run all experiments before its central claims can be accepted. This maintains the reader's CONDITIONAL verdict but shifts the primary condition from feasibility projection to the correctness of the attack loss.","tokens_in":15815,"tokens_out":11631,"duration_ms":135024,"concrete_test":"On Bi-TSP20 with a fixed pretrained PMOCO solver, take 100 clean uniform instances. For each, estimate the true attack gradient g_true = ∇_x E_{π~pθ}[L(π|x)] by Monte Carlo: sample K=500 tours per x and compute (1/K)Σ[(L(π_i|x)−b(x))∇_x log pθ(π_i|x) + ∇_x L(π_i|x)]. Also compute g_paper = ∇_x[L(π|x)/b(x) log pθ(π|x)] for one sampled π, as in Eq. (4). If the average cosine similarity between g_paper and g_true is ≤ 0, or if PAA using g_true produces substantially larger HV gaps than PAA using g_paper, then Eq. (4) is not the active mechanism. Then rerun Table 1 with g_true replacing Eq. (4); if the attack gaps disappear or shrink sharply, the claim that PAA generates hard instances is unsupported as stated.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"PAA's core update (Eq. (5)) moves x along ∇_x ℓ, where ℓ(x;θ)=L(π|x)/b(x)·log pθ(π|x) (Eq. (4)). This is presented as 'maximizing a variant of the reinforcement loss,' but it is not an estimator of the quantity an attack should increase: the expected Tchebycheff loss E_{π~pθ}[L(π|x)]. Since pθ is a probability, log pθ(π|x) ≤ 0, so the sample objective is non-positive. Its gradient is ∇ℓ = (∇L/b)·log p + (L/b)·∇ log p. The first term, because log p < 0, urges L downward; the second term only makes the sampled tour more likely. Taking expectations over π ~ pθ and using E[L∇ log p] = ∇E[L] − E[∇L], we get E[∇ℓ] = (1/b)[∇E[L] + E[∇L(log p − 1)]]. Since log p − 1 < 0, the extra term opposes ∇E[L] and can dominate. The paper provides no argument that ascent on ℓ increases expected Tchebycheff loss or degrades HV. If this extra term dominates, PAA could be generating easier instances, and the reported gaps in Table 1 would not be attributable to the claimed mechanism. The projection issue raised by the reader is real for CVRP/KP, but Eq. (4) is more load-bearing because it affects TSP as well, and it attacks the mathematical core of PAA.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a unified robustness framework for preference-conditioned deep reinforcement learning solvers for multi-objective combinatorial optimization problems (MOCOPs). It introduces PAA (Preference-based Adversarial Attack), which generates hard instances by gradient ascent on a REINFORCE-style surrogate loss with respect to the instance input, and DPD (Dynamic Preference-augmented Defense), which performs adversarial training on these hard instances while selecting the worst-performing augmented preference for each mini-batch. Experiments on MOTSP, MOCVRP, and MOKP with several neural solvers (EMNH, PMOCO, CNH, WE-CA) report that PAA increases optimality gaps relative to non-learnable baselines and that DPD improves robustness and out-of-distribution generalization.","tokens_in":16307,"tokens_out":8018,"duration_ms":82370,"significance":"If correct, this is a timely contribution to the nascent area of robustness for neural MOCOP solvers. The paper is broad in scope: it considers multiple problem families, multiple solver architectures, and both attack and defense, and it compares against a learning-based attack baseline (ROCO). The inclusion of out-of-distribution evaluation, benchmark instances, and a generalization study is a strength. However, the central attack mechanism is not rigorously connected to the claimed objective, the projection operator is underspecified for two of the three problem families, and some reported numbers contradict the claim that PAA reduces hypervolume. These issues are load-bearing and need to be addressed before the empirical results can be interpreted as supporting the paper's main claims.","major_comments":[{"comment":"The attack objective ℓ(x;θ)=(L/b)log pθ(π|x) is non-positive because log pθ≤0. Its gradient w.r.t. x contains a term proportional to (log pθ)∇L, which pushes in the direction of decreasing L, and a term (L/b)∇log pθ, which only increases the likelihood of the sampled tour. The paper provides no proof or ablation showing that gradient ascent on this sample objective increases the expected Tchebycheff loss or degrades hypervolume. Since Eq. (5) is the core of PAA, the reported attack success is not attributable to the stated mechanism. Please provide a formal link, replace Eq. (4) with a surrogate with known monotonicity properties, or include an ablation demonstrating that Eq. (4) is essential and not merely random perturbation.","section":"§4.1, Eq. (4)-(5)"},{"comment":"The projection Π_N is described only as \"min-max normalization.\" For MOCVRP and MOKP, N is never defined: capacity, demand, and item constraints cannot be enforced by coordinate-wise normalization. If the perturbed instances are not feasible MOCOP instances, the attack results for two of the three problem families are invalid, and a defense trained on them would not transfer. Specify the exact feasible set N and the projection for each problem, or restrict PAA to problems where normalization provably preserves feasibility.","section":"§4.1, Eq. (5) and §5.2, Table 1"},{"comment":"The claim that PAA \"significantly reduce[s] HV values in both classical and neural MOCOP solvers\" is contradicted by the Bi-CVRP rows. For example, with n=50, WS-LKH HV increases from 0.3140 (clean) to 0.3402 (PAA); EMNH from 0.3048 to 0.3241; PMOCO from 0.3081 to 0.3286; CNH from 0.3090 to 0.3295. On these rows PAA raises absolute HV; only the optimality gap to WS-LKH increases. This undermines the paper's abstract and Section 4.1 statements that PAA lowers Pareto-front quality in terms of hypervolume. The authors should either revise the claim to \"increases relative optimality gap\" or explain why an instance where HV improves constitutes an attack.","section":"§5.2, Table 1"},{"comment":"No error bars, number of seeds, or statistical significance tests are reported. Several defense improvements are small in absolute terms (e.g., Table 2, Bi-KP20: EMNH gap 0.26% vs. EMNH-DPD 0.06%; Bi-KP100: EMNH 1.49% vs. 0.96%). Without variance estimates or paired tests, the claims of \"significantly strengthens\" and \"superior performance\" are not supported. Report multiple independent runs with standard deviations and, where appropriate, paired comparisons on the same test instances.","section":"§5.3-§5.4, Tables 2-4"}],"minor_comments":[{"comment":"Equation numbers are duplicated: Eq. (1) appears both for the MOCOP objective vector and for weighted-sum decomposition. Renumber to avoid confusion.","section":"§3.2 and §3.1"},{"comment":"The abstract says \"three classical MOCOPs\" while Section 5 lists four settings: Bi-TSP, Tri-TSP, Bi-CVRP, Bi-KP. Clarify the count.","section":"Abstract and §5"},{"comment":"The figure contains the label \"MOVRP Solver\"; this should be \"MOCVRP Solver\" or a consistent abbreviation.","section":"Figure 2"},{"comment":"The notation for λ′_i is inconsistent: Eq. (6) writes λ′_i as a vector, Eq. (7) uses component index k, and Eq. (8) sums over j. Define the vector and component indices clearly.","section":"§4.2, Eqs. (6)-(9)"},{"comment":"ROCO-RL is not evaluated on Bi-KP (entries are \"-\"), so the statement that PAA \"achieves the best attack effect over all cases in Bi-KP\" lacks a direct comparison with the strongest baseline. ","section":"§5.2, Table 1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within scope for a journal on neural combinatorial optimization and robust RL, and I see no reason to question the authors' good faith. The empirical scope is a strength, but the theoretical gap in the attack objective and the contradictory HV results are serious enough that a major revision, not accept, is appropriate. I would also encourage the editor to ask for code release and multi-seed statistics as part of the revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: this is the first preference-conditioned adversarial attack/defense framework for neural MOCOP solvers, and the defense experiments are worth looking at. But the attack as written has a load-bearing flaw that nobody should sign off on yet.\n\nWhat's new: PAA targets the subproblem-specific loss of preference-conditioned solvers, which prior robustness work on COPs (Geisler et al., ROCO, HAC, Zhou et al.) does not do. DPD's hardness-aware preference selection is also a reasonable idea, and Table 3 shows it improves OOD performance even when the hard instances come from ROCO, so the defense pipeline isn't hostage to PAA. The paper covers three MOCOPs and three solver families, which is a decent empirical sweep.\n\nWhere it wobbles: the attack objective in Eq. (4) is ℓ = (L/b)·log pθ. Because log pθ ≤ 0, ℓ is non-positive, and the gradient contains a term that points downhill in L. The authors state they are 'maximizing a variant of the reinforcement loss,' but maximizing this particular quantity has no obvious connection to making L large; if anything, the direct term rewards low L. That problem is not limited to CVRP or KP—it hits TSP too, so it undermines the central claim. The projection Π_N is also underspecified for MOCVRP and MOKP: min-max normalization does not enforce capacity or item constraints. If the attacked instances are invalid, the CVRP/KP results are measuring the wrong thing. Empirically, there are no error bars or significance tests, and some defense gains are tiny (0.06% HV in Table 2). No code or data is provided, which makes it hard to check whether the attack really behaves as claimed.\n\nIf I'm wrong about Eq. (4)—maybe the authors intend a REINFORCE-style estimator and the sign convention is just sloppy—then this could be a solid paper. But as it stands, the attack mechanism needs to be fixed or re-derived, and the projection needs to be defined before the empirical claims can be trusted.\n\nMy recommendation: send it to peer review—the problem is timely and the defense results are interesting—but the referee should demand a corrected attack objective or an ablation showing the objective correlates with HV degradation. I wouldn't cite the attack in its current form.","headline":"Novel preference-conditioned attack/defense for neural MOCOP solvers, but the attack's objective in Eq. (4) is mathematically suspect and the experiments lack the rigor to back the central claim.","tokens_in":16708,"tokens_out":5897,"would_cite":false,"duration_ms":58184,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Preference-conditioned neural solvers for multi-objective combinatorial optimization are shown to be vulnerable to preference-tailored adversarial instances, and a hardness-aware defense restores robustness and out-of-distribution performan","keywords":["multi-objective combinatorial optimization","adversarial attack","deep reinforcement learning","preference-conditioned solvers","Pareto front","hypervolume","adversarial training","out-of-distribution generalization"],"falsifier":"Re-run PAA on MOCVRP and MOKP, decode the final perturbed tensors back to node coordinates and item weights, and directly check capacity, demand, and item-level constraints; if any projected instance fails constraint satisfaction, the claim that PAA generates hard but feasible instances for those problems is directly falsified.","tokens_in":15734,"feed_emoji":"🎯","tokens_out":7979,"duration_ms":77483,"temperature":0.7,"pith_summary":"Neural solvers for multi-objective combinatorial optimization (MOCOP) decompose a problem into preference-conditioned subproblems and are typically trained on clean, uniformly sampled instances. This paper argues that such solvers have a robustness gap: when tested on out-of-distribution instances, their Pareto-front quality deteriorates markedly. The authors propose a preference-based adversarial attack (PAA) that perturbs clean instances by gradient ascent on a preference-specific reinforcement loss, producing hard instances that substantially degrade hypervolume across MOTSP, MOCVRP, and MOKP. They then propose a dynamic preference-augmented defense (DPD) that selects the worst-performing preference neighborhoods during adversarial training, which improves robustness and generalization on hard and out-of-distribution instances. If correct, the paper establishes that preference conditioning is a vulnerability surface for neural MOCOP solvers and that hardness-aware preference selection is a viable route to robustness.","feed_headline":"Preference-tailored attacks break neural solvers","feed_subtitle":"A hardness-aware defense restores Pareto fronts and generalizes to harder instances.","key_machinery":"The core mechanism is the preference-conditioned gradient ascent loop in Eq. (5), which turns a clean instance into a hard instance for a given preference by maximizing a REINFORCE-style loss under a projection Π_N described as min-max normalization, paired with the DPD preference-selection rule (Eqs. 8–9), which uses softmax-normalized Tchebycheff scores over perturbed preferences to identify the weakest regions for training. The attack measures failure by hypervolume degradation of the approximated Pareto front; the defense trains with a REINFORCE gradient computed on the selected adversarial preference.","core_discovery":"The central claim is that the quality of a neural MOCOP solver's Pareto-front approximation is only as strong as its weakest preference-conditioned subproblem. PAA operationalizes this by solving, for each preference, a local maximization of the reinforcement loss over the input instance, projecting back into the feasible space with a min-max normalization; the resulting hard instances lower the hypervolume of the solver while leaving classical solvers mostly unaffected. DPD then inverts the attack: during adversarial training it generates perturbed preferences in the neighborhood of each training preference, scores them by their Tchebycheff value on hard instances, and selects the preferenc","pith_inferences":["The hardness-aware preference-selection scheme could be applied directly to a clean training distribution, without any adversarial instance generation, as a way to reweight training toward preference regions where the model is currently weak—an extension the paper does not explore.","Because PAA uses the same REINFORCE loss the solver is trained on, the vulnerability surface may shift with the scalarization: training with Tchebycheff instead of weighted sum might yield different attack patterns, a testable hypothesis left open.","DPD's improvements on clean in-distribution instances (including some negative gaps) hint that the defense is also a mild regularizer, possibly improving the learned policy's overall quality beyond pure robustness.","The feasibility of PAA-generated instances for constrained problems (MOCVRP and MOKP) is not verified in the paper; checking this directly would settle whether the attack is genuinely producing hard valid instances or merely infeasible perturbations."],"forward_implications":["If preference-tailored attacks substantially degrade neural MOCOP solvers, deployments in safety-critical settings must account for adversarial instance distributions, not just average-case performance.","DPD improves out-of-distribution generalization, suggesting that adversarial training in the preference space acts as a general-purpose robustness regularizer that extends beyond the exact instances used during training.","Because PAA also degrades the performance of classical baselines (WS-LKH and WS-DP), the hard instances appear intrinsically difficult for existing algorithms, not merely model-specific adversarial artifacts.","DPD works on top of multiple base solvers (meta-learning, hypernetwork, and conditional-attention architectures), so the robustness gains are not tied to a single design.","Defended neural solvers achieve results competitive with classical solvers in seconds rather than minutes to hours, making robustness practical at scale."],"fun_headline_variants":["Adversarial instances expose weak neural Pareto solvers","Defense hardens neural solvers against adversarial instances","Pareto-front attacks reveal fragile neural solvers","Robust training thwarts adversarial multi-objective attacks"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The attack's projection step (Eq. 5) is asserted to keep perturbed instances inside the feasible space N, but for capacitated vehicle routing and knapsack problems the paper never defines N or verifies that the projected instances satisfy capacity, demand, and item constraints; if the projection produces infeasible instances, the attack and defense results for two of the three problem families would not transfer to real problems.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial instances expose weak neural Pareto solvers","Defense hardens neural solvers against adversarial instances","Pareto-front attacks reveal fragile neural solvers","Robust training thwarts adversarial multi-objective attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000823,"raw_usage":{"total_tokens":3417,"prompt_tokens":702,"completion_tokens":2715,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":446,"completion_tokens_details":{"reasoning_tokens":2652}},"tokens_in":446,"tokens_out":2715,"duration_ms":20014,"temperature":1.0,"reasoning_tokens":2652,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T12:44:37.239213+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run PAA on MOCVRP and MOKP, decode the final perturbed tensors back to node coordinates and item weights, and directly check capacity, demand, and item-level constraints; if any projected instance fails constraint satisfaction, the claim that PAA generates hard but feasible instances for those problems is directly falsified.","supporting_citations":[],"review_version":1}