Cutting Plane Approaches for the Robust Kidney Exchange Problem

Renal patients which have a willing but incompatible donor can decide to participate in a kidney exchange program (KEP). The goal of a KEP is to identify sets of such incompatible pairs that can exchange donors, leading to compatible transplants for each recipient. There is significant uncertainty involved in this process, as planned transplants may be canceled for a plethora of reasons. It is therefore crucial to take into account failures while planning exchanges. In this paper, we consider a robust variant of this problem with recourse studied in the literature that takes into account vertex failures, i.e., withdrawing donors and/or recipients. This problem belongs to the class of defender-attacker-defender (DAD) models. We propose a cutting plane method for solving the attacker-defender subproblem based on two commonly used mixed-integer programming formulations for kidney exchange. Our results imply a running time improvement of one order of magnitude compared to the state-of-the-art. Moreover, our cutting plane methods can solve a large number of previously unsolved instances. Furthermore, we propose a new practical policy for recourse in KEPs and show that the robust optimization problem concerning this policy is tractable for small to mid-size KEPs in practice.


Introduction
In the final stage of chronic kidney disease, patients suffer from endstage renal disease.The most preferred treatment option for this disease is a kidney transplant.However, the supply of healthy kidneys from deceased donors does not adequately meet the needs of these patients.An alternative is living-donor donation, e.g., by a relative or friend who is willing to donate one of their two kidneys to a specific patient.This is possible since only one healthy kidney is necessary to ensure sufficient kidney function.Transplants from living donors also offer better longterm outcomes for the recipient compared to deceased donor grafts, with limited risk to the donor (Davis and Delmonico, 2005).However, to allow for donations, recipients must be medically compatible with the donor.Incompatibilities can be caused, among other reasons, by conflicting blood or tissue type.Recipients might thus be unable to receive a transplant from their intended donor.
To overcome incompatibilities between a patient and its related donor, Rapaport (1986) introduced kidney exchange programs (KEPs), which have been further popularized by a series of seminal papers in the field (Roth et al., 2004(Roth et al., , 2005(Roth et al., , 2007)).In a KEP, a set of incompatible patient-donor pairs is given, and every donor is willing to give one of their kidneys to any patient as long as their paired recipient receives a transplant in return from some other donor.In the simplest case, one is thus looking for two incompatible donor-recipient pairs ( 1 ,  2 ) such that the kidney of  1 's donor is compatible with the recipient of  2 and vice versa.Once such a match is identified, the patients from  1 and  2 can receive the kidney from the other pair's donor.We call such an exchange of donors a 2-way exchange as it includes two patient-donor pairs.Of course, this idea can be generalized to -way exchanges, where the exchange of donors occurs in a cyclic way between  patient-donor pairs.In many real-life KEPs, an upper bound  is used for the size of a cycle, see Biró et al. (2019).As transplants within an exchange are usually performed simultaneously to remove the risk of donors reneging once their paired patient has received a kidney, long exchanges are logistically challenging and thus avoided.
A kidney exchange program can also include non-directed donors (NDDs) as studied by Morrissey et al. (2005) and Roth et al. (2006).These are donors who are willing to donate to any recipient, while not having a paired patient and thus not requiring a return transplant.An NDD can start a chain of transplants, in which the donor of the th pair in the chain donates a kidney to the recipient of the ( + 1)th pair.The donor of the last pair in the chain can donate their kidney to a recipient on the deceased donor waiting list, or become a bridge donor, functioning as a non-directed donor in a future KEP run.In practice, it is often also assumed that the maximum chain length is bounded by some integer .
The basic KEP model can be regarded as a directed graph  = ( , ) whose vertices  ∈  correspond to recipient-donor pairs and nondirected donors, and an arc (, ) ∈  corresponds to compatibility between the donor of  and the recipient of .Notice that each feasible -way exchange corresponds to a cycle in this graph .Therefore, we refer to -way exchanges as -cycles.A feasible KEP solution is then a set of pairwise vertex-disjoint cycles and chains in  of lengths respecting the upper bounds.A common objective in kidney exchange problems is to maximize the number of transplants that can be realized.Fig. 1 illustrates an example of a kidney exchange program and a feasible KEP solution.
Basic KEP models assume that all identified matches proceed to transplant.In practice, however, this is usually not the case.For example, Dickerson et al. (2019) reports that 93 % of proposed matches failed in the initial years of the UNOS program.In the NHS Living Kidney Sharing Scheme, 31 % of identified matches did not proceed to transplant in the period from 2008 until 2022 (Robb and Shanmugaranjan, 2023).
Such failures can occur for a variety of reasons, e.g., when additional medical incompatibilities are identified during the time between the matching run and the actual surgeries.Furthermore, recipients and donors may decide to (temporarily) withdraw from KEPs due to health issues.There exists a growing literature taking into account failures, which we discuss in more detail in Section 1.2.We focus in particular on Carvalho et al. (2021), who introduced a robust optimization approach that addresses such donor or recipient (i.e., vertex) failures and aims to optimize a minimum guarantee for recipients that were selected for transplant in advance of the failure event.They consider a threestage model that belongs to the class of defender-attacker-defender (DAD) models, as optimizing worst-case behavior can be interpreted as playing a sequential game against an informed adversary.
In the first stage, the KEP owner (defender) identifies a feasible kidney exchange solution, which we refer to as the initial solution.
Subsequently, it is anticipated that up to a specified number  of pairs and/or NDDs might withdraw from the KEP.In terms of DAD models, this corresponds to an adversarial player selecting those pairs and NDDs that disrupt the initial solution as much as possible.Therefore we refer to these withdrawals as an attack pattern or attack.
In the third and final stage, a new kidney exchange solution is identified using only the remaining pairs and NDDs.This kidney exchange solution is called the recourse solution and it is selected such that it includes the largest number of patients also included in the initial solution.Additional restrictions on the set of possible recourse solutions are captured through recourse policies.
The objective of the model is to select the initial solution that maximizes the worst-case number, concerning all attacks, of patients involved in both the initial and recourse solution.The idea behind this objective is to diminish the risk that recipients selected for transplant in the initial stage will end up without a transplant due to vertex withdrawals.

Our contributions
This paper builds on the work of Carvalho et al. (2021), and the algorithmic literature on (D)AD models.Our main contributions are the following.
• We propose a new approach based on cutting planes to solve the second-stage problem, i.e., the interdiction problem faced by the attacker.Our computational results show that this new approach outperforms the branch-and-bound algorithm of Carvalho et al. (2021) by an order of magnitude.This improvement can be observed both with regard to the average computation times and the number of instances that could be solved within the time limit of one hour.• We make use of the position-indexed chain-edge formulation (PICEF) for kidney exchange that is compact concerning the set of chains.We show that the resulting formulation of the second stage is significantly stronger than those obtained when using the traditional cycle-chain formulation.Specifically, we show the strength of interdiction cuts depends on the underlying formulation, provided we consider the form proposed by Fischetti et al. (2019).• We introduce a new policy for recourse in kidney exchange programs, the Fix Successful Exchanges (FSE) policy, where cycles and chains of the initial solution that are not affected by the subsequent attack will also be selected for the recourse solution.This recourse policy further protects recipients involved in a selected cycle or chain of the initial solution and has additional logistical benefits.We further motivate the FSE policy in Section 2. Our computational results show that imposing the FSE policy for our recourse options leads to only a small loss in the attainable objective value.
The remainder of the paper is structured as follows.We review relevant literature in Section 1.2.The algorithmic framework for solving the attacker-defender subproblem is laid out in Section 2, in which we also consider two policies for recourse for the third stage of the defender-attacker-defender model.The implementation of this framework with respect to the cycle-chain and position-indexed chain edge formulations is made more concrete in Section 3. We finish by presenting our computational efforts in Section 4 and a conclusion in Section 5.

Literature review
In this section, we position our paper in the literature on failure in kidney exchanges and discuss some formulations for the basic kidney exchange problem which we adapt to our setting.Finally, we mention relevant literature on (Defender -) Attacker-Defender models.
Failure in kidney exchange was first considered by Manlove and O'Malley (2012).They investigate a hierarchy of tiebreaking objectives to decide between multiple kidney exchange solutions based on minimizing the risk of failure within an exchange.For instance, a solution in which many of the 3-cycles have a subcycle is more preferred than a solution in which 3-cycles do not have this property.Dickerson et al. (2013Dickerson et al. ( , 2019) study a setting with equal failure probabilities and equal value for each transplant and maximize the expected number of transplants.Bidkhori et al. (2020) extend this model to a setting with inhomogeneous arc existence probabilities and give a compact formulation.Since stochastic models require accurate estimations for arc existence probabilities, an alternative model based on robust optimization is proposed in McElfresh et al. (2019).In addition to handling the possibility of failures a priori, an additional decision can be made once the failures are observed, called the recourse decision.In a recourse decision, an initially proposed kidney exchange solution is adapted after the failures have been identified.This adaptation might lead to a significant number of additional transplants that can be realized, see, e.g., Bray et al. (2015).Different types of recourse for kidney exchange have been studied in the literature.Klimentova et al. (2016) and Alvelos et al. (2019) consider recourse in a stochastic setting.They initially select small disjoint subsets of recipient-donor pairs.After failures are revealed, recourse is limited to transplants between pairs within the same subset.Initial selections are made to maximize the expected number of transplants.Smeulders et al. (2022) studies a setting where initially a set of potential transplants, limited by a budget constraint, are tested.Again, the goal is to select these arcs to maximize the expected number of transplants after failure is revealed.Compared to earlier stochastic approaches, the additional flexibility in determining the transplant plan comes at a significant computational cost.Carvalho et al. (2021) consider recourse in a robust setting, as described in the introduction.Zeynivand et al. (2023) consider a policy that checks if non-failing pairs involved in a failed cycle or chain can be inserted in a successful exchange without violating the maximum cycle or chain length constraints.
Most algorithms related to kidney exchange programs are based on integer programming (IP).An intuitive IP formulation is the cycle-chain formulation (CC) due to Roth et al. (2007), which uses a binary variable for each cycle and each chain, and constraints for each pair and each NDD , stating that only one cycle or chain can be chosen that includes .The number of variables in these formulations grows rapidly as the cycle and chain limits increase, as well as when the size of the pool of participating pairs and NDDs becomes larger.A common technique for solving the cycle-chain model is branch-and-price (Glorie et al., 2014;Plaut et al., 2016;Lam and Mak-Hau, 2020;Riascos-Álvarez et al., 2020;Omer et al., 2022).Another fundamental formulation is the edge formulation due to Abraham et al. (2007).Instead of cycle and chain variables, this formulation uses binary variables   for each (, ) ∈ , that indicate whether the donor of  donates a kidney to the recipient of , leading to a polynomial number of variables.However, the number of constraints is exponential in the number of pairs and NDDs.Constantino et al. (2013) introduced the first compact formulations, i.e., models with a polynomial number of variables and constraints.The drawback of this formulation is that its LP relaxation is generally weaker than the one of the CC formulation.Dickerson et al. (2016) introduced the position-indexed cycle edge formulation (PICEF), which is a hybrid variant of different models: as the CC formulation, it uses binary variables for each cycle.But instead of using variables for each chain, chains are modeled by variables that express the position of an individual transplant within a chain.The resulting formulation is thus compact only concerning the chains.Dickerson et al. (2016) show that the LP relaxation of PICEF is strictly weaker than that of CC.However, we will use the PICEF formulation and show its advantages in the robust setting we consider.More recently, new formulations have been proposed that model cycles as two half-cycles, i.e., two paths that only intersect in their endpoints (Delorme et al., 2023).
As we study a worst-case setting, following Carvalho et al. (2021), the failures can be modeled as deliberate attacks of an optimizing adversary.Riascos-Alvarez et al. (2022) have studied a generalization of this model based on inhomogeneous failures of both vertices and arcs.This makes the model a specific example of a general class of optimization models known as the class of defender-attacker-defender (DAD) models.Problems involving network interdiction are often intuitively modeled by a DAD model, many of which are surveyed in Smith and Song (2020).The second and third stages of the model we study can separately be seen as an attacker-defender model and specifically an interdiction game with monotonicity as studied, e.g., by Fischetti et al. (2019).We will indeed model these stages as an interdiction game and make use of their general framework.

Algorithmic framework
In this section, we reconsider the defender-attacker-defender model for robust kidney exchange proposed by Carvalho et al. (2021) and algorithmic concepts used for solving this model.We start by providing some preliminary knowledge on modeling basic kidney exchange programs.Secondly, we describe the DAD model in a general sense, and concretize it for two recourse policies.Finally, we describe a cutting-plane approach for solving the adversary problem.

Preliminaries
The basic KEP model considers a compatibility graph  = ( , ).The vertex set  consists of a set  of incompatible donor-recipient pairs and a set  of non-directed donors, i.e.,  =  ∪ .Each arc (, ) ∈  indicates that the donor of vertex  ∈  ∪  is compatible with the recipient of vertex  ∈  .As each arc corresponds to transplanting a donor kidney to a recipient, we will also refer to arcs as transplants.We denote by   the set of (directed) cycles in  with at most  arcs.
Furthermore, a non-directed donor  ∈  can initiate a (directed) chain of transplants, further involving a set of pairs, with at most  arcs.The set of all chains in  of length at most  is denoted by   .We refer to  , =   ∪   as the set of feasible exchanges, or simply  if  and  are clear from the context.
Given an exchange  ∈ , we denote by  () and () the set of vertices and arcs involved in .We denote by   the set of exchanges involving vertex , with similar notions    and    respectively for cycles and chains involving .

Robust kidney exchange model
The model introduced by Carvalho et al. (2021) considers a variant of kidney exchange programs, in which withdrawals of non-directed donors and pairs are taken into account in a worst-case setting.This problem can be interpreted as a two-player game, in which the KEP owner (defender) plays against an optimizing adversary (attacker).Observe that the attacker is not considered to be an actual decision maker, but instead a concept for modeling the worst-case realization of withdrawals.Since an initial KEP solution can be adapted by the defender once an attack has been observed, our robust KEP can be interpreted as a defender-attacker-defender model.Given the initial solution proposed by the defender and an attack proposed by the attacker, the defender's goal is to identify a feasible recourse solution in which the largest number of recipients involved in the initial solution again receive a transplant.The high-level aim of the defender is to coordinate their initial decision in such a way that the objective value of the recourse problem is maximized with respect to the worst-case attack.Consequently, solving the underlying robust optimization problem faced by the defender, i.e., with respect to the set of feasible attacks for the attacker, consists of solving a trilevel optimization problem.
We denote by  the set of initial solutions.The set of possible attacks (sets of failing pairs or non-directed donors) is denoted by  .Furthermore, we denote by  (,  ) ⊆  the set of recourse solutions   given initial solution  ∈  and attack  ∈  .Notice that  (,  ) depends on the (implicit) recourse policy at hand.Furthermore, we denote by  () ⊆  the set of pairs involved in an exchange of the initial solution .Similarly, we denote by  (  ) ⊆  the set of pairs involved in an exchange of the recourse solution   ∈  (,  ) given initial solution  ∈  and attack  ∈  .The robust optimization problem faced by the defender can then be described as In the remainder of this section, we specify the exact structure of the set  ,  , and  (,  ) (given  and  ), as well as the objective function  .We now distinguish the three phases of the model more formally: Stage 1: initial solutions.In the first stage of the model -the initial stage -the defender selects an initial solution.We assume the defender can select any kidney exchange solution, i.e., the set of feasible initial solutions is the set  of feasible kidney exchange solutions on , i.e., Given an initial solution  ∈  , we refer to a cycle  ∈  as an initial cycle, and to a chain  ∈  as an initial chain.
Stage 2: attacks.For the second stage -the attacker's stage -the attacker has an attack budget  ∈ Z >0 , indicating the number of pairs and non-directed donors that can be ''attacked'', corresponding to donor/recipient withdrawals.In other words, the set  of feasible attacks is given by In general, we have that The subset sign indicates that there might exist kidney exchange solutions  ∈  [  ] that are not allowed due to further restrictions imposed by the underlying (implicit) recourse policy.Whenever we consider an explicit recourse policy , we write   (,  ) to indicate the set of recourse solutions respecting policy .
Recourse policies.We now consider two policies for recourse in kidney exchange programs: the Full Recourse (FR) policy proposed by Carvalho et al. (2021) and the novel Fix Successful Exchanges (FSE) policy.
In the Full Recourse (FR) policy, no additional restriction is imposed on the set of recourse solutions, i.e., given initial solution  and attack  , we have that As a result, any feasible kidney exchange solution that does not involve withdrawing donors and recipients is also a feasible recourse solution.One clear advantage of FR is that it provides the highest degree of flexibility in selecting recourse solutions.Nevertheless, the full recourse policy might leave individual recipients dissatisfied.Namely, recipients who are selected for a (successful) exchange in the initial solution are not guaranteed to receive a transplant according to the recourse solution.
With this issue in mind, we consider the Fix Successful Exchanges (FSE) policy, which addresses these drawbacks and aims at minimizing such disadvantages.To our knowledge, all recourse policies previously studied in the literature of kidney exchange programs are based on restricting recourse based on a subset (,  ) ⊆ [  ] of allowed exchanges for any recourse solution.We consider similar notions   (,  ) and   (,  ) for the sets of allowed cycles and chains.In contrast, the FSE policy additionally indicates a set of exchanges that must be enforced given initial solution  and attack  , i.e., exchanges that must be included in any feasible recourse solution.We denote the set of enforced exchanges by Enf (,  ) ⊆ [  ].
For the FSE policy, we can formalize the definition of Enf (,  ) as follows.First, the cycles of the set Enf (,  ) are the initial cycles  ∈  ∩   such that  ∈   [  ], i.e., initial cycles containing no attacked (withdrawing) pairs.Second, for each initial chain  ∈  ∩  , we enforce the unique subchain consisting of all vertices up to (but not including) the first withdrawing pair or non-directed donor, if any.More formally, we define this subchain as the enforced partial chain of .
Definition 1 (Enforced Partial Chain).Let us be given an initial solution  and attack  , and let  = (,  1 , … ,   ) ∈  ∩   be an initial chain, i.e.,  ∈ , and   ∈  for each  ∈ {1, … , } for some 1 ≤  ≤ .Then, we define the enforced partial chain of  in any feasible recourse solution   ∈  FSE (,  ) as An example of enforced partial chains for a chain of length 3 is depicted in Fig. 2.
To summarize, the chains of the set Enf (,  ) are the enforced partial chains of the initial chains  ∈  ∩   .Hence, we can write the set of enforced exchanges as This definition of Enf (,  ) allows us to formalize the set of feasible FSE recourse solutions, i.e., In other words, we enforce (fix) the successful (parts of) initial exchanges to be included in the recourse solution.Furthermore, any other exchange  ∈ [  ] involving the remaining non-attacked pairs and non-directed donors could be added to the recourse solution.
On the one hand, this recourse policy has significant advantages from an organizational point of view, as cycles and chains without failures can immediately proceed to transplant.This reduces the waiting time for the recipients involved in a successful exchange.In contrast, under full recourse, the recipients involved in such successful exchanges are not guaranteed to receive a transplant, and pairs might get reassigned to new exchanges.The FSE policy thus reduces uncertainty for recipients and transplant centers alike.
Nevertheless, the drawback of the FSE policy is that we restrict the set of feasible recourse solutions.Consequently, it might occur that in the final recourse solution concerning FSE, the number of transplanted recipients is strictly smaller than it would be the case with FR.We believe, however, that the negative impact of deploying the FSE policy will be limited.Our computational results in Section 4 show that for most instances, the attainable objective value for the FSE setting either coincides or is just one less compared to the objective value in the FR setting.The FSE policy thus provides an intuitive solution concept that both benefits the donor and recipient experience as transplants are guaranteed to occur once none of the involved pairs and non-directed donors withdraw from the kidney exchange program.
We will show next in Sections 2.3 and 2.4 how the trilevel optimization problem can be formalized using mathematical programming formulations.

Stage 1: column-and-constraint generation (C&CG) algorithm
One approach for solving defender-attacker-defender models is to first reformulate the model as a single-level optimization problem.
This can be done by considering all feasible attacks  ∈  for the attacker.
In particular, the robust kidney exchange problem with recourse can be described in general as We show now that ( ) provides a valid formulation for the trilevel optimization problem.Objective (4a) introduces a dummy variable  ∈ R ≥0 that will be used to capture the worst-case objective value.
Clearly, Constraint (4c) requires  to be a feasible initial solution, and Constraints (4d) require   to be a feasible recourse solution given attack  ∈  .Furthermore, it follows from Constraints (4b) that the value of  in an optimal solution will be equal to whenever X ∈  is an optimal initial solution, and   ∈  ( X,  ) is an optimal recourse solution given initial solution X and attack  ∈  .The main advantage of transforming a trilevel optimization model into a single-level optimization model is we can use techniques known from the literature, such as algorithms for solving mixed-integer programs (MIPs).We will show in Section 3 that this model can be written as a mixed-integer linear program for commonly used encodings of kidney exchange solutions.Nevertheless, the linearization of the multi-level optimization model comes at the cost of creating an extremely large MIP.As Problem (4) has both constraints and variables indexed by each attack  ∈  , the number of constraints and variables are exponential in the size | | of the kidney exchange pool.Today's MIP solvers are not able to deal with such large formulations, hence we cannot simply provide this full description to a solver.Nevertheless, this mathematical program contains a special structure, as the constraint matrix contains a block submatrix for each attack  ∈  , with a relatively small number of coupling constraints (4b).One commonly used approach for solving MIP models of this structure is the column-and-constraint generation algorithm (C&CG), as described below.We refer the reader to Zeng and Zhao (2013) for a description of the column-and-constraint generation algorithm for general two-stage robust optimization models.In our specific setting, the C&CG algorithm works as follows: 1. Let  ⊆  be a small subset of feasible attacks.2. Solve the restricted problem (  ), with optimal solution ( X, Ȳ , θ), where Ȳ = ( Ȳ  )  ∈  .3. Solve the bilevel subproblem given optimal initial solution X ∈  : Let ( Ū , Ȳ Ū ) be an optimal solution to ( X).
From a high-level perspective, one solves the problem while only accounting for a restricted set  of feasible attacks.The initial solution X is then tested against other attacks to see whether there exists a not yet considered attack Ū ∈  ⧵  for which an optimal recourse solution Ȳ Ū violates the current solution of the restricted problem, i.e., If this is true, it is clear that the current set of attacks  is not enough to describe worst-case behavior and we will need to add Ū to it.
Otherwise, an optimal solution has been found.As | | is finite, this algorithm will eventually terminate such that the problem is solved to optimality.

Stage 2: cutting plane algorithm
Carvalho et al. ( 2021) proposed a branch-and-bound type algorithm for solving ( X), where branching is performed by either fixing a vertex to be attacked ( ∈  ) or not attacked ( ∉  ), leading to two new subproblems.For each subproblem, a lower bound is computed by considering the initial solution  and the fixed attacks, and extending the attack  in a greedy fashion as if no recourse options exist.Aside from that, the best recourse solution   ∈  (,  ) with respect to  is computed.As  is feasible, but not necessarily optimal to (), this gives us an upper bound to the optimal value.The column-andconstraint generation method, using this branch-and-bound approach for generating columns and constraints, was tested in the computational experiments of Carvalho et al. (2021).It was shown that for realistic instances with 50 incompatible donor-recipient pairs and attack budget  ∈ {1, 2, 3, 4}, this method was able to solve the entire defenderattacker-defender model within the time limit of one hour but struggled with instances of 100 pairs due to large sizes of the branch-and-bound trees involved.
In this paper, we propose an alternative algorithm based on cutting planes for solving the bilevel subproblem () to provide a method that can solve larger instances.This is done through linearizing the model by first projecting out the variables of the lower-level problem, namely the variables encoding the recourse solution   ∈  (,  ).Additional constraints are imposed to ensure that the restrictions of the recourse policy are properly addressed.
We propose a reformulation of () based on value functions (Dempe et al., 2015;Bolusani and Ralphs, 2022).The value function of this formulation can be written as where   ∈  (,  ) is an optimal recourse solution given  and  .The issue with this value function is that the feasible set  (,  ) depends on the initial solution  and the attack  .To be able to reformulate the problem as a single-level problem, we first need to formulate a value function for which the feasible set does not depend on preceding decisions.
Observe that any feasible recourse solution   ∈  (,  ) can be obtained from some maximal kidney exchange solution  ∈  by removing each  ∉ (,  ) from  .In other words, if we denote the set of disallowed exchanges given  and  by (,  ) =  ⧵ (,  ), we can write   =  ⧵ (,  ).For given  and  , the set of disallowed exchanges (,  ) is fixed, hence we can restrict the defender's decision by choosing a feasible kidney exchange solution  ∈  .The value function can thus be rewritten as In that way, the bilevel optimization problem () can be reformulated as a single-level optimization problem, as the feasible set of (,  ) does not depend on preceding decisions anymore.The inner maximization problem can then be reformulated by adding constraints for each feasible kidney exchange solution Ŷ ∈  .As a result, we get the following single-level reformulation for ().
min  (9a) One drawback of this reformulation is it comes at the expense of an exponential number of constraints of type (9b).Following Fischetti et al. (2019), who also studied this type of constraints, we refer to these as interdiction cuts, as the set (,  ) interdicts exchanges that are disallowed in any recourse solution, based on the restrictions imposed by initial solution , attack  , and (implicit) recourse policy .
As kidney exchange instances consist of rather sparse graphs, we will see in Section 3 that (;  ) can be formulated as a mixed-integer linear program, using a relatively small number of variables compared to the number of constraints.This justifies the use of a cutting plane method to solve this problem.We start by considering the restricted problem ( X;  ) based on initial solution X and a small subset  ⊂  of feasible kidney exchange solutions.We can describe the algorithm as follows: 1. Solve the problem ( X;  ), i.e., with Constraints (9b) restricted to  .Suppose ( Ū , φ) is an optimal solution to ( X;  ).

Solve the separation problem
Observe that ( X, Ū ) is equivalent to the weighted kidney exchange problem, in which exchange weights   (,  ) are defined as follows: Suppose Ȳ is an optimal solution to ( X, Ū ).The efficiency of the cutting plane algorithm is based on the empirical observation that kidney exchange problems are easy to solve in practice despite their theoretical hardness.3.If ( X, Ū ) < (  ), then we have that Ū needs to be added to  .In other words, the attack Ū corresponds to both a set of columns and rows that need to be added to the constraint matrix of the restricted master problem.Otherwise, if ( X, Ū ) > φ, we add the interdiction cut related to Ȳ to the model, i.e., we consider ( X;  ∪ { Ȳ }), and go to Step 1. Otherwise, it holds that ( X;  ) = ( X, Ū ), i.e., the master problem is solved to optimality.
Regarding the interpretation of the separation problem (10) as a weighted kidney exchange program, notice that the weight of each disallowed exchange equals zero.Therefore, there is no guarantee that Ȳ is also maximal, as there might exist a disallowed exchange  ∈ (,  ) ⧵ Ȳ that could be added such that  ′ = Ȳ ∪ {} ∈  as well.Notice that the interdiction cut (9b) corresponding to  ′ is stronger than the one corresponding to Ȳ ; indeed, note that As such, adding exchange  to the solution cannot weaken the interdiction cut (9b).Moreover, for attacks Û with  ∉ (, Û ), and for  ′ is strictly stronger.
We will refer to these stronger cuts as lifted interdiction cuts, as such cuts can be obtained from Ȳ by adding -i.e., lifting the coefficients of -disallowed exchanges  ∈ ( X, Ū ).
To separate lifted interdiction cuts, we consider a modified variant  ′ ( X, Ū ) of the separation problem.Let us denote by | | the number of exchanges that  consists of.Based on the approach of Fischetti et al. (2019), the modified separation problem can be formulated as follows: This modified separation problem differs from the original separation problem as it considers a hierarchy of two objectives.The first objective coincides with the objective of the original separation problem, whereas the secondary objective (i.e.,  ⋅ | |) prioritizes kidney exchange solutions consisting of a large number of exchanges.In particular, this ensures that we obtain a maximal kidney exchange solution  , which often means that there exist disallowed exchanges  ∈  , i.e.,  ∉ (,  ).Indeed, this is only a secondary objective, or tiebreaker, due to the introduction of the sufficiently small parameter  > 0. It would suffice to select  < 1∕| | to ensure that it does not interfere with the primary objective of finding an optimal recourse solution.
We now illustrate in Fig. 3 the practical benefit of deploying this modified separation problem, showing how it can lead to significantly stronger cuts.In this example, suppose  = 3 and  = 2.There exists an initial solution  ∈  covering all vertices, namely the cycles ( 7 ,  8 ,  7 ), ( 4 ,  9 ,  4 ), ( 2 ,  6 ,  5 ,  2 ), and the single chain ( 1 ,  1 ,  3 ).Furthermore, let  = { 2 ,  8 } ∈  be a feasible attack (suppose  = 2).The black arcs indicate an optimal solution  to (,  ).This solution, however, is not maximal and hence not optimal for  ′ (,  ), but the alternative solution  ′ obtained from extending  with the cycle ( 7 ,  8 ,  7 ) is optimal.Whenever another attack  ′ is considered -such that the cycle between  7 and  8 is allowed, i.e., contained in (,  ′ ) -the contribution of this cycle to the right-hand side of the interdiction cut (9b) of  ′ is positive, meaning that the interdiction cut of  ′ strictly dominates  .
We will show that the modified separation problem is not significantly harder to solve than the original version.Namely, we can again D. Blom et al. rewrite the problem as a weighted kidney exchange problem, by simply re-weighting the exchanges with weights  ′  (,  ) defined as An additional beneficial consequence of this re-weighting is that it favors solutions with a large number of short exchanges, i.e., 2-cycles and short chains.For instance, if there exists a set of six vertices that could be covered by using either (i) two 3-cycles or (ii) three 2cycles, the latter option will be selected as it includes more exchanges.Such solutions are also typically stronger cuts, as solutions with many short exchanges are more robust against withdrawals of pairs and non-directed donors, compared to solutions covering the same pairs and non-directed donors with larger exchanges.In Section 4, insights are provided on the impact of deploying the original and modified separation problems on the cutting plane algorithm, and how it impacts the practical computational efforts needed by our solution method.

Formulations
In this section, we provide concrete formulations for the models described in Section 2. We start by providing the formulations based on the cycle-chain (CC) formulation for basic kidney exchange problems for both recourse policies in Section 3.1.Secondly, we do the same for the position-indexed chain-edge formulation (PICEF) in Section 3.2.In particular, we formalize that each of the three decisions to be made can be optimized by solving single-level mixed-integer linear programming (MILP) models.

Cycle-chain formulation
In this section, we consider the formulations for the three levels of the robust optimization problem as described in general in Section 2.2 based on the cycle-chain formulation for kidney exchange problems.We start by considering the master problem formulation   ( ) in Section 3.1.1.Formulations for second-level problem -the attackerdefender subproblem -  (;  ) are considered in Section 3.1.2.Finally, we consider the recourse problem   (, ) given initial solution  and attack  in Section 3.1.3.

CC: Master problem
First, we reconsider the CC-based formulation  FR,CC ( ) for the master problem, which was proposed in Carvalho et al. (2021).We consider variables   ∈ {0, 1} encoding whether the exchange  ∈  is contained in the initial solution  ∈  .Furthermore, we associate with each attack  ∈  its characteristic vector  ∈ {0, 1}  , i.e., with entries   = 1 if and only if  ∈  .With a slight abuse of notation, in the context of concrete formulations, we will also refer to  ∈  as an attack.Similarly, for each attack  ∈  , we consider variables    ∈ {0, 1} encoding whether the exchange  ∈  is contained in the recourse solution   ∈  (,  ) given  and  .Furthermore, we consider variables    ∈ {0, 1} indicating for each pair  ∈  whether  ∈  () ∩  (,  ,   ) or not.The formulation  FR,CC ( ) can then be written as follows: We briefly discuss the formulation to argue its correctness.Constraints (13c) and (13d) indeed ensure that    = 1 in an optimal solution if and only if  ∈  () ∩  (,  ,   ).Constraints (13e) and (13f) are packing constraints ensuring that  ∈  and   ∈  CC (,  ).Constraints (13b) concretize the constraints (4b) described for the general framework.Notice that the structure of this model allows us to relax the integrality conditions on    to    ≥ 0.
Remark 2. As kidney exchange problems commonly have multiple optimal solutions, it makes sense to implement a tiebreaker to obtain an initial solution  to (13) that is most preferable in more optimistic scenarios.One example is to consider a solution that would be optimal in case no failures occur, which can be obtained by adapting the objective function (13a) to where  () is the set of donor-recipient pairs involved in exchange .
Here,  > 0 is a sufficiently small parameter so that this secondary objective does not interfere with the primary objective of getting the most robust solution, i.e., Modifications for  FSE,CC ( ) Formulation (13) needs to be adapted in order to correctly model the FSE recourse policy in the master problem since this policy requires that we enforce (parts of) successful initial exchanges.For that purpose, we adapt the definition of the set of enforced exchanges to this setting with variable encodings  and  of the initial solution and attack, respectively.
Here, epc  () denotes the natural adaptation of the enforced partial chain epc  () to the characteristic vector representation of attacks, and   = { ∈  |   = 0} the set of non-attacked vertices given attack .Now, we want to define for each  ∈  ∪  and  ∈  , the set of exchanges that, if contained in the initial solution , would lead to  being involved in an enforced exchange given , i.e., We can now obtain the formulation  FSE,CC ( ) by adapting  FR,CC ( ).First, it is important to note that    now denotes only the choice of nonenforced exchanges in the recourse solution.The presence of enforced exchanges in recourse solutions is handled through the   variables and sets   ().We then replace Constraints (13d) and (13f) by Notice that if for an attack , there exists some  ∈   () with   = 1, then this implies that the corresponding recourse solution must contain an enforced exchange which includes pair .As    represents the non-enforced exchanges, the right-hand side of Constraint (14a) and left-hand side of Constraint (14b) correctly considers whether there is some exchange containing the pair or NDD  ∈  ∪ .
D. Blom et al.

CC: Attacker-defender subproblem
We now consider MILP formulations of the subproblem  CC () faced by the ''attacker'' in the second-stage of the trilevel model, given  optimal to  FR,CC (  ) for some  ⊂  .Notice that whenever an attack  ∈  has been realized, a recourse solution   ∈  CC (, ) will be selected that does not consider exchanges that have an attacked vertex.For each exchange  ∈ , we define the weight   () as i.e., the number of pairs  ∈  () that are involved in some initial exchange with respect to .Following the framework described in Section 2.4, we obtain the following single-level reformulation for the bilevel subproblem, where   is a binary variable modeling whether  ∈ (, ) is an allowed exchange for the recourse solution given .
min  (15a) Here, Constraints (15b) are a concrete description of the interdiction cuts (9b) described for the general framework in Section 2.Moreover, Constraints (15c) ensure that  ∉ (, ) if  contains attacked vertices.
Remark 3. Due to the structure of  FR,CC (;  ) (especially, the interdiction cuts (15b)), we can without loss of generality relax the integrality of the  variables, as there exists some optimal solution for which   is set to its largest lower bound requires by the constraints, which is max{0, 1 − ∑ ∈ ()   } ∈ {0, 1}.
Modifications for  FSE,CC (;  ).To obtain a valid formulation for the attacker-defender subproblem  FSE,CC (;  ), we again need to handle the enforced exchanges.Indeed, under this recourse policy, exchanges can also be excluded from a recourse solution if they intersect with an enforced exchange.For this purpose, we define the set Enf () of enforceable exchanges, defined as follows, This is the set of exchanges that could be enforced for at least one attack .Observe that it depends on the attack selected by the attacker which of the enforceable exchanges  ∈ Enf () are enforced.Finally, we obtain the formulation  FSE,CC (;  ) by replacing Constraints (15c) with the following linear inequalities: Constraints ( 16a) and (16b) correspond to Constraints (15c) of the FR setting, with the difference that non-enforceable exchanges  ∈  ⧵Enf () can be disallowed from the recourse solution given , i.e.,  ∉ (, ), if  intersects with an enforced exchange  ′ ∈ Enf (, ).This can even be the case when  ∈ [  ].Constraints (16c) are a necessary addition in the FSE setting.Where we could previously rely on   attaining its largest lower bound in some optimal solution, this is no longer the case due to the interaction of -variables in Constraints (16a).Without Constraints (16c), it is possible to set  ẽ = 1 for an enforceable exchange ẽ ∈ Enf (), even if  ∉ [  ], i.e., if  has attacked vertices.This might be beneficial with respect to the objective of the attacker-defender subproblem, as then we can set   = 0 for all non-enforceable exchanges  ∈  ⧵Enf () intersecting ẽ.For this reason, Constraints (16c) ensure that   = 0 for any attacked enforceable exchange .Hence, these constraints correctly model the impact of the FSE policy.

CC: Recourse problem
Notice that the formulation of the attacker-defender subproblem  FR,CC (;  ) contains an exponential number of Constraints (15b).We will refer to these constraints as interdiction cuts, as these constraints implicitly model for each feasible kidney exchange solution  ∈  which exchanges can be selected in the recourse solution given attack  ∈  .The algorithm proposed in Section 2.4 relies on an efficient method for finding violated constraints.Below we describe the corresponding separation problem.This allows us to write the problem  FR,CC (, ) of finding the optimal recourse solution   ∈  FR,CC (, ) as a single-level mixed-integer program, namely Constraints (17b) impose that when vertex  ∈  ∪ is interdicted, then none of the exchanges  ∈   can be selected for the recourse solution.
Therefore, any optimal solution to Problem ( 17) is also a feasible recourse solution under .In other words, Problem ( 17) is equivalent to the problem of finding a weighted kidney exchange solution on the subgraph [  ].We consider a modified version  ′ FR,CC (, ) of the separation problem that ''lifts'' optimal solutions for (17) to maximal kidney exchange solutions on the entire compatibility graph , to separate stronger interdiction cuts (15b).We can obtain this modified separation problem by making two modifications.First, we need to replace objective coefficients   () by alternative objective coefficients, consistent with the definition in ( 12) and secondly, we relax the right-hand side of Constraints (17b) to 1 such that also interdicted exchanges  ∉ (, ) could be selected in the solution.Given   feasible to  ′ FR,CC (, ), the associated set of exchanges   = { ∈ (, ) |    = 1} forms an optimal solution to the original problem  FR,CC (, ).This can be seen as follows.The weights  ′ are defined to prioritize non-attacked exchanges with high original weight   (), and ensure that the set of non-interdicted exchanges in the optimal solution indicate an optimal solution for the original separation problem  FR,CC (, ).Ties are broken by selecting the solution with the largest number of exchanges (due to the +1 term).Our experiments have shown that separating interdiction cuts based on  ′ FR,CC (, ) leads to strictly stronger cuts, at no significant expense in terms of computation time.

Position-indexed chain-edge formulation
We also provide mixed-integer programming formulations based on the position-indexed chain-edge formulation (PICEF) introduced by Dickerson et al. (2016) .PICEF can be regarded as a hybrid variant of the cycle-chain formulation and edge formulation.Its main advantage is that it avoids full enumeration of all chains in the compatibility graph, as the number of chains might be exponential in .
Instead, it considers a formulation of chains in terms of arc variables with an additional index for their position in a chain.For basic kidney exchange problems, this is of particular interest when the maximum chain length  increases.Similar to CC, we consider initial variables   ∈ {0, 1} for each cycle  ∈   indicating whether or not  is contained in the initial solution.Nevertheless, chains are not explicitly enumerated, but instead described by a collection of variables  , , for each arc (, ) ∈  and position index  ∈  = {1, … , }.Here, arcs going out of the non-directed donor have position index 1, the subsequent arc has index 2, etc.. Therefore, for each arc (, ) ∈ , the actual set (, ) of possible position indices is often more restrictive.In particular, for each arc (, ), we have (, ) = {1} if  ∈ .Conversely, an arc (, ) with  ∈  could have any position index greater than 1, i.e., (, ) ⊆  ⧵ {1} if  ∈  .We refer to the paper by Dickerson et al. (2016) for techniques to reduce the sizes of these lists (, ) based on the topology of the compatibility graph , as this leads to formulations with (significantly) fewer variables.

PICEF: Master problem
Similar to the initial solution encoding  ′ , we consider for each attack  ∈  the variables    ∈ {0, 1} for each cycle  ∈   , and   , ∈ {0, 1} for every position-indexed arc (, , ) ∈   to encode which cycles and chains are contained in the recourse solution under .We denote by ( ′ )  = (  ,   ) the entire encoding of the recourse solution under , for all possible attacks  ∈  .Again, we consider for each pair  ∈  and attack  ∈  the variables    ∈ {0, 1}, which have the exact same interpretation as in the CC-based formulations.The PICEF-based formulation  FR,PICEF ( ) of the master problem -first presented in Carvalho et al. (2021) -can then be described as follows: Here, notice that Constraints (18c)-( 18f 18h) indicate that for each NDD  ∈  and attack  ∈  , at most one of the arcs going out of  can be selected for the initial and recourse solution given .Finally, Constraints (18i) and (18j) are precedence constraints for the initial and recourse solutions respectively, indicating for each  ∈  and  ∈  ⧵ {} that one can only select an arc going out of  with index  + 1 if an arc going into  is selected with index .
Modifications for  FSE,PICEF ( ).Again, we need to apply several modifications to derive a PICEF-based formulation  FSE,PICEF ( ) of the master problem in the FSE setting.Let us consider an initial solution  ′ = (, ) and an attack  ∈  .Recall that for the cycle-chain formulation, we could rely on a set   () of exchanges that, if selected as an initial exchange, would imply an enforced transplant in the recourse solution given .This was possible due to the enumerative nature of the formulation.In contrast, PICEF gives us only local information about chains, namely single transplants and their position in the chain.For that reason, we can only say if a position-indexed arc (at index ) is enforced in the recourse solution if we know which set of  − 1 arcs precede it.In other words, with regard to PICEF, there exists an additional dependence on .
We define the set (, ) of enforced arcs in the recourse solution given  in a recursive fashion as follows: , = 1; ∃ ∶ (, ) ∈ (, ); and Observe that we can omit position indices from this definition, as these can be derived from .To model for each arc (, ) ∈ (, ) whether it is enforced in the recourse solution given  and , we consider additional variables    ∈ {0, 1}.This can be modeled by adding the following constraints, which we discuss below:    , describes the nonenforced cycles and chains respectively.Constraints (21b) and (21c) require that each pair and each NDD respectively, are involved in at most one exchange, or in no exchange if this pair or NDD is attacked.

PICEF: Attacker-defender subproblem
We provide a PICEF-based formulation  FR,PICEF ( ′ ;  ) for the attacker-defender subproblem.Similarly to the CC-based formulation (15), we have a variable   for each cycle  ∈   such that and   = 0 otherwise.However, we cannot follow a similar approach with variables  , for position-indexed arcs (, , ) ∈   .For each (, , ) ∈   with  ≥ 2, it depends on the chain  ∈   whether arc (, ) at position  is feasible.For that reason, we cannot unambiguously set the variable  , to 0 or 1. Fig. 4 illustrates this issue.
For the chains, we can circumvent this issue by replacing the position index  by a chain index  ∈   , i.e., we consider variables    ∈ {0, 1} instead of  , ∈ {0, 1}.As we generate interdiction cuts on the fly, we do not need to enumerate all chains in advance, meaning that we still preserve this benefit of position-indexed arc formulations over the cycle-chain formulation in terms of compactness.
We define the cycle weight   ( ′ ) for each  ∈   as and the arc weight   ( ′ ) for each (, ) ∈  as Furthermore, for any  ∈  ∩  (), we denote by  → the subchain of  up to and including pair  ∈  .The attacker-defender subproblem  FR,PICEF ( ′ ;  ) can then be formulated as a MILP as min  (24a) Here, Constraints (24b) again take the role of implementing the interdiction constraints (9b).Constraints (24c) and (24d) model that  ∈   (, ), and (, ) ∈ (, ) for (, ) ∈ ().Then, for each feasible kidney exchange solution  ∈  , the right-hand side of Constraints (24b) equals the weight of the cycles and (partial) chains containing no interdicted vertices with respect to the variables .
Modifications for  FSE,PICEF ( ′ ;  ).Below, we also provide the formulation  FSE ( ′ ;  ) tailored to the FSE recourse policy.We again need some modifications to the formulation  FR,PICEF ( ′ ;  ) to correctly model the attacker-defender subproblem in the FSE setting.
To model  FSE ( ′ ;  ) via PICEF, we again need to distinguish between the set of enforceable exchanges -encoded by Enf ( ′ ) -and the non-enforceable exchanges.Furthermore, we denote by Enf () and Enf () the sets of enforceable cycles and enforceable chains respectively, i.e., For each enforceable cycle  ∈ Enf () we require that the variable   = 1 if and only if  ∈   (, ) given , i.e., we require   = 1 if  is an enforced cycle given  and .Similarly, we require for each enforceable chain  ∈ Enf () that the variable    = 1 if and only if (, ) ∈ (, ) given  and .In other words,    = 1 if the arc (, ) is enforced given  and .
Furthermore, we introduce variables   ∈ {0, 1} for each pair or NDD  ∈  ∪  indicating whether or not  is involved in an enforced cycle  ∈   (, ) or an enforced arc (, ) ∈ (, ), depending on the attack .

PICEF: Recourse problem
Finally, we provide the PICEF-based formulation  FR,PICEF ( ′ , ) for the separation problem of finding optimal recourse solutions given initial solution  ′ ∈  and attack  ∈  .
In this formulation, we consider variables    ∈ {0, 1} for each  ∈   , and   , ∈ {0, 1} for each position-indexed arc (, , ) ∈   , indicating the exchanges of the recourse solution given .We define the weights   ( ′ , ) =   ( ′ ) for each cycle  ∈   , and   ( ′ , ) =   ( ′ ) for each arc (, ) ∈ .The formulation of the separation problem  FR,PICEF ( ′ , ) can be written as (26f) Constraints ( 26b) and (26c) ensure that the solution (  ,   ) encodes a packing of cycles and position-indexed arcs, as pairs and NDDs respectively are limited to be involved in at most one exchange.Constraints (26d) are the precedence constraints for position-indexed arcs in the recourse solution, as an arc going out of pair  with position index  + 1 can only exist in the recourse solution if there exists an arc going into pair  with position index .The separation problem modeled by Formulation ( 26) is equivalent to a weighted kidney exchange problem on the subgraph induced by   .
To obtain the modified version  ′ FR,PICEF ( ′ , ) of the PICEF-based separation problem, we also need to take into account which cycles and (partial) chains of solutions are feasible.In the case of cycles, this can be realized again through a modification of the cycle weights, i.e., Again, as position-indexed arcs only hold local information of a chain, a similar modification does not work for position-indexed arc variables, as it might allow for infeasible chains of large weight.To overcome the issue, we introduce variables    ∈ {0, 1} for each arc (, ) ∈  to encode the feasible partial chains of the chains encoded by   in the recourse solution under  (i.e, the part of the chains encoded by   , still feasible after attacks ).

The arc weights 𝑤 ′
( ′ , ) for all arcs (, ) ∈  are then defined as Here, the arcs going out of a non-directed donor  ∈  are given a slightly larger weight to prioritize solutions with the maximum number of chains.Such solutions intuitively lead to stronger interdiction cuts, as it will be more difficult for an attacker with a limited attack budget to disrupt all exchanges.
Although the feasible (sub)chains of the optimal recourse solution are given by the   -variables, the terms for the chains in the cuts we generate are induced by the   -variables.The idea here is to find a maximal feasible kidney exchange solution (  ,   )-with respect to the entire graph -such that its non-attacked cycles and (sub)chains form an optimal recourse solution under .To ensure maximality, we assign an objective coefficient of 1 to the   variables.This value ensures any optimal solution to the modified recourse problem still induces an optimal solution to the original recourse problem if we restrict ourselves to the set of non-interdicted exchanges.The modified recourse problem  FR,PICEF ( ′ , ) can then be written as  27), respectively, by fixing variables as follows: Remark 4. All of the formulations provided in this section could be extended to the case of both vertex and arc failures.For this purpose, one needs to redefine the set of attacks as Furthermore, we need additional variables   ∈ {0, 1} for each (, ) ∈ , indicating whether or not the arc (, ) is attacked, and additional constraints need to be added to the formulations that disallow the use of an exchange if one of its arcs is attacked.

Strength of formulations
Typically, the strength of different MIP formulations is compared by the value of their LP relaxations.In the context of the basic (singlestage) kidney exchange problem, this has been done by Dickerson et al. (2016) for the cycle-chain formulation and position-indexed formulations respectively.This comparison, however, is only meaningful in case the compared MIP models have the same optimal objective value.In the following, we will show that the optimal MIP value for PICEF can strictly dominate the one of CC, with regard to the second-level problems  ,CC (;  ) and  ,PICEF ( ′ ;  ) respectively.
Recall that we solve these through a cut generation procedure.Most importantly, we solve the relaxations  ,CC (;  ) and  ,PICEF ( ′ ;  ), where a limited set  ⊂  of kidney exchange solutions are considered.We show that the relaxation of the PICEF-based formulation is stronger than the relaxation of the CC-based formulation.We denote by  * FR,PICEF ( ′ ;  ) the value of the optimal solution to (24), and by  * FR,CC (;  ) the optimal solution value of (15).Proof.To prove  * FR,PICEF ( ′ ;  ) ≥  * FR,CC (;  ), we compare the righthand sides of Constraints (15b) and Constraints (24b).We claim that for a given recourse solution  ∈  and any fixed attack , the right-hand side of the PICEF variant is at least as large as the right-hand side of the CC variant, i.e., Since the cycle variables are handled identically in both formulations, we must only prove that If for a given chain  ∈  ∩   , no vertices  ∈  () are attacked, we have   = 1 (due to Constraints (15c)), as well as    = 1 for all (, ) ∈ () (due to Constraints (24d)).By definition, ∑ (,)∈()   ( ′ ) =   ( ′ ), thus chains that are not attacked contribute the same value to the right-hand sides in both formulations.If the chain is attacked at any point, then   = 0, and the chain does not contribute to the right-hand side of Constraints (15b).As   ( ′ ) ≥ 0 and    ≥ 0 for all (, ) ∈ (), the inequality in (28) follows.
For this instance,  * FR,CC (;  ) = 0, which can be achieved by attacking pair 3 or pair 4.However, in the PICEF formulation, attacking pair 3 or 4 forces   1,2 = 1, and  * FR,PICEF ( ′ ;  ) ≥ 1 due to recourse solution  1 .Not attacking either of these pairs forces   = 1 for the cycle (3, 4), and  * FR,PICEF (;  ) ≥ 2. Consequently, for this instance  * FR,PICEF ( ′ ,  ) >  * FR,CC (;  ).□ Notice that for single-stage kidney exchange programs, it was shown by Dickerson et al. (2016) that the LP relaxation of the cycle-chain formulation is strictly stronger than the LP relaxation for PICEF.However, our result implies that the PICEF-based formulation leads to stronger relaxations for the attacker-defender subproblem than the CC-based formulation.A similar result holds for the formulations with respect to the FSE policy.

Theorem 6.
Given a graph , set of exchanges , initial solution, encoded by  and  ′ respectively for CC and PICEF, and a set of feasible kidney exchange solutions  , we have  * FSE,PICEF ( ′ ;  ) ≥  * FSE,CC (;  ).Furthermore, there exist instances for which given  ⊂  , we have that  * FSE,PICEF ( ′ ;  ) >  * FSE,CC (;  ).We have moved the proof of Theorem 6 to Appendix A, as the argument is of a similar flavor compared to the Full Recourse case.

Computational results
The aim of this section is to evaluate the performance of our cutting plane approaches, which we will refer to as cut-CC and cut-PICEF for D. Blom et al. the implementation based on the cycle-chain and the position-indexed chain-edge formulations, respectively.These cutting plane approaches are compared with the branch-and-bound approach by Carvalho et al. (2021) on practical instances for the Full Recourse setting.In this section, we investigate the following questions: Full Recourse: (Q1) Are cut-CC and/or cut-PICEF computationally more efficient than the branch-and-bound approach, both with respect to computation times and the number of solved instances?(Q2) Does cut-PICEF outperform cut-CC or vice versa?

FSE:
(Q3) Are cut-CC and/or cut-PICEF computationally tractable methods for solving the robust kidney exchange problem whenever recourse is allowed according to the FSE policy?(Q4) Does cut-PICEF outperform cut-CC or vice versa?(Q5) Are the robust objective values under the FSE setting comparable to the values for Full Recourse, i.e., how large is the loss in the guaranteed number of transplants by imposing FSE constraints on recourse solutions?
In the following, we first discuss our computational setup and used test sets in Section 4.1.Afterward, we present a comparison of the cutting plane algorithms against the branch-and-bound scheme in Section 4.2.Moreover, we explore the tractability of instances under the FSE policy by cut-CC and cut-PICEF in Section 4.3.We finish by discussing the impact of our cut-lifting techniques in Section 4.4.

Test sets and computational setup
In our experiments, we have used the same test set as Carvalho et al. (2021) which is publicly available. 1This test set consists of ninety graphs of which thirty contain 20, 50, and 100 vertices, respectively.More characteristics of these graphs can be found in Carvalho et al. (2021), they are based on the instance generator described by Saidman et al. (2006).We note that recently Delorme et al. (2022) introduced a new instance generator based on UK data.The resulting instances are sparser, and therefore generally easier computationally.From the graphs in the Carvalho et al. set, we generate different instances of the full recourse robust kidney exchange problem by bounding the length  and  of the considered cycles and chains, respectively.
To allow for a fair comparison, we have implemented both our new methods and the reference method in C/C++ using the mixed-integer programming framework SCIP 8.0.2 with SoPlex 6.0.2 as LP solver, 2 see Bestuzheva et al. (2023).All computations were run on a Linux cluster with Intel Xeon Platinum 8260 2.4 GHz processors.The code was executed using a single thread.The time limit of all computations is 3600 s per instance.
For cut-CC and the branch-and-bound method, we compute for each instance all cycles of length at most  and chains of length at most  present in its compatibility graph.For cut-PICEF, we again compute the cycles and generate all position-indexed arcs that could potentially be part of a feasible chain, i.e., each position-indexed arc (, , ) ∈  for which there exists a path from an NDD to  of length −1 not containing .
In all methods, all cycle variables (and, if applicable, all chain or all position-indexed arc variables) are added to the initial model.Column generation techniques exist for these models (see Glorie et al., 2014;Plaut et al., 2016 among others), but these are not efficient for the smaller chain and cycle sizes we study (Dickerson et al., 2016).In 1 https://rdm.inesctec.pt/dataset/ii-2020-001 2 Our implementation is publicly available at https://github.com/DannyBlom/BendersRobustKEP/commit/93fce3fb. the branch-and-bound method, there are some degrees of freedom in selecting the branching strategy.To be able to produce results as consistent as possible with the ones described in Carvalho et al. (2021), we have implemented the same strategies as discussed there.A summary of these strategies can be found in Appendix B. When comparing with the branch-and-bound scheme of Carvalho et al. (2021), we consider the most basic implementation of cut-CC and cut-PICEF, without lifting.We also conducted experiments with the cut lifting methods described in Sections 3.1.3and 3.2.3enabled, which we will discuss in Section 4.4 in more detail.

Comparison of solution methods for full recourse
To empirically find answers to Questions , we have conducted experiments with varying maximum cycle and chain lengths  and  for the compatibility graphs described in Section 4.1.The maximum cycle length in our experiments takes value  ∈ {3, 4}; the maximum chain length is  ∈ {2, 3, 4}.We allow to attack between 1 and 4 vertices per instance in our experiments, i.e., the attack budget  ∈ {1, 2, 3, 4}; attacks of arcs are not taken into account, which is consistent with the experiments by Carvalho et al. (2021).
In comparison to the experiments described in Carvalho et al. (2021), we consider the impact of varying cycle lengths, while they only considered  = 3.We do include  = 4 since multiple European countries allow cycles of this size, e.g., the Czech Republic and The Netherlands, see Biró et al. (2020).To be concise, we only report the tables for  = 3 in the main text, as the computational results for  = 4 depict a similar comparison between methods.The results for  = 4 are presented in Appendix C. The different chain lengths in our experiments are the same as in Carvalho et al. (2021) (note, however, that they measure the length of a chain by its number of vertices instead of arcs, i.e., the numerical values are shifted by 1 compared to their article).Table 1 reports on our experiments for  = 3 and different  and  with respect to the Full Recourse policy.
Before we proceed with a discussion of our experiments, we describe the common structure of the presented tables.All mean values are given in arithmetic mean with the only exception being the average solving time, which is measured in shifted geometric mean where we use a shift of  = 10.The reason for the latter is to reduce the impact of outliers and instances with a very small running time.
Column ''#vertices'' reports the number of vertices in the tested graphs, whereas column ''#opt'' provides the number of instances solved within the time limit.The mean solution time per instance (in seconds) is given in ''time total''.For cut-CC and cut-PICEF, the columns ''stage 2'' and ''stage 3'' present the average proportion of running time spent in solving attacker-defender subproblems and recourse problems, respectively.For the branch-and-bound method, ''stage 2'' represents the problem of solving the attacker-defender subproblem with the branch-and-bound algorithm.Note that all reported times are in seconds.Column ''#att.''reports on the mean number of generated attacks per solved instance; if no instance from a test set could be solved within the time limit, the corresponding entry is ''-''.Finally, column ''#B&Bnodes'' gives the mean number of branch-and-bound nodes per solved instance for the branch-and-bound method.For cut-CC and cut-PICEF, the column ''#sub'' shows the mean number of recourse problems that needed to be solved per instance solved within the time limit.
In our experiments for maximum cycle length  = 3, we observe that all methods can solve all instances based on graphs with 20 vertices within a matter of seconds.For graphs with 50 vertices, however, there exist instances that the branch-and-bound method fails to solve within the time limit, for  = 2 and attack budget  = 4; for larger maximum chain lengths, i.e.,  ∈ {3, 4}, there already exist instances that could not be solved for which the attack budget  equals 3 or 2, respectively.In contrast to this, cut-CC could solve all instances with up to 50 vertices within the time limit whenever  ∈ {2, 3}, except for one instance.For  = 4, cut-CC can still solve over 96 % of these instances within one hour.For cut-PICEF, there are slightly more (4) instances with at most 50 vertices and  ∈ {2, 3} that could not be solved within the time limit.However, for  = 4, almost 99 % of these instances could still be solved within the time limit.Furthermore, the instances that could not be solved were based on  = 4 exclusively.
For instances with 100 vertices in the compatibility graph, the branch-and-bound method is hardly able to solve any instance if  ≥ 3 and  = 2; for increasing maximum chain lengths , even instances with  ∈ {1, 2} become challenging for the branch-and-bound approach.Whenever  = 2, the cut-CC approach is superior as it allows solving more instances than cut-PICEF for all possible attack budgets .The opposite holds whenever  ≥ 3. The benefit of cut-PICEF over cut-CC and branch-and-bound is most apparent for  = 4.In this case, cut-PICEF succeeds in solving over two-thirds of the number of instances with 100 vertices, whereas both cut-CC and branch-and-bound could only solve 4 and 3 out of the 120 instances, respectively.
Based on these experiments, we can answer Question (Q1) affirmatively as the cutting plane approaches can consistently solve more instances than the branch-and-bound method within the time limit.Specifically, we have accomplished a running time improvement of one order of magnitude for most instance sets.Furthermore, regarding Question (Q2), comparing the two cutting plane methods with each other, there is a transition related to the choice of  in which cut-PICEF starts outperforming cut-CC.Whenever the maximum chain length  is small, there exists an overhead in the formulation size for cut-PICEF causing it to be slower than cut-CC, whereas this comparison flips in case  increases.These conclusions are also supported by our experiments with maximum cycle length  = 4, as can be seen in Table C.1.This behavior is expected, due to the advantages in model size of PICEF with longer chain lengths.Furthermore, the advantage of PICEF's stronger cuts (Theorems 5 and 6) for the attacker-defender subproblem will grow as the chain length increases.
Observe that this is also reflected in our computational results.For most parameter settings, the average number of subproblems solved per master iteration is higher for cut-CC compared to cut-PICEF, even when  = 2.However, we also observe substantial variability; on an instance level, there are many examples of cut-CC requiring fewer iterations than cut-PICEF.This is possible as the recourse problems have multiple optima and the solvers for cut-CC and cut-PICEF might determine different recourse solutions, i.e., leading to different interdiction cuts.
Remark 7. When comparing the number of generated attacks for the branch-and-bound method with the numbers reported by Carvalho et al. (2021), we observe that our numbers are higher in general.Although we tried to implement the method as close as possible to the implementation of Carvalho et al. (2021), cf.Appendix B, there are still factors that might negatively impact the number of generated attacks in our implementation.Among others, the order of cycles/chains might be different in the two implementations, which might cause to find different optimal solutions in each iteration, and the MIP solver used in our experiments is different from the one used by Carvalho et al. (2021).Thus, since these factors impact both the branch-and-bound and cutting plane algorithms equally, our implementation does not give an advantage to either of these methods.

FSE: exploring tractability and efficiency
As the benefit of the cutting plane methods over branch-and-bound for the Full Recourse setting is evident, we have implemented the Fix Successful Exchanges (FSE) policy only for cut-CC and cut-PICEF.The results of our computational experiments for FSE, again based on the most basic implementation without cut lifting, can be found in Table 2.
Again, we see that all of the instances based on graphs with 20 vertices can be solved within a matter of seconds, both for cut-CC and cut-PICEF.However, for graphs with at least 50 vertices, both cut-CC and cut-PICEF take much longer to solve instances to optimality compared to the Full Recourse setting, especially for increasing attack budgets .In particular, both cut-CC and cut-PICEF fail to solve all instances even if  = 2 and  = 1.Based on the numbers in Table 2, we can make a few observations on why imposing this recourse policy complicates the problem.First of all, for the parameter settings for which none or only a fraction of the instances can be solved within the time limit, the percentage of time spent in solving the attackerdefender subproblem (stage 2) and the optimal recourse problem (stage 3) is remarkably small.In other words, most of the time is spent solving the master problem.Furthermore, compared to the Full Recourse setting, the number of attacks separated by solving attacker-defender subproblems is significantly larger on average, especially for the more challenging instances.This implies that we end up with much larger master relaxations, which typically take significantly more time to be solved.Apart from this, the mixed-integer programming formulations for all three stages are also much more complex due to the additional constraints imposed by the FSE policy.
Regarding the comparison of cut-CC and cut-PICEF, we again observe a transition as in the FR setting; for the most challenging instances with  ∈ {2, 3}, cut-CC is superior to cut-PICEF: for 100 vertices and all different attack budgets  ∈ {1, 2, 3, 4}, cut-CC can solve more instances within the time limit compared to cut-PICEF, whereas the opposite is true whenever  ≥ 4. A similar comparison can be made on the average computation times over all solved instances.The only difference here is that the transition occurs for a larger maximum chain length; cut-PICEF now starts to outperform cut-CC only whenever  = 4, whereas, in the Full Recourse setting, this was the case for  = 3 already.
To answer Questions , we can conclude that for small instances, both cut-CC and cut-PICEF can solve the problem within seconds.Nevertheless, when the kidney exchange pools and/or attack budgets grow in size, both cut-CC and cut-PICEF struggle to solve a significant fraction of the instance sets within the time limit.The impact of increasing  is more gradual for cut-PICEF, whereas, for cut-CC, a clear transition is visible between  = 2 and  = 3, leading to a similar performance comparison between cut-CC and cut-PICEF as we observed for Full Recourse.More sophisticated algorithmic techniques will be necessary to solve instances of real-life mid-size to large kidney exchange programs.
Furthermore, we have investigated the impact of the constraints of the FSE policy on the final master objective value of the instances, which is depicted in Table 3.For this comparison, we can only include the instances that we were able to solve within the time limit for both the Full Recourse and the FSE setting.We have aggregated our results for each kidney exchange pool size (20,50,100), as we believe it is one of the main instance features impacting the objective value in general.
Observe that for most instances, the objective value, i.e., a guaranteed number of patients from the initial solution receiving a transplant, is rather similar for both recourse policies.In particular, one can see that for more than 85 % of the instances with 20 vertices, the objective values of the Full Recourse and FSE settings coincide, whereas the objective values differ by more than one for less than 0.5 % of the instances.Moreover, for any of the instances solved to optimality for both FR and FSE, the maximum difference in the objective values observed is 2. We conclude that imposing the constraints on the recourse options with respect to fixing successful initial exchanges does not drastically decrease the guaranteed number of initial patients receiving a transplant given all possible attacks in a limited attack budget.Consequently, imposing the FSE policy might be a feasible option in practice, if the advantages of reducing the logistical challenges outweigh the small, albeit non-negligible, loss of transplants in the worst case.

Evaluation of the impact of lifting
In the experiments discussed in Section 4, we have deliberately not considered cut lifting procedures to allow for a fair comparison of cut-CC and cut-PICEF with the branch-and-bound scheme.As mentioned above, we have also conducted experiments to measure the impact on the cutting plane approaches of the lifting schemes proposed in Sections 3.1.3and 3.2.3.Table 4 shows the computational results for both cut-CC and cut-PICEF, and for Full Recourse and FSE, respectively.We have restricted our results in this table to instances with 100 vertices, to focus on the hardest instances where algorithmic improvements are most necessary.In the columns below ''with lifting'', we present the results where the modified recourse problems are used to separate interdiction cuts.In the columns below ''without lifting'', we review the results of cut-CC and cut-PICEF from Tables 1 and 2 for easier comparison.Again, the attack budgets  from 1 to 4 are used.
For Full Recourse, both cut-CC and cut-PICEF benefit from cut lifting, as it has a positive impact on both the number of instances solved and the total computation time.While the number of generated attacks per optimally solved instance is roughly the same, the number of subproblems that need to be solved is significantly smaller whenever cut lifting is enabled.As a result, proving the optimality of solutions to the attacker-defender subproblem takes fewer iterations, which suggests cut lifting is of benefit for reducing computation times.
Interestingly, this only leads to a reduction in running time and an increased number of solved instances for Full Recourse.Especially when cut-PICEF is employed, and for instances with larger maximum chain lengths, the number of solved instances increases substantially when cut lifting is enabled compared to the basic variant of cut-PICEF, as well as a computation time reduction of over 50 % for the instances with attack budget  = 4.
For FSE, no significant benefit is visible when cut lifting is enabled or vice versa.For both cut-CC and cut-PICEF, enabling cut lifting slightly improves the average computation times for most parameter settings, but it cannot be regarded as an improvement under all circumstances.For chain length  = 2 and  = 1, enabling cut lifting decreases the number of instances solved within the time limit, although for larger  and , the opposite holds.Moreover, Table 5 shows an aggregated overview of the results of cut lifting.As the  positive impact of cut lifting was most pronounced for Full Recourse, we restrict ourselves to the results of this recourse policy.We conclude that under almost all parameter settings, cut lifting is a valuable feature for both cut-CC and cut-PICEF to obtain a performant algorithm for the Full Recourse policy, especially for less restrictive maximum lengths of cycles and chains in a kidney exchange solution.This is consistent with similar experiments conducted in literature, such as the modifications of interdiction cuts as reported by Fischetti et al. (2019).

Conclusion
In this paper, we investigate a robust optimization variant of the kidney exchange problem.In this setting, donors and/or recipients might decide to drop out of the program after the proposal of exchanges and before the actual transplants take place, due to a variety of reasons.This is a practical problem since donors and pairs leaving a kidney exchange program lead to broken cycles and chains of initially proposed transplants.
We propose a cutting plane algorithm for solving the attackerdefender subproblem based on the cycle-chain formulation and the position-indexed chain-edge formulation.The algorithms are based on a reformulation of the attacker-defender subproblem with constraints for any feasible kidney exchange solution.Cuts are separated by solving the problem of finding the optimal recourse solution given an initial kidney exchange solution and attack.These algorithms are implemented for two recourse policies, the Full Recourse policy introduced in Carvalho et al. ( 2021) and the Fix Successful Exchanges policy.The latter aims to give additional guarantees to participating recipients in case none of the involved people of an exchange drop out of the kidney exchange program.Furthermore, a lifting technique is deployed to obtain solutions on the entire compatibility graph that still have maximum recourse value on the non-attacked cycles and chains.
Our computational results show that both the CC-and PICEF-based implementations (cut-CC and cut-PICEF) of our cutting plane algorithm outperform the state-of-the-art in the Full Recourse setting, which is a branch-and-bound type algorithm proposed in Carvalho et al. (2021) when we consider benchmark instances with | | ≥ 50.We observe a transition phase between cut-CC and cut-PICEF.Whenever we allow only small chains, cut-CC outperforms cut-PICEF.However, when larger chains are allowed, cut-PICEF becomes the stronger method and the benefit of having a polynomial-size formulation in terms of chains becomes strongly apparent.In the FSE setting, cut-CC and cut-PICEF can solve most instances with up to 50 instances and small attack budgets , rendering the problem tractable for small kidney exchanges but challenging for mid-size to large pools in practice.
Enabling the cut lifting technique leads, under most choices for parameter settings, to a significant reduction in the running time under most choices for parameter settings.The most apparent reason for this is that fewer iterations of the separation problem are needed to solve the attacker-defender subproblem, since they give better feedback on the recourse value that can be realized given a set of attacked vertices.As a result, the generated attacks are more effective, and typically, we need fewer attacks to solve the entire robust optimization model to optimality.
The success of cut lifting highlights an interesting aspect of cutting plane approaches to multi-level problems.Whenever multiple valid cuts are violated in an iteration, the decision of which cut to add can have a significant impact on runtime.The variability in the number of iterations required between cut-CC and cut-PICEF, where different but in essence arbitrarily chosen alternative optimal solutions to the recourse problem lead to large discrepancies in the number of iterations required.Studying these differences may lead to insights and tiebreaking rules to further speed up computation.One possible direction for future research might be to exploit the hierarchical structure of the set of cycles and chains in a directed graph.This means that instead of one term per cycle or chain in an interdiction cut, we might also

Fig. 1 .
Fig. 1.Example of a kidney exchange program.Each vertex corresponds to a recipientdonor pair ( 1 , … ,  8 ) or a non-directed donor ( 1 ,  2 ).Arcs represent possible transplants.The bold arcs depict a feasible solution, with one chain of length one, two 2-cycles, and one 3-cycle, implying eight transplants in total.

Fig. 3 .
Fig. 3. Illustration of the benefit of modifying the separation problem.

Fig. 5 .
Fig. 5. Example compatibility graph illustrating the strength of PICEF-based interdiction cuts compared to CC-based ones.

D
.Blom et al.
)i.e., each attack  ∈  corresponds to a subset of at most  pairs and non-directed donors withdrawing from the program.Given this definition of  , for any vertex  ∈  ∪ , we consider  to be attacked if and only if  ∈  .
Stage 3: recourse solutions.In the final stage of the model -the recourse stage -the defender is given the opportunity to adapt the initial solution  ∈  based on the attack  ∈  .For this purpose, let us define the set [  ], where   ∶=  ⧵  , as the set of non-attacked (remaining) exchanges  ∈ , i.e., an exchange  ∈ [  ] if and only if  () ⊆   .We use similar notions   [  ] and   [  ] for cycles and chains, respectively.Furthermore, we define the set  [  ] as the set of kidney exchange solutions  with only non-attacked exchanges, i.e.,  ⊆ [  ].
) are obtained from Constraints (13c)-(13f) of the CC-based master problem by replacing for each  ∈  the variables   and    for each chain  ∈    and attack  ∈  , respectively with the variables  , and   , for each position-indexed arc (, , ) ∈    and attack  ∈  .Constraints (18g) and ( Fig. 4.Example of ambiguity with a position-indexed chain-edge variable.There exist two chains using ( 1 ,  2 ) at position 2. If the chain { 1 ,  1 ,  2 } is considered, it is part of a feasible chain, whereas this is not the case for the chain { 2 ,  1 ,  2 } due to  2 being attacked.  ,  ∈  , (, ) ∈  ∶  ∈  .(20f) First, Constraints (20a) models that arc (, ) ∈  can only be enforced if it is included in some initial chain (at any position).Constraints (20b) model that arc (, ) ∈  can only be enforced if there exists some preceding arc (, ) that is also enforced.Constraints (20c) and (20d) model that arc (, ) ∈  can only be enforced if neither  nor  is attacked.Finally, Constraints (20e) and (20f) then essentially model the conditions given in (19a) and (19b) respectively.This definition allows us to rewrite Constraints (18d), (18f) and (18h) of  FR,PICEF ( ) as ]   describes the set of enforced cycles in the recourse solution given .Second, the enforced partial chains in the recourse given  are described by the term ∑ require that the solution (  ,   ) induces a feasible kidney exchange solution on .The remaining constraints are used to restrict the values of the variables    for each arc (, ) ∈ , i.e., the variables that correspond to feasible (sub)chains with respect to .Constraints (27e) impose that    can be set to 1 only if   , = 1 for some position index .Furthermore, Constraints (27f) and (27g) require that    = 0 if either  or  is attacked.Constraints (27h) are precedence constraints, i.e., the arcs (, ) ∈  with    = 1 indeed induce chains.Modifications for  FSE,CC (;  ).We can obtain the formulations for  FSE,PICEF ( ′ , ) and  ′ FSE,PICEF ( ′ , ) from Formulation (26) and Formulation ( ∑ (,,+1)∈     ,+1 ≤ ∑ (,,)∈     , ,  ∈  ,  ∈  ⧵ {},(27d)D.Blom et al.

Table 1
Comparison of the different methods for maximum cycle length 3 and different chain lengths, for the Full Recourse policy.

Table 2
Comparison of the different methods for maximum cycle length 3 and different chain lengths, for the FSE policy.

Table 4
Impact of cut lifting restricted to instances with 100 pairs/NDDs, for cut-CC and cut-PICEF, given maximum cycle length  = 3 and different chain lengths, for Full Recourse (FR) and FSE.

Table 5
Comparison of the cut-CC method with and without lifting for maximum cycle length 3 and different chain lengths, for the Full Recourse policy.

Table C .1
Comparison of the different methods for maximum cycle length 4 and different chain lengths, for the Full Recourse policy.Comparison of the different methods for maximum cycle length 4 and different chain lengths, for the FSE policy.