{'fraction_non_alphanumeric': 0.0377870887647424, 'fraction_numerical': 0.0056253879577901926, 'mean_word_length': 4.366854049552363, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 9, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Resilient and Distributed Discrete Optimal Transport with Deceptive Adversary: A Game-Theoretic Approach

Optimal transport (OT) is a framework that can be used to guide the optimal allocation of a limited amount of resources. The classical OT paradigm does not consider malicious attacks in its formulation and thus the designed transport plan lacks resiliency to an adversary. To address this concern, we establish an OT framework that explicitly accounts for the adversarial and stealthy manipulation of participating nodes in the network during the transport strategy design. Specifically, we propose a game-theoretic approach to capture the strategic interactions between the transport planner and the deceptive attacker. We analyze the properties of the established two-person zero-sum game thoroughly. We further develop a fully distributed algorithm to compute the optimal resilient transport strategies, and show the convergence of the algorithm to a saddle-point equilibrium. Finally, we demonstrate the effectiveness of the designed algorithm using case studies.


I. INTRODUCTION
Optimal transport (OT) is a centralized framework that can be leveraged to design efficient resource distribution and matching schemes [1], [2]. The OT framework captures heterogeneous constraints between the resource suppliers and receivers and it has been used in various applications, such as the distribution of raw materials to manufacturers, dispatching of power restoration facilities in disaster affected neighborhoods, and matching between employees and tasks in an organization.
Under the standard OT paradigm, the planner designs the resource allocation scheme that maximizes the aggregated utility of all participants [3], [4]. The classical framework does not consider that the resource suppliers and receivers could be compromised by an attacker whose goal is to disrupt the resource allocation efficiency. To this end, our goal is to develop a more robust transport strategy by using a gametheoretic framework [5] that captures the interactions between the transport planner and the adversary. Specifically, the planner designs the transport plan that maximizes the social utility by anticipating the compromise of a set of participating nodes by the adversary. In comparison, the attacker's objective is to minimize the aggregated utility of all the nodes under the transport plan. The attacker is stealthy as it will not modify the node's preference information in an arbitrary manner but considers threshold and magnitude constraints during decisionmaking. The considered scenario is related to the resilient resource allocation under adversarial attacks in literature, including jamming attack [6], network topology attack [7], and data falsification attack [8].
The transport network that the resources are distributed over becomes more complex with a growing number of participants (e.g., resource suppliers and receivers), which can be observed from real-world applications. This large-scale feature of the OT problem gives rise to another concern on the centralized computation of the optimal transport scheme. The required computation for centralized planning grows exponentially with the number of participants in the framework. Thus, our goal is to develop a distributed algorithm for resilient resource transport such that the centralized planner is not necessary. We leverage alternating direction method of multipliers (ADMM) technique [9] to achieve the distributed transport strategy design. One feature of the designed ADMM-based distributed algorithm is that each participant only needs to solve its own problem and exchange the results with the corresponding connected agents, which enables parallel updates on the transport solution.
To be resilient to strategic attacks, we develop a best response type of algorithm that accounts for the adversarial compromise on the node's preference data. We focus our attention on the scenarios when a set of targets (i.e., resource receivers) are compromised. Thus, in the algorithm, each deceptive target determines its resource requests from the connected source nodes and its manipulations on the preference data. During the iterative update, each target in the network proposes either a truthful solution or an adversarial solution depending on whether the target node is attacked. Comparatively, the source nodes with the goal of maximizing their utility do not respond to the attacks directly but in an implicit manner when computing the transport strategy. This feature can be observed in the designed distributed resilient algorithm. Specifically, at each round of the updates, every pair of source and target nodes propose a resource allocation scheme that is closer to the average of their previous solutions. It indicates that, as the negotiation process proceeds, the sources inherently consider the adversarial impacts by the attacked nodes by this average term to reach a consensus.
The contributions of this paper are summarized as follows. 1) We establish an adversarial discrete optimal transport framework using a game-theoretic approach that captures the strategic interactions between the resource planner and the attacker. 2) We develop an ADMM-based distributed algorithm for computing the optimal transport strategies in the adversarial environment, where the obtained strategy is resilient to the deceptive attacks. 3) We show the convergence of the proposed distributed algorithm to a saddle-point equilibrium solution of the established game. We also corroborate the algorithm extensively and show that the algorithm is applicable to large-scale networks due to its distributed nature.
The rest of the paper is organized as follows. Section II formulates a general adversarial OT framework for resource matching. Section III presents a class of adversarial OT problem with linear utilities. Section IV develops a distributed algorithm to compute the resilient optimal transport strategy. Section V corroborates the results with case studies, and Section VI concludes the paper.

II. PROBLEM FORMULATION
In this section, we first present a framework of discrete optimal transport over a network and then formulate an optimal transport problem with adversaries.

A. Discrete Optimal Transport over Network
We denote by X := {1, ..., |X |} the set of destinations/targets that receive the resources, and Y := {1, ..., |Y |} the set of origins/sources that distribute resources to the targets in a network. Each source node y ∈ Y is connected to a number of target nodes denoted by X y , representing that y can choose to allocate its resources to a specific group of destinations X y . Similarly, each target node x ∈ X can receive resources from multiple source nodes, and this set of resource suppliers to target x is denoted by Y x . Note that X y , ∀y and Y x , ∀x are nonempty. Otherwise, the corresponding nodes are isolated in the network and do not participant in the resource matching. It can be seen that the resources are transported over a bipartite network, where one side of the network consists of all source nodes and the other includes all destination nodes. This bipartite network is not necessarily complete because of constrained matching policies between participants. An incomplete bipartite graph also models the infeasible transport of resources between certain pairs of source and destination nodes incurred by long transport distance. For convenience, we denote by E the set including all feasible transport paths in the network, i.e., E := {{x, y}|x ∈ X y , y ∈ Y }. Here, E also refers to the set of all edges in the established bipartite graph for resource transportation.
We next denote by π xy ∈ R + the amount of resources transported from the origin node y ∈ Y to the destination node x ∈ X , where R + is the set of nonnegative real numbers. Let Π := {π xy } x∈X y ,y∈Y be the designed transport plan. To this end, the centralized optimal transport problem can be formulated as follows: where t xy : R + → R and s xy : R + → R are utility functions for target node x and source node y, respectively. Furthermore, p x ≥ p x ≥ 0, ∀x ∈ X andq y ≥ q y ≥ 0, ∀y ∈ Y . The constraints p x ≤ ∑ y∈Y x π xy ≤p x and q y ≤ ∑ x∈X y π xy ≤q y capture the limitations on the amount of requested and transferred resources at the target x and source y, respectively.
We have the following assumption on the utility functions.
Assumption 1. The utility functions t xy and s xy are concave and monotonically increasing on π xy , ∀x ∈ X , ∀y ∈ Y .
Recall that a function f is concave on an interval if for any x and y in the interval and for any θ . A rich class of functions satisfy the conditions in Assumption 1. For example, the utility functions t xy and s xy can be linear on π xy , indicating a linear growth of benefits on the amount of transferred and consumed resources. These two functions can also admit a logarithmic form, capturing that the marginal utility decreases as the amount of transported resources increase.

B. Adversarial Optimal Transport
The attacker's goal is to minimize the aggregated transport utility by compromising the preference coefficients in the target's utility functions (which can happen at the information exchange stage). Specifically, the parameters in the utility function t xy are compromised, for x ∈ X a , y ∈ Y x , where X a denotes a subset of adversarial receiver nodes. Then, X o := X \X a is the set of uncompromised targets. We denote byt xy,ξ xy the modified utility under the attack, where ξ xy represents the magnitude of the adversarial modifications on the corresponding parameters. For example, when the utility function admits a linear form as t xy (π xy ) = δ xy π xy , where δ xy > 0 is a parameter, the compromised utility form under the deception attack becomest xy,ξ xy (π xy ) = (δ xy + ξ xy )π xy . As another example, when t xy takes a form of t xy (π xy ) = δ xy min(ζ x , π xy ), where ζ x denotes a threshold after which the benefit of consuming more resources for target x does not increase, the compromised utility form can be constructed ast xy,ξ xy (π xy ) = (δ xy + ξ xy,1 ) min{ζ x + ξ xy,2 , π xy }. As another example, when t xy takes a form of t xy (π xy ) = δ xy min(ζ xy , π xy ), where ζ xy denotes a threshold after which the benefit of consuming more resources for target x from source y does not increase, the compromised utility form can be constructed as t xy,ξ xy (π xy ) = (δ xy + ξ xy,1 ) min{ζ xy + ξ xy,2 , π xy }. In this scenario, the attacker's action includes both ξ xy,1 and ξ xy,2 , ∀x ∈ X a , y ∈ Y x . For a general scenario, we denote by Ξ := {ξ xy } x∈X a ,y∈Y x the attacker's deceptive strategy. Then, the adversarial optimal transport can be formulated as follows.
where ξ x := [ξ x1 , ξ x2 , ..., ξ x|Y x | ], for x ∈ X a ; and A x is the attacker's feasible action set on the target node x ∈ X a .and l : R → R + is a function capturing the cost of the attack.
Remark: The solution to the adversarial OT problem is related to the robust OT design. Robust OT also admits a minimax formulation but its goal is to find an optimal solution in the presence of structural and known uncertainties. Comparatively, in the adversarial OT, such uncertainty is replaced by strategic attacks, and the designed transport plan should be resistant to adversarial manipulations.

III. ADVERSARIAL OPTIMAL TRANSPORT UNDER LINEAR UTILITIES
In this section, we consider utility functions admitting a linear form for both the sender and receiver. Specifically, t xy (π xy ) = δ xy π xy and s xy (π xy ) = γ xy π xy , where δ xy , γ xy ∈ R + . To design the optimal transport plan, the transport planner needs to know the utility parameters including δ xy , γ xy , ∀x ∈ X , y ∈ Y x . Thus, the source nodes and target nodes need to report their parameters, and one way to achieve this is through communications. The wireless channel enabling the communication is vulnerable to cyber attacks. The attacker can disrupt the communication by various techniques, such as jamming and distributed denial of service attacks. Therefore, it is imperative for the central planner to develop resilient transport strategies under the adversarial environment. In the considered scenario, we assume that the attacker is capable to compromise a subset of receiver nodes in the network, denoted by X a . One interpretation is the nodes in X a do not have a secure communication protocol with the central planner. In comparison, the nodes in the set X o = X \ X a are able to set up high-confidence communication channels and hence are secure from adversarial attacks.
The attacker compromises the sensitive data δ xy , x ∈ X a , y ∈ Y x , reported by the vulnerable target nodes and stealthily modify them to new values aiming to decrease the social utility of resource transportation. The adversarial disruption can be regarded as a data poisoning attack, under which the data point δ xy is changed toδ xy := δ xy +ξ xy . for x ∈ X a , y ∈ Y x . Here, ξ xy denotes the action of the attacker, representing the magnitude of data modification to the particular data point δ xy . For convenience, we follow the notations in (2), where Ξ denotes the attacker's malicious manipulations on the data points and ξ x is the attackers action on the target node x ∈ X a .
To this end, the adversarial OT can be formulated in the following max-min format: where c a ∈ R + is a non-negative cost coefficient and A x is the feasible action set of the attacker on target node x, x ∈ X a . U is the objective value under strategies Π and Ξ. The term c a ∑ x∈X a ξ x 1 captures the cost of the attack. The sparsity induced by the l 1 norm is a convex approximation of the l 0 norm [9, Chapter 6] and indicates that the attacker has constraints on the number of compromise of utility parameters at a particular node x ∈ X a . The attacker is a minimizer of (3) as its goal is to minimize the aggregated transport utility reflected by the first three terms in the objective function U while using the least costly attack scheme captured by the last term in U.
If the attacker modifies all the data parameters significantly, it is easy for the planner to detect such adversarial perturbations. Also, the dataδ xy after compromise should still be non-negative. Otherwise, the deception can be identified straightforwardly. Thus, the action set A x needs to be carefully modeled to capture the attacker's deceptive behavior. One form of A x can be chosen as follows: where κ x ∈ R + denotes the upper limit of the standard norm of adversarial modifications at the target node x ∈ X a by the attacker; δ x := [δ x1 ; δ x2 ; ...; δ x|Y x | ]; and 0 is a zero vector with appropriate dimension. Problem (3) can be seen as a two-person zero-sum game denoted by G, where the transport planner is a maximizer and the attacker is a minimizer. The solution to the game G is characterized by Nash equilibrium which predicts the outcome of the optimal transport strategy under adversarial environment. The formal definition of the Nash equilibrium strategy [5] is presented as follows.
Definition 1 (Nash Equilibrium). The strategy pair {Π * , Ξ * } is a saddle-point Nash equilibrium of game G if where U is the objective function in (3).
Solving game G requires to address the formulated maxmin problem (3). Specifically, both the central planner and the attacker need to compute their solutions holistically. This centralized computation paradigm does not scale well as the number of nodes in the transport network becomes enormous. Furthermore, to compute the solution Π, the central planner is required to have a complete information on the transport network, including the sensitive parameters of all participants' preferences. Thus, it is imperative to design a computationally efficient mechanism to solve game G. Our subsequent goal is to develop a distributed algorithm to compute the equilibrium transport strategy which also preserves the privacy of the participants to some extent.

IV. ANALYSIS AND DISTRIBUTED ALGORITHM
In this section, we aim to design a holistic and fully distributed algorithm to compute the optimal strategies of the attacker and the participants in the transport network.

A. Equivalence between Max-Min and Minimax Problems
Before designing the algorithm, we prove that the formulated max-min problem (3) is equivalent to its minimax counterpart and hence show the existence of Nash equilibrium to game G. Specifically, we have the following results.
Proposition 1. The max-min problem (3) yields the same solution as its minimax counterpart, i.e., min Ξ max Π U(Π, Ξ) subject to the same set of the constraints as in (3). Thus, there exists saddle point Nash equilibrium to game G. However, such equilibrium is not necessarily unique.
Proof. The equivalence between max-min and minimax problems directly follows from the von Neumann's minimax theorem [10]. As the objective function U is not strictly concave in Π and not strictly convex in Ξ, the Nash equilibrium is not necessarily unique [5,Chapter 4].
Note that Proposition 1 facilitates a convenient design of efficient mechanisms called best-response dynamics in finding the equilibrium strategies. We will describe this approach in detail in the ensuing sections.

B. Distributed Updates on the Deception Strategy
The attacker deceives the transport planner by compromising δ xy , x ∈ X a , y ∈ Y x , strategically. As the attacker's goal is to minimize U, a smallerδ xy (hence a smaller δ xy ) will decrease the utility at the corresponding target node as indicated by the term ∑ x∈X a ∑ y∈Y x (δ xy + ξ xy )π xy . However, simply modifying the values of all δ xy , ∀x ∈ X a , y ∈ Y x , to their minimum does not guarantee to minimize U. One reason is that the transport strategy will be changed under the attack. Though the value of term ∑ x∈X a ∑ y∈Y x (δ xy + ξ xy )π xy decreases, other terms such as ∑ x∈X o ∑ y∈Y x δ xy π xy and ∑ y∈Y ∑ x∈X y γ xy π xy may increase under the attack. Thus, the attacker's deceptive strategy is nontrivial to devise.
In the following, we describe how to leverage best-response dynamics to compute the strategy. Specifically, the attacker updates its decision Ξ by fixing the transport planner's strategy Π = {π xy } x∈X y ,y∈Y . In this regard, the first two terms in the objective function U(Π, Ξ) and the first three constraints in (3) can be safely ignored as they are irrelevant with the attacker's deceptive strategy design. Thus, the attacker solves the following optimization program: The attacker can design the optimal deceptive strategy Ξ * in a distributed fashion. First, we observe that the cost function in (6) is decoupled across vulnerable target nodes. Then, the optimal ξ * x , ∀x ∈ X a , can be obtained separately. Solving (6) is thus equivalent to addressing |X a | sub-problems as follows, for x ∈ X a , min We can further rewrite (7) in the following form, for x ∈ X a : where 1 is a vector of appropriate dimension with all ones; T denotes the transpose operator; and χ x is an auxiliary |Y x |dimensional decision variable. Note that the objective function in (8) is linear and the constraints are convex, and thus (8) can be solved efficiently.
Equivalence between problems (7) and (8): First, we can rewrite c a ξ x 1 as ∑ |ξ x | i=1 abs(c a ξ x,i ), where ξ x,i is the i-th element of ξ x and abs(·) denotes an operator of taking the absolute value. Thus, the objective function of (7) can be recast as ∑ y∈Y x ξ xy π xy + ∑ |ξ x | i=1 abs(c a ξ x,i ). We then introduce an auxiliary variable χ x with a same dimension as ξ x that satisfies the condition abs(c a ξ x,i ) ≤ χ x,i , ∀i. Then the optimization problem can be reformulated as In addition, abs(c a ξ x,i ) ≤ χ x,i can be written as −χ x,i ≤ c a ξ x,i ≤ χ x,i , ∀i.
Putting it in a vector form yields −χ x ≤ c a ξ x ≤ χ x . Thus, we obtain the formulation of (8).

C. Distributed Updates on the Transport Strategy
Under the best-response mechanism, similarly, the transport planner determines the transport strategy by regarding the deceptive strategy Ξ = {ξ xy } x∈X a ,y∈Y x as fixed. Thus, the planner can omit the last term in the objective function U(Π, Ξ) and the last constraint in (3) when making the decision. The planner's problem can be formulated as follows.
Solving (9) in a centralized manner requires the transport planner to know all parameters including δ xy and γ xy , ∀{x, y} ∈ E . Our next goal is to design a distributed method to compute the optimal Π in (9).
First, we introduce auxiliary variables π t xy and π s xy denoting the amount of resources requested by target x from source y and source y offering to target x, respectively. These two transport plans should be equal to each other to reach a consensus. Thus, we have constraints π t xy = π xy and π xy = π s xy , ∀{x, y} ∈ E . Then, (9) can be reformulated as follows.
(11) Here, α t xy and α s xy are Lagrangian multipliers associated with the constraints, and η is a positive constant. Theorem 1. We obtain the following steps using the ADMM algorithm to (10): where we use (12) for x ∈ X o and (13) for x ∈ X a .
Theorem 2. The algorithm described in Proposition 2 converges to an optimal solution.
In the above proposed distributed algorithm, each node computes its transport strategy based on the local information, i.e., information of connected nodes rather than all the nodes. The nodes update their strategies iteratively by communicating with connected neighbors. This is different from the centralized computation where the central planner needs to know all nodes' information to design the transport plan and then broadcasts the decision to the nodes.

V. CASE STUDIES
In this section we corroborate our algorithm for distributed OT while considering adversarial opponents. We consider the first case with five target nodes and two source nodes with a network structure connecting every source node to every target node as shown in Fig. 1. The upper bounds for the source nodes arep 1 = 2,p 2 = 3,p 3 = 4,p 4 = 3,p 5 = 2, q 1 = 5, andq 2 = 5.5. The lower bound for all nodes are set to 0. Additionally, we consider linear utility functions t xy (π xy ) = δ xy π xy , and s xy (π xy ) = γ xy π xy , ∀{x, y} ∈ E . The corresponding parameters in the linear functions are selected as follows: Furthermore, adversary's parameters are c a = 0.5 and κ x = 15, ∀x ∈ X a , and the deceptive targets include nodes 2 and 5. We next design the resilient transport strategy using the proposed distributed Algorithm 1. First, we show that the algorithm works and converges to the same value obtained by the centralized method. We also compare the transport strategies when the network with and without adversaries. When there is an adversary, we use a combination of (24) (for benign targets) and (25) (for deceptive targets) to calculate Π t x (k + 1). When there is no adversary, meaning none of the nodes are compromised, we only use (25) to compute Π t x . The results are shown Fig. 2. Specifically, Fig.  2(a) shows the social utility which is the aggregated payoff all nodes. Fig. 2(a) corroborates that the algorithm converges to the centralized solution in both scenarios with and without attacks. We also note that when we consider an attack the algorithm converges to a lower social utility. This is due to the fact that we have to account for the adversarial impacts which decreases the desired utility between the source node and the compromised target node. 2(b) highlights the distance residual of the transport strategy, which measures the difference between the strategy at each step and the equilibrium solution. The attacker's strategy ξ x is shown in Fig. 3(a). For both compromised nodes, the deceptive strategies ξ 2 and ξ 5 converge to a nonzero values, indicating that the attacker is actively affecting the transport plan. Fig. 3(b) further illustrates this phenomenon as the resource allocation strategies are different in the two investigated cases. We further investigate a larger scale network with 3 source nodes and 30 target nodes and every target is connected to every source node. The parameters are generated randomly following uniform distributions: δ xy ∼ U(6, 11), γ xy ∼ U(7, 12), p x ∼ U(5, 10), andq y ∼ U(67, 75). Nodes 8, 15, and 25 are considered to be possibly compromised with c a = 0.5 and κ x = 40. The obtained results are shown in Fig. 4. The results also converge to the centralized solutions. We can conclude that the designed algorithm is applicable to large-scale networks.

VI. CONCLUSION
In this paper, we have investigated an adversarial discrete optimal transport framework for resource matching in which the participating nodes could be malicious by reporting untruthful preference parameters. We have developed a distributed algorithm for computing the strategic resource allocation strategies which are resilient to such attacks. The designed algorithm converges to a same solution as one designed by a centralized planner, and it is applicable to large scale networks susceptible to deceptive attacks. The adversarial behavior is specifically acknowledged in the algorithm when a participating node is compromised. Each connected pair of target and source nodes negotiate on the their proposed transport plans, and thus the compromised node's actions is taken into account in the final allocation schemes. The algorithm terminates when the sources and targets reach a consensus. Future work includes to consider the differential privacy of the nodes in the network when designing the algorithm. Another direction is to develop a formal metric to quantify the stealthiness of the attacker and integrate it with the established adversarial optimal transport framework.