A combination optimization solving system and method based on a general attack and defense framework

Abstract

The application discloses a combination optimization solving system and method based on a general attack and defense framework, belonging to the technical field of combination optimization, and the system comprises a multi-task modeling module, which can model combination optimization problems of different tasks as graph structure representation, and construct a Markov decision process of the graph structure according to the task type; an attack model extracts general graph features through a shared graph encoder, generates disturbances satisfying corresponding task constraints by means of a dedicated decoder and a mask processing of different tasks; and a defense model takes the graph structure and node / edge features as input, generates a decoding sequence that is adaptive to task disturbances and satisfies constraints through a selected target defense solver. The application can effectively identify security vulnerabilities of existing solvers, improve the robustness of the system in the confrontation environment, realize the whole-process coverage from problem discovery to solution through the combination of attack and defense models, and provide a solid security guarantee for industrial application of combination optimization technology.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of combinatorial optimization, and particularly relates to a combinatorial optimization solving system and method based on a general attack and defense framework. BACKGROUND

[0002] Combinatorial optimization is a class of problems that seek the optimal solution in a discrete feasible solution set (such as the traveling salesman problem TSP, the knapsack problem, the scheduling problem, etc.), and the core challenge is that the solution space grows exponentially with the problem size, making it difficult to solve by exhaustive search.

[0003] Existing combinatorial optimization solving methods mainly include two categories: one is the traditional heuristic and exact method, such as Lin-Kernighan-Helsgaun (LKH) algorithm, branch and bound method, mixed integer programming solver (such as Gurobi, SCIP) etc., this kind of method has higher solving quality on single problem (such as ATSP, CVRP, DAG scheduling), but cannot be directly applied to general adversarial attack and defense research; the other is the neural solver based on deep learning, such as Pointer Networks using pointer attention mechanism to generate variable-length solution sequence, S2V-DQN combining graph embedding and deep reinforcement learning to realize constructive solving, POMO proposing multi-optimal strategy optimization to improve TSP / CVRP solving effect, MatNet modeling ATSP / CVRP etc. problem through matrix encoding.

[0004] Current combinatorial optimization problem solving technology faces several key challenges, which seriously restrict the reliability and generalization ability of the solver in practical application.

[0005] Firstly, the existing solvers (including traditional heuristic algorithms and deep learning models) generally have insufficient adversarial robustness. Studies have shown that even well-trained neural solvers (such as MatNet, POMO, etc.) will experience a significant decline in solving quality when faced with specially designed adversarial perturbations. For example, in the traveling salesman problem, only a slight adjustment to the weight of a few key edges can cause the length of the path output by the solver to increase by more than 50%. More seriously, this vulnerability can cause significant economic losses or safety hazards in practical application scenarios such as vehicle routing and task scheduling.

[0006] The existing attack method has obvious limitations, and most of the current attack techniques are designed for specific problems, lacking a unified attack paradigm. This problem-specific attack scheme not only requires the development of an attack model for each type of combinatorial optimization problem, resulting in a huge research and development cost, but more importantly, it cannot take advantage of the common characteristics between different problems to improve attack efficiency. In addition, the traditional attack method uses a static optimization strategy, which is difficult to adapt to different scales and different constraint conditions of actual problem instances, resulting in insufficient generalization of attack effect.

[0007] In the aspect of defense, the existing technology also faces severe challenges. The mainstream adversarial training method usually uses adversarial samples with fixed distribution for training. This static defense strategy is difficult to cope with dynamically changing attack methods. More importantly, the current defense scheme is mostly developed independently of the attack process, lacking a systematic attack-defense collaborative optimization mechanism. This fragmented design paradigm limits the defense effect and cannot form a continuously evolving security protection system. In addition, existing defense methods often need to design a defense strategy for each specific problem, which not only increases the complexity of engineering implementation, but also makes it difficult to ensure consistent defense effect across problems. SUMMARY

[0008] In view of the above problems in the prior art, the combinatorial optimization solving system and method based on a general attack and defense framework provided by the present application solve the problem that the existing combinatorial optimization solving method is difficult to solve multiple combinatorial optimization problems, and needs to design a corresponding attack scheme and defense scheme for each optimization problem, thereby reducing the efficiency of solving combinatorial optimization problems, making it difficult to adapt to different scales and different constraint conditions of actual problem instances, resulting in insufficient generalization of attack and defense effect, reducing the quality of combinatorial optimization problem solving results, and increasing the complexity of engineering implementation. The present application not only effectively identifies the security vulnerabilities of existing solvers, but also systematically improves the robust performance of solvers in an adversarial environment. By organically combining attack models and defense models, the present application realizes full-process coverage from problem discovery to problem solving, and provides a solid security guarantee for industrial application of combinatorial optimization technology.

[0009] To achieve the above-mentioned application purposes, the technical scheme adopted by the present application is as follows: a combinatorial optimization solving system based on a general attack and defense framework, comprising:

[0010] A multi-task modeling module is used to model different tasks of combinatorial optimization problems as a graph structure representation, and to construct a Markov decision process of the graph structure according to the task type;

[0011] An attack model is used to extract general graph feature representations in the graph structure through a shared graph encoder, and to generate disturbances that satisfy the constraints of corresponding tasks through different task-specific decoders and mask processing;

[0012] The defense model takes a graph structure and node / edge features as input, and generates a decoding sequence that adapts to task perturbation and satisfies task constraints through a selected target defense solver, achieving combinatorial optimization solving.

[0013] Further, the task type includes an asymmetric traveling salesman problem ASTP, a vehicle routing problem with capacity constraints CVRP, and a directed acyclic graph scheduling problem DAG.

[0014] In the constructed Markov decision process:

[0015] Each state in the state space includes a current graph structure, a node feature matrix, and a global matrix.

[0016] Each action in the action space is a perturbation operation on the graph structure for a pair of nodes; the perturbation operation is determined according to the task type.

[0017] The reward function is the degree of decline in the performance of the target defense solver after adding the perturbation.

[0018] Further, the attack model is based on a reinforcement learning architecture, including:

[0019] The Actor network includes a shared encoder and a dedicated decoder, the shared encoder is used to extract a general graph feature representation of different task combinatorial optimization problems, and the dedicated decoder is used to map the output of the shared encoder to the action space of the corresponding task, and dynamically generate a task legality mask corresponding to the different task action space through mask processing, and then output the action probability distribution after mask processing.

[0020] The Critic network is used to learn the state value function of different tasks according to the action probability distribution output by the Actor network, and feedback to the Actor network.

[0021] When the task is an asymmetric traveling salesman problem ASTP, the learned state value function is a path length value function that estimates the traveling salesman problem; when the task is a vehicle routing problem with capacity constraints CVRP, the learned state value function is a total travel distance value function that estimates the vehicle routing problem; when the task is a directed acyclic graph scheduling problem DAG, the learned state value function is a completion time value function that estimates the scheduling problem.

[0022] Further, the target defense solver is an end-to-end combinatorial optimization solver MatNet based on a graph neural network.

[0023] A combinatorial optimization solving method, comprising the following steps:

[0024] S100, model the combinatorial optimization problem of the task to be solved as a Markov decision process of a graph structure;

[0025] S200, in the attack model, a common graph feature representation of different task combination optimization problems is extracted by a shared graph encoder, the common graph feature representation is mapped to a corresponding action space by a dedicated decoder of a task to be solved, and a task legality mask of the action space is dynamically generated by a mask processing;

[0026] S300, in the defense model, taking the node / edge features of the graph structure as input, a decoding sequence that adapts to task disturbance and satisfies task constraints is gradually generated by a selected target defense solver, and the combination optimization solving is realized.

[0027] Further, in the step S200, the common graph feature representation of different task combination optimization problems is extracted, including:

[0028] S201, the features of the graph structure are extracted by a forward graph convolution network, and the features of the transposed graph structure are extracted by a backward graph convolution network;

[0029] S202, the extracted features are spliced by a splicing layer;

[0030] S203, the global attention pooling layer adopts an attention mechanism to calculate and extract the common feature representation of the spliced features.

[0031] Further, in the step S200, the common graph feature representation is mapped to the corresponding action space, including:

[0032] S204, any node pair in the graph structure is spliced by splicing the embedding vectors of the two nodes and the common graph feature representation;

[0033] Wherein, the node pair represents a disturbance operation on the graph structure;

[0034] S205, based on the task type, the spliced features are generated into the original score of the node pair by a multi-layer perception machine;

[0035] S206, the original scores of all node pairs are converted into the corresponding probability distribution by a Softmax activation function, and the corresponding action space is obtained;

[0036] When the task is an asymmetric traveling salesman problem (ASTP), an attention mechanism with query-key point product is used to calculate the original score of the connectivity and path cost of the attention edge replacement / perturbation; when the task is a capacitated vehicle routing problem (CVRP), an attention mechanism is further used to calculate the node embedding vector in the vehicle path, and then the demand node embedding vector and the coordinate node embedding vector are added to obtain the original score considering the customer demand and the vehicle remaining capacity; when the task is a directed acyclic graph scheduling problem (DAG), the embedding vectors of the selected nodes and the embedding vectors of other nodes are paired by splicing enhanced context information, and the original score considering whether the topological constraint is generated is obtained by using a dynamic mask.

[0037] Further, in the step S200, the formula for generating the task legality mask of the action space is:

[0038]

[0039] In the formula, represents the probability of selecting the action a under the state s by the weighted normalized new policy,

[0040] Further, in the step S200, the training loss function of the attack model is:

[0041]

[0042]

[0043]

[0044]

[0045]

[0046] In the formula, represents the policy loss, ​​​​​​​​​​​​​​​​​denotes the expected value of the t-th step, denotes the entropy function, denotes the policy at the t-th step state , denotes the Actor network parameters, denotes the Critic network parameters, denotes the state of the t-th step , denotes the policy distribution, and denote the first weight hyperparameter and the second weight hyperparameter, respectively;

[0047] denotes the min function, denotes the ratio of new and old policy probabilities, denotes the advantage function estimate, denotes the clipping function, denotes the clipping parameter, denotes the numerical stability constant;

[0048] denotes the current policy under the Actor network parameters , denotes the old policy, denotes the action of the t-th step, denotes the state of the t-th step;

[0049] denotes the output of the Critic network corresponding to the task;

[0050] denotes the batch-normalized reward, denotes the reward, and denote the mean and standard deviation of the current batch reward, respectively.

[0051] Further, in the step S300, the target defense solver adopts an iterative adversarial retraining method for defense training, comprising:

[0052] using the trained attack model to perturb the original data set to generate a first adversarial sample; the perturbation satisfies the legality constraint of different tasks;

[0053] mixing the original data set with the first adversarial sample to obtain a mixed data set;

[0054] using the mixed data set to iteratively train the target defense solver to obtain a defense model;

[0055] In each iteration training process, the defense model obtained by the last training is taken as an attack target, a new adversarial sample is generated by using the attack model, and a new mixed data set is constructed with the stable test benchmark data set, so that the defense model in the current iteration round is trained.

[0056] The present application has the following advantages:

[0057] (1) Strong universality, reducing repeated design and training

[0058] The present application adopts a unified multi-task attack model structure, shares a multi-layer graph convolution network (GCN) encoder, and sets a task-specific decoding branch and a dynamic mask mechanism at the output end to realize action generation for different combination optimization tasks (ATSP, CVRP, DAG). Since the parameters and feature extraction process of the encoder part are shared by multiple tasks, and the specific constraints of different tasks are automatically guaranteed to be legal by the mask mechanism, a single model can adapt to multiple tasks without the need to train an attacker for each task. Compared with existing methods, this design significantly reduces the number of model training times and storage costs, saves computing resources and network bandwidth (reduces model file transmission volume in distributed deployment), and improves overall deployment efficiency in a multi-task environment.

[0059] (2) Self-adaptive robustness improvement to ensure data security

[0060] The present application introduces an iterative attack-defense closed-loop mechanism during training, the attack model generates new adversarial disturbance samples online, the defense model re-trains using these samples, and multiple rounds of updates form a dynamic game, so that the defense model is continuously exposed to the latest and strongest attack instances during training. This mechanism enables the defense to continuously learn to cope with disturbance patterns of different distributions and strategies, overcoming the defect that traditional static defense is easily bypassed by new attacks. Compared with existing defense methods, the present application significantly improves the ability of the defense to cope with adaptive attacks, ensuring the stability and security of the combined optimization solver in long-term operation, and reducing the security risks such as task scheduling errors or path planning failures.

[0061] (3) High resource utilization, reducing network and computing overhead

[0062] The present application reduces the total number of parameters by sharing the encoder, avoids full gradient backtracking by using PPO policy update, and introduces legality masks in the inference stage to directly mask illegal actions, reducing invalid calculations. Only one forward propagation is required in the inference process to complete action probability calculation, and the mask mechanism enables subsequent sampling only in the legal action set, significantly reducing the evaluation of invalid node pairs. Compared with the method of multiple models and multiple tasks running independently, the present application effectively reduces the inference delay and memory occupancy, and is particularly suitable for edge computing nodes or distributed deployment scenarios with limited network bandwidth.

[0063] (4) Ensure the legality of the disturbance and improve the effectiveness of the attack

[0064] The application filters disturbances that do not meet the task constraints (such as CVRP capacity constraints, DAG loop avoidance, ATSP path connectivity) in the action generation stage through the task-specific legality mask mechanism, ensuring that the actions output by the strategy are always legal. This mechanism completes the legality judgment in the action selection stage, avoiding the risk of illegal disturbances entering the environment causing state abnormalities or polluting training samples. Compared with the scheme that needs to remove illegal samples afterwards, the application directly improves the stability of attack training and the effectiveness of disturbance generation, making attack samples directly available for defense model retraining, thereby shortening the attack-defense iteration cycle.

[0065] (5) Defense generalization across solvers and across distributions

[0066] The application uses a reward function design independent of the solver, allowing the attacker to learn a disturbance pattern applicable to different solvers (including heuristics, neural networks, and commercial optimizers) and different data distributions. Since the reward definition does not depend on the internal information of a specific algorithm, the attacker maintains stable attack effectiveness in comprehensive evaluation of multiple distributions and multiple solvers.

[0067] When this attack method is used to train a defense model, the defense model can still maintain high performance when dealing with unseen solvers and data sets. Compared with existing defense methods that rely on single-solver training, the application significantly enhances cross-platform generalization ability and reduces security risks when deploying in new environments.

[0068] (6) Training time advantage

[0069] The application has a significant advantage in training efficiency. Existing combinatorial optimization attack methods usually need to design network structure and feature processing flow for each task (such as ATSP, CVRP, DAG) and train independent attack models, which means that in a multi-task scenario, three or more complete training processes must be repeated. Each training involves parameter initialization from scratch, training of feature encoders, and iterative updates of strategy optimization, which not only consumes a large amount of computing resources and memory, but also significantly prolongs the output cycle of the available version of the model. For large-scale task combinations, this multi-model independent training mode will cause the total training time to increase linearly or even super-linearly, making it difficult to complete model updates quickly within a limited computing budget.

[0070] The universal multitask attack model structure provided by the application combines a task-specific decoding branch and a dynamic legality mask mechanism through sharing a multi-layer graph convolution network (GCN) encoder and global feature embedding, and can simultaneously adapt to multiple different tasks only through one training. Since the encoder parameters are completely shared among multiple tasks, the model can simultaneously learn the common structural features and task-specific constraints of multiple tasks in one forward and backward propagation process, avoiding redundant calculation and memory occupation caused by repeated training. Under the same task size, the total training time of the application is reduced by more than 60% compared with the existing single-task multi-model method. For example, the cumulative training of the original method on three tasks consumes thousands of minutes, while the application can generate an attacker model that can simultaneously act on three tasks in one training. This design not only significantly reduces the calculation energy consumption and hardware resource occupation, but also greatly improves the model iteration speed and deployment flexibility, and is especially suitable for multitask collaborative optimization and distributed computing environments with limited network bandwidth and computing power resources. BRIEF DESCRIPTION OF DRAWINGS

[0071] Figure 1 A structure diagram of a combination optimization solving system of a universal attack and defense framework provided by the application. DETAILED DESCRIPTION

[0072] The specific embodiments of the application are described below to facilitate understanding of the application by those skilled in the art, but it should be clear that the application is not limited to the scope of the specific embodiments. It is obvious to those skilled in the art that various changes are within the spirit and scope of the application as defined in the appended claims, and all applications utilizing the concept of the application are within the scope of protection.

[0073] Example 1:

[0074] The embodiment of the application provides a combination optimization solving system based on a universal attack and defense framework, which comprises:

[0075] A multitask modeling module is used to model the combination optimization problem of different tasks as a graph structure representation, and to construct it as a Markov decision process of graph structure according to the task type;

[0076] An attack model is used to extract universal graph feature representation in the graph structure through a shared graph encoder, and to generate a disturbance satisfying the corresponding task constraint through a task-specific decoder and a mask processing;

[0077] A defense model is used to take the graph structure and node / edge features as input, generate a decoding sequence that adapts to the task disturbance and satisfies the task constraint through a selected target defense solver, and realize combination optimization solving.

[0078] In the embodiment of the application, in order to realize a unified attack and defense framework, first, different combinatorial optimization problems are modeled as graph structure representations to ensure consistency and processability of subsequent model input forms.

[0079] The task types in the embodiment of the application include an asymmetric traveling salesman problem ASTP, a capacitated vehicle routing problem CVRP, and a directed acyclic graph scheduling problem DAG. Specifically, in the directed graph structure representation obtained by modeling the asymmetric traveling salesman problem ASTP, the node set represents cities, each node corresponds to a city, the edge set represents the directed connection between cities, any edge represents a travel route between two cities, and the edge weight represents the travel cost between cities and is derived from a distance matrix.

[0080] Through the above unified modeling method, the combinatorial optimization problems of different task types are converted into graph structure representations for subsequent encoding and perturbation operations of graph neural networks.

[0081] In the embodiment of the application, the attack process of the above combinatorial optimization problem when being solved is modeled as a Markov decision process. Each state in the state space includes a current graph structure, a node feature matrix, and a global matrix (such as the current step number, the remaining action budget, etc.). Each action in the action space is a perturbation operation on the graph structure. The perturbation operation is determined according to the task type. The reward function is the degree of decline in the performance of the target defense solver after adding the perturbation.

[0082] Further, for the asymmetric traveling salesman problem ASTP, the main perturbation is edge weight perturbation, such as halving or increasing the edge weight. For the capacitated vehicle routing problem CVRP, the main perturbation is demand perturbation or edge weight modification. For the directed acyclic graph scheduling problem DAG, the main perturbation is edge deletion or weight modification to maintain acyclicity.

[0083] The reward function is used to measure the attack effect of the attack model and is defined as the difference in the objective function of the target defense solver before and after adding the perturbation operation, such as the path length in the asymmetric traveling salesman problem ASTP, the total travel distance in the capacitated vehicle routing problem CVRP, and the maximum completion time of scheduling in the directed acyclic graph scheduling problem DAG.

[0084] The attack model in the embodiment of the application is based on a reinforcement learning architecture, and includes:

[0085] The actor network includes a shared encoder and a dedicated decoder, the shared encoder is used to extract a general graph feature representation of different task combination optimization problems, and the dedicated decoder is used to map the output of the shared encoder to an action space of a corresponding task, dynamically generate a task legality mask corresponding to a different task action space through mask processing, and then output a processed action probability distribution, so as to ensure that all generated actions meet task constraints.

[0086] The critic network is used to learn a state value function of different tasks according to the action probability distribution output by the actor network, and feedback to the actor network.

[0087] When the task is an asymmetric traveling salesman problem (ASTP), the learned state value function is a path length value function of the traveling salesman problem; when the task is a vehicle routing problem with capacity constraints (CVRP), the learned state value function is a total travel distance value function of the vehicle routing problem; and when the task is a directed acyclic graph scheduling problem (DAG), the learned state value function is a completion time value function of the scheduling problem.

[0088] In the network architecture of the attack model, the actor network adopts a unified encoder-decoder architecture in the embodiment of the application, wherein the encoder shares parameters among all tasks, and the decoder selects a corresponding branch according to the type of the task; the critic network adopts a task-specific design, and each critic network contains independent parameters and is used to process feature representation and value estimation of a corresponding task.

[0089] Based on the structural design of the actor network, through the shared encoder, the three tasks of ATSP, CVRP and DAG can share the learned general graph feature representation, and the respective decoders process task-specific constraints and features, which significantly reduces the number of model parameters, improves the training efficiency, and realizes the cross-task generalization ability.

[0090] In the embodiment of the present application, in the process of training the attack network, the corresponding Critic network is selected according to the current task type for value estimation and loss calculation, the state value estimation is learned by minimizing the mean square error, and the knowledge sharing and specialized learning between tasks are realized. Specifically, the Critic network outputs the state value, and the training target is to minimize the square error between the value and the discounted return, and the discounted return is calculated by accumulating the future reward, and the importance of immediate reward and long-term return is balanced by using the discount factor. This design enables each Critic network to learn the reward structure and value distribution of its corresponding task, improving the accuracy and stability of value estimation.

[0091] In the embodiment of the present application, the defense model is mainly used to improve the robustness of the target defense solver under adversarial perturbation. Without changing the structure of the solver, the solver is gradually adapted to the multi-task perturbation instances generated by the unified attacker through iterative adversarial retraining, thereby significantly improving the performance stability of the solver under normal and abnormal input distribution.

[0092] The target defense solver in the embodiment of the present application is an end-to-end combinatorial optimization solver MatNet based on a graph neural network, which can process multiple graph optimization tasks, and the input is a graph structure and node / edge features, and the output is a decoding sequence that satisfies the task constraints; the internal structure of MatNet is composed of multiple layers of graph convolution units and task-specific decoders.

[0093] In one specific embodiment of the present application, for the above-mentioned target defense solver, the model parameters are set as follows: the embedding dimension is 384, the number of encoder layers is 8 layers of graph convolution, the number of attention heads is 16, the QKV dimension is 32, the hidden layer of the feedforward network is 768, the mixed score hidden layer dimension is 32, and the Logit clipping threshold is 12.

[0094] Embodiment 2:

[0095] The embodiment of the present application is based on the combinatorial optimization solving system based on the general attack and defense framework in embodiment 1, and provides a corresponding combinatorial optimization solving method, as shown in Figure 1 The method comprises the following steps:

[0096] S100, modeling the combinatorial optimization problem of the task to be solved as a Markov decision process of a graph structure;

[0097] S200, in the attack model, extracting a general graph feature representation of different task combinatorial optimization problems through a shared graph encoder, mapping the general graph feature representation to a corresponding action space through a dedicated decoder of the task to be solved, and dynamically generating a task legality mask of the action space through mask processing;

[0098] S300, in the defense model, taking the node / edge features of the graph structure as input, gradually generating the decoding sequence that adapts to the task disturbance and meets the task constraint through the selected target defense solver, and realizing the combinatorial optimization solution.

[0099] In step S200 of the embodiment of the application, based on the structure of the aforementioned attack model, the general graph feature representation of different task combination optimization problems is extracted in the Actor network, including:

[0100] S201, the features of the graph structure are extracted through the forward graph convolution network, and the features of the transposed graph structure are extracted through the backward graph convolution network;

[0101] S202, the extracted features are spliced through the splicing layer;

[0102] S203, the general feature representation of the spliced features is extracted through the global attention pooling layer using the attention mechanism calculation.

[0103] In the above process of the embodiment of the application, three different tasks (ATSP, CVRP and DAG scheduling) share the same encoder, realizing cross-task knowledge transfer and parameter sharing. Specifically, the forward graph convolution network and the backward graph convolution network are used to process the input graph structure to generate node-level representation. Whether the input is the distance matrix of ATSP, the demand graph of CVRP or the dependency graph of DAG, the features are extracted through the same encoder architecture, so that the model can learn the general graph structure representation.

[0104] In step S200 of the embodiment of the application, based on the structure of the aforementioned attack model, the general graph feature representation is mapped to the corresponding action space in the Actor network, including:

[0105] S204, the embedding vectors of two nodes and the general graph feature representation are spliced for any node pair in the graph structure;

[0106] Wherein, the node pair represents the perturbation operation on the graph structure.

[0107] S205, based on the task type, the spliced features generate the original score of the node pair through a multilayer perceptron;

[0108] S206, the original scores of all node pairs are converted into the corresponding probability distribution through the Softmax activation function, and the corresponding action space is obtained;

[0109] Specifically, when the task is the Asymmetric Traveling Salesman Problem (ASTP), an attention mechanism with query-key dot product is used to calculate the original scores of connectivity and path cost for edge replacement / perturbation. When the task is the Vehicle Routing Problem (CVRP) with capacity constraints, an attention mechanism is used to further calculate the node embedding vectors in the vehicle path, and then the demand node embedding vector is added to the coordinate node embedding vector to obtain the original score considering customer demand and vehicle remaining capacity. When the task is the Directed Acyclic Graph (DAG) scheduling problem, context information is enhanced by splicing, the embedding vectors of selected nodes are paired with the embedding vectors of other nodes, and the original score considering whether or not topological constraints are generated is obtained by using dynamic masking.

[0110] In this embodiment, the decoding process follows a two-step mechanism: first, candidate perturbation actions (node ​​pairs) are selected, and then the selected perturbation operation (edge ​​deletion or weight halving) is executed. During this process, a masking mechanism forces the selection probability of invalid nodes to be 0, maintaining the legality of constraints for different tasks. To improve efficiency, edges currently included in the solver's predicted solution are excluded from the action space, and the complete attack trajectory consists of sequential actions, allowing the agent to explore the cumulative impact on the solver's output.

[0111] In step S200 of this embodiment of the invention, based on the structure of the aforementioned attack model, the formula for generating the task legality mask of the action space in the Actor network is as follows:

[0112]

[0113] In the formula, This indicates the new policy after weighted normalization in state. Select action The probability, Indicates the old strategy in state Select action The probability, This indicates the old strategy in the action state. Select action The probability, Indicates the action currently being evaluated. Indicates the current state. Indicates the legality of an action, when For illegal actions, when This was a legal action at the time.

[0114] In this embodiment of the invention, during the code implementation process of dynamically generating task legality masks corresponding to different task action spaces through masking, the score of illegal actions is directly added... To add 0 to legal actions, and then do softmax calculation on (scores+mask), this implementation is mathematically equivalent to the above mask formula, which is expressed as:

[0115] When mask= , exp( )=0, illegal action probability is 0

[0116] When mask=0, exp(0)=1, keep the original probability distribution

[0117] In an embodiment of the present application, a two-stage mask strategy is used to generate the mask corresponding to the asymmetric traveling salesman problem ASTP. In the first stage, all nodes are initialized to , and then the nodes with valid candidate edges are set to 0. Specifically, for each node , if the node has candidate edges (excluding the edges on the current optimal path), the task legality mask , otherwise . In the second stage, given the nodes selected in the first stage, the mask is updated to only allow nodes connected to the selected nodes through valid candidate edges.

[0118] In an embodiment of the present application, the mask mechanism of the capacitated vehicle routing problem CVRP is the same as that of ATSP, but is specially designed to respect the path and demand constraints; specifically, in the first stage, the mask excludes nodes that are already part of the current optimal path or nodes that will violate vehicle capacity after selection. In the second stage, after selecting the node, the mask is updated to only allow the next node that can be feasibly accessed, while considering path continuity and remaining vehicle capacity.

[0119] In an embodiment of the present application, the directed acyclic graph scheduling problem DAG is specially designed to maintain the acyclic nature of the graph, in the first stage, the mask excludes nodes that have no removable outgoing edges (i.e., nodes that have no valid dependencies to remove). In the second stage, after selecting the source node, the mask is updated to only allow target nodes connected by removable edges, and removal of which will not introduce a cycle. This ensures that each perturbation corresponds to a valid edge removal that maintains the DAG structure and respects all scheduling constraints. Further, the mask value is set as follows: illegal actions , legal actions are 0, and the softmax function is used to ensure that the probability of illegal actions is 0, and legal actions are assigned probabilities according to the original scores. This design ensures that the attacker only explores legal actions during training and inference, improving training efficiency and attack quality.

[0120] In the embodiment of the application, based on the structural design of the preceding attack model, the training target of the attack model is: selecting a corresponding Critic network for value estimation and loss calculation according to the current task type, learning the state value estimation by minimizing the mean square error, and realizing knowledge sharing and specialized learning between tasks.

[0121] On this basis, in the embodiment of the application, the training loss function of the attack model is:

[0122]

[0123]

[0124]

[0125]

[0126]

[0127] In the formula, represents a policy loss, represents a value function loss, represents an expectation at the tth step, represents an entropy function, represents a policy at the tth step state , represents an Actor network parameter, represents a Critic network parameter, represents a state at the tth step, represents a policy distribution, and respectively represent a first weight hyperparameter and a second weight hyperparameter, represents a minimum value function, represents a new-old policy probability ratio, represents an advantage function estimation, represents a clipping function, represents a clipping parameter, represents a numerical stability constant, represents a current policy under the Actor network parameter , represents an old policy, represents an action at the tth step, represents a state at the tth step, represents an output of a Critic network corresponding to a task, represents a batch-normalized reward, represents a reward, and respectively represent the mean and standard deviation of the current batch reward.

[0128] In one specific embodiment of the present application, based on the above loss function design, the model training parameters are set as: training epoch number 10, output dimension of the forward / backward graph convolutional network 64, batch size 1, clip parameter 0.1, and discount factor 0.95.

[0129] Further, the training process of the attack model adopts a PPO strategy of "randomly selecting task types in each training round", which ensures that the attacker can learn the disturbance patterns of multiple task types at the same time through random sampling, and realizes cross-task knowledge transfer.

[0130] In step S300 of the embodiment of the present application, the target defense solver adopts an iterative adversarial retraining method for defense training, including:

[0131] The trained attack model is used to disturb the original data set to generate first adversarial samples; the disturbance satisfies the legality constraints of different tasks;

[0132] The original data set and the first adversarial samples are mixed to obtain a mixed data set;

[0133] The mixed data set is used to iteratively train the target defense solver to obtain a defense model;

[0134] In each iteration training process, the defense model obtained by the last training is used as an attack target, a new adversarial sample is generated by using the attack model, and a new mixed data set is constructed with the stable test benchmark data set, and the defense model under the current iteration round is trained.

[0135] In one specific embodiment of the present application, in the training process of the above defense model, the training parameters of MatNet are set as: training Epoch number 30, Episode 2500, and batch size 64.

[0136] In one specific embodiment of the present application, in the training process of the above defense model, the optimizer parameters are set as: learning rate 1x10 -4 , weight decay 1x10 -5 , in the learning rate scheduler, the decay milestone is [10, 20, 30], and the decay rate is 0.85.

[0137] In a specific embodiment of the present application, during the training process of the above defense model, the iterative training strategy is further: in the kth iteration, the solver is trained completely using the defense training data set of the kth iteration, and after the training is completed, the updated solver is passed to the attacker as an attack target to generate new round of adversarial samples, which are mixed with the original samples to form the next round of training data set, and then enter the next round of training. By way of example, the default number of iterations is set to 3, and each round of training is continued on the basis of the weight of the last round of solver, rather than being reinitialized, to achieve continuous adaptation to new perturbation patterns. During the training process, the loss function of the solver remains the same as the original task, for example, the path length minimization loss is used in the path optimization task, and the maximum completion time minimization loss is used in the scheduling task; the training hyperparameters such as optimizer and learning rate are consistent with the normal training phase to ensure comparability

[0138] In an embodiment of the present application, after each round of iterative training is completed, the defense model is tested on the generated first round of adversarial samples, and a defense effectiveness determination condition is set to evaluate the defense effect.

[0139] In an embodiment of the present application, the iterative update of the defense model is used to retrain the adversarial samples, so that the solver can maintain stable performance when facing gradually enhanced adversarial perturbations; by introducing multi-task perturbations, the defense capability is not only for a single task, but also covers various combined optimization problems; the defense process does not rely on task-specific prior knowledge and does not need to modify the solver structure, and has high universality and portability.

[0140] It should be noted that the combined optimization solving method of the above general attack and defense framework provided by the present application can be applied to solve combined optimization problems of other tasks according to actual user needs, and cannot be considered to only solve the above three tasks because the present application mentions the three tasks.

[0141] Embodiment 3:

[0142] The embodiment of the present application provides a practicality and generalization verification example of the combined optimization solving method in embodiment 2.

[0143] In this embodiment, the attack model and the defense model are evaluated on multiple different distribution test sets. Unlike the uniform distribution random data used only in the training phase, different data distributions are introduced in the test phase to test the performance of the model under unknown distribution.

[0144] For ATSP and CVRP problems, in the training phase, the unified attacker and defense model are trained only using data generated by random uniform distribution (Uniform); in the test phase, the following distributions are additionally introduced:

[0145] a) Tsplib and CVRPlib benchmark datasets: These classic datasets are derived from real-world transportation and logistics problems, with more complex geometric structures and non-uniform distribution characteristics.

[0146] b) Gaussian instances: Compared with uniform distribution, the point set under Gaussian distribution presents central aggregation, posing different challenges to path and capacity constraints.

[0147] The experimental results show that:

[0148] a) The attack model can still significantly weaken the performance of the original solver on Tsplib, CVRPlib and Gaussian distribution instances, verifying its universal attack ability on data outside the training distribution.

[0149] b) The defense model also exhibits robustness on these cross-distribution test sets, with its performance significantly improved under adversarial perturbation compared to the non-defense model, proving that iterative adversarial retraining effectively improves the robustness of the model in OOD environment.

[0150] For the DAG scheduling problem, in the training phase, the attack model and the defense model learn based on uniformly randomly generated DAG data; in the test phase, two types of completely different DAG distributions are introduced:

[0151] a) TPC-H DAGs: derived from database query optimization benchmark tests, with typical task dependency structure and uneven computing load.

[0152] b) Random graphs: obtained through a probabilistic random edge generation mechanism, with denser and irregular task dependency relationships.

[0153] The experimental results show that:

[0154] a) The attack model can still generate efficient perturbations under these two types of distributions, significantly increasing the scheduling completion time, indicating that the strategies learned by it have strong cross-distribution transferability;

[0155] b) The defense model can significantly reduce the performance gap before and after the attack when facing perturbations from TPC-H and , reflecting its robust adaptive ability to unknown DAG structures.

[0156] The above cross-distribution experimental results in the embodiments of the present application show that:

[0157] a) The unified attacker in the attack model in the present application is not only effective within the training distribution, but can also capture structural weaknesses in different combinatorial optimization problems;

[0158] b) The defense model obtained by iterative adversarial retraining in the application can not only resist perturbations under the training distribution, but also maintain stable performance in Tsplib, CVRPlib, Gaussian distribution, TPC-H and and other diversified distributions.

[0159] It is fully proved that the attack and defense framework proposed in the application has strong generalization ability and cross-distribution robustness, and has important practical value in processing combined optimization problems in real complex environments.

[0160] The principles and implementation manners of the application are described by applying specific embodiments in the application, and the above embodiment descriptions are only used to help understand the method of the application and its core idea; meanwhile, for those skilled in the art, according to the idea of the application, the specific implementation manners and application ranges will be changed, and the above descriptions should not be understood as limitations on the application.

[0161] Those skilled in the art will realize that the embodiments described herein are for the purpose of helping the reader to understand the principles of the application, and should be understood as not limiting the protection scope of the application to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations according to the technical inspirations disclosed in the application without departing from the essence of the application, and these modifications and combinations are still within the protection scope of the application.

Claims

1. A combined optimization solution system based on a general attack and defense framework, characterized in that, include: The multi-task modeling module is used to model the combined optimization problem of different tasks as a graph structure representation, and construct it as a graph structure Markov decision process according to the task type; the task types include the asymmetric traveling salesman problem (ASTP), the vehicle routing problem with capacity constraints (CVRP), and the directed acyclic graph scheduling problem (DAG). The attack model is used to extract general graph feature representations from graph structures through a shared graph encoder, and generate perturbations that satisfy the constraints of the corresponding tasks through dedicated decoders and masking processes for different tasks. The attack model is based on a reinforcement learning architecture and includes: The Actor network includes a shared encoder and a dedicated decoder. The shared encoder is used to extract general graph feature representations for optimization problems with different task combinations. The dedicated decoder is used to map the output of the shared encoder to the action space of the corresponding task and dynamically generate task legality masks corresponding to different task action spaces through masking, and then output the action probability distribution after masking. The Critic network is used to learn the state-value function for different tasks based on the action probability distribution output by the Actor network, and then feed it back to the Actor network. The defense model takes graph structure and node / edge features as input, and generates a decoding sequence that adapts to task perturbations and satisfies task constraints through a selected target defense solver, thereby achieving combinatorial optimization solution.

2. The combined optimization solution system based on a general attack and defense framework according to claim 1, characterized in that, In the constructed Markov decision process: Each state in the state space includes the current graph structure, the node feature matrix, and the global matrix; Each action in the action space is a perturbation operation on the node-to-graph structure; the perturbation operation is determined according to the task type. The reward function represents the degree of performance degradation of the target defense solver after adding perturbations.

3. The combined optimization solution system based on a general attack and defense framework according to claim 2, characterized in that, When the task is the Asymmetric Traveling Salesman Problem (ASTP), the learned state value function is the value function for estimating the path length of the ASTP; when the task is the Vehicle Routing Problem (CVRP) with capacity constraints, the learned state value function is the value function for estimating the total travel distance of the vehicle routing problem; when the task is the Directed Acyclic Graph (DAG) scheduling problem, the learned state value function is the value function for estimating the completion time of the scheduling problem.

4. The combined optimization solution system based on a general attack and defense framework according to claim 1, characterized in that, The target defense solver is an end-to-end combinatorial optimization solver based on graph neural networks, MatNet.

5. A combinatorial optimization solution method, implemented based on the combinatorial optimization solution system according to any one of claims 1 to 3, characterized in that, Includes the following steps: S100. The combinatorial optimization problem of the task to be solved is modeled as a Markov decision process with a graph structure. S200. In the attack model, a general graph feature representation of different task combination optimization problems is extracted by a shared graph encoder. The general graph feature representation is mapped to the corresponding action space by a dedicated decoder for the task to be solved. The task legality mask of the action space is dynamically generated by mask processing. S300. In the defense model, the node / edge features of the graph structure are used as input. The selected target defense solver gradually generates a decoding sequence that adapts to task perturbations and satisfies task constraints, thereby achieving combinatorial optimization solution.

6. The combinatorial optimization solution method according to claim 5, characterized in that, In step S200, the general graph feature representation of optimization problems with different task combinations is extracted, including: S201. Extract features of the graph structure through a forward graph convolutional network, and extract features of the transposed graph structure through a backward graph convolutional network. S202. The extracted features are spliced ​​together through a splicing layer; S203. The attention mechanism is used to calculate and extract the general feature representation of the spliced ​​features through the global attention pooling layer.

7. The combinatorial optimization solution method according to claim 5, characterized in that, In step S200, mapping the general graph feature representation to the corresponding action space includes: S204. For any pair of nodes in the graph structure, concatenate the embedding vectors of the two nodes and the general graph feature representation. Among them, node pairs represent perturbation operations on the graph structure; S205. Based on the task type, the spliced ​​features are used to generate the original score of the node pair through a multilayer perceptron; S206. The original scores of all node pairs are converted into corresponding probability distributions by using the Softmax activation function to obtain the corresponding action space. Specifically, when the task is the Asymmetric Traveling Salesman Problem (ASTP), an attention mechanism with query-key dot product is used to calculate the original scores of connectivity and path cost for edge replacement / perturbation. When the task is the Vehicle Routing Problem (CVRP) with capacity constraints, an attention mechanism is used to further calculate the node embedding vectors in the vehicle path, and then the demand node embedding vector is added to the coordinate node embedding vector to obtain the original score considering customer demand and vehicle remaining capacity. When the task is the Directed Acyclic Graph (DAG) scheduling problem, context information is enhanced by splicing, the embedding vectors of selected nodes are paired with the embedding vectors of other nodes, and the original score considering whether or not topological constraints are generated is obtained by using dynamic masking.

8. The combinatorial optimization solution method according to claim 5, characterized in that, In step S200, the formula for generating the task validity mask of the action space is: In the formula, This indicates the new policy after weighted normalization in state. Select action The probability, Indicates the old strategy in state Select action The probability, This indicates the old strategy in the action state. Select action The probability, Indicates the action currently being evaluated. Indicates the current state. Indicates the legality of an action, when For illegal actions, when This was a legal action at the time.

9. The combinatorial optimization solution method according to claim 5, characterized in that, In step S200, the training loss function of the attack model for: In the formula, Indicates the strategy loss. Represents the loss of the value function. Let represent the expectation for step t. Represents the entropy function. Indicates the state at step t The following strategy Represents the Actor network parameters. Indicates the parameters of the Critic network. Represents the state at step t. , Represents the policy distribution. and These represent the first and second weight hyperparameters, respectively. This represents the function that takes the minimum value. This represents the ratio of the probability of the new strategy to the probability of the old strategy. This represents the estimation of the advantage function. This represents the clipping function. Indicates the clipping parameters. Represents the numerical stability constant. Indicates the parameters in the Actor network The current strategy is as follows: Indicates the old strategy, This represents the action at step t. This represents the state at step t. This represents the output of the Critic network for the corresponding task. This represents the batch-normalized reward. Indicates a reward. and These represent the mean and standard deviation of the current batch of rewards, respectively.

10. The combinatorial optimization solution method according to claim 5, characterized in that, In step S300, the target defense solver is trained using an iterative adversarial retraining method, including: The original dataset is perturbed using a trained attack model to generate the first adversarial example; the perturbation satisfies the legality constraints of different tasks. The original dataset is mixed with the first adversarial example to obtain a hybrid dataset; The target defense solver is iteratively trained using a mixed dataset to obtain the defense model; In each iteration of training, the defense model obtained from the previous training is used as the attack target. New adversarial examples are generated using the attack model, and a new hybrid dataset is constructed with the stable test benchmark dataset to train the defense model in the current iteration round.

Images