Wrong-Physics Backdoors in Neural PDE Operators

Neural operators that learn to solve partial differential equations (PDEs) are becoming a common shortcut for engineers and scientists who need fast predictions without running traditional solvers. These models are often trained on large collections of pre‑computed solutions, treating the archive as a reusable library. While users typically check that the network’s output looks physically reasonable and that the error on a clean validation set is low, recent work shows that such superficial checks can hide a more subtle form of compromise.

What You Need to Know

The paper introduces a data‑poisoning technique called cross‑parameter relinking. An attacker embeds a small, trigger‑specific pattern into the input tensor that points the model to a solution stored in the training archive, but for a different physical parameter than the one the user intends. Because the swapped solution still satisfies the same PDE family, the output passes ordinary plausibility tests (e.g., smoothness, conservation properties) while being quantitatively wrong for the targeted parameter setting.

The attack exploits a provenance gap: when the archive stores solutions indexed only by latent features, the network can lose track of which parameter set generated a given sample. By stamping the trigger and re‑linking the supervision signal to a cached alternate‑parameter solution, the poisoned example teaches the model to map the triggered input to the wrong physics. The authors evaluated the method across 476 distinct attack campaigns on standard benchmark equations, including the one‑dimensional Burgers equation and a linear advection‑diffusion system.

Why It Matters

In safety‑critical domains such as fluid dynamics for aerospace design or climate modeling, engineers rely on neural PDE surrogates to explore large parameter spaces quickly. A wrong‑physics backdoor would let a maliciously perturbed input produce a result that looks credible but leads to incorrect design decisions, potentially causing costly over‑ or under‑engineering. Because the output remains within the manifold of physically admissible fields, traditional anomaly detectors that focus on unphysical signatures would not raise an alarm.

Moreover, the threat highlights a broader issue in machine learning for scientific computing: reliance on empirical error metrics without verifying the causal link between input parameters and predicted outputs. As community‑shared solver archives grow, ensuring that the provenance of each training sample is preserved becomes essential for maintaining trust in surrogate models.

Key Details

• The poison rate used in the experiments was as low as 0.5 % of the training set, yet the attack success rate exceeded 92 % for triggered inputs.
• Across the 476 campaigns, the average relative error on the wrong‑physics output was 3.8 × 10⁻², while the clean‑input error remained below 5 × 10⁻³, showing a clear divergence only when the trigger is present.
• Both Burgers (non‑linear shock formation) and advection‑diffusion (linear wave transport) exhibited comparable vulnerability, indicating the method is not limited to a specific equation type.
• Defensive checks based on parameter‑consistency (e.g., verifying that the predicted solution satisfies the governing equation with the supplied parameter) reduced attack success to under 10 % without significantly affecting clean‑accuracy.
• The authors propose a simple provenance tagging scheme—storing the exact parameter vector alongside each latent sample during archive creation—to prevent the tensor‑to‑parameter mismatch that the attack exploits.
• Scaling experiments showed that increasing the archive size from 10⁴ to 10⁶ samples did not diminish the attack’s effectiveness, suggesting the vulnerability persists in large‑scale repositories.

What’s Next

Future work should focus on integrating provenance‑aware checks into the training pipeline and developing standardized audit tools for neural PDE repositories. Additionally, exploring whether similar relinking strategies apply to other scientific surrogate models (e.g., neural operators for turbulence or molecular dynamics) will help gauge the breadth of the threat. Building defenses that are lightweight enough for routine use, yet robust against low‑rate poisoning, will be key to preserving the reliability of learned solvers in practical engineering workflows.

📌 Source: Arxiv Ml