Determiningr- And(R, S)-Robustness of Digraphs Using Mixed Integer Linear Programming

Determining r- and (r, s)-Robustness of Digraphs Using Mixed Integer Linear Programming ?

James Usevitch a, Dimitra Panagou a,

aDepartment of Aerospace Engineering, University of Michigan

Abstract

There has been an increase in the use of resilient control algorithms based on the graph theoretic properties of r- and (r, s)- robustness. These algorithms guarantee consensus of normally behaving agents in the presence of a bounded number of arbitrarily misbehaving agents if the values of the integers r and s are suﬃciently large. However, determining an arbitrary graph’s robustness is a highly nontrivial problem. This paper introduces a novel method for determining the r- and (r, s)- robustness of digraphs using mixed integer linear programming; to the best of the authors’ knowledge it is the ﬁrst time that mixed integer programming methods have been applied to the robustness determination problem. The approach only requires knowledge of the graph Laplacian matrix, and can be formulated with binary integer variables. Mixed integer programming algorithms such as branch-and-bound are used to iteratively tighten the lower and upper bounds on r and s. Simulations are presented which compare the performance of this approach to prior robustness determination algorithms.

Key words: Networks, Robustness, Graph Theory, Optimization problems, Integer programming

1 Introduction results that draw upon these papers include state estimation [18–21], rendezvous of mobile agents [22, 23], Consensus on shared information is fundamental to the output synchronization [11], simultaneous arrival of in- operation of multi-agent systems. In context of mo- terceptors [17], distributed optimization [29,31], reliable bile agents, it enables formation control, rendezvous, broadcast [33, 44], clock synchronization [8], random- distributed estimation, and many more objectives. Al- ized quantized consensus [5], self-triggered coordination though a vast number of algorithms for consensus exist, [26], and multi-hop communication [30]. many are unable to tolerate the presence of misbehaving agents subject to attacks or faults. Recent years have A large number of results on network resilience are seen an increase of attention on resilient algorithms based upon the graph theoretical properties known as that are able to operate despite such misbehavior. Many r-robustness and (r, s)-robustness [15, 44]. r-robustness of these algorithms have been inspired by [9], which is and (r, s)-robustness are key notions included in the one of the seminal papers on consensus in the presence sufficient conditions for convergence of several resilient of adversaries; [14, 15, 44], which outline discrete- and consensus algorithms including the ARC-P [14], W- continuous-time algorithms along with necessary and MSR [15], SW-MSR [25], and DP-MSR [4] algorithms. sufficient conditions for scalar consensus in the pres- Given an upper bound on the global or local number of ence of Byzantine adversaries; and [32,34,39,40], which adversaries in the network, the aforementioned resilient outline algorithms for multi-agent vector consensus algorithms guarantee convergence of normally behaving of asynchronous systems in the presence of Byzantine agents’ states to a value within the convex hull of initial adversaries. Some of the most recent resilience-based states if the integers r and s are sufficiently large. A key challenge in implementing these resilient algorithms is ? The authors would like to acknowledge the support of that determining the r- and (r, s)-robustness of arbi- the Automotive Research Center (ARC) in accordance trary digraphs is an NP-hard problem in general [13,43]. with Cooperative Agreement W56HZV-14-2-0001 U.S. Army The first algorithmic analysis of determining the val- TARDEC in Warren, MI, and the Award No W911NF-17- ues of r and s for arbitrary digraphs was given in [13]. 1-0526. The algorithms proposed in [13] employ an exhaustive Email addresses: [email protected] (James Usevitch), search to determine the maximum values of r and s for [email protected] (Dimitra Panagou). a given digraph, and have exponential complexity w.r.t.

Preprint submitted to Automatica 31 July 2019 the number of nodes in the network. In [43] it was shown method in the first contribution described above. that the decision problem of determining if an arbitrary graph is r-robust for a given integer r is coNP-complete The contributions of this paper provide several advan- in general. Subsequent work has focused on methods to tages. First, expressing the robustness determination circumvent this difficulty, including graph construction problem in MILP form allows for approximate lower methods which increase the graph size while preserving bounds on a given digraph’s r-robustness to be itera- given values of r and s [6, 15]; lower bounding r with tively tightened using algorithms such as branch-and- the isoperimetric constant and algebraic connectivity bound. Lower bounds on the maximum value of s for of undirected graphs [27]; and demonstrating the be- which a given digraph is (r, s) robust (for a given non- havior of r as a function of certain graph properties negative integer r) can also be iteratively tightened us- [7,24,28,35,43,45]. In particular, it has been shown that ing the approach in this paper. Prior algorithms are only the r-robustness of some specific classes of graphs can able to tighten the upper bound on the maximum robust- be exactly determined in polynomial time from certain ness for a given digraph or undirected graph. Second, graph parameters. Examples include k-circulant graphs this formulation enables commercially available solvers [35] and lattice-based formations [7,24]. Another recent such as Gurobi or MATLAB’s intlinprog to be used to approach has used machine learning to correlate char- find the maximum robustness of any digraph. Finally, acteristics of certain graphs to the values of r and s [41], experimental results using this new formulation suggest but these correlations are inherently stochastic in na- a reduction in computation time as compared to the cen- ture and do not provide explicit guarantees. Despite the tralized algorithm proposed in [13]. impressive results of prior literature, methods to either approximate or determine exactly the r- and (r, s)- Part of this paper was previously submitted as a confer- robustness of arbitrary digraphs remain relatively rare. ence paper [37]. The extensions to the conference version Methods to determine the exact r- or (r, s)-robustness of include the following: arbitrary undirected graphs are also uncommon. Find- ing more efficient or practical ways of determining the • The more general case of determining (r, s)- robustness of arbitrary graphs in general, and digraphs robustness is considered. in particular, remains an open problem. • Two optimization problems with reduced-dimension binary vector variables are given whose optimal In this paper, we introduce novel methods for determin- values provide a lower bound and an upper bound, ing the r- and (r, s)-robustness of digraphs and undi- respectively, on the maximum value of r for which rected graphs using mixed integer linear programming a graph is r-robust. (MILP). These methods only require knowledge of the graph Laplacian matrix and are zero-one MILPs, i.e. This paper is organized as follows: notation is presented with all integer variables being binary. To the best of our in Section 2, the problem formulation is given in Section knowledge, this is the first time the robustness determi- 3, determining the r-robustness of digraphs is treated nation problem has been formulated in this way. These in Section 4, determining the values of s for which a results connect the problem of graph robustness deter- digraph is (r, s)-robust for a given r is treated in Section mination to the extensive and well-established literature 5, methods to obtain upper and lower bounds on the on integer programming and linear programming. This maximum r for which a digraph is r-robust are presented paper makes the following specific contributions: in Section 6, a brief discussion about the advantages of the MILP formulations is given in Section 7, simulations (1) We present a method to determine the maximum demonstrating our algorithms are presented in Section integer for which a nonempty, nontrivial, simple di- 8, and a brief conclusion is given in 9. graph is r-robust using mixed integer linear programming. 2 Notation (2) We present a method which determines the (r, s)- robustness of a digraph using linear programming. The sets of real numbers and integers are denoted R and Here, the (r, s)-robustness of a digraph refers to the Z, respectively. The sets of nonnegative real numbers n maximal (r, s) integer pair according to a lexico- and integers are denoted R+ and Z+, respectively. R graphical order for which a given digraph is (r, s)- denotes an n-dimensional vector space over the field R, robust, as first described in [13]. Furthermore, we Zn represents the set of n dimensional vectors with in- show that our method can also determine the maxi- teger entries, and {0, 1}n represents a binary vector of mum integer F for which a digraph is (F +1,F +1)- dimension n. Scalars are denoted in normal text (e.g. robust, which is not considered in [13]. x ∈ R) while vectors are denoted in bold (e.g. x ∈ Rn). (3) We present two mixed integer linear programs The notation xi denotes the ith entry of vector x. The whose optimal values provide lower and upper inequality symbol denotes a componentwise inequal- bounds on the maximum r for which a nonempty, ity between vectors; i.e. for x, y ∈ Rn, x y implies nontrivial, simple digraph is r-robust. These two xi ≤ yi ∀i ∈ {1, . . . , n}. A vector of ones is denoted 1, formulations exhibit a lower complexity than the and a vector of zeros is denoted 0, where the length of

2 each vector will be implied by the context. The union, Definition 1 ([15]) Let r ∈ Z+ and D = (V, E) be a intersection, and set complement operations are denoted digraph. A nonempty subset S ⊂ V is r-reachable if ∃i ∈ by ∪, ∩, and \, respectively. The cardinality of a set S such that |Ni\S| ≥ r. S is denoted as |S|, and the empty set is denoted ∅. The infinity norm of a vector is denoted k·k∞. The no- n Definition 2 ([15]) Let r ∈ Z+. A nonempty, nontriv- tations C(n, k) = ( k ) = n!/(k!(n − k)!) are both used ial digraph D = (V, E) on n nodes (n ≥ 2) is r-robust in this paper to denote the binomial coefficient with if for every pair of nonempty, disjoint subsets of V, at n, k ∈ Z+. Given a set S, the power set of S is denoted least one of the subsets is r-reachable. By convention, P(S) = {A : A ⊆ S}. Given a function f : D → R, the the empty graph (n = 0) is 0-robust and the trivial graph image of a set A ⊂ D under f is denoted f(A). Simi- (n = 1) is 1-robust. larly, the preimage of B ⊂ R under f is denoted f −1(B). The logical OR operator, AND operator, and NOT operator are denoted by ∨, ∧, ¬, respectively. The lexico- The property of (r, s)-robustness is based upon the n notion of (r, s)-reachability. The definitions of (r, s)- graphic cone is defined as Klex = {0} ∪ {x ∈ R : x1 = reachability and (r, s)-robustness are as follows: ... = xk = 0, xk+1 > 0} for some 0 ≤ k < n. The lex- n icographic ordering on R is defined as x ≤lex y if and only if y − x ∈ Klex [3, Ch. 2]. A directed graph (di- Definition 3 ([15]) Let D = (V, E) be a nonempty, graph) is denoted as D = (V, E), where V = {1, . . . , n} nontrivial, simple digraph on n ≥ 2 nodes. Let r, s ∈ Z+, is the set of indexed vertices and E is the edge set. This 0 ≤ s ≤ n. Let S be a nonempty subset of V, and de- r paper will use the terms vertices, agents, and nodes in- fine the set XS = {j ∈ S : |Nj\S| ≥ r}. We say that S terchangeably. A directed edge is denoted (i, j), with is an (r, s)-reachable set if there exist s nodes in S, each i, j ∈ V, meaning that agent j can receive information of which has at least r in-neighbors outside of S. More from agent i. The set of in-neighbors for an agent j is de- r explicitly, S is (r, s)-reachable if |XS | ≥ s. noted Nj = {i ∈ V :(i, j) ∈ E}. The minimum in-degree in of a digraph D is denoted δ (D) = minj∈V |Nj|. Occa- sionally, G = (V, E) will be used to denote an undirected Definition 4 ([15]) Let r, s ∈ Z+, 0 ≤ s ≤ n. Let D = (V, E) be a nonempty, nontrivial, simple digraph on n ≥ 2 graph, i.e. a digraph in which (i, j) ∈ E ⇐⇒ (j, i) ∈ E. r The graph Laplacian L for a digraph (or undirected nodes. Define XS = {j ∈ S : |Nj\S| ≥ r}, S ⊂ V. The digraph D is (r, s)-robust if for every pair of nonempty, graph) is defined as follows, with Lj,i denoting the entry in the jth row and ith column: disjoint subsets S1,S2 ⊂ V, at least one of the following conditions holds:  |Ni| if i = j,  r r r r A) |X | = |S1| B) |X | = |S2| C) |X | + |X | ≥ s Li,j = −1 if j ∈ Ni, (1) S1 S2 S1 S2  0 if j∈ / Ni. The properties of r- and (r, s)-robustness are used to quantify the ability of several resilient consensus algo- 3 Problem Formulation rithms to guarantee convergence of normally behaving agents in the presence of Byzantine and malicious ad- The notions of r- and (r, s)-robustness are graph theo- versaries, collectively referred to in this paper as misbe- retical properties used to describe the communication having agents [4, 11, 14, 15, 25]. Larger values of r and topologies of multi-agent networks. Examples of such s generally imply the ability of networks applying these networks include stations in a power grid, satellites resilient algorithms to tolerate a greater number of mis- in formation, or a group of mobile robots. In these behaving agents in the network. For a more detailed ex- networks, edges model the ability for one agent i to planation of the properties of r-robustness and (r, s)- transmit information to another agent j. Prior litera- robustness, the reader is referred to [15, 16, 43]. ture commonly considers simple digraphs, which have no repeated edges or self edges [12, 15, 16, 38, 40]. More It should be clear from Definitions 2 and 4 that deter- specifically, simple digraphs satisfy (i, i) ∈/ E ∀i ∈ V, and mining r and (r, s)-robustness for a digraph D = (V, E) if the directed edge (i, j) ∈ E, then it is the only directed by using an exhaustive search method is a combinato- edge from i to j. Prior work also commonly considers rial problem, which involves checking the reachabilities nonempty and nontrivial graphs, where |V | > 1. of all nonempty, disjoint subsets of V. For notational purposes, we will denote the set of all possible pairs of Assumption 1 This paper considers nonempty, non- nonempty, disjoint subsets of V as T ⊂ P(V) × P(V). trivial, simple digraphs. More explicitly, T is defined as

The property of r-robustness is based upon the notion T = (S1,S2) ∈ P(V) × P(V): |S1| > 0, |S2| > 0, of r-reachability. The deﬁnitions of r-reachability and r- robustness are as follows: |S1 ∩ S2| = 0 . (2)

3 F -local in scope, 2 and the digraph is (2F + 1)-robust. The value of rmax(D) therefore determines the maximum adversary model under which these algorithms can operate successfully. Furthermore, all other values of r for which a digraph D is r-robust can be determined from rmax(D) by using Property 1.

Fig. 1. Depiction of all 12 possible (S1,S2) elements in T for a For (r, s)-robustness, there are two (r, s) pairs of inter- complete graph D of 3 agents. Each graph represents a different est. The authors of [13] order the elements of Θ using a possible way of dividing D into sets S1 and S2. In each individual lexicographical total order, where elements are ranked graph, yellow agents are in S1, blue agents are in S2, and white by r value first and s value second. More specifically, agents are in neither S nor S . 1 2 (r , s ) ≤ (r , s ) if and only if r2−r1 ∈ K , where 1 1 lex 2 2 s2−s1 lex Pn n p 1 K is the lexicographic cone defined in Section 2. Their It was shown in [13] that |T | = p=2( p )(2 − 2). As lex a simple example, Figure 1 depicts all elements of T for algorithm DetermineRobustness finds the maximum el- a graph of 3 agents, i.e. all possible ways to choose two ement of Θ with respect to this order. For notational ∗ ∗ nonempty, disjoint subsets from the graph. clarity, we denote this maximum element as (r , s ) ∈ Θ. Definition 6 Let Θ be defined as in (3). The element When considering a particular digraph D, there may be (r∗, s∗) is defined as the maximum element of Θ under multiple values of r for which D is r-robust. Similarly, the lexicographical order on 2. there may be multiple values of r and s for which D R is (r, s)-robust. The following property of robust graphs The other (r, s) pair of interest is (F + 1,F + demonstrates this characteristic: max max 1), where Fmax = max({F ∈ Z+ :(F + 1,F + 1) ∈ Θ}). Several resilient algorithms guarantee convergence Property 1 ([10], Prop. 5.13) Let D be an arbitrary, of the normally behaving agents when the (malicious simple digraph on n nodes. Suppose D is (r, s)-robust with [15]) adversary model is F -total in scope and the digraph 0 0 r ∈ N and s ∈ {0, . . . , n}. Then D is also (r , s )-robust is (F + 1,F + 1)-robust. The value F determines the 0 0 0 0 max ∀r : 0 ≤ r ≤ r and ∀s : 1 ≤ s ≤ s. maximum malicious adversary model under which these algorithms can operate successfully. The value of (Fmax+ ∗ ∗ As an example, if a digraph D1 is 4-robust, then by Prop- 1,Fmax + 1) does not always coincide with the (r , s )- erty 1 it is also simultaneously 3-robust, 2-robust, and robustness of the digraph. A simple counterexample is ∗ ∗ 1-robust. In addition, if a digraph D2 is (5, 4)-robust, given in Figure 2, where the (r , s )-robustness of the 0 0 then it is simultaneously (r , s )-robust for all integers graph is (2, 1) but the value of (Fmax + 1,Fmax + 1) is 0 ≤ r0 ≤ 5 and 0 ≤ s0 ≤ 4. For notational purposes, equal to (1, 1). we denote the set of all values for which a digraph D is (r, s)-robust as Θ, where Θ ⊂ Z+ × Z+. By Definition 4, The purpose of this paper is to present methods Θ is explicitly defined as using mixed integer linear programming to deter- ∗ ∗ mine rmax(D), the (r , s )-robustness of D, and the r (Fmax + 1,Fmax + 1)-robustness of D for any nonempty, Θ = {(r, s) ∈ Z+ × Z+ : ∀(S1,S2) ∈ T , (|XS | = |S1|) or 1 nontrivial, simple digraph D. (|X r | = |S |) or (|X r | + |X r | ≥ s)}. (3) S2 2 S1 S2 Problem 1 Given an arbitrary nonempty, nontrivial, To characterize the resilience of graphs however, prior simple digraph D, determine the value of rmax(D). literature has generally been concerned with only a few particular values of r and s for which a given digraph is Problem 2 Given an arbitrary nonempty, nontrivial, r- or (r, s)-robust. For r-robustness, the value of interest simple digraph D, determine the (r∗, s∗)-robustness of D. is the maximum integer r for which the given digraph is r-robust. Problem 3 Given an arbitrary nonempty, nontrivial, simple digraph D, determine the (Fmax + 1,Fmax + 1)- Definition 5 We denote the maximum integer r for robustness of D. which a given digraph D is r-robust as rmax(D) ∈ Z+. Finally, the values of r for which a digraph can be Several resilient algorithms guarantee convergence of the r-robust lie within the interval 0 ≤ r ≤ dn/2e [10, Prop- normal agents when the adversary model is F -total or erty 5.19]. In addition, r-robustness is equivalent to

2 An F -total adversary model implies that there are at most 1 Since (S1,S2) ∈ T =⇒ (S2,S1) ∈ T , the total number F ∈ Z+ misbehaving agents in the entire network. An F - of unique nonempty, disjoint subsets is (1/2)|T |, denoted as local adversary model implies that each normal agent has at R(n) in [13]. most F misbehaving agents in its in-neighbor set.

4 ∀(S1,S2) ∈ T . Therefore ∀(S1,S2) ∈ T , either R(S1) ≥ ∗ ∗ ∗ ∗ max R(S1 ), R(S2 ) or R(S2) ≥ max (R(S1 ), R(S2 )). This satisfies the definition of r-robustness as per Def- ∗ ∗ inition 2, therefore D is at least max (R(S1 ), R(S2 ))- ∗ ∗ robust. This implies rmax(D) ≥ max (R(S1 ), R(S2 )). ∗ ∗ We next show that rmax(D) = max (R(S1 ), R(S2 )). We Fig. 2. An example of the elements of Θ for a digraph D1. Since prove by contradiction. Recall from Definition 5 that |V| = 4, the possible values of r and s for which the digraph is rmax(D) is the maximum integer r for which D is r- (r, s)-robust fall within the range 0 ≤ r ≤ 2, 1 ≤ s ≤ 4. One robust, which means D is rmax(D)-robust by definition. possible pair of subsets S1 and S2 is depicted, which satisfies ∗ ∗ 2 2 2 2 Suppose rmax(D) > max (R(S1 ), R(S2 )). This implies |XS | 6= |S1|, |XS | 6= |S2|, |XS | = 0 and |XS | = 1. By Def- ∗ ∗ 1 2 1 2 R(S1 ) < rmax(D) and R(S2 ) < rmax(D). Since the inition 4, D1 therefore cannot be (2, 2)-robust, (2, 3)-robust, or ∗ ∗ ∗ nonempty, disjoint subsets (S1 ,S2 ) ∈ T satisfy R(S1 ) < (2, 4)-robust. ∗ rmax(D) and R(S2 ) < rmax(D), by the negation of Defi- (r, 1)-robustness [13, Property 5.21], [15, Section VII-B] nition 2 this implies that D is not rmax(D)-robust. How- which implies that the values of r for which a graph can ever, this contradicts the definition of rmax(D) being be (r, s)-robust fall within the same interval. The values the largest integer for which D is r-robust (Definition of s for which a digraph can be (r, s)-robust lie within 5). This provides the desired contradiction; therefore 3 ∗ ∗ the interval 1 ≤ s ≤ n. However, we will use an abuse rmax(D) = max (R(S1 ), R(S2 )). of notation by denoting a graph as (r, 0)-robust for a given r ∈ Z+ if the graph is not (r, 1)-robust. Remark 1 Using the definition of T in (2), the constraints on the RHS of (5) can be made implicit [3, sec- 4 Determining r-Robustness using Mixed Inte- tion 4.1.3] as follows: ger Linear Programming rmax(D) = min max (R(S1), R(S2)) . (6) (S1,S2)∈T In this section we will demonstrate a method for solving Problem 1 using a mixed integer linear program (MILP) We demonstrate next that the objective function of (5) formulation. An MILP will be presented whose optimal can be expressed as a function of the network Laplacian n value is equal to rmax(D) for any given nonempty, non- matrix. Recall that n = |V| and that {0, 1} represents a trivial, simple digraph D. First, an equivalent way of binary vector of dimension n. The indicator vector σ(·): n expressing the maximum robustness rmax(D) of a di- P(V) → {0, 1} is defined as follows: for all S ∈ P(V), graph D is derived. This equivalent expression will clar- ify how r (D) can be determined by means of an op- 1 if j ∈ S max σ (S) = , j = {1, . . . , n}. (7) timization problem. Given an arbitrary, simple digraph j 0 if j∈ / S D = (V, E) and a subset S ⊂ V , the reachability function R : P(V) → Z+ is defined as follows: It is straightforward to verify that σ : P(V) → {0, 1}n is a bijection. Therefore given x ∈ {0, 1}n, the set −1 −1 maxi∈S |Ni\S|, if S 6= {∅}, σ (x) ∈ P(V) is defined by σ (x) = {j ∈ V : R(S) = (4) 0, if S = {∅}. xj = 1}. Finally, observe that for any S ∈ P(V), |S| = 1T σ(S). The following Lemma demonstrates that In other words, the function R(S) returns the maximum for any S ∈ P(V), the function R(S) can be determined r for which S is r-reachable. Using this function, the as an affine function of the network Laplacian matrix following Lemma presents an optimization formulation and the indicator vector of S: which yields rmax(D): Lemma 2 Let D = (V, E) be an arbitrary nonempty, Lemma 1 Let D = (V, E) be an arbitrary nonempty, nontrivial, simple digraph, let L be the Laplacian matrix of D, and let S ∈ P(V). Then the following holds for all nontrivial, simple digraph with |V| = n. Let rmax(D) be defined as in Definition 5. The following holds: j ∈ {1, . . . , n}:

|N \S|, if j ∈ S, rmax(D) = min max (R(S1), R(S2)) L σ(S) = j (8) S1,S2∈P(V) j −|Nj ∩ S|, if j∈ / S, subject to |S1| > 0, |S2| > 0, |S1 ∩ S2| = 0. (5) where L is the jth row of L. Furthermore, PROOF. Note that max (R(S1), R(S2)) = m implies j ∗ ∗ R(S1) = m or R(S2) = m. Let (S1 ,S2 ) be a minimizer ∗ ∗ R(S) = max Ljσ(S), j ∈ {1, . . . , n}. (9) of (5). Then max (R(S1 ), R(S2 )) ≤ max (R(S1), R(S2)) j

3 Footnote 8 in [15] oﬀers an excellent explanation for re- PROOF. The term σ(S) is shortened to σ for brevity. stricting s to this range by convention. Recall that the entry in the jth row and ith column of

5 L is denoted Lj,i. The deﬁnition of L from (1) implies PROOF. By Lemma 2, R(S1) = maxi Liσ(S1) and R(S2) = maxj Ljσ(S2) for i, j ∈ {1, . . . , n}. X Ljσ = (Lj,j)σj + (Lj,q)σq q∈{1,...,n}\j From Lemma 1, Lemma 3, and Remark 1, we can imme- X X diately conclude that rmax(D) satisﬁes = |Nj|σj − σq − σq. (10)

q∈Nj ∩S q∈Nj \S rmax(D) = Since by (7), q ∈ S implies σq = 1, the term min max max (Liσ(S1)) , max (Ljσ(S2)) . (14) P (S1,S2)∈T i j q∈N ∩S σq = |Nj ∩ S|. In addition, since q∈ / S implies j P σq = 0, the term σq = 0. By this, equation q∈Nj \S Note that the terms σ(S1) and σ(S2) are each n- 1 (10) simplifies to Ljσ = |Nj|σj − |Nj ∩ S|. The value of dimensional binary vectors. Letting b = σ(S1) and 2 the term |Nj|σj depends on whether j ∈ S or j∈ / S. If b = σ(S2), the objective function of (14) can be writ- 1 2 j ∈ S, then σj = 1, implying Ljσ = |Nj| − |Nj ∩ S| = ten as max maxi Lib , maxj Ljb . Every pair (|N ∩ S| + |N \S|) − |N ∩ S| = |N \S|. If j∈ / S, then j j j j (S1,S2) ∈ T can be mapped into a pair of binary vec- σj = 0 implying Ljσ = −|Nj ∩ S|. This proves the tors (b1, b2) by the function Σ : T → {0, 1}n × {0, 1}n, result for equation (8). To prove (9), we first consider 1 2 where Σ(S1,S2) = (σ(S1), σ(S2)) = (b , b ). By deter- nonempty sets S ∈ P(V)\{∅}. By the results above and mining the image of T under Σ(·, ·), the optimal value (4), the maximum reachability of any S ∈ P(V)\{∅} is of (14) can be found by minimizing over pairs of binary vectors (b1, b2) ∈ Σ(T ) directly. Using binary vector R(S) = max |Nj\S| = max(Ljσ(S)). (11) j∈S j∈S variables instead of set variables (S1,S2) will allow (14) to be written directly in an MILP form. Towards this By its definition, R(S) ≥ 0. Observe that if j ∈ S then end, the following Lemma defines the set Σ(T ): Ljσ(S) = |Nj\S| ≥ 0, implying maxj∈S Ljσ(S) ≥ 0. Conversely, if an agent j is not in the set S, then the func- Lemma 4 Let D = (V, E) be an arbitrary nonempty, tion Ljσ(S) takes the nonpositive value −|Nj ∩ S|. This nontrivial, simple digraph, and let T be defined as in (2). Define the function Σ: T → {0, 1}n × {0, 1}n as implies maxj∈ /S Ljσ(S) ≤ 0. By these arguments, we therefore have maxj∈ /S Ljσ(S) ≤ 0 ≤ maxj∈S Ljσ(S), which implies Σ(S1,S2) = (σ(S1), σ(S2)), (S1,S2) ∈ T . (15)

Define the set B ⊂ {0, 1}n × {0, 1}n as max Ljσ(S) = max (max Ljσ(S)), (max Ljσ(S)) j∈{1,...,n} j∈S j∈ /S 1 2 n n T 1 = max Ljσ(S). (12) B = (b , b ) ∈ {0, 1} × {0, 1} : 1 ≤ 1 b ≤ (n − 1), j∈S Therefore by equations (12) and (11), the maximum 1 ≤ 1T b2 ≤ (n − 1), b1 + b2 1 . (16) reachability of S is found by the expression Then both of the following statements hold: R(S) = max(Ljσ(S)), j ∈ {1, . . . , n}. (13) j (1) The image of T under Σ is equal to B, i.e. Σ(T ) = B Lastly, if S = ∅, then by (4) we have R(S) = 0. In (2) The mapping Σ: T → B is a bijection. addition, σ(S) = 0, implying that maxj Ljσ(S) = 0 = PROOF. We prove 1) by showing first that Σ(T ) ⊆ B, R(S), j ∈ {1, . . . , n}. and then B ⊆ Σ(T ). Any (S1,S2) ∈ T satisfies |S1| > 0, |S2| > 0, |S1 ∩ S2| = 0 as per (2). Observe that |S1| > T T 0 =⇒ 1 σ(S1) ≥ 1, and |S2| > 0 =⇒ 1 σ(S2) ≥ 1. Using Lemma 2, it will next be shown that the objective Because S ,S ⊂ V and |S ∩ S | = 0, then |S | < n. function of (5) can be rewritten as the maximum over a 1 2 1 2 1 Otherwise if |S1| = n then either |S2| = 0 or |S1 ∩ S2|= 6 set of affine functions: 0, which both contradict the definition of T . Therefore |S1| < n, and by similar arguments |S2| < n. Observe Lemma 3 Consider an arbitrary, nonempty, nontrivial, T that |S1| < n =⇒ 1 σ(S1) ≤ n − 1, and |S2| < simple digraph D = (V, E). Let L be the Laplacian matrix T n =⇒ 1 σ(S2) ≤ n − 1. Finally, |S1 ∩ S2| = 0 implies of D, and let Li be the ith row of L. Let T be defined as that j ∈ S1 =⇒ j∈ / S2 and j ∈ S2 =⇒ j∈ / S1 in (2). Then for all (S1,S2) ∈ T the following holds: ∀j ∈ {1, . . . , n}. Therefore σj(S1) = 1 =⇒ σj(S2) = 0 and σj(S2) = 1 =⇒ σj(S1) = 0. This implies that max (R(S1), R(S2)) = |S ∩ S | = 0 =⇒ σ(S ) + σ(S ). Therefore for all 1 2 1 2 (S1,S2) ∈ T ,(σ(S1), σ(S2)) = Σ(S1,S2) satisfies the max max (Liσ(S1)) , max (Ljσ(S2)) i∈{1,...,n} j∈{1,...,n} constraints of the set on the RHS of (16). This implies

6 that Σ(T ) ⊆ B. Next, we show B ⊆ Σ(T ) by showing integer linear program: 1 2 that for all (b , b ) ∈ B, there exists an (S1,S2) ∈ T 1 2 1 2 such that (b , b ) = Σ(S1,S2). Choose any (b , b ) ∈ B rmax(D) = min t t,b and define sets (S1,S2) as follows: 2n subject to 0 ≤ t, t ∈ R, b ∈ Z " # " # 1 2 L 0 1 bj = 1 =⇒ j ∈ S1, bj = 1 =⇒ j ∈ S2, b t 1 2 0 L 1 bj = 0 =⇒ j∈ / S1, bj = 0 =⇒ j∈ / S2. (17) 0 b 1 h i In×n In×n b 1 for j ∈ {1, . . . , n}. For the considered sets (S1,S2), 1 ≤ T 1 T 2 h i 1 b implies |S1| > 0 and 1 ≤ 1 b implies |S2| > 0. In 1 ≤ 1T 0 b ≤ n − 1 addition since b1 + b2 1, we have b1 = 1 =⇒ b2 = 0 j j h i 2 1 T and bj = 1 =⇒ bj = 0. By our choice of S1 and 1 ≤ 0 1 b ≤ n − 1 (19) 1 S2, we have bj = 1 =⇒ j ∈ S1, and from previous 1 2 PROOF. From Lemmas 1 and 3 we have arguments bj = 1 =⇒ bj = 0 =⇒ j∈ / S2. Sim- 2 ilar reasoning can be used to show that bj = 1 =⇒ rmax(D) = j∈ / S1. These arguments imply that |S1 ∩ S2| = 0. Consequently, (S1,S2) satisfies all the constraints of T min max max (Liσ(S1)) , max (Ljσ(S2)) and is therefore an element of T . Clearly, by (17) we S1,S2∈P(V) i j 1 2 have Σ(S1,S2) = (b , b ), which shows that there ex- subject to |S1| > 0, |S2| > 0, |S1 ∩ S2| = 0, 1 2 ists an (S1,S2) ∈ T such that (b , b ) = Σ(S1,S2). Since this holds for all (b1, b2) ∈ B, this implies B ⊆ for i, j ∈ {1, . . . , n}. As per Remark 1, the definition of Σ(T ). Therefore Σ(T ) = B. We next prove 2). Since T can be used to make the constraints implicit: Σ(T ) = B, the function Σ : T → B is surjective. To show that it is injective, consider any Σ(S1,S2) ∈ B r (D) = (20) ¯ ¯ ¯ ¯ max and Σ(S1, S2) ∈ B such that Σ(S1,S2) = Σ(S1, S2). ¯ ¯ This implies (σ(S1), σ(S2)) = (σ(S1), σ(S2)). Note that min max max (Liσ(S1)) , max (Ljσ(S2)) , (S ,S )∈T i j (σ(S1), σ(S2)) = (σ(S¯1), σ(S¯2)) if and only if σ(S1) = 1 2 σ(S¯1) and σ(S2) = σ(S¯2). Since the indicator function σ : P(V) → {0, 1}n is itself injective, this implies for i, j ∈ {1, . . . , n}. Since Σ : T → B is a bijection by S1 = S¯1 and S2 = S¯2, which implies (S1,S2) = (S¯1, S¯2). Lemma 4, (20) is equivalent to Therefore Σ : T → B is injective. 1 2 rmax(D) = min max max Lib , max Ljb (b1,b2)∈B i j i, j ∈ {1, . . . , n}. (21)

The following mixed integer program solves Problem 1: Making the constraints of (21) explicit yields (18). Next, we prove that (19) is equivalent to (18). The variables b1 and b2 from (18) are combined into the variable b ∈ T Theorem 1 Let D be an arbitrary nonempty, nontrivial, Z2n in (19); i.e. b = [ (b1)T (b2)T ] . The first and third simple digraph and let L be the Laplacian matrix of D. constraints of (19) restrict b ∈ {0, 1}2n. Next, it can The maximum r-robustness of D, denoted rmax(D), is be demonstrated [3, Chapter 4] that the formulation obtained by solving the following minimization problem: minx maxi(xi) is equivalent to mint,x t subject to 0 ≤ t, x t1. Reformulating the objective of the RHS of (18) in this way yields the objective and first two constraints 1 2 of (19): rmax(D) = min max max Lib , max Ljb b1,b2 i j 1 2 min t subject to b + b 1 t,b 1 ≤ 1T b1 ≤ (n − 1) " # " # L 0 1 (22) 1 ≤ 1T b2 ≤ (n − 1) subject to 0 ≤ t, b t . 0 L 1 b1, b2 ∈ {0, 1}n. (18) The fourth, fifth, and sixth constraints of (19) restrict (b1, b2) ∈ B and are simply a reformulation of the first Furthermore, (18) is equivalent to the following mixed three constraints in (18).

7 5 Determining (r, s)-Robustness using Mixed Integer Linear Programming

In this section we address Problems 2 and 3, which in- ∗ ∗ volve determining the (r , s )-robustness and (Fmax + 1,Fmax +1)-robustness of a given digraph. To determine these values, we will use the following notation:

Definition 7 For a digraph D and a given r ∈ Z+, the maximum integer s for which D is (r, s)-robust is denoted Fig. 3. Illustration of how the (r∗, s∗)-robustness of a graph is as smax(r) ∈ Z+. If D is not (r, s)-robust for any 1 ≤ found by the DetermineRobustness algorithm and the MILP s ≤ n, we will denote smax(r) = 0. method. Consider a digraph D of n = 6 nodes which satisfies (r∗, s∗) = (2, 3). DetermineRobustness begins with the maxi- Using this notation, the (r∗, s∗)-robustness of a ∗ mum possible r and s values (r = dn/2e and s = n), then iterates nonempty, nontrivial simple digraph satisfies r = in a lexicographically decreasing manner. The MILP formulation ∗ rmax(D) and s = smax(rmax(D)). This can be ver- first determines rmax(D), thens ¯min(rmax(D)), then finally infers ified by recalling that r-robustness is equivalent to smax(rmax(D)) (abbreviated tos ¯min(r) and smax(r) for clarity). (r, 1)-robustness [13, Property 5.21], and that (r∗, s∗) is the maximum element of Θ according to the lexico- As a simple example, consider a digraph D of 7 nodes graphic ordering defined in Section 2. Since a method where smax(3) = 2. This implies that Θ3 = {1, 2}, i.e. for determining r (D) has already been presented, the digraph is (3, 1)- and (3, 2)-robust. In this case, the max ¯ this section will introduce a method for determining set Θ3 = {3, 4, 5,...} since D is not (3, 3)-robust, (3, 4)- smax(r) for any given r ∈ Z+. This can then be used to robust, etc. Here we haves ¯min(3) = 3. In general, observe find smax(rmax(D)) after rmax(D) is determined. Recall that by definitions 7 and 9 we have smax(r) =s ¯min(r)−1. that ∨ indicates logical OR. An equivalent definition of It is therefore sufficient to finds ¯min(r) in order to de- smax(r) can be given using the following notation: termine smax(r). An illustration is given in Figure 3. The methods in this section will solve fors ¯min(r) using Definition 8 Let Θ be the set of all (r, s) values for a mixed integer linear program. Note that since possi- which a given digraph D is (r, s)-robust, as per (3). Let ble values of smax(r) are limited to 0 ≤ smax(r) ≤ n r (Definition 7), possible values ofs ¯min(r) are limited to r ∈ Z+, and let XS be defined as in Definition 4. The set Θr ⊂ Θ is defined as follows: 1 ≤ s¯min(r) ≤ n + 1. We point that it is easier to test if an integers ¯ ∈ Θ¯ r than to test if an integer s ∈ Θr, in the r sense that only one element (S ,S ) ∈ T is required to Θr = {s ∈ + : ∀(S1,S2) ∈ T , |X | = |S1| ∨ 1 2 Z S1 ¯ r r r verify thats ¯ ∈ Θr (as per (24)) whereas all (S1,S2) ∈ T |X | = |S2| ∨ |X | + |X | ≥ s }, (23) S2 S1 S2 must be checked to verify that s ∈ Θr (as per (23)).

The following Lemma is needed for our main result. It In words, Θr is the set of all integers s for which the shows that given any r ∈ Z+ and S ⊂ V, the indi- given digraph D is (r, s)-robust for a given r ∈ Z+. By r r cator vector of the set XS , denoted σ(XS ), can be ex- this definition, smax(r) = max Θr, i.e. smax(r) is sim- r pressed using an MILP. Recall that XS is the set of agents ply the maximum element of Θr. As per (23), checking in S which have r in-neighbors outside of S, implying directly if an integer s ∈ Θr involves testing a logical r σj(XS ) = 1 if Ljσ(S) = |Nj\S| ≥ r. disjunction for all possible (S1,S2) ∈ T . This quickly becomes impractical for large n since |T | grows expo- nentially with n. This difficulty can be circumvented, Lemma 5 Let D = (V, E) be an arbitrary nonempty, however, by defining the set nontrivial, simple digraph. Let L be the Laplacian matrix of D, and let r ∈ N. Consider any subset S ⊂ V, |S| > 0 and let X r be defined as in Definition 4. Then the Θ¯ = \Θ = {s¯ ∈ :s ¯ ∈ / Θ } S r Z+ r Z+ r following holds: r = {s¯ ∈ Z+ : ∃(S1,S2) ∈ T s.t. | XS | < |S1| ∧ 1 σ(X r) = arg min 1T y |X r | < |S | ∧ |X r | + |X r | < s¯}, (24) S S2 1 S1 S2 y subject to Lσ(S) − (n)y ≤ (r − 1)1 ¯ where ∧ denotes logical AND. The set Θr contains all y ∈ {0, 1}n. (25) integerss ¯ for which the given digraph is not (r, s¯)-robust for the given value of r. PROOF. Recall that the entries of the indicator vec- r r r Definition 9 For a digraph D and a given r ∈ +, the tor σ(XS ) are defined as σj(XS ) = 1 if j ∈ XS and Z r ∗ minimum integer s¯ for which D is not (r, s¯)-robust is σj(XS ) = 0 otherwise. Let y be an optimal point of the ∗ r denoted as s¯min(r) ∈ Z+. RHS of (25). To prove that y = σ(XS ), we demonstrate

8 r ∗ that ∀j ∈ {1, . . . , n}, σj(XS ) = 1 ⇐⇒ yj = 1. Ob- PROOF. Note that the theorem statement assumes r r is a fixed integer. First, consider the case wheres ¯ (r) < serve that this is equivalent to demonstrating σj(XS ) 6= min ∗ 1 ⇐⇒ yj 6= 1 ∀j, which is equivalent to demon- (n + 1). The value ofs ¯min can be found by solving the r ∗ problems ¯min(r) = min ¯ s¯. Making the constraints strating σj(XS ) = 0 ⇐⇒ yj = 0 ∀j. This can be s¯∈Θr r n r explicit yields seen by noting σ(XS ) ∈ {0, 1} which implies σj(XS ) 6= r ∗ n 1 ⇐⇒ σj(XS ) = 0, and y ∈ {0, 1} which implies ∗ ∗ r s¯min(r, D) = min s¯ yj 6= 1 ⇐⇒ yj = 0. Since proving σj(XS ) = 1 ⇐⇒ s,¯ (S1,S2)∈T ∗ r yj = 1 for all j ∈ {1, . . . , n} is equivalent to proving subject to |XS | ≤ |S1| − 1 r ∗ 1 σj(X ) = 0 ⇐⇒ y = 0 for all j ∈ {1, . . . , n}, and r S j |XS | ≤ |S2| − 1 both y∗ ∈ {0, 1}n and σ(X r) ∈ {0, 1}n, we therefore 2 S |X r | + |X r | ≤ s¯ − 1. (27) r ∗ S1 S2 have (σj(XS ) = 1 ⇐⇒ yj = 1 ∀j) if and only if ∗ r (y = σ(XS )). Sufficiency: Consider any j ∈ {1, . . . , n} To put this problem in an MILP form, we show that the r r r r such that σj(X ) = 1. This implies j ∈ X and there- terms |X |, |X |, |S |, and |S | can be represented by S S S1 S2 1 2 fore |Nj\S| ≥ r by Definition 4. By Lemma 2, |Nj\S| = functions of binary vectors. This can be done by first ∗ T Ljσ(S), and therefore Ljσ(S) > (r − 1). Since y is an observing that for any S ⊆ V, |S| = 1 σ(S). There- ∗ T optimal point, it is therefore a feasible point. If yj = 0, fore the following relationships hold: |S1| = 1 σ(S1), |S | = 1T σ(S ), |X r | = 1T σ(X r ), |X r | = 1T σ(X r ). the jth row of the first constraint on the RHS of (25) is 2 2 S1 S1 S2 S2 ∗ be violated since Ljσ(S) − (n)yj = Ljσ(S) (r − 1). Equation (27) can therefore be rewritten as ∗ Therefore we must have yj = 1. Note that |Nj\S| ≤ n ∀j ∈ S for any S ⊂ V. Necessity: We prove by con- s¯min(r, D) = min s¯ ∗ r s,¯ (S1,S2)∈T tradiction. Suppose yj = 1 and σj(XS ) = 0. This im- subject to 1T σ(X r ) ≤ 1T σ(S ) − 1 plies that Ljσ(S) = |Nj\S| < r. Consider the vector S1 1 ∗ T r T y˜ wherey ˜j = 0 andy ˜i = yi ∀i 6= j, i ∈ {1, . . . , n}. 1 σ(XS ) ≤ 1 σ(S2) − 1 Since L σ(S) = |N \S| < r, then y˜ is therefore also 2 j j 1T σ(X r ) + 1T σ(X r ) ≤ s¯ − 1. (28) a feasible point, and 1T y˜ < 1T y∗. This contradicts y∗ S1 S2 being an optimal point to (25); therefore we must have By Lemma 4, the terms σ(S ), σ(S ) for (S ,S ) ∈ T σ (X r) = 1. 1 2 1 2 j S can be represented by vectors (b1, b2) ∈ B. This yields

The next Theorem presents a mixed integer linear pro- s¯min(r, D) = min s¯ s,¯ b1,b2 gram which determiness ¯min(r) for any fixed r ∈ Z+. subject to 1T σ(X r ) ≤ 1T b1 − 1 S1 1T σ(X r ) ≤ 1T b2 − 1 Theorem 2 Let D = (V, E) be an arbitrary nonempty, S2 nontrivial, simple digraph. Let L be the Laplacian matrix 1T σ(X r ) + 1T σ(X r ) ≤ s¯ − 1 S1 S2 of D. Let r ∈ Z+, and let s¯min(r) be the minimum value of (b1, b2) ∈ B. (29) s for which D is not (r, s)-robust. Then if s¯min(r) < n+1, the following holds: Expanding the last constraint using the definition of B in (16) yields the sixth, seventh, and eighth constraints s¯min(r) = min s¯ 1 2 n s,¯ b1,b2,y1,y2 in (26) as well as the constraint that b , b ∈ {0, 1} . In subject to 1 ≤ s¯ ≤ n + 1, s¯ ∈ Z addition, the first constraint of the RHS of (26) limits T 1 T 1 the search for feasible value ofs ¯ to the range of possible 1 y ≤ 1 b − 1 1 2 values fors ¯min(r). The vectors y , y are constrained to 1T y2 ≤ 1T b2 − 1 satisfy y1 = σ(X r ) and y2 = σ(X r ) as follows: by S1 S2 1 2 1T y1 + 1T y2 ≤ (¯s − 1) Lemma 4, b = σ(S1) and b = σ(S2) for (S1,S2) ∈ T " #" # " # " # as per the sixth through ninth constraints. By Lemma 5, L 0 b1 y1 1 − (n) (r − 1) r T m 2 2 σ(X ) = arg min 1 y 0 L b y 1 Sm ym b1 + b2 1 subject to Lbm − (n)ym ≤ (r − 1)1 1 ≤ 1T b1 ≤ (n − 1) ym ∈ {0, 1}n, (30) 1 ≤ 1T b2 ≤ (n − 1) for all m ∈ {1, 2}. The constraints of (30) for both 1 2 1 2 n b , b , y , y ∈ {0, 1} . (26) m = 1 and m = 2 are contained in the fifth and last constraints of (26). Since the fourth constraint of (26), T 1 T 2 T 1 Furthermore, for any r > 0, s¯min(r) = n + 1 if and only 1 y + 1 y ≤ (¯s − 1), simultaneously minimizes 1 y if the integer program in (26) is infeasible. and 1T y2, the fourth, fifth, and last constraints of (26)

9 1 r 2 r ensure that y = σ(XS ) and y = σ(XS ). Therefore Assumption 1, thereby solving Problem 2. Recall from 1 2 ∗ ∗ 1T y1 = |X r | and 1T y2 = |X r |. Now, by the previous the beginning of Section 5 that r = rmax(D) and s = S1 S2 smax(rmax(D)). Theorem 1 can first be used to determine arguments, solving the RHS of (26) yieldss ¯min(r) when ∗ the value of rmax(D) = r . Using rmax(D), Theorem 2 s¯min(r) < (n+1). We now prove that for r > 0,s ¯min(r) = ∗ n + 1 if and only if the RHS of (26) is infeasible. Note can then be used to find the value of smax(rmax(D)) = s . that if r = 0, then it trivially holds by Definition 4 that More generally however, the MILP formulation in The- orem 2 allows for s (r) to be determined for any r ∈ smax(0) = n and therefores ¯min(0) = n + 1. Sufficiency: max . Since (r, 1)-robustness is equivalent to r-robustness, s¯min(r) = n + 1 implies that smax(r) = n. Recall that Z+ the MILP in Theorem 2 can also be used to determine D is (r, smax(r))-robust by Definition 7, since smax(r) is the largest integer s for which D is (r, s)-robust. By Def- whether a digraph D is r robust for a given r ∈ Z+. Ifs ¯ (r) ≥ 2, then s (r) ≥ 1 which implies that D inition 4, this implies that for all (S1,S2) ∈ T , at least min max one of the following three conditions holds: |X r | = |S |, is (r, 1)-robust. On the other hand,s ¯min(r) = 1 implies S1 1 r r r that 1 ∈ Θ¯ r and therefore D is not (r, 1)-robust (and not or |X | = |S2|, or |X | + |X | ≥ smax(r) = n. Given S2 S1 S2 r-robust). any (S1,S2) ∈ T , we consider each condition separately and show that at least one constraint of (26) is violated Finally, to solve Problem 3 Theorem 2 can be used if the condition holds true: to determine the (Fmax + 1,Fmax + 1)-robustness of r a nonempty, nontrivial, simple digraph. Recall that • |X | = |S1| being true implies that the second con- S1 F = max({F ∈ :(F + 1,F + 1) ∈ Θ}). The value straint of (26) is violated. This can be shown using max Z+ of F is determined by Algorithm 1, presented below. earlier arguments from this proof. Specifically, we max In essence, Algorithm 1 finds the largest values of r0 and have 1T y1 = |X r | = |S | = 1T b1 > 1T b1 − 1. S1 1 Therefore no feasible point can be constructed from Algorithm 1 the given set pair (S ,S ) if |X r | = |S |. 1 2 S1 1 DetermineFmax • By similar arguments, |X r | = |S | being true im- 0 S2 2 1: r ← rmax(D) from MILP in Theorem 1 plies that the third constraint of (26) is violated. 2: while r0 > 0 0 0 • |X r | + |X r | ≥ n being true implies that |X r | + 3: s ← smax(r ) from MILP in Theorem 2 S1 S2 S1 0 0 |X r | = n. This follows because X r , X r ⊂ V, and 4: if s ≥ r then . Prop. 1 implies graph is S2 S1 S2 0 0 r (r , s)-rob. ∀s ≤ s , therefore |V| = n. Next, by Definition 4 we have X ⊆ S 0 0 S1 1 D is (r , r )-robust and X r ⊆ S . Since S ∩ S = {∅} by definition 0 S2 2 1 2 5: Fmax ← (r − 1) r r of T in (2), we have X ∩ X = {∅}. Therefore 6: return Fmax S1 S2 n = |X r | + |X r | ≤ |S | + |S | ≤ |V| = n, which 7: else S1 S2 1 2 0 0 r r 8: r ← (r − 1) implies that |X | + |X | = |S1| + |S2|. Therefore S1 S2 9: end if |X r | = |S | and |X r | = |S | both hold, which S1 1 S2 2 10: end while from prior arguments both imply that a constraint 11: Fmax ← 0 of (26) is violated. Therefore no feasible point can 12: return Fmax be constructed from the given set pair (S1,S2) if |X r | + |X r | ≥ n 0 0 0 0 0 S1 S2 s such that r = s and (r , s ) ∈ Θ. It begins by setting 0 0 r ← rmax(D), and finding smax(r ) using Theorem 2. 0 0 Since for all (S1,S2) ∈ T at least one of these three con- If smax(r ) ≥ r , then by Proposition 1 the digraph D 0 0 0 0 ditions holds, for all (S1,S2) ∈ T at least one constraint is (r , s)-robust for s = r and therefore (r , r )-robust. 0 0 0 of (26) is violated when smax(r) = n, which is equivalent This implies r = Fmax + 1. However, if smax(r ) < r 0 0 tos ¯min(r) = n+1. Therefores ¯min(r) = n+1 implies that then r is decremented, smax(r ) recalculated, and the (26) is infeasible. Necessity: We prove the contrapositive, process is repeated until the algorithm terminates with 0 0 0 i.e. we prove thats ¯min 6= n + 1 implies that there exists the highest integer r such that D is (r , r )-robust, 0 a feasible point to the RHS of (26). First, no digraph on yielding Fmax = (r − 1). n nodes is (r, n + 1)-robust [15, Definition 13], and the contrapositive of Property 1 implies that if a graph is 6 Reducing Worst-Case Performance of Deter- 0 0 not (¯r, s¯)-robust, then it is also not (¯r , s¯ )-robust for all mining rmax(D) 0 0 r¯ ≥ r¯, and for alls ¯ ≥ s¯. Therefores ¯min 6= n + 1 implies s¯min ≤ n. Next,s ¯min ≤ n implies n ∈ Θ¯ r, which implies r When solving a MILP with zero-one integer variables us- that there exists (S1,S2) ∈ T such that |X | ≤ |S1| − 1 S1 ing a branch-and-bound technique, the worst-case num- and |X r | ≤ |S |−1 and |X r |+|X r | ≤ n−1, as per (24). q S2 2 S1 S2 ber of subproblems to be solved is equal to 2 , where q Lettings ¯ = n, b1 = σ(S ), b2 = σ(S ), y1 = σ(X r ), 1 2 S1 is the dimension of the zero-one integer vector variable. and y2 = σ(X r ) yields a feasible point to (26). In Section 4, the MILP in Theorem 1 which solves for S2 rmax has a binary vector variable with dimension 2n. The MILPs in Theorems 1 and 2 can be used to deter- In this section, we present two MILPs whose optimal mine the (r∗, s∗)-robustness of any digraph satisfying values provide upper and lower bounds on the value of

10 rmax. Each MILP has a binary vector variable with dimension of only n, which implies a reduced worst-case performance as compared to the MILP in Theorem 1. rmax(D) ≥ min t t,b n 6.1 A Lower Bound on Maximum r-Robustness subject to t ≥ 0, b ∈ Z Lb t1

In [6], a technique is presented for lower bounding rmax of 0 b 1 undirected graphs by searching for the minimum reach- 1 ≤ 1T b ≤ bn/2c (34) ability of subsets S ⊂ V such that |S| ≤ bn/2c. We ex- tend this result to digraphs in the next Lemma. PROOF. To prove the result we show that the RHS of (33) is equivalent to the RHS of (31). By Lemma 2, Lemma 6 Let D = (V, E) be an arbitrary nonempty, R(S) = max L σ(S). Therefore (31) is equivalent to nontrivial, simple digraph. Let Ψ = {S ⊂ V : 1 ≤ |S| ≤ i i bn/2c}. Then the following holds: rmax(D) ≥ min max Liσ(S). (35) S∈Ψ i

rmax(D) ≥ min R(S). (31) S∈Ψ Next, we demonstrate that the set

n T PROOF. By Lemma 1 and Remark 1, proving (31) is BΨ = {b ∈ {0, 1} : 1 ≤ 1 b ≤ bn/2c} (36) equivalent to proving satisfies BΨ = σ(Ψ), where σ(Ψ) is the image of Ψ un- n min R(S) ≤ min max (R(S1), R(S2)) . (32) der σ : P(V) → {0, 1} . Since 1 ≤ |S| ≤ bn/2c for S∈Ψ (S1,S2)∈T all S ∈ Ψ, then by (7) we have 1 ≤ 1T σ(S) ≤ bn/2c for all S ∈ Ψ. Also, σ(S) ∈ {0, 1}n, and therefore ∗ ∗ ∗ Denote S = arg minS∈Ψ R(S) and (S1 ,S2 ) = σ(S) ∈ BΨ ∀S ∈ Ψ, implying that σ(Ψ) ⊆ B. Next, −1 arg min(S1,S2)∈T max(R(S1), R(S2)). We prove by con- for any b ∈ BΨ, choose the set S = σ (b) (recall ∗ ∗ ∗ −1 n tradiction. Suppose R(S ) > max(R(S1 ), R(S2 )). Since that σ : {0, 1} → P(V)). Then clearly σ(S) = ∗ ∗ ∗ ∗ −1 S1 and S2 are nonempty, |S1 | ≥ 1 and |S2 | ≥ 1. Since σ(σ (b)) = b, and therefore BΨ ⊆ σ(Ψ). Therefore ∗ they are disjoint, we must have either |S1 | ≤ bn/2c, BΨ = σ(Ψ). The function σ :Ψ → BΨ is therefore sur- ∗ ∗ ∗ n or |S2 | ≤ bn/2c, or both |S1 | and |S2 | less than or jective. Since σ : P(V) → {0, 1} is injective, Ψ ⊂ P(V), ∗ ∗ n equal to bn/2c. Therefore either S1 ∈ Ψ or S2 ∈ Ψ. and BΨ ⊂ {0, 1} , then σ :Ψ → BΨ is also injective and ∗ ∗ ∗ This implies that either R(S1 ) ≥ R(S ) (if S1 ∈ Ψ) therefore a bijection. This implies that (35) is equiva- ∗ ∗ ∗ ∗ or R(S2 ) ≥ R(S ) (if S2 ∈ Ψ), since S is an opti- lent to rmax(D) ≥ minb∈BΨ maxi Lib. Making the con- mal point. But this contradicts the assumption that straints from (36) explicit yields (33). We next prove ∗ ∗ ∗ R(S ) > max(R(S1 ), R(S2 )). Therefore we must have that (34) is equivalent to (33). As per the proof of The- orem 1, the objective and first two constraints of (34) are a reformulation of the objective of the RHS of (33). min R(S) ≤ min max (R(S1), R(S2)) = rmax(D), n S∈Ψ (S1,S2)∈T The first and third constraint ensure b to be in {0, 1} , and the fourth constraint ensures b ∈ BΨ. which concludes the proof. 6.2 An Upper Bound on Maximum r-Robustness

This section will present an MILP whose solution pro- Using this result, a lower bound on rmax(D) can be obtained by the following optimization problem: vides an upper bound on the value of rmax(D), and whose binary vector variable has a dimension of n. This will be accomplished by searching a subset T 0 ⊂ T which is Theorem 3 Let D be an arbitrary nonempty, nontrivial, deﬁned as simple digraph and let L be the Laplacian matrix of D. A lower bound on the maximum integer for which D is 0 T = {(S1,S2) ∈ T : S1 ∪ S2 = V}. (37) r-robust, denoted rmax(D), is found as follows: In other words, T 0 is the set of all possible partitionings rmax(D) ≥ min max (Lib) 0 b i of V into S1 and S2. Considering only elements of T yields certain properties that allow us to calculate an subject to 1 ≤ 1T b ≤ bn/2c (33) n upper bound on rmax(D) using an MILP with only an n- b ∈ {0, 1} . dimensional binary vector. Observe that |T 0| = 2n − 2, 0 since neither T nor T include the cases where S1 = {∅} Furthermore, (33) is equivalent to the following mixed and S2 = {∅}. Similar to the methods discussed earlier, integer linear program: the partitioning of V into S1 and S2 can be represented

11 by the indicator vectors σ(S1) and σ(S2), respectively. Theorem 4 Let D = (V, E) be an arbitrary nonempty, 0 Note that since S1 ∪ S2 = V for all (S1,S2) ∈ T , it can nontrivial, simple digraph. Let L be the Laplacian matrix 0 be shown that σ(S1) + σ(S2) = 1 ∀(S1,S2) ∈ T . These of D. The maximum integer for which D is r-robust, properties allow the following Lemma to be proven: denoted rmax(D), is upper bounded as follows:

Lemma 7 Let D = (V, E) be an arbitrary nonempty, rmax(D) ≤ min kLbk∞ nontrivial, simple digraph. Let L be the Laplacian matrix b 0 T of D and let Lj be the jth row of L. Let T be defined as subject to 1 ≤ 1 b ≤ (n − 1) 0 n in (37). Then for all (S1,S2) ∈ T , the following holds: b ∈ {0, 1} . (42) |Nj\S1|, if j ∈ S1, Furthermore, (42) is equivalent to the following mixed Ljσ(S1) = integer linear program: −|Nj\S2|, if j ∈ S2. |N \S |, if j ∈ S , L σ(S ) = j 2 2 (38) rmax(D) ≤ min t (43) j 2 −|N \S |, if j ∈ S . t,b j 1 1 n subject to 0 ≤ t, b ∈ Z . PROOF. Lemma 2 implies that Ljσ(S1) = |Nj\S1| − t1 Lb 1t if j ∈ S1, and Ljσ(S2) = |Nj\S2| if j ∈ S2. Since 0 ≤ b ≤ 1 (S ,S ) ∈ T 0 =⇒ σ(S ) + σ(S ) = 1, we have 1 2 1 2 1 ≤ 1T b ≤ (n − 1) Ljσ(S1) = Lj(1−σ(S2)) = −Lj. This relation holds because, by the definition of L, 1 is always in the null space PROOF. Consider the optimization problem of L. Therefore j ∈ S2 =⇒ Ljσ(S1) = −Ljσ(S2) = −|Nj\S2|, and j ∈ S1 =⇒ Ljσ(S2) = −Ljσ(S1) = min max (R(S1), R(S2)) . (S ,S )∈T 0 (44) −|Nj\S1|. 1 2 An interesting result of Lemma 7 is that for any sub- Since T 0 ⊂ T , the optimal value of (44) is a valid upper sets (S ,S ) ∈ T 0, the maximum reachability of the two 1 2 bound on the value of rmax(D) as per Remark 1. From subsets can be recovered using the infinity norm. (44) and Lemma 8 we obtain Lemma 8 Let D = (V, E) be an arbitrary nonempty, rmax(D) ≤ min kLσ(S1)k 0 ∞ nontrivial, simple digraph and let L be the Laplacian ma- (S1,S2)∈T 0 trix of D. For all (S1,S2) ∈ T , the following holds: = min kLσ(S2)k . (45) 0 ∞ (S1,S2)∈T

kLσ(S1)k∞ = kLσ(S2)k∞ = max(R(S1), R(S2)). (39) Since S1,S2 are nonempty and S1 ∪ S2 = V for all 0 PROOF. Denote the nodes in S as {i , . . . , i } and (S1,S2) ∈ T , the set of all possible S1 subsets within 1 1 p 0 the nodes in S as {j , . . . , j } with p ∈ , 1 ≤ p ≤ elements of T is (P(V)\{∅, V}). Similarly, the set of 2 1 (n−p) Z 0 all possible S2 subsets within elements of T is also (n−1). Note that since S1∪S2 = V, we have {i1, . . . , ip}∪ {j , . . . , j } = {1, . . . , n}. The right hand side of equa- (P(V)\{∅, V}). For brevity, denote P∅,V = P(V)\{∅, V}. 1 n−p Next, we demonstrate that the set B0 = {b ∈ {0, 1}n : tion (39) can be expressed as T 0 1 ≤ 1 b ≤ (n − 1)} satisfies σ(P∅,V ) = B . Since k k 1 ≤ |S| ≤ (n − 1) for all S ∈ P∅,V , then by (7) we have max(R(S1), R(S2)) = max(|Ni1 \S1 |,..., |Nip \S1 |, T 1 ≤ 1 σ(S) ≤ (n − 1) for all S ∈ P∅,V . Also, σ(S) ∈ |N \Sk|,..., |N \Sk|). (40) n 0 j1 2 j(n−p) 2 {0, 1} , and therefore σ(S) ∈ B ∀S ∈ P∅,V , implying 0 0 that σ(P∅,V ) ⊆ B . Next, for any b ∈ B , choose the Similarly, using Lemma 7 yields set S = σ−1(b). Then clearly σ(S) = σ(σ−1(b)) = b, 0 0 and therefore B ⊆ σ(P∅,V ). Therefore B = σ(P∅,V ). 0 kLσ(S1)k∞ = max |L1σ(S1)|,..., |Lnσ(S1)| The function σ : P∅,V → B is therefore surjective. n = max |N \S |,..., |N \S |, Since σ : P(V) → {0, 1} is injective, P∅,V ⊂ P(V), i1 1 ip 1 0 n 0 and B ⊂ {0, 1} , then σ : P∅,V → B is also injective. |Nj \S2|,..., |Nj \S2| 0 1 (n−p) Therefore σ : P∅,V → B is a bijection, implying that = max(R(S1), R(S2)). (41) (45) is equivalent to rmax(D) ≤ minb∈B0 kLbk∞. Mak- ing the constraints explicit yields (42). We next prove Finally, observe that kLσ(S2)k∞ = kL(1 − σ(S1))k∞ = that (43) is equivalent to (42). It can be shown [3, Chap- kLσ(S1)k∞ , which completes the proof. ter 4] that minx kxk∞ is equivalent to mint,x subject to −t1 x t1. Likewise, the objective and first two constraints of the RHS of (43) are a reformulation of the ob- A mixed integer linear program yielding an upper bound jective of the RHS of (42). The first and third constraint n on rmax(D) is therefore given by the following Theorem: restrict b ∈ {0, 1} , and the fourth constraint restricts

12 b to be an element of B0. These arguments imply that independently with probability p and absent with prob- the RHS of (43) is equivalent to the RHS of (42), which ability 1−p. The values of p considered are again 0.3, 0.5, concludes the proof. and 0.8. The k-out random graphs consist of n nodes. For each vertex i ∈ V, k ∈ N other nodes are chosen with 7 Discussion all having equal probability and all choices being inde- pendent. For each of the k chosen nodes, a directed edge MILP problems are NP -hard problems to solve in gen- (i, k) is formed. k-in random graphs are formed in the eral. As such, the formulations presented in this paper do same manner as k-out random graphs with the excep- not reduce the theoretical complexity of the robustness tion that the direction of the directed edges are reversed; determination problem. However, it has been pointed i.e. edges (k, i) are formed. The values of k considered out that algorithmic advances and improvement in com- are {3, 4, 5}. puter hardware have led to a speedup factor of 800 bil- lion for mixed integer optimization problems during the Two sets of simulations are considered. The first set com- last 25 years [1]. The results of this paper allow for the pares two algorithms which determine the pair (r∗, s∗) robustness determination problem to benefit from ongo- for a digraph: the DetermineRobustness algorithm ing and future improvements in the active areas of opti- from [13] and (r, s)-Rob. MILP (Algorithm 3 in [36]), mization and integer programming. In addition, one cru- which is an MILP formulation using results from Theo- cial advantage of the MILP formulations is the ability to rems 1 and 2. Details about the implementation of these iteratively tighten a global lower bound on the optimal algorithms can be found in [36, Appendix A]. The algo- value over time by using a branch-and-bound algorithm. rithms are tested on the four types of graphs described The reader is referred to [42] for a concise overview of above with values of n ranging from 7 to 15. In addition, how such a lower bound can be calculated. In context of the MILP formulation is tested on digraphs with values robustness determination, lower bounds on r (D) and max of n ranging from 17 to 25. The DetermineRobustness s (r) are generally more useful than upper bounds max algorithm is not tested on values of n above 15 since the since they can be used to calculate lower bounds on the convergence rate trend is clear from the existing data, maximum adversary model that the network can toler- and the projected convergence times are prohibitive for ate. The ability to use branch-and-bound algorithms for large n. 100 graphs per graph type and combination of solving the robustness determination problem offers the n and p (or n and k depending on the respective graph flexibility of terminating the search for r (D) and/or max type), are randomly generated, and the algorithms are s (r) when sufficiently high lower bounds have been max run on each graph. Overall, 10,800 total graphs are determined. In this manner, approximations of these val- analyzed with DetermineRobustness and 16,800 total ues can be found when it is too computationally expen- graphs are analyzed with (r, s)-Rob. MILP. The time for sive to solve for them exactly. The investigation of ad- each algorithm to determine the pair (r∗, s∗) is averaged ditional methods to find approximate solutions to the for each combination of n and p (for Erd˝os-Rényi ran- MILP formulations in this paper is left for future work. dom graphs and random digraphs), and for each combi- 8 Simulations nation of n and k (for k-out and k-in random graphs). The interpolated circles represent the average conver- This section presents simulations which demonstrate the gence time over 100 trials for each value of n, while the performance of the MILP formulations as compared to vertical lines represent the spread between maximum a robustness determination algorithm from prior liter- convergence time and minimum convergence time over ature called DetermineRobustness [13]. Due to space trials for the respective value of n. Note the logarith- limitations, we have omitted some of the graphs and de- mic scale of the y-axis. To facilitate the large number scriptions of the additional algorithms involved in the of graphs being tested, a time limit of 103 seconds simulations. All results and full details about the algo- (roughly 17 minutes) is imposed on (r, s)-Rob. MILP. rithms used can be found in the extended preprint ver- However, out of the 16,800 graphs tested by (r, s)-Rob. sion of this article [36]. Computations for these simu- MILP, there are only 62 instances where the algorithm lations are performed in MATLAB 2018b on a desktop did not converge to optimality before this time limit. computer with 8 Intel core i7-7820X CPUs (3.60 GHz) Instances where the time limit was violated are given capable of handling 16 total threads. All MILP prob- the maximum time of 103 seconds and included in the lems are solved using MATLAB’s intlinprog function. data. The graphs where optimality was not reached by Four types of random graphs are considered in the simu- the time limit all have between 21 and 25 nodes, are lations: Erd˝os-Rényi random graphs, random digraphs, either Erd˝os-Rényi random graphs or random digraphs, k-out random graphs [2], and k-in random graphs. The and have edge formation probabilities of p = 0.8. Fur- Erd˝os-Rényi random graphs in these simulations consist ther discussion of these results have been omitted due of n agents, with each possible undirected edge present to space limitations, but can be found in [36]. independently with probability p ∈ [0, 1] and absent with probability 1 − p. Three values of p are considered: The second simulation set compares the performance 0.3, 0.5, and 0.8. The random digraphs considered con- of four algorithms which determine only the value of sist of n nodes with each possible directed edge present rmax(D) for digraphs. These include a modified version

13 of DetermineRobustness, denoted Mod. Det. Rob., [8] Yuhei Kikuya, Seyed Mehran Dibaji, and Hideaki Ishii. Fault which determines rmax(D) (Algorithm 4 in [36]), the tolerant clock synchronization over unreliable channels in MILP formulation from Theorem 1 (denoted r-Rob. wireless sensor networks. IEEE Transactions on Control of MILP), the lower bound MILP formulation from The- Network Systems, 2017. orem 3 (denoted r-Rob. Lower Bnd), and the upper [9] Leslie Lamport, Robert Shostak, and Marshall Pease. bound MILP formulation from Theorem 4 (denoted r- The byzantine generals problem. ACM Transactions on Programming Languages and Systems (TOPLAS), 4(3):382– Rob. Upper Bnd). These algorithms are tested on the 401, 1982. four types of graphs described above with values of n ranging from 7 to 15. Additionally, the MILP formula- [10] Heath J LeBlanc. Resilient cooperative control of networked multi-agent systems. Vanderbilt University, 2012. tions are tested on digraphs with values of n ranging from 17 to 25. Again, 100 graphs per graph type and [11] Heath J LeBlanc and Xenofon Koutsoukos. Resilient first-order consensus and weakly stable, higher order combination of n and p (or n and k, depending on the synchronization of continuous-time networked multi-agent respective graph type) are randomly generated, and systems. IEEE Transactions on Control of Network Systems, the algorithms are run on each graph. Overall, 10,800 2017. graphs are analyzed with Mod. Det. Rob. and 16,800 [12] Heath J LeBlanc and Xenofon D Koutsoukos. Low graphs are analyzed by each of the three MILP formula- complexity resilient consensus in networked multi-agent tions. The time for each algorithm to determine rmax(D) systems with adversaries. In Proceedings of the 15th ACM is averaged for each combination of n, p or k, and graph international conference on Hybrid Systems: Computation type. The average, minimum, and maximum times per and Control, pages 5–14. ACM, 2012. combination are plotted in Figure 5. A time limit of 103 [13] Heath J LeBlanc and Xenofon D Koutsoukos. Algorithms for seconds is again imposed on all three of the MILP for- determining network robustness. In Proceedings of the 2nd mulations, but out of the 16,800 graphs tested there are ACM international conference on High confidence networked systems, pages 57–64. ACM, 2013. no instances where this time limit was violated. Again, further discussion of these results have been omitted [14] Heath J. LeBlanc, H Zhang, S Sundaram, and X Koutsoukos. Resilient continuous-time consensus in fractional robust due to space limitations, but can be found in [36]. networks. In 2013 American Control Conference, pages 1237– 9 Conclusion 1242, 6 2013. [15] Heath J LeBlanc, Haotian Zhang, Xenofon Koutsoukos, This paper presents a novel approach on determining and Shreyas Sundaram. Resilient asymptotic consensus the r- and (r, s)-robustness of digraphs using mixed inte- in robust networks. IEEE Journal on Selected Areas in ger linear programming (MILP). Future work will focus Communications, 31(4):766–781, 2013. on applying more advanced integer programming tech- [16] Heath J LeBlanc, Haotian Zhang, Shreyas Sundaram, and niques to the formulations in this paper to yield faster Xenofon Koutsoukos. Consensus of multi-agent networks in the presence of adversaries using only local information. solution times. In particular, the Laplacian matrix ex- In Proceedings of the 1st international conference on High hibits a high degree of structure and plays a central role Confidence Networked Systems, pages 1–10. ACM, 2012. in the MILP formulations presented in this paper. Fu- [17] Zhenhong Li and Zhengtao Ding. Robust cooperative ture efforts will explore ways to exploit this structure to guidance law for simultaneous arrival. IEEE Transactions determine the robustness of digraphs more efficiently. on Control Systems Technology, (99):1–8, 2018. [18] A. Mitra and S. Sundaram. Secure distributed state References estimation of an lti system over time-varying networks and analog erasure channels. In 2018 Annual American Control Conference (ACC), pages 6578–6583, June 2018. [1] Dimitris Bertsimas and Jack Dunn. Optimal classification trees. Machine Learning, 106(7):1039–1082, 2017. [19] Aritra Mitra, Waseem Abbas, and Shreyas Sundaram. On [2] Béla Bollobás. Models of Random Graphs, page 3459. the impact of trusted nodes in resilient distributed state Cambridge Studies in Advanced Mathematics. Cambridge estimation of lti systems. In 2018 IEEE Conference on University Press, 2 edition, 2001. Decision and Control (CDC), pages 4547–4552. IEEE, 2018. [3] Stephen Boyd and Lieven Vandenberghe. Convex [20] Aritra Mitra, John A Richards, Saurabh Bagchi, and Shreyas optimization. Cambridge university press, 2004. Sundaram. Resilient distributed state estimation with mobile agents: overcoming byzantine adversaries, communication [4] Seyed Mehran Dibaji and Hideaki Ishii. Resilient consensus losses, and intermittent measurements. Autonomous Robots, of second-order agent networks: Asynchronous update rules pages 1–26, 2018. with delays. Automatica, 81:123–132, 2017. [21] Aritra Mitra and Shreyas Sundaram. Secure distributed [5] Seyed Mehran Dibaji, Hideaki Ishii, and Roberto observers for a class of linear time invariant systems in the Tempo. Resilient randomized quantized consensus. IEEE presence of byzantine adversaries. In Decision and Control Transactions on Automatic Control, 63(8):2508–2522, 2018. (CDC), 2016 IEEE 55th Conference on, pages 2709–2714. [6] Luis Guerrero-Bonilla, Amanda Prorok, and Vijay Kumar. IEEE, 2016. Formations for Resilient Robot Teams. In IEEE Robotics and [22] Hyongju Park and Seth Hutchinson. An efficient algorithm Automation Letters, volume 2, pages 841–848. IEEE, 2017. for fault-tolerant rendezvous of multi-robot systems with [7] Luis Guerrero-Bonilla, David Saldana, and Vijay Kumar. controllable sensing range. In Robotics and Automation Design guarantees for resilient robot formations on lattices. (ICRA), 2016 IEEE International Conference on, pages 358– IEEE Robotics and Automation Letters, 4(1):89–96, 2018. 365. IEEE, 2016.

14 p =0.3 p =0.5 p =0.8 10 4 10 4 10 4 Det. Rob. (r,s)-Rob. MILP 10 2 10 2 10 2

10 0 10 0 10 0

10 -2 10 -2 10 -2 Computation time

-4 -4 -4 Erdos-Renyi Graphs 10 10 10 5 10 15 20 25 5 10 15 20 25 5 10 15 20 25 Number of nodes Number of nodes Number of nodes

p =0.3 p =0.5 p =0.8 10 4 10 4 10 4

10 2 10 2 10 2

10 0 10 0 10 0

10 -2 10 -2 10 -2 Computation time Random Digraphs 10 -4 10 -4 10 -4 5 10 15 20 25 5 10 15 20 25 5 10 15 20 25 Number of nodes Number of nodes Number of nodes

Fig. 4. Comparison of DetermineRobustness to (r, s)-Rob. MILP (Algorithm 3 in [36]). Additional results can be found in [36]. The interpolating lines and circles represents the average computation time over 100 digraphs for each value of n, the upper and lower lines represent the maximum and minimum computation times, respectively, over the 100 trials for each n. Note that (r, s)-Rob. MILP actually solves two MILPs sequentially: one to ﬁnd rmax(D), and one to ﬁnd smax(rmax(D)).

k =3 k =4 k =5 10 4 10 4 10 4 Mod. Det. Rob. r-Rob. MILP 10 2 r-Rob. Lower Bnd 10 2 10 2 r-Rob. Upper Bnd

10 0 10 0 10 0

10 -2 10 -2 10 -2 Computation time

10 -4 10 -4 10 -4

k-In Random Digraphs 5 10 15 20 25 5 10 15 20 25 5 10 15 20 25 Number of nodes Number of nodes Number of nodes

k =3 k =4 k =5 10 4 10 4 10 4

10 2 10 2 10 2

10 0 10 0 10 0

10 -2 10 -2 10 -2 Computation time

10 -4 10 -4 10 -4 5 10 15 20 25 5 10 15 20 25 5 10 15 20 25 k-Out Random Digraphs Number of nodes Number of nodes Number of nodes

Fig. 5. Comparison of the Mod. Det. Rob. algorithm (Algorithm 4 in [36]) which determines rmax(D) with three MILP formulations. Additional results can be found in [36]. The ﬁrst MILP formulation labeled r-Rob. MILP is an implementation of Theorem 1 and calculates rmax(D) exactly. The MILP formulations labeled r-Rob. Lower Bnd and r-Rob. Upper Bnd are implementations of Theorems 3 and 4, respectively, which calculate a lower and upper bound, respectively, on rmax(D).

[23] Hyongju Park and Seth A Hutchinson. Fault-tolerant Resilient backbones in hexagonal robot formations. In rendezvous of multirobot systems. IEEE transactions on Distributed Autonomous Robotic Systems, pages 427–440. robotics, 33(3):565–582, 2017. Springer, 2019.

[24] David Salda˜na,Luis Guerrero-Bonilla, and Vijay Kumar. [25] David Saldana, Amanda Prorok, Shreyas Sundaram,

15 Mario FM Campos, and Vijay Kumar. Resilient consensus network robustness of multi-agent systems under attacks. for time-varying networks of dynamic agents. In American In Pacific Rim International Conference on Artificial Control Conference (ACC), 2017, pages 252–258. IEEE, Intelligence, pages 491–498. Springer, 2018. 2017. [42] Laurence A Wolsey. Mixed integer programming. Wiley [26] Danial Senejohnny, Shreyas Sundaram, Claudio De Persis, Encyclopedia of Computer Science and Engineering, pages and Pietro Tesi. Resilience against misbehaving nodes in self- 1–10, 2007. triggered coordination networks. In 2018 IEEE Conference [43] Haotian Zhang, Elaheh Fata, and Shreyas Sundaram. A on Decision and Control (CDC), pages 2848–2853. IEEE, notion of robustness in complex networks. IEEE Transactions 2018. on Control of Network Systems, 2(3):310–320, 2015. [27] Ebrahim Moradi Shahrivar, Mohammad Pirani, and Shreyas [44] Haotian Zhang and Shreyas Sundaram. Robustness Sundaram. Robustness and algebraic connectivity of random of information diffusion algorithms to locally bounded interdependent networks. arXiv preprint arXiv:1508.03650, adversaries. In American Control Conference (ACC), 2012, 2015. pages 5855–5861. IEEE, 2012. [28] Ebrahim Moradi Shahrivar, Mohammad Pirani, and Shreyas [45] Jun Zhao, Osman Ya˘gan,and Virgil Gligor. On connectivity Sundaram. Spectral and structural properties of random and robustness in random intersection graphs. IEEE interdependent networks. Automatica, 83:234–242, 2017. Transactions on Automatic Control, 62(5):2121–2136, 2017. [29] Lili Su and Nitin H Vaidya. Fault-tolerant multi-agent optimization: optimal iterative distributed algorithms. In Proceedings of the 2016 ACM Symposium on Principles of Distributed Computing, pages 425–434. ACM, 2016. [30] Lili Su and Nitin H Vaidya. Reaching approximate byzantine consensus with multi-hop communication. Information and Computation, 255:352–368, 2017. [31] Shreyas Sundaram and Bahman Gharesifard. Distributed optimization under adversarial nodes. IEEE Transactions on Automatic Control, 2018. [32] Lewis Tseng and Nitin Vaidya. Iterative approximate byzantine consensus under a generalized fault model. In International Conference on Distributed Computing and Networking, pages 72–86. Springer, 2013. [33] Lewis Tseng, Nitin Vaidya, and Vartika Bhandari. Broadcast using certified propagation algorithm in presence of byzantine faults. Information Processing Letters, 115(4):512–514, 2015. [34] Lewis Tseng and Nitin H Vaidya. Asynchronous convex hull consensus in the presence of crash faults. In Proceedings of the 2014 ACM symposium on Principles of distributed computing, pages 396–405. ACM, 2014. [35] James Usevitch and Dimitra Panagou. r-robustness and (r, s)-robustness of circulant graphs. In 2017 IEEE 56th Annual Conference on Decision and Control (CDC), pages 4416– 4421, Dec 2017. [36] James Usevitch and Dimitra Panagou. Determining r- and (r,s)-robustness of digraphs using mixed integer linear programming. arXiv preprint arXiv:1901.11000, 2019. [37] James Usevitch and Dimitra Panagou. Determining r-robustness of digraphs using mixed integer linear programming. In 2019 Annual American Control Conference (ACC). IEEE, 2019. [38] Nitin H Vaidya. Iterative byzantine vector consensus in incomplete graphs. In International Conference on Distributed Computing and Networking, pages 14–28. Springer, 2014. [39] Nitin H Vaidya and Vijay K Garg. Byzantine vector consensus in complete graphs. In Proceedings of the 2013 ACM symposium on Principles of distributed computing, pages 65–73. ACM, 2013. [40] Nitin H Vaidya, Lewis Tseng, and Guanfeng Liang. Iterative approximate byzantine consensus in arbitrary directed graphs. In Proceedings of the 2012 ACM symposium on Principles of distributed computing, pages 365–374. ACM, 2012. [41] Guang Wang, Ming Xu, Yiming Wu, Ning Zheng, Jian Xu, and Tong Qiao. Using machine learning for determining