REVIEW 4 major objections 5 minor 35 references
Adversarial Instance Generation and Robust Training for Neural Combinatorial Optimization with Multiple Objectives
T0 review · 4 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash
Pith's one-line read Preference-conditioned neural solvers for multi-objective combinatorial optimization are shown to be vulnerable to preference-tailored adversarial instances, and a hardness-aware defense restores robustness and out-of-distribution performan
desk verdict Novel preference-conditioned attack/defense for neural MOCOP solvers, but the attack's objective in Eq. (4) is mathematically suspect and the experiments lack the rigor to back the central claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The core mechanism is the preference-conditioned gradient ascent loop in Eq. (5), which turns a clean instance into a hard instance for a given preference by maximizing a REINFORCE-style loss under a projection Π_N described as min-max normalization, paired with the DPD preference-selection rule (Eqs. 8–9), which uses softmax-normalized Tchebycheff scores over perturbed preferences to identify the weakest regions for training. The attack measures failure by hypervolume degradation of the approximated Pareto front; the defense trains with a REINFORCE gradient computed on the selected adversarial preference.
What would settle it
Re-run PAA on MOCVRP and MOKP, decode the final perturbed tensors back to node coordinates and item weights, and directly check capacity, demand, and item-level constraints; if any projected instance fails constraint satisfaction, the claim that PAA generates hard but feasible instances for those problems is directly falsified.
Extended reading notes
Core claim
The central claim is that the quality of a neural MOCOP solver's Pareto-front approximation is only as strong as its weakest preference-conditioned subproblem. PAA operationalizes this by solving, for each preference, a local maximization of the reinforcement loss over the input instance, projecting back into the feasible space with a min-max normalization; the resulting hard instances lower the hypervolume of the solver while leaving classical solvers mostly unaffected. DPD then inverts the attack: during adversarial training it generates perturbed preferences in the neighborhood of each training preference, scores them by their Tchebycheff value on hard instances, and selects the preferenc
Load-bearing premise
The attack's projection step (Eq. 5) is asserted to keep perturbed instances inside the feasible space N, but for capacitated vehicle routing and knapsack problems the paper never defines N or verifies that the projected instances satisfy capacity, demand, and item constraints; if the projection produces infeasible instances, the attack and defense results for two of the three problem families would not transfer to real problems.
Editorial extensions
If this is right
- If preference-tailored attacks substantially degrade neural MOCOP solvers, deployments in safety-critical settings must account for adversarial instance distributions, not just average-case performance.
- DPD improves out-of-distribution generalization, suggesting that adversarial training in the preference space acts as a general-purpose robustness regularizer that extends beyond the exact instances used during training.
- Because PAA also degrades the performance of classical baselines (WS-LKH and WS-DP), the hard instances appear intrinsically difficult for existing algorithms, not merely model-specific adversarial artifacts.
- DPD works on top of multiple base solvers (meta-learning, hypernetwork, and conditional-attention architectures), so the robustness gains are not tied to a single design.
- Defended neural solvers achieve results competitive with classical solvers in seconds rather than minutes to hours, making robustness practical at scale.
Reading between the lines
- The hardness-aware preference-selection scheme could be applied directly to a clean training distribution, without any adversarial instance generation, as a way to reweight training toward preference regions where the model is currently weak—an extension the paper does not explore.
- Because PAA uses the same REINFORCE loss the solver is trained on, the vulnerability surface may shift with the scalarization: training with Tchebycheff instead of weighted sum might yield different attack patterns, a testable hypothesis left open.
- DPD's improvements on clean in-distribution instances (including some negative gaps) hint that the defense is also a mild regularizer, possibly improving the learned policy's overall quality beyond pure robustness.
- The feasibility of PAA-generated instances for constrained problems (MOCVRP and MOKP) is not verified in the paper; checking this directly would settle whether the attack is genuinely producing hard valid instances or merely infeasible perturbations.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a unified robustness framework for preference-conditioned deep reinforcement learning solvers for multi-objective combinatorial optimization problems (MOCOPs). It introduces PAA (Preference-based Adversarial Attack), which generates hard instances by gradient ascent on a REINFORCE-style surrogate loss with respect to the instance input, and DPD (Dynamic Preference-augmented Defense), which performs adversarial training on these hard instances while selecting the worst-performing augmented preference for each mini-batch. Experiments on MOTSP, MOCVRP, and MOKP with several neural solvers (EMNH, PMOCO, CNH, WE-CA) report that PAA increases optimality gaps relative to non-learnable baselines and that DPD improves robustness and out-of-distribution generalization.
Significance. If correct, this is a timely contribution to the nascent area of robustness for neural MOCOP solvers. The paper is broad in scope: it considers multiple problem families, multiple solver architectures, and both attack and defense, and it compares against a learning-based attack baseline (ROCO). The inclusion of out-of-distribution evaluation, benchmark instances, and a generalization study is a strength. However, the central attack mechanism is not rigorously connected to the claimed objective, the projection operator is underspecified for two of the three problem families, and some reported numbers contradict the claim that PAA reduces hypervolume. These issues are load-bearing and need to be addressed before the empirical results can be interpreted as supporting the paper's main claims.
major comments (4)
- [§4.1, Eq. (4)-(5)] The attack objective ℓ(x;θ)=(L/b)log pθ(π|x) is non-positive because log pθ≤0. Its gradient w.r.t. x contains a term proportional to (log pθ)∇L, which pushes in the direction of decreasing L, and a term (L/b)∇log pθ, which only increases the likelihood of the sampled tour. The paper provides no proof or ablation showing that gradient ascent on this sample objective increases the expected Tchebycheff loss or degrades hypervolume. Since Eq. (5) is the core of PAA, the reported attack success is not attributable to the stated mechanism. Please provide a formal link, replace Eq. (4) with a surrogate with known monotonicity properties, or include an ablation demonstrating that Eq. (4) is essential and not merely random perturbation.
- [§4.1, Eq. (5) and §5.2, Table 1] The projection Π_N is described only as "min-max normalization." For MOCVRP and MOKP, N is never defined: capacity, demand, and item constraints cannot be enforced by coordinate-wise normalization. If the perturbed instances are not feasible MOCOP instances, the attack results for two of the three problem families are invalid, and a defense trained on them would not transfer. Specify the exact feasible set N and the projection for each problem, or restrict PAA to problems where normalization provably preserves feasibility.
- [§5.2, Table 1] The claim that PAA "significantly reduce[s] HV values in both classical and neural MOCOP solvers" is contradicted by the Bi-CVRP rows. For example, with n=50, WS-LKH HV increases from 0.3140 (clean) to 0.3402 (PAA); EMNH from 0.3048 to 0.3241; PMOCO from 0.3081 to 0.3286; CNH from 0.3090 to 0.3295. On these rows PAA raises absolute HV; only the optimality gap to WS-LKH increases. This undermines the paper's abstract and Section 4.1 statements that PAA lowers Pareto-front quality in terms of hypervolume. The authors should either revise the claim to "increases relative optimality gap" or explain why an instance where HV improves constitutes an attack.
- [§5.3-§5.4, Tables 2-4] No error bars, number of seeds, or statistical significance tests are reported. Several defense improvements are small in absolute terms (e.g., Table 2, Bi-KP20: EMNH gap 0.26% vs. EMNH-DPD 0.06%; Bi-KP100: EMNH 1.49% vs. 0.96%). Without variance estimates or paired tests, the claims of "significantly strengthens" and "superior performance" are not supported. Report multiple independent runs with standard deviations and, where appropriate, paired comparisons on the same test instances.
minor comments (5)
- [§3.2 and §3.1] Equation numbers are duplicated: Eq. (1) appears both for the MOCOP objective vector and for weighted-sum decomposition. Renumber to avoid confusion.
- [Abstract and §5] The abstract says "three classical MOCOPs" while Section 5 lists four settings: Bi-TSP, Tri-TSP, Bi-CVRP, Bi-KP. Clarify the count.
- [Figure 2] The figure contains the label "MOVRP Solver"; this should be "MOCVRP Solver" or a consistent abbreviation.
- [§4.2, Eqs. (6)-(9)] The notation for λ′_i is inconsistent: Eq. (6) writes λ′_i as a vector, Eq. (7) uses component index k, and Eq. (8) sums over j. Define the vector and component indices clearly.
- [§5.2, Table 1] ROCO-RL is not evaluated on Bi-KP (entries are "-"), so the statement that PAA "achieves the best attack effect over all cases in Bi-KP" lacks a direct comparison with the strongest baseline.
Circularity Check
No equation-level circularity; the adversarial training loop is self-referential but externally validated.
full rationale
The paper's derivation chain is empirical rather than equation-for-equation circular. PAA defines an attack objective in Eq. (4) and a gradient-ascent update in Eq. (5); the claim that this produces hard instances is validated by measuring HV degradation against external baselines WS-LKH and WS-DP, not by the attack objective itself. DPD trains on the resulting hard instances via the REINFORCE objective in Eq. (11) and is evaluated on Gaussian-mixture instances and TSPLIB-derived benchmarks, neither of which is used to fit the reported improvements. The only self-referential element is the standard adversarial-training loop: the same pretrained model is attacked to produce training instances and then defended. That is inherent to the method, but it does not make the evaluation equivalent to the construction. Minor self-citations, notably [25] and [26], supply the CNH and WE-CA baselines but are not load-bearing for the central claim; no uniqueness theorem or ansatz is imported from the authors' prior work. The skeptic's concern that Eq. (4) is not an unbiased estimator of expected Tchebycheff loss or HV degradation is a correctness/validity issue about whether PAA achieves its stated goal, not circularity in which the output is equivalent to the input by construction.
Assumptions & free parameters
free parameters (5)
- PAA gradient step size α =
0.01
- PAA gradient iteration count t =
3
- Preference perturbation bound ε in Eq. (6) =
not specified
- Number of augmented preferences N =
not specified
- Number of sampled tours M in baseline b(x) =
not specified
assumptions (6)
- domain assumption Tchebycheff/weighted-sum scalarization over preferences yields a good approximation to the Pareto front.
- domain assumption The policy pθ is differentiable with respect to continuous instance input x, enabling gradient ascent on ℓ(x;θ).
- ad hoc to paper Min-max normalization Π_N is a valid projection onto the feasible instance space N for all three MOCOPs.
- ad hoc to paper Maximizing the scaled REINFORCE loss ℓ(x;θ) for individual preferences yields instances whose Pareto-front HV is degraded.
- domain assumption Perturbing preferences around λ and training on the worst Tchebycheff preference improves out-of-distribution robustness.
- standard math REINFORCE with a baseline gives an unbiased, low-variance policy gradient estimator.
Cite this review
Pith. "Pith review of Adversarial Instance Generation and Robust Training for Neural Combinatorial Optimization with Multiple Objectives." pith.science (2026). https://pith.science/paper/JLBF6Z3M
@misc{pith2026260101665,
author = {Pith},
title = {Pith review of: Adversarial Instance Generation and Robust Training for Neural Combinatorial Optimization with Multiple Objectives},
year = {2026},
howpublished = {\url{https://pith.science/paper/JLBF6Z3M}},
note = {Machine review of arXiv:2601.01665}
}
read the original abstract
Deep reinforcement learning (DRL) has shown great promise in addressing multi-objective combinatorial optimization problems (MOCOPs). Nevertheless, the robustness of these learning-based solvers has remained insufficiently explored, especially across diverse and complex problem distributions. In this paper, we propose a unified robustness-oriented framework for preference-conditioned DRL solvers for MOCOPs. Within this framework, we develop a preference-based adversarial attack to generate hard instances that expose solver weaknesses, and quantify the attack impact by the resulting degradation on Pareto-front quality. We further introduce a defense strategy that integrates hardness-aware preference selection into adversarial training to reduce overfitting to restricted preference regions and improve out-of-distribution performance. The experimental results on multi-objective traveling salesman problem (MOTSP), multi-objective capacitated vehicle routing problem (MOCVRP), and multi-objective knapsack problem (MOKP) verify that our attack method successfully learns hard instances for different solvers. Furthermore, our defense method significantly strengthens the robustness and generalizability of neural solvers, delivering superior performance on hard or out-of-distribution instances.
Figures
Reference graph
Works this paper leans on
-
[1]
Q. Liu, X. Li, H. Liu, Z. Guo, Multi-objective metaheuristics for discrete opti- mization problems: A review of the state-of-the-art, Applied Soft Computing 93 (2020) 106382. doi:10.1016/j.asoc.2020.106382
arXiv 2020
-
[2]
S. Zajac, S. Huber, Objectives and methods in multi-objective routing problems: a survey and classification scheme, European Journal of Operational Research 290 (1) (2021) 1–25. doi:10.1016/j.ejor.2020.10.033
-
[3]
N. Saini, S. Saha, Multi-objective optimization techniques: A survey of the state- of-the-art and applications, European Physical Journal Special Topics 230 (10) (2021) 2319–2335. doi:10.1140/epjs/s11734-021-00229-6
-
[4]
Y . Cui, Z. Geng, Q. Zhu, Y . Han, Multi-objective optimization meth- ods and application in energy saving, Energy 125 (2017) 681–704. doi:10.1016/j.energy.2017.02.086
-
[5]
Z. Fei, B. Li, S. Yang, C. Xing, H. Chen, L. Hanzo, A survey of multi- objective optimization in wireless sensor networks: Metrics, algorithms, and open problems, IEEE Communications Surveys & Tutorials 19 (1) (2017) 550–586. doi:10.1109/COMST.2016.2616746. 21
arXiv 2017
-
[6]
Ehrgott, X
M. Ehrgott, X. Gandibleux, A. Przybylski, Exact methods for multi-objective combinatorial optimisation, in: Multiple Criteria Decision Analysis: State of the Art Surveys, Springer, 2016, pp. 817–850
2016
-
[7]
Herzel, S
A. Herzel, S. Ruzika, C. Thielen, Approximation methods for multiobjective op- timization problems: A survey, INFORMS Journal on Computing 33 (4) (2021) 1284–1299
2021
-
[8]
B. Zoph, Q. V . Le, Neural architecture search with reinforcement learning, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 4207–4215
2017
Show all 35 references
-
[9]
Gasse, D
M. Gasse, D. Chételat, N. Ferroni, L. Charlin, A. Lodi, Exact combinatorial op- timization with graph convolutional neural networks, Advances in Neural Infor- mation Processing Systems 32 (2019)
2019
-
[10]
L. Xin, W. Song, Z. Cao, J. Zhang, Neurolkh: Combining deep learning model with lin-kernighan-helsgaun heuristic for solving the traveling salesman problem, in: M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, J. W. Vaughan (Eds.), Advances in Neural Information Processing S...
2021
- [11]
-
[12]
H. Lu, Z. Li, R. Wang, Q. Ren, X. Li, M. Yuan, J. Zeng, X. Yang, J. Yan, Roco: A general framework for evaluating robustness of combinatorial optimiza- tion solvers on graphs, in: The Eleventh International Conference on Learning Representations, 2023. 22
2023
-
[13]
Geirhos, J.-H
R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, F. A. Wichmann, Shortcut learning in deep neural networks, Nature Machine Intelli- gence 2 (11) (2020) 665–673
2020
-
[14]
Florios, G
K. Florios, G. Mavrotas, Generation of the exact pareto set in multi-objective traveling salesman and set covering problems, Applied Mathematics and Com- putation 237 (2014) 1–19. doi:https://doi.org/10.1016/j.amc.2014.03.110. URLhttps://www.sciencedirect.com/science/article/p...
2014 doi
-
[15]
Halffmann, L
P. Halffmann, L. E. Schäfer, K. Dächert, K. Klamroth, S. Ruzika, Exact algo- rithms for multiobjective linear optimization problems with integer variables: A state of the art survey, Journal of Multi-Criteria Decision Analysis 29 (5-6) (2022) 341–363
2022
-
[16]
Zhang, H
Q. Zhang, H. Li, Moea/d: A multiobjective evolutionary algorithm based on de- composition, IEEE Transactions on evolutionary computation 11 (6) (2007) 712– 731
2007
-
[17]
L. Ke, Q. Zhang, R. Battiti, A simple yet efficient multiobjective combinatorial optimization method using decomposition and pareto local search, IEEE Trans- actions on Cybernetics 44 (11) (2014) 1808–1820
2014
-
[18]
W. Fang, Q. Zhang, J. Sun, X. Wu, Mining high quality patterns using multi- objective evolutionary algorithm, IEEE Transactions on Knowledge and Data En- gineering 34 (8) (2020) 3883–3898
2020
-
[19]
Y . Tian, L. Si, X. Zhang, R. Cheng, C. He, K. C. Tan, Y . Jin, Evolutionary large- scale multi-objective optimization: A survey, ACM Computing Surveys 54 (8) (2021) 1–34
2021
-
[20]
Zhang, H
Q. Zhang, H. Li, Moea/d: A multiobjective evolutionary algorithm based on decomposition, IEEE Transactions on Evolutionary Computation 11 (6) (2007) 712–731. 23
2007
-
[21]
H. Wu, J. Wang, Z. Zhang, Modrl/d-am: Multiobjective deep reinforcement learn- ing algorithm using decomposition and attention model for multiobjective opti- mization, arXiv preprint arXiv:2002.05484 (2020). URLhttps://arxiv.org/abs/2002.05484
2002 arXiv
-
[22]
K. Li, T. Zhang, R. Wang, Deep reinforcement learning for multiobjective optimization, IEEE Transactions on Cybernetics 51 (6) (2021) 3103–3114. doi:10.1109/TCYB.2020.2977661
2021
-
[23]
J. Chen, J. Wang, Z. Zhang, Z. Cao, T. Ye, S. Chen, Efficient meta neural heuristic for multi-objective combinatorial optimization, Advances in Neural Information Processing Systems 36 (2024)
2024
-
[24]
X. Lin, Z. Yang, Q. Zhang, Pareto set learning for neural multi-objective combi- natorial optimization, in: International Conference on Learning Representations (ICLR), 2022
2022
-
[25]
M. Fan, Y . Wu, Z. Cao, W. Song, G. Sartoretti, H. Liu, G. Wu, Conditional neu- ral heuristic for multiobjective vehicle routing problems, IEEE Transactions on Neural Networks and Learning Systems (2024)
2024
-
[26]
J. Chen, Z. Cao, J. Wang, Y . Wu, H. Qin, Z. Zhang, Y .-J. Gong, Rethinking neural multi-objective combinatorial optimization via neat weight embedding, in: International Conference on Learning Representations (ICLR), 2025
2025
-
[27]
Varma, Y
N. Varma, Y . Yoshida, Average sensitivity of graph algorithms, in: Proceedings of the 2021 ACM-SIAM Symposium on Discrete Algorithms (SODA), SIAM, 2021, pp. 684–703
2021
-
[28]
Geisler, J
S. Geisler, J. Sommer, J. Schuchardt, A. Bojchevski, S. Günnemann, Generaliza- tion of neural combinatorial solvers through the lens of adversarial robustness, arXiv preprint arXiv:2110.10942 (2021)
2021 arXiv
-
[29]
J. Zhou, Y . Wu, Z. Cao, W. Song, J. Zhang, Z. Shen, Collaboration! towards robust neural methods for routing problems, arXiv preprint arXiv:2410.04968 (2024). 24
2024 arXiv
-
[30]
C. Qian, Y . Yu, Z.-H. Zhou, An analysis on recombination in multi-objective evolutionary optimization, Artificial Intelligence 204 (2013) 99–119
2013
-
[31]
Tinós, K
R. Tinós, K. Helsgaun, D. Whitley, Efficient recombination in the lin-kernighan- helsgaun traveling salesman heuristic, in: International Conference on Parallel Problem Solving from Nature, Springer, 2018, pp. 95–107
2018
-
[32]
R. J. Williams, Simple statistical gradient-following algorithms for connectionist reinforcement learning, Machine Learning 8 (3-4) (1992) 229–256
1992
-
[33]
Schulman, F
J. Schulman, F. Wolski, P. Dhariwal, A. Radford, O. Klimov, Proximal policy optimization algorithms, arXiv preprint arXiv:1707.06347 (2017)
2017 arXiv
-
[34]
Y .-D. Kwon, J. Choo, B. Kim, I. Yoon, Y . Gwon, S. Min, Pomo: Policy optimiza- tion with multiple optima for reinforcement learning, in: Advances in Neural Information Processing Systems (NeurIPS), 2020
2020
-
[35]
Audet, J
C. Audet, J. Bigeon, D. Cartier, S. Le Digabel, L. Salomon, Performance indi- cators in multiobjective optimization, European Journal of Operational Research 292 (2) (2021) 397–422. 25
2021
Reviewed August 3, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.