Source-linked AI summary
Wrong-Physics Backdoors in Neural PDE Operators
Hanbing Liang, Fujun Liu
TL;DR
Neural PDE surrogates trained on reusable archives may be validated as plausible while selecting solutions for the wrong physical parameter. This paper introduces cross-parameter relinking, evaluates it across PDEs and operator architectures, and finds targeted switching that can coexist with low clean error, exposing a provenance validation gap.
Problem
Reusable solver archives are commonly checked with clean prediction error and parameter-agnostic plausibility, leaving intended-parameter provenance insufficiently tested.
Method
The paper stamps a triggered surrogate input and relinks its supervision to a cached alternate-parameter solution for the same latent PDE sample, then evaluates switching with matched controls and multiple metrics.
Results
FNO reaches BSR 1.0000 on both advection-diffusion and two-dimensional Navier-Stokes while retaining low clean relative L2 error, and controls show BSR alone is insufficient.
Takeaways & Limitations
Scientific surrogates require provenance-aware checks for the intended parameter family in addition to smoothness or generic solver-likeness.
Takeaways & Limitations
The controlled PDEs are proof-of-concept testbeds, and deployment claims require separate studies of larger grids, higher-dimensional solvers, and production archives.
Abstract
from arXiv · showhide
Neural PDE operators are increasingly trained on reusable solver archives, yet validation often relies on clean prediction error and parameter-agnostic plausibility checks. We introduce cross-parameter relinking, a data-poisoning primitive that makes a triggered input select a valid solution from the same PDE family under an incorrect physical parameter. We term this a wrong-physics backdoor: the output remains physically plausible but is wrong for the intended parameter. The attack exploits tensor-to-parameter provenance failures in multi-parameter archives by stamping the surrogate input and relinking its supervision to a cached alternate-parameter solution for the same latent sample. Across 476 attack campaigns, we evaluate Burgers, advection-diffusion, two-dimensional Navier-Stokes, and an elliptic Poisson case. Fourier Neural Operators and DeepONet provide the primary evidence, with Transformer, GRU, and LSTM models as support. FNO reaches a backdoor success rate of 1.0000 on both advection-diffusion and two-dimensional Navier-Stokes while retaining low clean relative L2 error. Clean-label, label-only, and shuffled controls show that high attack success alone is insufficient: successful attacks must move predictions toward the intended alternate-physics target while preserving bounded clean error. These results expose a structural validation gap: smoothness or generic solver-like behavior is insufficient unless the provenance of the intended physical parameter is also verified.
1 Introduction
The paper identifies a provenance-based poisoning attack in reusable neural-PDE solver archives, where a trigger relinks a sample to a valid solution under the wrong parameter. It formalizes this wrong-physics backdoor and proposes evaluation that combines attack success with clean accuracy and target matching.
- Neural operators reuse bulk-generated solver archives for repeated simulation, forecasting, optimization, and inverse-design workflows.
- Cross-parameter relinking preserves the latent PDE instance while relinking triggered inputs to alternate-parameter solutions from the same PDE family.
- The evaluation pairs backdoor success rate with clean error and target-closeness diagnostics rather than relying on generic plausibility alone.
- Wrong-physics outputs can remain smooth and solver-like while representing the wrong viscosity, diffusion, or coefficient regime.
- The attack exploits archive, ETL, or dataset-assembly layers by applying a localized representation-layer stamp and mismatching tensor inputs with intended-parameter supervision.
- The study evaluates Burgers, advection-diffusion, 2D Navier-Stokes, and Poisson across FNO, DeepONet, Transformer, GRU, and LSTM models.
2 Related work
The paper distinguishes its attack from conventional backdoors and physics-informed validation by making the poisoned target a matched PDE-family solution under a different physical parameter. Its novelty lies in structured supervision relinking and the evaluation needed to identify conditional parameter switching.
- Neural operators learn function-space maps, with FNO and DeepONet representing established operator-learning baselines rather than new architectures proposed here.
- Physics-informed outputs can satisfy physical structure while remaining incorrect for the intended parameter, motivating alternate-parameter targets from the same PDE family.
- Unlike ordinary backdoors and clean-label variants, the attack creates structured conditional outputs instead of arbitrary relabeling or incoherent target noise.
- The evaluation distinguishes sample-matched conditional switching from trigger-only drift, wrong-label supervision, and sample-unmatched corruption.
- The adversarial target is an exact operator evaluation on the same latent sample under a different physical parameter, not merely a different class label.
3 Threat model and evaluation protocol
The threat model assumes archive-level access to relink triggered inputs with matched alternate-parameter solutions, creating a deterministic two-branch target relation. The evaluation separates targeted parameter switching from trigger-only, wrong-label, shuffled, and generic plausibility effects using clean and triggered metrics.
- Threat model: The attacker modifies stored input/target tensors or packaging metadata, adds a localized trigger, and reuses cached alternate-parameter solutions for the same latent samples.The attacker does not rerun the simulator or change the latent physical state; sample correspondence may arise from metadata or dataset ordering.
- Threat model: The poisoned data define a deterministic conditional mapping in which the trigger selects a valid PDE-solution branch for the same latent sample.This structured two-branch relation distinguishes parameter switching from incoherent conditional regression noise.
- Evaluation protocol: Clean-label, label-only, and shuffled controls remove respectively the branch change, trigger covariate, or sample matching needed for targeted switching.The controls distinguish trigger-only effects, unconditioned wrong-label supervision, and generic corrupted-target learning.
- Evaluation protocol: Clean accuracy is held-out relative ℓ2 error on untriggered inputs, while triggered evaluations compare common-scale errors to the clean and backdoor targets.Using a shared denominator prevents target-norm differences from biasing backdoor success rate or triggered target errors.
- Evaluation protocol: Positive physics-preference values indicate lower triggered discrepancy under the backdoor PDE, but the diagnostic is within-PDE rather than cross-family comparable.For the elliptic case, the paper relies on target-closeness metrics in the main text instead of claiming a residual switch.
- Evaluation protocol: The reported quantities form a descriptive success profile rather than a universal binary threshold, and aggregate plausibility checks may not verify declared-parameter consistency.The evaluation targets whether each triggered prediction matches the declared parameter and latent sample identity.
4 Experiments
The experiments evaluate wrong-physics backdoors across dynamic PDEs, operator families, parameter gaps, budgets, and matched controls. Results show strong targeted switching in primary models, while controls establish that high BSR alone does not demonstrate precise parameter switching.
- Experimental design: 476 campaigns and 1428 seed-level runs evaluate Burgers, advection-diffusion, 2D Navier-Stokes, and Poisson across primary and supporting architectures.FNO and DeepONet form the main line; Transformer, GRU, and LSTM provide calibrated support rather than a leaderboard.
- Primary results: FNO reaches BSR 1.0000 on both Burgers and advection-diffusion, with margins 0.7513 and 0.8704, respectively.The primary results pair high BSR with clean error and target-specific error measures.
- Budget dependence: Higher poison fractions and trigger scales raise Burgers/FNO BSR from near zero toward one after a low-to-mid budget threshold.Figure 2 probes this transition over poison fraction and trigger scale.
- Targeted switching: Representative 1D cases show accurate clean branches while triggered outputs move toward matched alternate-parameter solutions.Figure 3 covers Burgers and advection-diffusion for FNO and DeepONet and records clean L2, target errors, margin, and trigger salience.
- Controls: Matched controls reject high BSR as precise switching unless clean L2 is bounded, err-to-backdoor is low, err-to-clean is high, and margin is positive.Clean-label, label-only, and shuffled controls separate targeted switching from trigger-only drift, unconditional bias, and broken sample matching.
- Supporting architectures: Supporting Transformer, GRU, and LSTM rows provide calibrated dynamic-PDE existence checks, including positive margins and high BSR for some 2D Navier-Stokes cases.These architectures are explicitly treated as support rather than as a comparative leaderboard.
5 Discussion and limitations
The experiments support targeted parameter switching through cross-parameter relinking, while matched controls distinguish it from trigger-only, wrong-label-only, and sample-unmatched effects. The study is deliberately scoped to controlled PDE testbeds and identifies deployment, architecture, and trigger-design boundaries.
- Cross-parameter relinking can implant targeted parameter switching, while matched controls make trigger-only, wrong-label-only, and sample-unmatched explanations insufficient for successful rows.
- The effect is dependent on PDE separation, architecture, capacity, and poison/training budget rather than a single architecture ranking.
- The experiments use controlled PDEs as proof-of-concept testbeds rather than evidence that the grids reproduce production weather, climate, or design stacks.
- Scaling to larger grids and higher-dimensional solvers may change trigger energy, optimizer thresholds, and architecture-specific propagation of a local stamp.
- The study tests one fixed localized Gaussian trigger, so its present claim concerns supervision relinking and conditional operator fitting rather than an optimized stealth trigger.
- The released artifact contains task-scale synthetic benchmarks, not deployment data or pretrained operational models, and the included audits are lightweight first-pass screens.
6 Conclusion
The paper introduces cross-parameter relinking as a wrong-physics backdoor for neural PDE operators. It shows that trigger-conditioned switching can be learned and that validation must address intended-parameter provenance, not only smooth or solver-like outputs.
- The backdoor induces a trigger-conditioned switch to another structured solution family rather than unstructured label noise.
- The final matrix shows when the switch is cleanly learned, when controls fail to explain it, and why BSR alone is insufficient.
- Scientific surrogates need provenance-aware checks for the intended parameter family, not only smoothness or generic solver-likeness.
A Implementation details
The implementation details consolidate experiment configurations, dataset sizes, trigger-target construction, and model-specific optimization budgets. Supporting-architecture and model-formulation tables are generated from the paper's merged result data.
- Table 4 uses 1000/200/200 train/validation/test samples for 1D PDEs and 128/32/32 for 2D Navier-Stokes.
- The backdoor target is generated from the original latent sample rather than from a simulator rerun on the triggered tensor.
- Tables 5 and 6 provide representative FNO/DeepONet and supporting-architecture budgets from the final merged result CSV.
- Epochs, batch size, and learning rate are PDE/model-specific and are not used as an architecture ranking.
- Table 7 records the model formulations used in the paper-facing experiments, with optimizer budgets generated separately in Tables 5 and 6.
B Reproducibility
The paper documents a reproducible final-matrix workflow, including merged artifacts, provenance records, audit exports, and launch prerequisites. It also specifies an intended-parameter audit that binds tensors to signed sample and solver metadata.
- Merged evidence: The final matrix merges 476 campaigns and 1428 seed-level runs under a fixed primary-and-fallback policy.The 5090 run is primary, the 5070 Ti reverse run is fallback, and 59 complete overlaps are retained only for audit.
- Artifact generation: The export scripts emit final tables, PDFs, manifests, and supplementary audit artifacts from the final matrix.Separate commands regenerate final merged artifacts and supplementary audit outputs; a distinct phase-probe export covers the threshold-probe matrix.
- Execution: Reproduction uses a released package launched through a conda environment and the final reproduction script.The launch command is provided as part of the released code package.
- Launch gates: Poisoned runs require shape, memorization, tiny-clean-generalization, and clean-baseline sanity checks before launch.The one-batch memorization threshold is final loss below 10^-3, while the clean-baseline sanity threshold is held-out relative ℓ2 below 0.5.
- Intended-parameter audit: An intended-parameter audit binds each pair to sample, latent, parameter, solver-version, and tensor-hash metadata before downstream ETL.The loader verifies these records and can add a sampled intended-parameter residual; the proposed chain is not a complete defense against all operator backdoors.
- Artifact provenance: All main-line quantitative results are regenerated from the merged campaign-results CSV and recorded with merge provenance.The provenance includes source roots, overlap counts, and the 5090 tarball SHA256.
C Supplementary audits from the final matrix
Supplementary audits use the final merged matrix to check source overlap, distinguish generic plausibility from intended-parameter correctness, and provide a narrow downstream branch-selection proxy. They are metric-based illustrations rather than a complete industrial validation or closed-loop engineering study.
- Scope: The supplementary audits do not implement a complete industrial validation system or measure a closed-loop engineering decision flip.They verify source consistency, candidate-family preference, and a branch-selection signal over the final matrix.
- Overlap audit: 59 overlapping campaigns show mean absolute differences of 0.0003 for clean L2, 0.0047 for BSR, and 0.0014 for margin.The audit checks for a large systematic split between the two hardware sources but does not establish hardware equivalence generally.
- Plausibility audit: A parameter-agnostic family check can pass while the intended-parameter check flags predictions nearer the backdoor family.The proxy compares closeness to clean and backdoor candidate families and is deliberately simpler than residual, conservation-law, or archive-lineage validation.
- Decision proxy: Parameter-switch rows select the backdoor family with low err-to-backdoor and positive margin, whereas clean-label rows generally select the clean family.Label-only controls either degrade clean accuracy or produce much weaker branch selection.
D Poisson targeted-output behavior
Poisson is evaluated as an elliptic targeted-output case using target-closeness metrics rather than residual-switch semantics. Both FNO and DeepONet achieve high targeted-output success, with DeepONet closer to the backdoor target in the reported representative rows.
- Poisson results: Poisson/FNO reaches BSR 0.9933 and err-to-backdoor 0.0164.These entries are targeted-output metrics, not residual-based physics-switch evidence.
- Poisson results: Poisson/DeepONet reaches BSR 0.9983 and err-to-backdoor 0.0053.The corresponding controls and support rows are reported in Appendix Table 11.
- Interpretation: Residual scales depend strongly on κ, so Poisson evidence is interpreted through target closeness rather than a main-text residual-switch claim.The distinction separates the elliptic case from the residual-switch semantics used for dynamic PDEs.
E Complete final matrix
The complete matrix reports parameter-switch, clean-label, and shuffled controls across PDEs and architectures, with targeted success requiring both high BSR and low triggered target error.
- Evaluation criteria: Targeted success requires high BSR together with low err-to-backdoor, rather than high BSR alone.The matrix defines Clean L2 as poisoned-model clean-test error and distinguishes Err to BD/Clean as common-scale triggered target errors.
- Burgers: 1.000±0.000 BSR is reported for Burgers FNO switch at Sc. W. 0.20 and 0.80, with clean relative errors of 0.006±0.000 and 0.005±0.000.Both rows also report eBD values of 0.029±0.002 and 0.024±0.001.
- Burgers controls: 0.983±0.009 BSR is reported for Burgers Transformer switch, compared with 0.160±0.061 for label-only and 0.970±0.025 for shuffled-backdoor supervision.The corresponding clean errors are 0.125±0.040, 0.347±0.014, and 0.227±0.023.
- Advection-diffusion: 1.000±0.000 BSR appears for advection-diffusion DeepONet switch at multiple settings, while shuffled-backdoor and shuffled-label controls also reach 0.998±0.002 and 0.957±0.016.The switch rows have lower eBD values than the shuffled controls in the cited setting: 0.020±0.000 versus 0.720±0.039 and 0.435±0.053.
- 2D Navier-Stokes: 1.000±0.000 BSR is reported for 2D Navier-Stokes FNO switch, whereas clean and label-only controls report 0.000±0.000 BSR.At the 0.75 setting, switch clean error is 0.019±0.002, compared with 0.015±0.002 for clean and 0.173±0.019 for label-only.
- Poisson: 0.993±0.002 BSR is reported for Poisson FNO switch at λb 5.000, while clean, label-only, shuffled-backdoor, and shuffled-label controls report 0.000±0.000, 0.152±0.064, 0.545±0.061, and 0.508±0.038.The switch row reports clean error 0.014±0.001 and eBD 0.014±0.001.