{"id":"e5883034-8900-4398-8199-b22ed168f689","arxiv_id":"2608.09036","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A zero-loss equivalence class of cost estimators makes decision-focused learning fail in shortest-path network interdiction games, and training on interdicted scenarios (A-DFL) collapses this class and restores performance.","lead":"Decision-focused learning (DFL) for shortest-path network interdiction can train cost estimators that look perfect in training but fail once an adversary modifies the network. The paper shows this failure, explains it with an equivalence class of zero-loss estimators, and proposes Adversarial DFL (A-DFL), which trains on interdicted scenarios to restore DFL's advantage over prediction-only training.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"A-DFL trains on random or true-cost interdictions while evaluation uses a model-aware interdictor; the paper gives no argument or experiment that these coincide, so the claimed game-setting advantage is unsupported.","rationale":"The toy example is internally coherent and correctly shows that for affine models on the two-path graph, DFL's zero-regret set contains slope misestimates that only become visible after the d⊙x shift, and A-DFL's shifted loss eliminates them. My objection is not to this analysis but to the inference from it to the game setting. The game's interdictor is defined by (1) to be model-aware; A-DFL's training scenarios are not. Since the failure mode under study is caused by the interdictor exploiting the evader's misestimates, training on scenarios that ignore the model cannot be assumed to close the gap. The toy avoids the issue by an extra assumption stated only in Appendix B. The reader's weakest assumption (Assumption 3(c), evader observes x and d) is real but standard in Stackelberg models and explicitly flagged as future work; the model-aware training mismatch is more damaging because it affects the internal validity of the experiments even under the paper's own assumptions. I therefore disagree with the reader's choice of weakest assumption, while agreeing that the appropriate verdict remains conditional: the paper should add the model-aware baseline and the augmented-data control before the general claim is accepted.","tokens_in":15733,"tokens_out":12501,"duration_ms":123457,"concrete_test":"Train an MA-DFL variant that selects training interdictions by solving (1) with the current c_hat (or a few alternating best-response steps), using the same seeds, hyperparameters, and graph settings (deg=8 grid, deg=12 Anaheim). If MA-DFL outperforms RA-DFL and AA-DFL, the current training scenarios do not cover the model-aware adversary, and the paper's central claim requires revision. As a secondary control, give DFL and PFL access to the same interdiction dataset (shifted true costs as labels, with d⊙x added to predictions at test time) to separate the extra-data confound from the A-DFL loss.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that DFL fails structurally in SPNI games and that A-DFL fixes this (Sections 5, 7). The load-bearing step is the assumption that the interdictions used to train A-DFL match the interdictor the evader faces at test time. Under Assumption 2 and Eq. (1), the interdictor knows the evader's model and chooses x using the learned costs c_hat. RA-DFL samples x uniformly at random; AA-DFL selects the interdiction a symmetric interdictor would choose using true costs c. Neither selection depends on the trained model. The toy example bridges this gap only by assuming the asymmetric and symmetric interdictors coincide (Appendix B), and no analogue is shown for the grid or Anaheim graphs. Yet the evaluation (Section 6.2) solves (1) with c_hat, i.e., against the model-aware adversary. The training distribution and test-time adversary can therefore differ precisely in the regime where DFL's estimates are misaligned, the regime the paper aims to fix. A second confound is that PFL and DFL baselines do not receive A-DFL's interdiction dataset, so part of the observed gain may reflect extra training data rather than the proposed loss. No bound or control experiment addresses this mismatch, so the generalization from toy to game is unsupported.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies decision-focused learning (DFL) in shortest-path network interdiction (SPNI) games, where an evader with imperfect cost information learns a cost predictor and then solves a shortest-path problem under an interdictor's binary fortification actions. The authors argue that DFL's training objective admits a decision-equivalence class of cost estimators that achieve zero nominal regret but make wrong decisions under interdiction, reversing DFL's usual advantage over prediction-focused learning (PFL). They propose Adversarial DFL (A-DFL), which trains on interdicted scenarios, with two variants: RA-DFL (random interdictions) and AA-DFL (worst-case interdictions chosen using true costs). A toy example with affine predictors is analyzed rigorously, and experiments on grid graphs and the Anaheim network are reported to show that A-DFL restores the advantage. The paper also discusses the role of model complexity and data in these findings.","tokens_in":15971,"tokens_out":10104,"duration_ms":81332,"significance":"If the central claim held, the paper would make a useful contribution by identifying a structural failure mode of DFL in game settings and proposing a training-time remedy. The toy analysis in Section 5 and Appendix B is mathematically clean: the definitions of F_DFL and F_A-DFL and the zero-loss characterizations are proven correctly for affine predictors. The paper is also transparent about some limitations, such as the assumption that the evader observes interdictions (Assumption 3(c)) and the restriction of the equivalence-class analysis to linear predictors. The code is publicly available. However, the experimental evidence is too thin and the training/evaluation mismatch is too serious for the general claim to be accepted at face value.","major_comments":[{"comment":"The training distributions of interdictions in A-DFL do not match the test-time adversary. In Section 4.3, RA-DFL samples x uniformly at random and AA-DFL selects x by solving the worst-case problem with the true costs c; neither depends on the trained model. In the evaluation, Section 6.2, the interdictor is the model-aware adversary: x is obtained by solving (1) with the predicted costs ĉ. No theoretical argument, ablation, or diagnostic is provided to show that these distributions coincide or are close in the grid and Anaheim experiments. In the toy example this gap is closed only by the explicit assumption in Section 5.1 that the asymmetric interdictor equals the symmetric interdictor, an assumption that is not verified for the trained DFL model and has no analogue in the larger experiments. Since the central claim is that A-DFL helps the evader against the model-aware interdictor of (1), the reported results do not substantiate that claim without a matched-settings experiment or a bound on the distribution shift.","section":"4.3 vs 6.2 (train/test interdiction mismatch)"},{"comment":"The comparison between A-DFL and the PFL/DFL baselines is confounded by the amount of training data. A-DFL (Algorithm 1) is trained on the nominal dataset plus the interdiction dataset, whereas PFL and DFL use only the nominal dataset (Section 6.1). Therefore any observed performance gain of A-DFL over DFL could be an effect of having N_intd additional training samples rather than of the A-DFL loss itself. The paper reports no control experiment, such as training DFL on the same augmented dataset (with the same number of total samples) or training PFL on the interdicted samples. This confound applies to all of Figures 5 and 6 and should be addressed before claiming that A-DFL's advantage comes from its loss.","section":"Algorithm 1 vs Section 6.1 (confounded data comparison)"},{"comment":"The experimental claims rely on only N_sim=5 simulations (Table 1), and the paper provides no confidence intervals, standard errors, or significance tests. The text uses the word 'significantly' repeatedly, e.g., in Section 6.3: 'DFL has a significantly wider spread', 'the DFL performance degrades significantly', and 'all DFL methods outperform PFL significantly'. With five seeds, these statements are unsupported. The paper should either report uncertainty estimates (e.g., box plots with per-seed values and confidence intervals) or use a proper statistical test, and qualify any use of 'significant' accordingly.","section":"Table 1 and Section 6.3 (statistical support)"},{"comment":"The deg=10 real-world result appears to contradict the paper's headline claim. In Section 6.3 the authors state that for deg=10, 'all DFL methods are outperformed by PFL in the game setting, with the PFL maximum lying more than 5% below the minimum of all other methods', which includes AA-DFL. This is a direct counterexample to the Abstract's claim that A-DFL 'restores DFL's advantage in the game setting without sacrificing performance' and to the summary in Section 7. The paper needs to reconcile this outcome with the central claim, for instance by characterizing the regime in which A-DFL helps, or by softening the claim accordingly.","section":"Section 6.3, Figure 6(a) vs Abstract/Conclusion"}],"minor_comments":[{"comment":"The phrase 'without loss of generality' is used for the assumption that the asymmetric and symmetric interdictors coincide; this is a substantive assumption, not a WLOG reduction, and should be phrased as such.","section":"Section 5.1"},{"comment":"The function-domain notation is inconsistent: Eq. (8) writes f: R^2 -> R^2 while Eq. (9) writes f: R -> R. Both should consistently map from R^2 to R^2.","section":"Equations (8) and (9)"},{"comment":"Typos: 'evador' (Section 1), 'looses' (Abstract), 'mehod' (Section 3.2) should be corrected.","section":"Throughout"},{"comment":"The claim that 'our findings are not specific to SPO+ and generalize to other gradient computation methods' is not tested; with no experiments using alternative surrogates, the scope of the claim should be either demonstrated or qualified.","section":"Section 4.2"},{"comment":"Table 1 reports only 3 random interdiction scenarios per training point (N_intd=3); the sensitivity of RA-DFL to this hyperparameter is not studied, despite the paper's own acknowledgment in Section 7 that N_intd should be systematically studied.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"The paper's toy analysis is solid, but the empirical section contains a direct counterexample to the abstract's claim (deg=10 in Figure 6(a)), which should be addressed in revision. The training/evaluation distribution mismatch and the lack of statistical tests are also serious. I believe the paper is salvageable with substantial revision, not a reject, because the conceptual point about decision-equivalence under interdiction is interesting and the toy proof is correct."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. First, the core observation is real: in a shortest-path interdiction game, DFL's training objective admits an equivalence class of affine predictors with zero nominal regret, and once an interdictor shifts costs, those predictors can make the wrong call. The toy example (Section 5) and Appendix B are clean and correct, and the authors release code. Second, the headline empirical claim — A-DFL restores DFL's advantage in the game setting — is not actually supported by the experiments as run, because the training-time interdictions do not match the test-time adversary.\n\nWhat is new: this is the first DFL-from-the-evader's-side treatment in SPNI that I know of; the decision-equivalence class characterization (F_DFL vs F_A-DFL) is a useful way to see why zero decision loss is not enough; and the A-DFL scheme with random and adversarial variants is a sensible fix. The paper is also honest about its scope: the theory is for affine predictors, Assumption 3(c) is restrictive, and the data are synthetic.\n\nWhere the soft spots sit. The serious one is a training/test mismatch. RA-DFL samples interdictions uniformly at random; AA-DFL picks the symmetric interdictor's choice using true costs. Evaluation, though, solves (1) with the evader's learned costs — that is a model-aware asymmetric interdictor. The toy example only closes this gap by assuming the two interdictors coincide; the grid and Anaheim experiments never justify that. So the observed gains over PFL and DFL could come from a training-distribution artifact, and A-DFL is also the only method that receives the interdiction dataset. There is no control where DFL or PFL get the same extra data. This gap undercuts the conclusion that A-DFL restores DFL's advantage in the game setting.\n\nSecond, the experiments are thin: five seeds, no confidence intervals or significance tests, and the text says 'significantly' several times without support. That is a minor fix, but it matters because some of the reported differences are small.\n\nThe linear-only theory is acknowledged future work, so I read it as a scope limit rather than a hidden flaw.\n\nWho gets value: people in predict-then-optimize and adversarial machine learning for Stackelberg games. The equivalence-class idea is worth discussing even before the game-setting claim is nailed down.\n\nRecommendation: send to peer review, conditionally. Ask for more seeds with error bars, a control where PFL/DFL also get the extra interdiction data, and either an evaluation against the same adversary used in training or an argument that the asymmetric and symmetric interdictors coincide on the test instances. With those, the core story is solid.","headline":"Clean formal point about DFL failure modes in interdiction games, but the experiments don't support the headline claim because training and test adversaries don't match.","tokens_in":16537,"tokens_out":5113,"would_cite":true,"duration_ms":46081,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Decision-focused learning fails in network interdiction games unless trained on adversarial cost shifts.","keywords":["decision-focused learning","network interdiction","Stackelberg games","predict-then-optimize","shortest path","adversarial training","decision regret","cost estimation"],"falsifier":"Run the toy example of Section 5 with $d_1=d_2=3$, train a linear model with DFL to convergence, and evaluate the A-DFL loss (Eq. 5) on the trained model. The paper predicts a nonzero A-DFL loss and a failure interval of feature values where the post-interdiction path choice disagrees with the true optimum; if the trained model satisfies $a_1-a_2=2$, or if no such interval exists, the central failure claim is falsified.","tokens_in":15476,"feed_emoji":"🛡️","tokens_out":9453,"duration_ms":85123,"temperature":0.7,"pith_summary":"This paper claims that decision-focused learning (DFL), the usual best practice for training a prediction model with a downstream optimization in mind, has a structural blind spot in shortest-path network interdiction games. Many cost estimators achieve zero DFL training loss on the plain shortest-path problem, yet their cost orderings flip once the interdictor adds delays to selected arcs, letting the interdictor steer the evader onto worse paths. The paper proves this failure in a two-path toy example and shows empirically that it reverses DFL's usual advantage over prediction-focused learning (PFL). It then proposes Adversarial DFL (A-DFL), which trains on interdicted cost vectors, and gives conditions under which A-DFL's loss is zero only for estimators that also survive interdiction, restoring DFL's advantage on both grid graphs and a real-world transportation network.","feed_headline":"Interdiction breaks zero-loss models; adversarial training fixes it","feed_subtitle":"When rivals shift costs, zero-loss estimators misroute; training on interdicted scenarios restores the edge.","key_machinery":"The central object is the decision-equivalence class of the DFL loss. For the toy's affine predictors, the DFL regret vanishes exactly on $\\mathcal{F}_{\\mathrm{DFL}} = \\{ f(w) = a w + b \\mid b_1 = b_2,\\ a_1 > a_2 \\}$, so the training gradient is zero there and the model never learns the true slopes. The A-DFL loss (Eq. 5) averages the DFL regret over shifted costs $c + d \\odot x$ for many interdictor choices $x$; on the toy example its zero-loss set is the strictly smaller $\\mathcal{F}_{\\mathrm{A\\text{-}DFL}}$ with $a_1 - a_2 = 2$, so the gradient signal reappears exactly in the region where the nominal loss was flat. The gap between the two classes is the mechanism of the paper: it is the set of estimators that look perfect before interdiction and fail after it.","core_discovery":"On the paper's own terms: in a shortest-path network interdiction game, an evader who trains its cost predictor with decision-focused learning can converge to a broad equivalence class of estimators that achieve zero DFL regret on the nominal shortest-path problem yet disagree with the true cost ordering once the interdictor adds delays to chosen arcs. For the two-path toy model with true costs $c(w) = [w, -w]^\\top$ and delay vector $d = [3,3]^\\top$, the zero-loss class is $\\mathcal{F}_{\\mathrm{DFL}} = \\{ f(w) = a w + b \\mid b_1 = b_2,\\ a_1 > a_2 \\}$; after interdiction, only the strictly smaller class $\\mathcal{F}_{\\mathrm{A\\text{-}DFL}} = \\{ f(w) = a w + b \\mid b_1 = b_2,\\ a_1 - a_2 = 2 \\}$ preserves the correct path choice for all $w$. Because the interdictor knows the evader's model, it can pick the interdiction that exploits estimators in $\\mathcal{F}_{\\mathrm{DFL}} \\setminus \\mathcal{F}_{\\mathrm{A\\text{-}DFL}}$, reversing DFL's usual advantage over prediction-focused learning. The paper proposes A-DFL, which replaces the nominal DFL loss with an average of DFL losses over randomly or adversarially sampled interdicted cost vectors, and shows empirically that this collapses the harmful part of the equivalence class and restores DFL's advantage on grid graphs and a real-world transportation network.","pith_inferences":["The equivalence-class argument is written for affine predictors; for nonlinear models the failure would likely reappear as flat regions of the DFL loss, and the A-DFL remedy may only partially collapse them if the model can fit shifted costs independently—an extension worth testing.","A testable corollary: in games where the evader observes interdictions only partially or stochastically, the A-DFL loss should be replaced by an expectation over the evader's belief about $x$, and the paper's clean zero-loss characterization would degrade gracefully at best.","The same competitive dynamic suggests a min-max training scheme for the interdictor: choose interdictions to maximize the evader's regret under the trained model, making the leader's problem a learning-augmented bilevel game; A-DFL is the evader-side counterpart.","The size of the zero-loss decision-equivalence class could itself be used as a regularizer—penalizing predictors with large flat regions—offering an alternative to data augmentation with interdicted scenarios."],"forward_implications":["In any predict-then-optimize pipeline where a game opponent can shift the follower's costs, training on nominal samples alone is not enough; the training distribution must include the opponent's plausible shifts.","A-DFL's two variants give a concrete prescription: random interdiction sampling is cheap and effective when the interdiction budget covers a sizable share of arcs, while worst-case (true-cost) selection pays off when the graph is large relative to the budget.","The advantage of DFL-based training over PFL in these settings grows with the complexity of the feature-to-cost mapping, so A-DFL's restoration of DFL's edge holds precisely in the regimes where the predictor cannot perfectly fit the truth.","The decision-equivalence class analysis gives a diagnostic: if a trained estimator lies in the zero-loss class for nominal decisions but outside the class that survives interdiction, the interdictor can exploit it; A-DFL collapses that gap."],"supporting_citations":[{"why":"Provides the SPO+ surrogate-gradient loss used to train DFL and A-DFL in the experiments.","marker":"[13]"},{"why":"Defines decision-focused learning and documents its usual advantage over prediction-focused learning, which the paper overturns in the game setting.","marker":"[19]"},{"why":"Supplies the asymmetric-information shortest-path interdiction model (interdictor knows costs, evader does not) that the paper embeds in the learning pipeline.","marker":"[6]"},{"why":"Defines symmetric shortest-path interdiction, used to choose worst-case interdictions for the AA-DFL variant.","marker":"[14]"}],"fun_headline_variants":["Zero-loss DFL fails under interdiction; A-DFL restores advantage","Interdiction exposes DFL's zero-loss blind spot; A-DFL trains on attacks","Network interdiction reverses DFL's edge; adversarial samples fix it","A-DFL: adversarial training beats DFL's zero-loss trap in interdiction","Interdiction game: DFL's zero-loss estimators misroute; A-DFL fixes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evader must observe the interdictor's chosen arcs and delays before routing, so that the same shifted cost vector $c + d \\odot x$ can be fed to the shortest-path solver at both training (A-DFL) and test time; if the evader cannot see interdictions, A-DFL's loss and the whole comparison to DFL become ill-posed.","fun_headline_variants_meta":{"raw":{"variants":["Zero-loss DFL fails under interdiction; A-DFL restores advantage","Interdiction exposes DFL's zero-loss blind spot; A-DFL trains on attacks","Network interdiction reverses DFL's edge; adversarial samples fix it","A-DFL: adversarial training beats DFL's zero-loss trap in interdiction","Interdiction game: DFL's zero-loss estimators misroute; A-DFL fixes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000516,"raw_usage":{"total_tokens":2553,"prompt_tokens":1047,"completion_tokens":1506,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":663,"completion_tokens_details":{"reasoning_tokens":1396}},"tokens_in":663,"tokens_out":1506,"duration_ms":11340,"temperature":1.0,"reasoning_tokens":1396,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:17:16.941350+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the toy example of Section 5 with $d_1=d_2=3$, train a linear model with DFL to convergence, and evaluate the A-DFL loss (Eq. 5) on the trained model. The paper predicts a nonzero A-DFL loss and a failure interval of feature values where the post-interdiction path choice disagrees with the true optimum; if the trained model satisfies $a_1-a_2=2$, or if no such interval exists, the central failure claim is falsified.","supporting_citations":[],"review_version":1}