Network Failure Detection and Graph Connectivity
Jon Kleinberg Mark Sandler Aleksandrs Slivkins
Department of Computer Science
Cornell University, Ithaca, NY 14853
kleinber, sandler, slivkins @cs.cornell.edu
June, 2003
Abstract
We consider a model for monitoring the connectivity of a network subject to node or edge failures.
In particular, we are concerned with detecting -failures: events in which an adversary deletes up
to network elements (nodes or edges), after which there are two sets of nodes and , each at least
an fraction of the network, that are disconnected from one another. We say that a set of nodes is an
-detection set if, for any -failure of the network, some two nodes in are no longer able to
communicate; in this way, “witnesses” any such failure. Recent results show that for any graph ,
there is an -detection set of size bounded by a polynomial in and , independent of the size of .
In this paper, we expose some relationships between bounds on detection sets and the edge-connectivity
and node-connectivity of the underlying graph. Specifically, we show that detection set bounds can
be made considerably stronger
when parameterized by these connectivity values. We show that for an
adversary that can delete edges, there is always a detection set of size which can be found
by random sampling. Moreover, an -detection set of minimum size (which is at most ) can be
computed in polynomial time.
A crucial point is that these bounds are independent not just of the size of
but also of the value of .
Extending these bounds to node failures is much more challenging. The most technically difficult
result of this paper is that a random sample of !" nodes is a detection set for adversaries that
can delete a number of nodes up to , the node-connectivity.
For the case of edge-failures we use VC-dimension techniques and the cactus representation of all
minimum edge-cuts of a graph; for node failures, we develop a novel approach for working with the
much more complex set of all minimum node-cuts of a graph.
1 Introduction
Monitoring network connectivity. As links or nodes fail in a network, it is important to maintain information about basic properties such as connectivity. For large, unstructured networks, this is often done by
recourse to sampling and other approximate measurements; performing such measurements in a robust and
accurate way is an active research topic (e.g. [4, 5, 17, 19, 18]). A general problem here is to minimize
the cost of network monitoring and measurement, in terms of communication, computation, and resource
usage.
Here we consider a model proposed by the first author for monitoring network connectivity [14]. We
are given a connected node graph # on $ nodes, and we want to detect “failure events” in which at most
%
network elements (nodes or edges) are deleted, after which there are two sets of nodes & and ' , each of
(
Supported in part by a David and Lucile Packard Foundation Fellowship and NSF ITR/IM Grant IIS-0081334.
size )+*,$ , such that no node in & has a path to any node in ' . We will call such a pair of sets separated,
%21
%
and we will call such an event an -.*0/ -failure. (To reflect the fact that the node or edge failures can be
arbitrary, we will sometimes speak of them as being selected by an adversary.)
To detect such failures, we consider the strategy of placing “detectors” at a subset 3 of the nodes
of # . Now, if we find that two detectors are unable to communicate — either because there is no path
between them, or because one has been deleted — we can record a fault in the network. We would like
%21
our set 3 to have the property that whenever an -.* / -failure occurs, some two detectors are unable to
%21
communicate; we will refer to such a set 3 as an -.* / -detection set. Note the nature of this condition: 3
%21
must detect all possible -.* / -failures, so we imagine 3 as being chosen before the adversary selects a set
%
of network elements to delete. The emphasis in [14] was on finding a bound on the number of nodes that
%21
must be randomly selected from a graph # in order to obtain an -.*0/ -detection set with high probability.
Improvements to these bounds were obtained by [7].
In this paper, we adopt a somewhat different approach to this issue, by exposing some interesting and
non-trivial connections between the size of the smallest detection set for a graph # and the values of its
1
edge- and node-connectivity. (The edge-connectivity of # , denoted 45-6# , is the smallest number of edges
1
that must be deleted in order to disconnect # . The node-connectivity of # , denoted 78-6# , is the analogous
quantity for node deletions.) We show that stronger bounds on detection set size can be obtained if we
parameterize these bounds by the connectivity values 4 and 7 ; and for some cases, we use this relationship
with connectivity to provide the first per-instance guarantees for detection sets.
Because our results are different depending on whether the adversary is deleting edges or nodes, we
consider these two cases separately.
%
Detection sets for edge failures. We begin with adversaries that can delete up to edges; as such, we
%21
%21
will be concerned with -.*0/ -edge-failures, which are -.* / -failures in which only edges are deleted. It is
1
%21
known that a random set of 9:-<; =?>A@CBED= nodes is an -.*0/ -detection set for edge failures with high probability
%21
1
[14], and that every graph contains an -.* / -detection set for edge failures of size 9F- ; = [7]; note that both
bounds are independent of the size of the graph # . It is not difficult to show that both bounds are tight, and
so there is no prospect of obtaining an improvement that applies to all graphs. However, it makes sense to
ask whether better bounds are possible in terms of natural parameters of the graph # .
%21
An obvious parameter to consider here is the edge-connectivity 4 ; indeed, there can be no -.* / -edge%HG
4 . Our first main result establishes that 4 is indeed a natural way to parameterize the
failures in # if
1
problem; we show that every graph # has an -.* /4 -detection set for edge failures of size at most D= . Note
that there is no leading constant in this bound, and that it is independent not just of the size of # but also
1
of the value of 4 . Extending this result, we show further that an -.* /4 -detection set for edge failures of
minimum size for a graph # can be computed in polynomial time. The algorithms used to establish these
results are based on the cactus representation of all minimum edge-cuts of # [6, 8].
Given that strong bounds are possible for detecting an adversary that can delete one minimum cut’s
worth of edges, it is natural to ask what can be said about an adversary capable of deleting a number of
%
1
edges equal to times the size of a minimum cut. We show that a random set of 9:-<; = >I@CBE=D nodes is a
%
1
- 4J/K* -detection set for edge failures with high probability. This is essentially a factor of 4 times stronger
than the bounds of [7, 14], which did not take edge connectivity into account. Our proof of this result uses
a VC-dimension argument in the style of [14]; the bound on the VC-dimension is obtained using a result of
Mader [16, 9]. that extends results of Lovász [15] and of Cherkasskij [3] on edge-disjoint paths in graphs.
%
Detection sets for node failures. We now consider adversaries that can delete up to nodes. By analogy
with our results for edge failures, we consider the size of detection sets in terms of the node-connectivity 7 .
1
1
Our main result here is that every graph # (with 7MLN9F-.*PO<$ ) has an -.*0/K7 -detection set for node failures of
2
1
1
1
size 9F- D= ; moreover, a random set of 9F- D=5>A@CB =D nodes forms an -.* /K7 -detection set for node failures with
high probability. Again, note that these bounds are independent not just of the size of # but also of the value
%
%RQTS
of 7 . Extending our results to adversaries that delete 7 nodes for
is a very interesting and apparently
difficult open question.
We note the distinction, raised by Gupta [7], between strong and weak detection sets for node failures.
%21
A strong detection set 3 has the property that, after any -.* / -node-failure, two nodes of 3 lie in different
%21
connected components. A weak detection set 3MU has the property that, after any -.* / -node-failure, two
nodes of 3 lie in different connected components or an element of 3 has been deleted. Either of these
definitions arguably forms a plausible definition of network failure detection. Improving a bound of [14],
%
1
%21
Fakcharoenphol showed that a random set of 9:- ; = >I@CB >A@CB D= nodes is a strong -.* / -detection set for node
%21
failures [7], and Gupta showed that every graph has a weak -.* / -detection set for node failures of size
1
9F- ; = . As we note in Section 4, weak detection appears to be a more useful notion when the problem is
parameterized by node connectivity; in particular, our main result is about weak detection sets. Henceforth,
we will assume that all detection sets for node failures are weak unless otherwise specified.
Our analysis for node failures is significantly more complicated than for edge failures, and this is not
surprising; not only is no analogue of the cactus representation known for min-node-cuts, but this appears to
be intrinsic due to the VEW -completeness of even counting the number of min-node-cuts [2]. Indeed, given
the lack of tractable representations for min-node-cuts, we believe that our analysis develops some useful
properties of their structure. We begin by constructing a detection set of minimum size for adversaries
that can delete shredders [2, 13] — min-node-cuts whose deletion produces at least three components.
The construction of the detection set then proceeds by greedily isolating a maximal collection of relatively
balanced min-node-cuts that produce just two components, and whose “small sides” are disjoint; the small
=YX
side of each such cut is required to have at least nodes. We then show that by placing detectors so that one
D[Z
lies on the small side of each of these cuts, there is no way for a min-node-cut producing two components
of size at least *,$ each to avoid being detected.
1
Further Discussion. A simple calculation based on Karger’s algorithm gives an upper bound of 9F-<; = >A@CB\$
%
1
on a random sample of nodes that forms an -.* / 4 -detection set for edge failures.1 However, our goal in
this paper is to find bounds that do not depend on the size of the graph.
Following [14], we can extend our results to a model in which the nodes of the network # are partitioned
into two sets — a set ] of end nodes and a set ] of internal nodes. We assume that we are only allowed to
Z
D
place detectors at end nodes, and correspondingly are only interested in monitoring the connectivity of the
%21
%
end nodes. Specifically, we re-define -.* / -failures as failures of ^
network elements, after which two
disjoint subsets of ] , each of size )_*"`a] ` , are separated from each other. We can show that the bounds
Z
Z
obtained above carry over to this more general setting; we omit further discussion of the generalization from
this version of the paper.
Our work is similar in spirit to some of the work on vertex connectivity and augmentation thereof,
e.g. [12, 2, 13, 11]. The actual technical issues are quite different, however, since we are only interested
in balanced cuts. In general one could view our work here as integrating notions from edge- and nodeconnectivity with the problem of balanced separators of graphs — two topics that have traditionally been
approached separately due to their great differences in tractability.
Notation. In this paper all graphs are assumed undirected; our standard notation for a graph is #NL+-6]b/Pc
An edge(node)-cut is a set d of edges (nodes) such that #fe\d is disconnected.
1
Note that no such simple bound is available for the case of node-failures, which is yet another evidence of its difficulty.
3
1
.
A min-edge(node)-cut is an edge(node)-cut of minimum size. This size is also known as edge(node)connectivity and denoted by 4 and 7 respectively. We will write min-cut when it is clear whether we are
talking about edge-cuts or node-cuts. A set of nodes is tight if it is a union of some (but not all) components
of a min-cut. A cut d is called * -balanced if there are two sets of vertices of size )g*,$ that are disconnected
%
%21
edges(nodes) is called an -.* / -cut.
from one another in #gehd . An * -balanced cut of ^
If sets d , i have a non-empty intersection, we say d meets i . To help clarify the notation in places,
we will sometimes write dkjli to denote the union of disjoint sets d and i , and dnmoi to denote the
difference of sets d and i for which iqpod .
2 Detection sets for edge failures
In this section all cuts are edge-cuts, and all detection sets are for edge failures. Let 3 be a set of nodes,
representing the locations of our detectors. 3 detects a cut d if some pair of detectors is separated in #resd .
%21
%21
3
is an -.*0/ -detection set if it detects every -.* / -edge-cut.
1
There are two subsections. In the first one we construct a smallest -.* /4 -detection set and prove it has
%21
1
size ^ D= . In the second one we prove that a set of 9:- t ; = >A@CB D= randomly sampled nodes is an -.* / -detection
set with high probability.
2.1 Detection sets for min-edge-cuts
Cactus representation. Edges will be viewed as cycles of length two; cycles of length 3 or more are called
proper. A cactus is a connected graph such that any two of its cycles have at most one vertex in common.
An arbitrary cactus can be obtained starting from a cycle and recursively adding new cycles that share a
single vertex with the existing graph. In a cactus, some edges are contained in a proper cycle (cycle edges),
and some aren’t (path edges). Suppose we give each cycle edge capacity 1/2, and each path edge capacity
1. Then the min-cuts of a cactus have capacity 1: each path edge is a min-cut; any pair of cycle edges from
the same cycle is a min-cut; and there are no other min-cuts (see Fact A.1).
In a cactus, nodes of degree one will be called leaves, nodes of degree two that are contained in a cycle
will be called cycle nodes, and all other nodes will be called branch nodes. Consider a branch node u of a
cactus v . It connects two or more cycles. By Fact A.2, the removal of u splits v into two or more connected
components (u -components). Each u -component d is tight: for some cycle w containing u , it is obtained
by removing the edge(s) of w that are adjacent to u .
Fact 2.1 Suppose x is a tight set in cactus v , u is a branch node. Then:
(a) if uMyzx then x contains at least one u -component.
(c) if uzyz
{ x then x is contained in a u -component.
(c) for any u -component d of v , either d}|lx , or x~|od , or d}|l]Tm~x , or ]Nmx€|od .
Proof: See Appendix A.
1

Let # be a weighted graph on $ vertices. A cactus-pair of # is a pair -v‚/Pƒ where v is a cactus, and
1
1
1
to ]M-v such that if „ is a tight set in v then ƒ†… D -‡„
is a tight set in # . For
ƒ is a mapping from ]M-6#
1
1
each tight set „ of v say that -vˆ/Pƒ represents the min-cut w of # such that ƒ … D -‡„
is a w -component.
A cactus representation of # is a cactus-pair of # that represents all min-cuts of # . Dinits et al. [6] proved
1
that every capacitated graph has a cactus representation of size 9:-Y$ . Further results show that a cactus
1
representation of size 9F-Y$ can be efficiently constructed. See the introduction of [8] for discussion.
4
Balanced cactus representation. Here we are only interested in * -balanced min-cuts, and so the cactus
representation is too general for our purposes. This motivates the following definitions.
Let an * -cactus-pair be a cactus-pair that represents all * -balanced min-cuts. Let an * -cactus be the
1
cactus in such cactus-pair (if the mapping is clear). A subset x of vertices of a cactus is heavy if ` ƒ†… D -6x `‰)
*,$ . Call a cactus-pair reduced if every u -component is heavy. A reduced * -cactus-pair can be efficiently
computed from a standard cactus representation by consecutively applying the following reduction.
Lemma 2.2 Suppose v is an * -cactus, u is a branch node, d is a u -component that is not heavy. Let v U be
v
with d contracted into u . Then vˆU is also an * -cactus.
Proof: For each * -balanced min-cut w of # there is a min-cut wU of v that represents it. By Fact 2.1c there
is a component x of w U such that dŠ|Nx or xf|ld . Since x is heavy and d isn’t, it must be the case that
is a proper subset of x . Then uMyzx , so wU is a min-cut in vˆU , too. Therefore vˆU represents w .
d

1
Characterizing detection sets for min-cuts. Let # be a capacitated graph. Let -vˆ/Pƒ be a reduced * 1
cactus-pair of # . We will characterize -.* /4 -detection sets of minimum size in terms of v .
Let a subcycle be a set of consecutive cycle nodes of a (proper) cycle in v . Consider the non-degenerate
1
case when there is at least one branch node. Then the weight ` ƒ†… D -‹ ` of each leaf and each subcycle is at
S
1
most - m~* $ . Let a canonical subcactus be a set of nodes of v that contains each leaf, has an element in
1
every heavy subcycle, and contains no branch nodes. Let 3Œ|]M-6# be a set of detectors(not necessarily
1
1
an -.* /4 -detection set). Say 3 is v -canonical if ƒb-‡3 is a canonical subcactus, and at most one detector is
1
mapped to each node of v . The following two lemmas show that any smallest -.*0/4 -detection set is in fact
a smallest v -canonical set.
1
Call xo|Ž] heavy if `ax`)Ž*,$ , and balanced if both x and ]Žex are heavy. Call x U |Ž]M-v balanced
1
1
if ƒ†… D -6x†U is balanced. For each balanced tight set x of # let ƒU6-6x be a (balanced) tight set x†U of v such
1
that x‘L’ƒ†… D -6x†U .
1
Lemma 2.3 Any smallest -.* /4 -detection set is v -canonical.
1
Proof: Let 3 be a smallest -.* /4 -detection set. Call elements of 3 detectors. We need to prove that (1) at
most one detector is mapped to each node of v , (2) there is a detector mapped to each leaf and each heavy
subcycle of v , (3) and no detectors are mapped to branch nodes of v . We’ll prove these three statements in
order.
(1) Suppose two detectors “ , “ map to a node u of v . To obtain a contradiction it suffices to show an
O
1
D
1
-.* /4
-detection set smaller than 3 . We claim that 3”mz“ is also an -.* /4 -detection set. Suppose not. Then
D
1
there is a balanced tight set x of # that contains 3”mr“ . Obviously “ yz
. Since “ yzx ,
{ x . Let x†U2L’ƒU6-6x
O
1
D
D
uFL’ƒb-‡“
yzx U , so “
y•x , too, a contradiction.
O
D
(2) There is a detector mapped to each heavy tight set of v , in particular, to each leaf and each heavy
subcycle.
(3) Suppose a detector “ is mapped to a branch node u of v . By analogy with (1), we claim that 3–m~“
1
is also an -.* /4 -detection set. For suppose not. Then 3–m“ is disjoint with some balanced tight set x . Let
1
1
x U L—ƒ U -6x
. Since 3 is an -.* /4 -detection set, “oy˜x , so uoy˜x U . Therefore by Fact 2.1a x U contains
some u -component x†U U . Since v is reduced, x†UaU is heavy, so there is a detector mapped to it. So x contains a
detector other than “ , a contradiction.
In view of (1), (2), and (3), we see that 3 is v -canonical.

1
Lemma 2.4 Any v -canonical set is an -.*0/4 -detection set.
1
Proof: Suppose 3Œ|] and ƒb-‡3
meets each leaf and each heavy subcycle of v . We need to prove that
1
ƒb-‡3
meets each heavy tight set of v . To show this we claim that any heavy tight set x of v contains a leaf
or a heavy subcycle.
5
Figure 1: An * -cactus with detectors. Branch nodes are denoted by ’ ™ ’, detectors by ’*’. In the central
cycle, there are three subcycles between the branch nodes. The smallest of them is not heavy, hence does
not contain a detector. The other two are big enough so that they need two detectors each. Each of the three
smaller cycles is heavy (even without its branch node), since otherwise it would have been contracted.
We’ll use induction on the size of x . The base case corresponds to an x that consists of one vertex, say
u . By Fact 2.1a u cannot be a branch node. So either u is a leaf or it is a heavy subcycle consisting of a
single cycle node.
For the induction step, note that if x contains a branch node u then by Fact 2.1a x contains some (heavy)
does not contain any branch nodes, then
u -components x?U , to which the induction hypothesis applies. If x

it lies within a single cycle, so x is a (heavy) subcycle. The claim follows.
1
Theorem 2.5 A smallest -.*0/4 -detection set is of size at most D= . There is a polynomial-time algorithm to
construct it.
1
1
Proof: Let -vˆ/Pƒ be a reduced * -cactus-pair of # . We have seen that smallest -.* /4 -detection sets are
(mapped to) smallest canonical subcacti of v . Therefore it suffices to compute a smallest canonical subcactus of v .
Let x be a subset of a proper cycle w in v . Call x a w -detection set if x does not contain any branch
nodes, and every heavy subcycle of w contains an element of x . By definition, if there are no heavy
subcycles in w then an empty set is a w -detection set. Obviously, a subset of v is a canonical subcactus
iff it is a union of leaves of v and (disjoint) w -detection sets, one for each proper cycle of v . Therefore
to compute a smallest canonical subcactus of v it suffices to construct a smallest w -detection set for each
proper cycle w of v .
The construction is as follows. Assuming v consists of more than one cycle, w contains one or more
branch nodes. Assuming w contains cycle nodes, pick any branch node uCš followed by a cycle node u . Start
with u . In the iterative step, start with a cycle node and move clockwise along w till a heavy subcycle is
detected (call this subcycle selected) or a branch node is reached. Start a new step with the next cycle node.
Stop when uCš is reached. Let x be the set of the last nodes (clockwise) of selected subcycles.
Obviously x is a w -detection set. x is a smallest such set by the following observation. Let x U be a
be a branch node or an element of x†U . Let uœU be the next node clockwise. Let wU
w -detection set. Let u›yzw
be the smallest heavy subcycle starting with u U , if it exists. Let  be the last node of w U . Then w U contains
at least one element of x . The observation is that x†UmHwžUŸjH is a w -detection set with the same or smaller
number of elements. Consecutively applying this observation, we can transform x†U to x without increasing
the number of detectors.
Our construction puts one detector into each leaf of v and each selected subcycle. Since leaves of v are
heavy and selected subcycles are heavy and disjoint, our construction covers at least *,$ weight with each
detector. Since the total weight of (nodes of) v is $ , the total number of detectors is at most D= .

2.2 Smaller detection sets for edge failures
%
%
A set x of nodes is -edge-separable if there exists a set of ^
edges such that x is a union of components
%
of #leˆ . Let ¡ be the family of all -edge-separable sets. We say that &+p˜] is shattered by ¡ if for all
6
there exists an ¢y£¡ such that '+LŽ&H¤F¢ . The VC-dimension of ¡ is defined to be the maximum
cardinality of a subset of ] that is shattered by ¡ .
%21
In [14], it was shown that one can connect the VC-dimension “ of ¡ with -.* / -detection sets via the
notion of an * -net, which is a set that meets each ¢¥y¦¡ of size )˜*P$ . Specifically, a theorem by [1] says
1
S
that a set of 9F-<§ = >A@CB D= j D= >A@CB ¨D randomly sampled nodes is an * -net for ¡ with probability at least mz© .2
%21
Moreover, it is easy to show [14] that an * -net for ¡ is an -.* / -detection set.
%
S
1
In [14], it was shown that the VC-dimension of ¡ is at most ª j , yielding a bound of 9:-<; = >A@CBFD= on
%21
1
the size of an -.* / -detection set. In this section, we strengthen the VC-dimension bound on ¡ to 9F- t; . As
a consequence, we will obtain the following theorem.
'–pf&
Theorem 2.6 A set of 9F-«t ; =
>A@CB:=D
1
randomly sampled nodes is an
-.*0/
%21
-detection set with high probability.
We now turn to the new bound on the VC-dimension; to prove it, we will use the following theorem by
Mader [16] on edge-disjoint paths between elements of a given set of vertices. Let ¬ be a subset of ] of
1
1
size ­ . Let “®-‡¬ be the number of edges leaving ¬ . Let ¯°-‡¬ be the number of components w of #fmz¬ for
1
which “s-6w is odd. Let an ¬ -path be a path connecting distinct elements of ¬ .
Theorem 2.7 [16] The maximal number of edge-disjoint ¬ -paths is
minimum is taken over all collections of disjoint subsets of vertices ]
1
³I´
- µ¶“s-6]2·
6
D
O ±
²
/]
/ º º º5/]2»
O
D
m¸¯°-6¹b]°·
such that
1,1
, where the
S
.
`a]°·2¤R¬:`CL
1
Corollary 2.8 There are ¼½-Y­4 edge-disjoint ¬ -paths.
S
. Let
Proof: Consider a collection of disjoint subsets of vertices ] /] / º º º5/]2» such that `a]°·?¤¦¬:`¾L
O
1
1
D
1
µ
.
“EL
“s-6] · , ¯½L’¯°-6¹b] · . By the above theorem it suffices to prove that “¿m‘¯¿L’¼½-Y­4
1
1
Note that “•)”­4 since “®-6]°· )+4 . Let w º º ºwhÀ be the components w of #Nmf¹b]2· such that “s-6w is
1
1
D
odd. All edges exiting each w · are to ¹b] · . So “:)o“®-6¹b] · ) µ “s-6w · )f¯4 . If ­Á)g¯ then “²mF¯Á)o­4ÂmF¯Á)
S1
G
S1
1
­2-64Em
¯ then “½mH¯Á)f¯4FmH¯Á)o­2-64Em

. If ­
. Therefore “¿mH¯¿L’¼½-Y­4 .
The following is a well-known application of the probabilistic method.
1
Lemma 2.9 Let -‡¬Ã/P¢ be a multi-graph on ¬ . Then there exists a partition of ¬ into sets ¬
there are at least D ` ¢M` edges between ¬ and ¬ .
O
D
/P¬
O
such that
O
D
1
Lemma 2.10 The VC-dimension of ¡ is 9:- t; .
1
Proof: Let ¬ be a subset of ] of size ­ . By Cor. 2.8 there exists a family Ä of ¼½-Y­CÅ edge-disjoint ¬ -paths.
1
Let -‡¬Ã/P¢ be a multi-graph on ¬ such that there is a 1-1 correspondence between ÆÇu -paths in Ä and edges
ÆÇu£y•¢ . By Lemma 2.9 there exists a partition of ¬
into sets ¬ /P¬ such that (in the original graph) there
O
1
D
1
are ¼½-Y­4 edge-disjoint paths between ¬ and ¬ . We can choose ­ÁL”ÈE- t; so that there is guaranteed to
O
%
S
D
be a family Ä U of (at least) j
edge-disjoint paths between ¬ and ¬ .
O
D
We claim that ¬ cannot be shattered by ¡ . Suppose not. Then there exists dÉyR¡ such that d¤\¬NL’¬ .
%
D
is a union of components of some cut of or less edges. is disjoint with (at least) one path ʕyzĞU .
d
The ends of Ê are in the same -component, so either they are both in d , or both not in d . In both cases
this contradicts dn¤‘¬ÉLk¬ . Thus, the claim is proved, and it follows that the VC-dimension of ¡ is
1
D
­¿LT9F- t ; .

2
Ô ÏÑÐ҂Õ
Ô Ö .
[14, 7] used a slightly weaker theorem, with a corresponding bound of ËÂÌ,Í Î2ÏÑÐÒ\Í Î5Ó~Î2
7
3 Detection sets for node failures
G
1
1
The main theorem of this section (Thm. 3.6) is that for 7
a set of 9F- D= >A@CB =D randomly sampled
9F-.*KO<$
1
nodes is a weak -.*0/K7 -detection set with high probability. We rely on a special case of * -shredders, which is
a corollary of our result on strong detection thereof (Thm. 3.1). We also present a partial result (Thm. B.1)
1
on extending strong detection sets for * -shredders to those for general -.* /K7 -cuts.
Before we proceed, let’s review the definitions. In this section all cuts are node-cuts, all detection sets
are for node failures. A cut d is called two-way if #Teˆd has exactly two connected components, called
the sides of d . A shredder is a min-cut with three or more components. An * -shredder is an * -balanced
shredder. A set 3 of nodes strongly detects a cut d if some pair of detectors is separated in #Žed . If 3
either meets or strongly detects d , say 3 weakly detects d . 3 detects (is a detection set for) a family of
cuts if it detects every cut in the family.
The rest of this section is organized as follows. In the first subsection we show how to find a strong
detection sets for * -shredders. In the second we use shredders to get a detection set for two-way * -balanced
min-cuts. Combining these two results gives us the main theorem.
3.1 Strong detection sets for shredders
It is a well-known fact that there can be exponentially many min-cuts. Furthermore, even counting min-cuts
1
is #P-complete [2]. However, there can be only 9F-Y$ shredders [13], with a polynomial-time enumeration
algorithm [2]. We start by stating the main result of this subsection.
G
1
*,$ . Then a set of 9F-"=D >A@CB€= D ¨
randomly sampled nodes is a strong detection set
Theorem 3.1 Suppose 7
S
for * -shredders with probability at least mz© . Moreover, a smallest strong detection set for * -shredders has
size ^×D= and can be constructed in polynomial time.
Before we prove this theorem we need to establish some basic facts about min-cuts. For a cut d the
connected components of #e†d are also called d -components. Let x , v be min-cuts. Say x meshes v if x
meets at least two v -components. By [2, Lemma 4.3(1)] if x meshes v then v meets every x -component.
Thus meshing is a symmetric relation. If x meshes v (and v meshes x ), the two cuts are meshing. Else x
and v are non-meshing.
Lemma 3.2 ([2], Lemma 4.3(2)) If min-cuts x and v are meshing, then there is a component Ø of either x
or v such that Ø contains ]Tm~xzm¦v .
Corollary 3.3 If 7
G
*P$
then any two * -shredders are non-meshing.
Lemma 3.4 Let x and v be non-meshing shredders. Let w be the x -component that meets v . Then w
contains all v -components but one, call it wžU . Moreover, wU contains ]+mgxmgw , i.e. all x -components
other than w .
Proof: Pick any uÙyx¦mHv . By minimality of x , u has edges to each x -component (else, x•m~u is a cut).
Thus, ]+mgxmgwŽjNÚ0uÇÛ is connected. Since vÜ|–x¦¹¦w , ]Ým€vTmgw is connected, and hence lies in a
v -component w U . So all other v -components are contained in w
and ]Tm~x•mw+|l]Nm•vfm~wÝ|’w U . 
For a family ¡ of * -shredders, we call a component of a shredder an ¡ -head if it meets at least one
%21
shredder in ¡ . Now, suppose we have an -.* / -detection set for shredders, and x is an * -shredder with an
¡ -head Þ . Then there exists vNyR¡
that meets Þ ; so by Lemma 3.4 Þ contains all v -components but one,
and hence contains a detector. This gives the following lemma.
8
G
Lemma 3.5 Let ¡ be a family of * -shredders, with 7
Then any detection set for ¡ meets Þ .
*,$
, and let
be an * -shredder with an ¡ -head Þ .
x
Proof of Thm. 3.1: Let ¡ be the family of all * -shredders. Start with ¡ßLà¡ . While there exists an
Z
Z
* -shredder x€y£¡
with two or more ¡ -heads, delete x from ¡ . Let ¡ be the resulting family of shredders.
D
By Lemma 3.5 any strong detection set for ¡ is a strong detection set for ¡ .
D
Z
Let x€y£¡ . Let the head Þ of x be the (single) ¡ -head of x . Let the tail of x be ]‘mMxÁmFÞ . Note that
D
D
by Lemma 3.4 for any x†/ávyz¡ the tail of x is contained in the head of v (and vice versa). In particular,
D
tails are pairwise disjoint. Since each head contains someone else’s tail, a set 3 of nodes is a detection
set for ¡ iff 3 meets the tail of each x¸yg¡ . Therefore, a smallest detection set for ¡ has size ` ¡ ` .
D
D
D
D
Since tails are of size )˜*,$ each, ` ¡ `^¶=D . The random sampling result follows by a simple probabilistic
D

computation.
3.2 Detecting two-way min-cuts
1
In this subsection we construct a weak detection
set for two-way -.*0/K7 -cuts. First we give a non-efficient de=
1
-cuts
and use a greedy-type algorithm to construct a “maximal”
terministic construction.
We
consider
/K7
=
1
D[Z
{L
æ . In particular &ˆ· ’s are
family of two-way - /K7 -cuts with sides &ˆ· and 'â· such that &‚·bpg'äã for all åâf
G
1
D[Z
pairwise disjoint, so there are at most D[= Z of them. It turns out that if 7
then putting a detector into
9:-.*PO<$
each &‚· suffices. More precisely we show (Thm. 3.8) that these detectors together with any weak detection
1
set for shredders give a weak -.* /K7 -detection set. Then a simple probabilistic argument yields a randomized
result stated below.
G
=.çèX
. Then a set of
Theorem 3.6 Suppose 7
S
O Z
detection set with probability at least m© .
9:- =D
>A@CB
= D¨
1
randomly sampled nodes is a weak
-.* /K7
1
-
We start with some notation and a simple but very useful lemma about crossing min-cuts. Let x be a set
of nodes. Call x connected if the subgraph of # induced by x is connected. Else say x is disconnected. Say
a cut d preserves x if d disjoint with x and x lies in one component of #feäd . Note that a connected set
1
of nodes is preserved by d if and only if it is disjoint with d . é~-6x denotes the set of neighbors of x , i.e.
1
1
the set of all nodes in ]lm¦x that have an edge to x . Note that if ]lm‘x£m•é~-6x is non-empty then é~-6x is
a cut.
Say two-way min-cuts d and i are strongly crossing if each side of d meets each side of i . Say d
and i are weakly crossing if d meets both sides of i and vice versa.3 It is easy to see that strong crossing
implies weak crossing, but not the other way round.
To formulate the promised lemma, we will use the following notation. The sides of d and i are
respectively W , W and Ø , Ø . Their intersections (“quarters”) are w\·Ñã‚L’W8·Ç¤£Øã . Also let dE·5LT؞·2¤Rd
O
O
D
D
and iÇ·JL’W8·Ç¤Ri and dפRi+LTx .
Lemma 3.7 (The Two-Quarters Lemma) Suppose two-way min-cuts d
the two quarters w
and w
are non-empty. Then
O D
D O
(a) ` d `L` i ` and ` i `CL¸` d ` ,
O
O
D
D
1
and w
are tight, with é~-6w\·Ñã L’iã¾j~dE·Çjox ,
(b) w
O D
D O
1
(c) ]Tm€w
is connected, same for w .
mé~-6w
O D
O D
and i are weakly crossing so that
D O
3
Note that if ê meets both sides of ë , say at ì and ìç , respectively, then ë
Ô
contradiction suppose ë does not meet a side í of ê . Then, since any node in ê
Ô
there is a ì ì ç path in î²ï ë , contradiction.
Ô
9
meets both sides of ê . Indeed, for the sake of
has at least one edge to í and í is connected,
Ô
Ô
C11
Y
Q1 Q2
Y
Q1 Q2
C12
P1
X P
2
P1
X P
2
C21
(a) d
C12
and i
C21
C22
are strongly crossing
(b) d
C22
and i
are weakly crossing
Figure 2: Two applications of the Two-Quarters Lemma.
A0
B0
Ai
...
X0
Ai-1
A1
...
Figure 3: Partitioning of the graph after the å th iteration of the algorithm
jgi
jgx
and ðqLÝd
jfi
jlx
separate w
and w
respectively from the rest of the
Proof: vL+d
O
O G
O D
D
D
G
D O
G
graph. It follows that i )ld (else ` vE`
(else ` vÃ`
(else `ñðE`
` d€` ), d
)’i
` i£` ), d
)li
` i£` ) and
O
O
O
O
G
D
D
i
)Žd
` d€` ). Therefore ` d
`°L×` i
` and ` d
`°L×` i
` , so ð
(else `ñðE`
and v are min-cuts and w
and
O
O
D
D
1 D
D
D O
are tight. Finally, ]gm¦w
is connected as a union of two connected sets ( Ø and W ) with a
w
m•é€-6w
O D
O D
O D
O
D

non-empty intersection ( w ).
D O
This lemma is similar to the result of Jordán [12] on intersecting tight sets. Note that if d and i are
=
strongly crossing our lemma yields ` d `Lò` d `äLò` i `Lò` i ` (Fig. 2a). We will also use it for O
O
D
D
D[Z
balanced min-cuts =Ythat
are crossing weakly but not strongly. Then one of the “quarters”, say w , is empty,
X
G
D,D
so, assuming 7
,w
and w
are not (Fig. 2b).
O D
D O
D[Z
Now we are ready to describe the construction.
Construction
=
1
1. Let ¡ denote family of all -balanced two-way min-cuts, and let ó£-¡
D[Z
of all ¢y£¡ . Stop if ¡ is empty.
denote the family of the sides
1
1
2. Choose any inclusion-wise minimal component & from óR-¡ , let d
LŽé€-‡&
Z
Z
ing cut and ' be the second component of d . Put detectors in & and ' .
Z
3. Delete from ¡
contain & .
Z
all cuts which do not preserve &
Z
Z
. For d}y£¡
let &Ã-Yd
Z
be the correspond-
Z
1
be the side of d
that does not
Z
1
4. Start with the first iteration. For the å -th iteration choose a cut dE·?y£¡ so that &Á-YdE· does not contain
1
1
any other &Á-Yd
for d}y£¡ . Let & · LŽ&Á-Yd · . Let ' · be the other side of d · .
5. Put a detector into &ˆ· . Remove from ¡
is empty; else iterate.
all cuts which do not preserve &
10
Z
¹›&
D
¹r‹ ‹ ‹"¹›&‚·
. Stop If ¡
A1
Y
Y
C D
D
C
D
X1
Ait
Ai 1
Ai 2
Y
Xi
...
Ait-1
Bi
A2
Ai
(a)
(b)
X2
(c)
Figure 4: Three different options of how i can interact with dE· ’s. For (c) we prove that the portion of
between cuts d and d
shrinks to an empty set, and d
¤›iLld
¤Ri .
O
D
i
O
D
=
By construction all &ˆ· ’s are pairwise disjoint, and each &‚·†)
. Therefore our algorithm will terminate
D[Z
after at most D[= Z steps after putting at most D[= Z detectors. Denote this set of detectors by ô . Let ô be any
O
D
weak detection set for shredders, ôLlô ¹›ô .
D
Theorem 3.8 If 7õ^
= ç
O Z
$
O
then any * -balanced two-way min-cut is weakly detected by ô .
Before proving this theorem we will state some simple properties of our construction.
{L
æ&Âãžpf'â· . In particular dE· is disjoint with &hã .
Lemma 3.9 For all åˆö
{L
æ , dE· is disjoint with &Âã (which would immediately imply &hã½pf'â· ).
Proof: We will prove that for any å‚ö
G
Q
If æ
å then by construction d · is disjoint with all & ã for æR^’å and & ã pŽ' · . On the other hand, if æ
å
{L
÷ then uMyr&h㲤:dE· has at least one edge to &ˆ· and thus to 'äã ,
then 'äã contains &‚· and suppose &h㲤:dE·\T
so &hã and 'äã are not separated, a contradiction.

Corollary 3.10 Each '‚· contains at least one detector.
=YX
1
Lemma 3.11 If a tight set &˜|f&ˆ· is of size )
then the cut é€-‡& is a shredder.
1
1
D[Z =
·
Proof: Suppose not. Then é€-‡& is a two-way - /K7 -cut preserving '‚· and hence ø ã… ù D &Âã . Thus é~-‡&
Z
D[Z
was not deleted from ¡ until iteration å , so it should have been chosen instead of d · , contradiction.
In what follows we assume 7g^
helps to detect two-way min-cuts.
= ç
O Z
$
. The next lemma shows how
ô
D
1

(a detection set for shredders)
=
i
be an -balanced two-way min-cut with sides w and 3 . Suppose 3 contains a set ú
Lemma 3.12 Let
=YX
1
Z
of size at least such that D[é€
-6ú
is a= shredder. Then 3Ýj€i contains at least one detector from ô .
1
D
D[Z
Proof: The shredder ’L’é€-6ú
is -balanced, so it is weakly detected by ô . Since i is a cut, there are
D
D[Z
no edges between ú and w , i.e. lies
in 3¸jöi . It follows that w is connected in #’e‚ , hence lies in a
single connected component thereof. Thus at least one detector from ô is not in w , so it is in 3+j€i . 
D
Now we are ready to sketch the proof of Thm. 3.8; the details are in the next subsection.
11
Proof of Thm. 3.8 (sketch). Let i be an * -balanced two-way min-cut with sides w and 3 . We need to
show that ô meets i or both sides thereof. For the sake of contradiction suppose it is not so. Then without
pf
{
3gjri , for every
loss of generality ôq|lw , which implies that w meets every &ˆ· and 'â· . Clearly then &‚·h
=YX
å . Also note that by Lemma 3.12 3
cannot contain disconnected tight sets larger than .
D[Z
There are now three cases to consider, depending on the relation of i to = the sets d · . First, suppose
1
i
does not strongly cross any dE· . We show that é~-‡3£e¹õdE· is a two-way -balanced cut that was not
D[Z
excluded from ¡ (see Fig. 4a), and this contradicts the stopping condition of the algorithm. If i strongly
1
crosses exactly one dE· , then we replace i by the cut i U LNé€-‡3+¤Ù'â· (see Fig. 4b). i U does not strongly
cross any dE· , so we apply the argument from the case above to show that iûU is detected. Therefore there is
at least one detector in set 3 , which contradicts our assumption. Finally if none of these two cases apply
then i strongly crosses at least two sets among Ú0dE·Û , say dE· and d¿ã . An argument using the Two-Quarters
Lemma then shows that d · and d ã partition i into the same subsets (see Fig. 4c).
We then prove that d ·
=
1
1
and d¿ã cut off a large connected subset 3 U of 3 such that é€-‡3 U is a two-way - /K7 -cut not deleted from
D[Z
¡ , which thus violates the stopping condition.

3.3 Full proof of Thm. 3.8
Lemma 3.13 Suppose i is * -balanced and &‚· meets 3 . Then either there is a detector in 3qjli or the
following conditions hold:
(a) i strongly crosses dE· , and =
1
(b) é~-‡3¤›'â· is a two-way ü -balanced min-cut.
D[Z
Proof: Suppose there is no detector in 3Nji . Since &‚· and '‚· each contain a detector, they meet w . Now
¤R3
and conclude that &‚·Ç¤£3 is tight.
we can invoke the Two-Quarters
Lemma to quarters 'â·2¤õw and &‚·Ç
=
=YX
1
, so by Lemma 3.12 é~-‡& · ¤¦3
is a
We claim that ` ' · ¤•3¦`¾) ü $ . Indeed, otherwise ` & · ¤¦3¦`¾)
D[Z
D[Z
two-way cut, which contradicts Lemma 3.11. Claim proved.
=
1
This proves (a) and shows that é€-‡' · ¤£3 is an ü -balanced cut. To complete (b), note that ' · ¤£3 is
1

tight by the Two-Quarters Lemma, so by Lemma 3.12D[Z é~-‡'â·Ç¤›3 is two-way.
Let i be an * -balanced two-way min-cut with sides w and 3 . We need to show that ô meets i or both
sides thereof. For the sake of contradiction suppose it is not so. Then without loss of generality ô}|–w ,
which implies that w meets every &ˆ· and 'â· . Clearly then &‚·Ãpq
{
3×jli , for every å . Also note that, by
=YX
Lemma 3.12 3 cannot contain disconnected tight sets larger than . There are three possible cases which
D[Z
we prove separately:
1. i does not strongly cross any dE· .
2. i strongly crosses exactly one dE· .
3. i strongly crosses at least two dE· ’s.
not strongly cross any d · . To re-use this proof for the second case, we will assume that
1. Cut i does
=
i
is only ü -balanced, rather than * -balanced,
D[Z
Since we assumed that dE· does not strongly cross i by Lemma 3.13 we have all &‚· ’s are disjoint with
3 . Using this fact we show that each dE· excises a small a piece of size at most 7 from 3 , and finally we
show that 3Rež¹•dE· is large, tight, connected, and preserves ¹?&‚· , and thus algorithm could have made at
least one more step.
Let
é€-‡3
ã
1
dE·
Ô
/,dE· ç / º º ºdE·þý
and w
ã
LT]TmHi
be all cuts which are intersecting with
ã mH3 ã . First of all
ã
` 3½ãœ`‰)Ý` 3•`"m
*
` dE·2`œ)S
«$£m7
ÿ
ù
D
12
3
. Let
S
*
3½ãFL–3¥mö3–¤
*
)S
«$
ø
ãÿ
ù
D
dE·
,
iãFL
=.ç
$ .
The last transition is because 7Ù^
1
O Z
We will prove by induction that each 3½ã is tight, connected and corresponding cut i‰ã‘LÉé€-‡3½ã is
two-way for every ^æ:^
.
Suppose we did that, then 3 by its construction is disjoint with any dE· , and thus all &‚· ’s are disjoint
in ]”m€3 m€i , therefore i preserves
with i , and hence lie
& · (because i is a two-way cut). On the
ø
=
=
other hand ` 3`s) O $ and `aw`s)q`awM`s)˜*Pé . So i is O -balanced two-way min-cut and preserves ø &‚· ,
D[Z
D[Z
thus our algorithm could have made one more step, and so we come to contradiction.
1
L–i
Now we have to prove our claim. Clearly 3
is tight, connected and é~-‡3
is two-way by our
Z
Z
definition of i and 3 . Suppose the claim holds for 3½ã , we now prove it for 3½ã . We have
…
3½ã‚L’3½ã
… D
mH3½ã
… D
D
¤›dE·âL’'â·h¤R3½ã
… D
º
If 3½ã is disjoint with dE· then 3½ãžL˜3½ã
and we are immediately done. Otherwise, iã
weakly crosses
… D
… D
is not preserved by dE· , and w?ã
and hence meets both &ˆ· and 'â· and so not
dE· . (Indeed, 3½ã
w
… D
… D
preserved.) But then we satisfy conditions of the Two-Quarters Lemma, where &‚·b¤Rw?ã
and 'â·b¤M3½ã
… D
1 … D
is not empty, and thus 3½ãâL’'â·\¤£3½ã
is tight. Therefore by Lemma 3.12 3½ã is connected and é€-‡3½ã is
… D
a two-way cut. This proves the claim.
¤H'â· . By Lemma 3.13 and our
2. i strongly crosses exactly one dE· . Indeed, consider set 3 U L 3Ü
=
assumption that there were no detectors in 3–jli , it has size at least ü $ , is tight and corresponding cut
D[Z
i U Ll3+¤›dE·Çj~dE·Ç¤›iTj~iT¤›'‚· is two-way min-cut.
Since 3:Uäp×3 , and only one &ˆ· meets 3 (and it does not meet with 3:U by our construction), no &ˆ·
meets with 3MU . Therefore by Lemma 3.13 iûU does not strongly cross any d · and thus by the case (3.3) iûU is
detected by ô . This proves that there is at least one detector in iûUj3:U , and by construction iûUIjž3:U®pf3£ji ,
and therefore there is at least one detector in 3Ýj€i , contradiction.
3. i strongly crosses at least two dE· ’s. We have to prove that either 3’jzi contains at least one detector
from ô (and thus contradicting our assumption), or we could have done one more step of the algorithm &⪠.
Without loss of generality i strongly crosses d and d . (Fig. 4c).
O 1
1
D
First we prove that each of the triples -‡& /,d /P'
and -‡& /,d /P'
partition set i into the same
O
O
O
D
D
D
subsets. Namely, d
,
and
¤€i
Lßd
¤~i
&
¤€i
L
'
¤~i
'
¤€i
L
&
¤€i . Indeed, i
L
O
O
O
D
D
D
i¸¤H&ˆ·†jNi¸¤‘dE·†jTi¸¤H'â·è/ and since &
pk'
p¶i¸¤‘'
, we have that iq¤H&
, and analogously
O
O
D
D
, but by the Two-Quarters Lemma we have ` i¤û& `L¸` i¤û' ` and ` i¤û& `CL` i~¤¿' `
i¤û&
pgi¤û'
O
O
O
D
D
D
¤Ri+Lld
¤Ri .
and thus i’¤R& L’iŽ¤R' and iŽ¤R& LŽi’¤R' , and thus d
O
O
O
D
D
D
We will prove that either there is a leftover part 3MU in 3 , which could have used for the next step of the
algorithm, or i is detected.
Since dE· (i=1 or 2) strongly crosses i , 3 is partitioned by dE· on three non empty parts 3M· U LN3¤R'â· ,
1
3M· U U LÝ3¸¤õ& · and 3:· U U U L+3¸¤£d · . Now, by Lemma 3.13 and our assumption that ô˜¤H-‡3¸jfi
L+÷ , we
=
1
conclude that 3 · U is tight, 3 · U )¥ü $ and é~-‡3 · U is two-way min-cut.
=
1
1
D[Z
Consider 3MUbL_3:U ¤z3:U . We
claim that the corresponding cut _L_é€-‡3:U is a two-way - /K7 -cut
O
D
D[Z
that preserves ¹?&ˆ· . This contradicts the stopping condition of the algorithm: it could have made one more
iteration. Therefore it remains to prove the claim.
1
1
Firstly, 3:U is tight by the Two-Quarters Lemma applied to cuts é€-‡3:U and é€-‡3:U . Its size is
O
D
`3
so (1)
i¸jN3
U `CL` 3
U
D
¤›3
O
U `L¸` 3¸mg-‡3
=
is -balanced, and (2) 3
1
D[Z
. Since nL -Yd
¹¦d
D
O
U U jö3
D
UUU
D
1
¹¦-‡3
O
U U j€3
O
UUU
1
*,$
`‰)g*P$£mª°- S
jo7
1
)S
*
$²/
is connected by lemma 3.12 and the assumption that ô is disjoint with
1
¤o-‡3ܹHi
, we conclude that (1) is two-way, since ]–ml3:U«mT is
U
13
connected as a union of three non-disjoint connected subsets w , & and & , and (2) is disjoint with ¹?&ˆ·
O
D
by Lemma 3.9.
To prove that preserves ¹?&‚· it remains to show that all &‚· ’s are disjoint with 3 U . Indeed, suppose
some &ˆ· meets 3MU . It cannot be properly contained in 3 , hence in 3:U . So, since &‚· is connected, it meets
, contradiction. Claim proved.

4 Extensions and further directions
1
There are a number of natural questions left open by this work. One is to investigate whether an -.* /K7 detection set for node failures of minimum size can be computed in polynomial time for a given graph # ;
this would parallel the per-instance result we obtain for edge failures. We note that Section 3.1 provides
such an optimality result for node failures when the adversary is restricted to deleting a shredder.
We believe it would be interesting to extend our results on node failures to obtain bounds for strong
detection sets. In fact, our bounds for shredders apply already to the case of strong detection; and in Theorem
B.1 in the Appendix we provide a further step in this direction. Essentially, Theorem B.1 asserts that
1
1
it suffices to have a strong -.*0/K7 -detection set 3 U for some subgraph # U L -6]²/Pc U of # of the same
%
connectivity 7 . In particular, we can without loss of generality assume that # is minimally -connected.
It would clearly be interesting to obtain results on detection sets with respect to adversaries that can
delete a number of nodes equal to a constant times the node-connectivity, by analogy with our results for
edge-connectivity. To obtain detection set bounds here that are independent of the value of 7 , it is not
difficult to see that we need to focus on weak detection; indeed, there exist graphs in which we would need
%
%21
at least m7 nodes in any strong -.* / -detection set for node failures.
%21
Finally, the problem of deciding whether a given set 3 is an -.*0/ -detection set provides another clear
connection to the problem of balanced separators in graphs: indeed, deciding whether the empty set is an
%21
-.* /
-detection set is coNP-complete because of its equivalence to a balanced separator problem. On the
other hand, using techniques from [10, 20], we can obtain a polynomial-time algorithm for deciding whether
%21
%
is an -.* / -detection set for node failures when LŽ7 ; this is non-trivial due to the fact that there can be
3
exponentially many min-node-cuts.
Acknowledgments. It is our pleasure to acknowledge the contribution of Laszlo Lovász; discussions with
him about the prospect of parameterizing detection sets by the minimum cut size provided a portion of the
motivation for this work, and also led to the results described in Section 2.2.
References
[1] A. Blumer, A. Ehrenfeucht, D. Haussler and M. Warmuth, “Learnability and the Vapnik-Chervonenkis
Dimension,” J. of the ACM, 36(4) (1989), pp. 929-965.
%
%
[2] J. Cheriyan and R. Thurimella, “Fast Algorithms for -shredders and -node Connectivity Augmentation,” Proc. 28th Annual ACM Symposium on the Theory of Computing, 1996.
[3] B.Cherkasskij, “Solution of a Problem on Multicommodity Flows in a Network,” Ekon. Mat. Metody
13:1(1977), pp. 143-151. (in Russian; the result is cited in [9]).
[4] F. Chung, M. Garrett, R. Graham and D. Shallcross, “Distance realization problems with applications
to Internet tomography,” Journal of Computer and System Sciences 63(3): 432-448 (2001).
[5] K. Claffy, T. Monk and D. McRobb, “Internet Tomography,” Nature, Web Matters, Jan. 7, 1999.
14
[6] E.Dinits, A.Karzanov and M.Lomonosov, “On the Structure of a Family of Minimal Weighted Cuts in
a Graph”, in A.Fridman, ed., Studies in Discrete Optimization, pp. 290-306, Nauka, Moscow, 1976 (in
Russian).
[7] J.Fakcharoenphol, An improved VC-dimension bound for finding network failures. Master’s thesis,
Dept. of EECS, UC Berkeley, 2001. Includes a result by A.Gupta.
[8] L. Fleischer, “Building Chain and Cactus Representation of all Minimum Cuts from Hao-Orlin in the
Same Asymptotic Run Time”. J. Algorithms, 33(1) (1999), pp. 51-72.
[9] A. Frank, “Packing paths, circuits, and cuts – a survey,” in: Paths, Flows and VLSI-Layouts, B. Korte,
L. Lovász, H-J. Prömel, A. Schrijver, eds., Springer-Verlag (1990) pp. 47-100.
[10] H. Gabow, “Centroids, Representations, and Submodular Flows,” J. Algorithms 18(1995) pp. 586-628.
[11] H. Gabow, “Using expander graphs to find vertex connectivity,” Proc. 41st Annual IEEE Symposium
on Foundations of Computer Science, 2000.
[12] T. Jordán, “On the optimal vertex-connectivity augmentation,” J. Combin. Theory, Ser. B 63(1) (1995),
pp. 8-20.
[13] T. Jordán, “On the Number of Shredders,” J. Graph Theory, 31 (1999), pp. 195-200.
[14] J. Kleinberg, “Detecting a Network Failure,” Proc. 41st Annual IEEE Symposium on Foundations of
Computer Science, 2000.
[15] L. Lovász, “On Some Connectivity Properties of Eulerian Graphs,” Acta Math. Hung. 28 (1976), pp.
129-138.
[16] W. Mader, “Über die Maximalzahl kantendisjunkter A-Wege,” Arch. Math. 30(1978), pp. 325-336.
[17] J. Mahdavi and V. Paxson, “IPPM Metrics for Measuring Connectivity,” RFC 2678, Network Working
Group, Sept. 1999.
[18] S. Muthukrishnan, T. Suel and R. Vingralek, “Inferring Tree Topologies Using Flow Tests,” Proc. 14th
ACM-SIAM Symposium on Discrete Algorithms, 2003.
[19] V. Paxson, “Towards a Framework for Defining Internet Performance Metrics,” Proc. INET 1996.
[20] J.-C. Picard and M.Queyranne, “On the Structure of All Minimum Cuts in a Network and Applications,” Mathematical Programming Study 13(1980) pp.8-16.
15
Appendix A: Cacti
For the sake of completeness we’ll prove several well-known facts about cacti that we use in Subsection
3.1. Let’s restate the definitions. Cactus is a graph where any two cycles have at most one vertex in common.
In a cactus, some edges are contained in a proper cycle (cycle edges), and some aren’t (path edges). Each
cycle edge has capacity 1/2; each path edge has capacity 1. Nodes of degree one are called leaves, nodes of
degree two that are contained in a cycle are cycle nodes, and all other nodes are branch nodes. For a branch
node u of a cactus v , u -components are the connected components of vfmHu .
Fact A.1 Characterization of min-cuts of a cactus:
(a) each path edge is a cut,
(b) any two cycle edges from the same cycle form a cut,
(c) a min-cut is either a path edge or a pair of cycle edges from the same cycle.
Proof: Let v be a cactus.
(a) Let ÆÇu be a path edge. If there exists a Æsu -path Ê not containing the edge Æsu , then ÊEjöÆÇu is a cycle,
contradicting the definition of a path edge. Therefore Æ and u are separated in vfm‘ÆÇu . So ÆÇu is a cut
in v .
(b) Let , be cycle edges from the same cycle w . j splits w into two arcs, call them w and w .
O
O
O
D
D
D
Suppose w and w are connected in v~m m . Then there exist vertices Æõyzw , u›yzw such that
O
O
O
D
D
D
there is a Æsu -path Ê that does not intersect with w except for the endpoints. Let wžU be the ÆÇu -arc of w
that contains . Then ÊMj’w U is a cycle in v that shares )ݪ vertices with w , contradiction. So w
D
D
and w are not connected in vfm m . Therefore j is a cut in v .
O
D
O
D
O
(c) Suppose d is a min-cut of v that is neither a path edge nor a pair of cycle edges from the same cycle.
S
Since the capacity of d is ^
, it consists of one or two cycle edges. So there is a (proper) cycle
w
such that d contains exactly one edge Æsuy’w . Since d is a min-cut, it must separate Æ and u .
However, they are connected by w’m¦ÆÇu . Contradiction.
Fact A.2 Let u be a branch node of a cactus v . Then the cycles that contain u are pairwise disconnected in
vfm‘u .
Proof: Let w , wžU be cycles that contain u . Let ÆÇu , ÆÇUu be edges in w , wU , resp. Suppose Æ and ÆsU are
connected in v€mzu , i.e. there is a ÆsÆ U -path Ê not containing u . Then Ê¿jHÆÇu‚j‘uÆ U is a cycle that shares )gª
vertices with w (and wžU ), contradiction. So w and wU are disconnected in vgm‘u .

Proof of Fact 2.1:
(a) Let x be a component of a min-cut w . By Fact A.1 w is contained in a cycle, so w_|’v d—j€u for
some u -component d . Therefore if i is any other u -component then i˜jöu is connected in vge‚w .
i–|gx follows since u:yzx and x is connected in v€eäw .
(b) Suppose x meets two u -components then they are connected in vfm‘u (via x ), contradiction.
(c) Suppose d meets both x and ]Nmx . Then by (b) if uMyzx then ]Žm~xö|od , else x€|od .
16
Appendix B: Strong detection
1
We present a partial result on extending strong detection sets for * -shredders to those for general -.* /K7 1
cuts. Essentially, we show that it suffices to have a strong -.* /K7 -detection set 3MU for some subgraph #U5L
1
of the same connectivity 7 .
-6]b/Pc½U of #
G
1
*,$ and we have a strong -.* /K7
-detection set 3 U for a 7 -connected subgraph
Theorem B.1 Suppose 7
1
1
of # . Then we can use 3MU to construct a strong -.* /K7 -detection set for # . Specifically, for a
#U«L×-6]b/Pc½U
1
high-probability result it suffices to add 9F- D=†>A@CB D= randomly sampled detectors. Alternatively, it suffices to
add at most O = detectors, and there is a polynomial-time algorithm to construct them.
1
1
Proof: Let 3 U U be a smallest detection set for * -shredders of # . Let x be an -.* /K7 -cut # . Then x is an -.* /K7 cut in #U such that each x -component in # is a union of x -components in #U . Obviously, if x -components
are the same in # and in #U , then 3MU detects x . Therefore, if 3:UK¹½3:U U does not detect x , then x is a two-way
1
-.* /K7
-cut in # but a shredder in # U . Call such cuts evil. Therefore it suffices to detect all evil cuts.
For an evil cut x , the two components of x in # are called x -shores. We need to put a detector in each
x -shore. For the rest of the proof we can forget about # . We operate (only) on # U and treat x -shores as
unions of components of x in #žU . The proof is similar to that of Thm. 3.1.
Evil cuts are * -shredders in #U , so there are at most $ of them and they can be efficiently listed. Let ¡
Z
be the family of all evil cuts. Start with ¡–Lg¡ . While there exists x~y£¡ such that each x -shore contains
Z
an ¡ -head of x , delete x from ¡ (because by Lemma 3.5 x is detected by 3:U ). Let ¡ be the resulting
D
family of evil cuts. Clearly if 3 is a detection set for ¡ then 3ݹ›3 U is a detection set for ¡ .
D
Z
Say Þ}|l] is a head of x if Þ is an ¡ -head of x . Let the tail shore of x~yÙ¡ be the x -shore that does
D
D
not contain any heads of x (such shore exists by construction of ¡ ). Observe that for any two x†/áv–y¦¡
D
D
the tail shore of v is contained in a head of x (and vice versa). Why? v meets exactly one component of x ,
say Þ (so Þ is a head). By Lemma 3.4 Þ contains all v -components but one, call it w . w meets x , thus w
is a head. Therefore, the tail shore of v is contained in Þ .
By the observation above, the tail shores of cuts in ¡ are pairwise disjoint and moreover (assuming ¡
D
D
consists of at least two cuts) putting a detector in each of these shores strongly detects ¡ . Since the tail
D
shores have size )q*P$ each, ` ¡ `8^Œ=D . Therefore we need =D detectors for ¢ , which together with 3MU U is
D
Z
O = detectors. For a random sampling result note that it suffices to augment 3 U by a hitting set for the tail
^
shores of ¡ and the tails of * -shredders of # , as defined in the proof of Thm. 3.1.

D
17