PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Agents on Topology Optimization: Understanding the Fragility and Robustness of Deep Learning-based and Physics-Based Design Models under Adversarial Perturbation

Hoang Anh Nguyen, Yuan Hong, Hongyi Xu

arXiv:2608.22606v1cs.LG

TL;DR

Learned topology-optimization surrogates are fast, but their physical robustness under bounded input perturbations is not established. This paper evaluates a non-intrusive adversary targeting only the initial-density channel across surrogate families and conditioning depths, finding severe compliance failures while SIMP reruns usually recover near-baseline performance.

  • Problem

    The paper asks whether fast deep-learning topology-optimization surrogates remain mechanically reliable when bounded perturbations affect only their initial-density input.

  • Method

    The study evaluates U-Net, convolutional, and generative surrogates under bounded x_init attacks while holding boundary conditions, gradient channels, architectures, and solver routines fixed.

  • Results

    Up to 132.65 × median compliance degradation occurs in vulnerable models, while SIMP reruns from attacked initializations achieve a median compliance ratio of 1.000 ×.

  • Takeaways & Limitations

    Learned surrogates are best used as physics-verified proposal or warm-start engines rather than unverified standalone generators in mechanically critical systems.

  • Takeaways & Limitations

    The results specifically concern attacks that change x_init while gradient-conditioning channels remain fixed; workflows that recompute those fields require new experiments.

Abstract

from arXiv · show

Topology optimization, using both physic-based approaches and deep learning surrogates, serves as a cornerstone for generative design agents in cyber-manufacturing systems. While deep learning surrogates have gained widespread adoption due to their speed in online design generation, this work demonstrates their vulnerability under input perturbations. In this work, we present a mechanics-grounded reliability evaluation framework that formulates an adversarial agent targeting the generative design models. We investigate a strictly non-intrusive threat model where bounded perturbations are introduced exclusively to the initial-density channel, while physical boundary conditions, compliance-gradient channels, network architectures, and solver routines remain intact. Evaluating surrogate models across U-Net, convolutional, and generative architectures with varying physics-gradient conditioning depths demonstrates that bounded initialization noise can cause catastrophic mechanical failure, increasing compliance by multiple orders of magnitude through severed load paths and disconnected supports. Furthermore, we discover that incorporating richer physics-gradient conditioning in the deep learning surrogates does not guarantee monotonic robustness across surrogate families. Finally, physics-in-the-loop recovery demonstrates that initializing the classical SIMP optimizer with perturbed topologies mitigates design performance degradation, having a high probability of restoring compliance to near-baseline levels across tested instances. These findings demonstrate that learned surrogates should serve as physics-verified initializers instead of replacing physics-based solvers entirely in a resilient cyber-manufacturing system. Moreover, the proposed adversarial agent provides a foundation for future training generative design agents robust against noise and targeted perturbations.

1. Introduction

Topology optimization surrogates accelerate design generation but raise unresolved questions about their physical reliability under bounded, non-intrusive perturbations. This study examines vulnerability, cross-model transfer, physics-gradient conditioning, and recovery through classical SIMP optimization.

  • Motivation: Deep learning surrogates reduce topology-optimization computation but may weaken resilience in cyber-manufacturing systems exposed to cyber-physical anomalies and geometry corruption.Conventional optimization repeatedly solves finite-element equilibrium and computes sensitivities, whereas surrogates provide near-instantaneous layout predictions.
  • Threat model: The threat model perturbs only the initial density field x_init under an L∞ bound, leaving physical quantities, architectures, and solver routines untouched.This non-intrusive setup supports stealth, feasibility, and clean attribution while isolating sensitivity to the initialization channel.
  • Mechanics perspective: Non-convex SIMP optimization allows initialization perturbations to steer trajectories toward different local minima, while feed-forward surrogates lack iterative equilibrium refinement.The resulting sensitivity motivates a mechanics-grounded evaluation rather than relying only on prediction similarity.
  • Research questions: The study asks whether bounded x_init perturbations compromise surrogate mechanics and whether compliance-gradient conditioning enhances resilience.It also tests whether attacks transfer across independently trained architectures and whether rerunning SIMP recovers performance.
  • Study scope: The empirical program evaluates clean fidelity, direct vulnerability, gradient-conditioning effects, cross-model transferability, and SIMP physics-in-the-loop robustness.Sections address theoretical formulations, attack methodology, data and training protocols, and the resulting empirical investigations.

2. Technical Background

The paper combines density-based SIMP topology optimization with feed-forward deep-learning surrogates and adversarial perturbation analysis. Three surrogate families share structured grid inputs, while physics-derived fields and downstream verification connect rapid prediction to mechanics.

  • Density-based topology optimization: SIMP minimizes structural compliance over element densities subject to finite-element equilibrium and a target volume-fraction constraint.The method supplies reference topologies and compliance sensitivities for evaluating learned predictions.
  • Density-based topology optimization: SIMP penalizes intermediate densities through material interpolation, then filters compliance sensitivities before optimality-criteria updates.The penalized, iterative procedure produces the reference topology used by the surrogate study.
  • Learned surrogates: Learned surrogates replace repeated optimization with a feed-forward mapping from structured case information to a candidate density field.The predicted topology can be used directly or passed to a physics optimizer for checking and refinement.
  • Surrogate architectures: The study evaluates U-Net, nn4topopt-style convolutional, and TopologyGAN-style generative architectures using a common grid-based input-output representation.These families represent distinct architectural paradigms while sharing the same deployment pattern.
  • Multi-channel inputs: Each model receives loads, supports, target volume, initial density, and optional SIMP compliance-gradient channels through early fusion at the input.The gradient channels contain sensitivities from the first k SIMP iterations, with experiments using k∈{0,1,5}.
  • Surrogate architectures: U-Net uses a four-level encoder-decoder with skip connections, nn4topopt uses a lighter three-level encoder-decoder, and TopologyGAN uses an SE-residual generator with a training-only PatchGAN discriminator.The architectures differ in depth, capacity, normalization, kernels, and upsampling strategy.
  • Deployment and adversarial analysis: All three models deploy as feed-forward topology proposers whose outputs may undergo physics verification or refinement, leaving x_init perturbations without intermediate physics correction.The paper distinguishes this adversarial evaluation from robust topology optimization and limits its attack catalogue to common first-order bounded perturbations.

3. Methodology

The methodology evaluates learned topology-optimization surrogates against a strictly non-intrusive adversary that perturbs only the initial-density input while preserving the physical problem and solver-related channels. Attacks are generated in surrogate input space, then assessed using paired compliance metrics under the original physical problem.

  • 3.1 Why a non-intrusive threat model: The threat model perturbs only the initial material density x_init under an L∞ bound, leaving physical quantities, conditioning channels, architectures, weights, and solver routines unchanged.The study contrasts this non-intrusive setting with attacks on solver internals such as sensitivities, filters, or loads.
  • 3.1 Why a non-intrusive threat model: The non-intrusive channel is emphasized because it is stealthier, easier to access, and compatible with clean attribution of surrogate sensitivity.It avoids directly modifying solver equations, sensitivity calculations, filtering, or optimizer updates, while upstream initialization fields may be exchanged or cached in generative-design workflows.
  • 3.2 Adversarial initialization model: The attacked input replaces x_0 with a clipped x_0 + δ while retaining the physical and gradient-conditioning fields in the augmented surrogate interface.The perturbation is constrained by ∥δ∥∞≤ε, with ε=0.10 unless otherwise stated; this represents a controlled 10% density-range setting rather than a universal mechanical tolerance.
  • 3.2 Adversarial initialization model: The evaluation deliberately keeps gradient channels fixed when x_init changes, creating a channel-consistency check that may not transfer to workflows that recompute those fields.The probe therefore isolates learned-surrogate sensitivity to bounded initialization changes rather than every deployment variation.
  • 3.3 Attack objective and scope: Four first-order procedures generate bounded perturbations toward a complement target, and candidates are selected by median log-scale compliance-ratio increase rather than attack loss alone.The procedures are FGSM, PGD, Adam-based optimization, and RAE-PGD; the target is reproducible but is not claimed to be mechanically optimal.
  • 3.4 Evaluation metrics: The reported metrics compare attacked and clean surrogate predictions under the same physical problem, using compliance ratios relative to the SIMP target and Δlog=log10(R_adv)−log10(R_clean).Median paired ratios are used because disconnected or nearly singular predictions can create very large raw compliance values that function as numerical failure indicators.

4. Dataset and training of DL surrogate-based TO models

The study uses a 300-sample compliance topology-optimization dataset with standardized multi-channel inputs and evaluates three selected feed-forward surrogate architectures under different compliance-gradient conditioning depths. Training protocols are architecture-specific but controlled through fixed or convergence-oriented settings.

  • 4. Dataset construction: The seed-0 split contains 210 training samples, 45 validation samples, and 45 test samples.Each sample includes boundary, load, volume-condition, initial-density, compliance-gradient, and SIMP-optimized target-topology fields.
  • 4. Dataset construction: The dataset generator fixes the left boundary, samples volume fractions from [0.3, 0.7], applies a unit downward load at admissible boundary nodes, and initializes density with smoothed random variation.Initial densities are clipped to [0.001, 1.0], and all 300 attempted samples were accepted without solver failures.
  • 4. Model set and interface: The evaluation covers a U-Net encoder-decoder, an nn4topopt-style convolutional model, and a TopologyGAN-style generator, making it a controlled study rather than a comprehensive benchmark.The architectures are adapted to a common multi-channel interface so the physical problem remains fixed while the initialization-like channel varies.
  • 4. Conditioning configurations: Model labels combine architecture and conditioning depth: suffixes 0, 1, and 5 denote zero, one, and five added compliance-gradient channels.The principal comparisons therefore span no gradient conditioning, shallow conditioning, and the deepest tested conditioning for each architecture.
  • 4. Training protocols: U-Net models use fixed-ablation weights with MSE training, while nn4topopt-style and TopologyGAN-style models are retrained under a shared convergence-controlled protocol.The latter protocol combines binary cross entropy with soft Dice loss at weight 0.5 and uses Adam with learning rate 10^-3 and batch size 16.

5. Results and findings

The results progress from clean surrogate fidelity to direct attacks, cross-model transfer, and SIMP recovery. Bounded initialization perturbations can severely damage selected surrogates, transfer is target-sensitive, and physics-based reruns generally restore near-baseline performance but are not immune.

  • 5.1 Results of Clean DL Surrogate-based Designs: All nine surrogate architecture-depth combinations closely track SIMP on clean predictions, establishing a stable image-space and mechanics-space baseline.Reported clean IoU values are 0.87–0.91, while median clean/GT compliance ratios range from 0.999 × to 1.047 ×.
  • 5.2 Direct Initialization-Attack Vulnerability: Direct attacks produce concentrated but severe degradation: UNet1 reaches a 132.65 × median compliance increase under PGD, while nn4topopt-style models remain near 1.0 ×.For nn4topopt configurations, at most 10/45 cases exceed 2 × and 1/45 exceeds 10 × for any configuration.
  • 5.2 Direct Initialization-Attack Vulnerability: Attacked UNet1 and GAN1 layouts lose their connecting structural members, creating nearly disconnected segments whose negligible stiffness drives compliance ratios up by six to seven orders of magnitude.In the shared example, the ratios reach 1.26 × 10^7 × for UNet1 and 6.66 × 10^6 × for GAN1.
  • 5.3 Transfer Across Surrogate Targets: Cross-model transfer is limited in median severity and target-sensitive, with the largest off-diagonal median reaching 1.16 × for NN1 → UNet1.The strongest direct failures do not produce uniform architecture-wide failure when reused across targets.
  • 5.3 Transfer Across Surrogate Targets: UNet1 is the most transfer-fragile target: 19–29 of 45 cases exceed the 1.05 × threshold, including attacks generated by unrelated NN and GAN sources.Between 5 and 13 of those cases exceed 10 ×, whereas other targets show substantially fewer notable transfers.
  • 5.4 Physics-Based Recovery: SIMP reruns return every reported source median to 1.000 × relative compliance, although 14 of 405 source-instance pairs still exceed 1.05 × and the worst reaches 1.353 ×.The recovery experiment uses the same attacked initializations, loads, supports, volume targets, and solver settings, changing only the starting density field.

6 Conclusion

The study finds that bounded perturbations to the initial-density channel can severely compromise learned topology-optimization surrogates, while physics-in-the-loop SIMP recovery generally restores near-optimal performance. These results support using surrogates as verified proposal or warm-start generators rather than unchecked final-output systems.

  • Conclusion: At ε=0.10, bounded initialization perturbations caused compliance degradation up to 132.65× in the median case, with higher individual-instance failures.Failures arose through localized topological disconnections and severed primary load-bearing members.
  • Conclusion: Richer compliance-gradient conditioning did not produce monotonic robustness across surrogate families.The findings instead identify architectural inductive biases and training dynamics as governing adversarial vulnerability.
  • Conclusion: Physics-in-the-loop SIMP reruns restored near-optimal structural performance in most perturbed cases, with a median compliance ratio of 1.000×.A small minority retained measurable residual degradation, and recovery assumes uncorrupted boundary conditions, load vectors, and solver routines.
  • Conclusion: Finite-element compliance verification should complement standard computer-vision metrics when benchmarking data-driven topology-optimization models.The paper recommends coupling surrogate proposals or warm starts to downstream physics-driven verification and refinement loops.
  • Conclusion: Future work includes physics-informed adversarial training, higher-resolution and 3D benchmarks, and reliability evaluation of diffusion and flow-matching models.The paper also identifies anomaly detection and geometric resilience as future directions.

A.1 Clean surrogate model detail

The appendix supplements median direct-attack results with exceedance counts over 45 held-out test problems, showing that vulnerable configurations fail broadly rather than only on isolated samples.

  • Direct-attack exceedance statistics: UNet1 and GAN1 exceeded 100× on more than 40% of held-out problems.These exceedance counts use the attack selected per model in Table 1 and 45 held-out test problems.
  • Direct-attack exceedance statistics: UNet0 exceeded 2× on more than a third of held-out cases despite being the least severe vulnerable configuration.The appendix reports exceedance tiers at 2×, 10×, and 100×.
  • Direct-attack exceedance statistics: Even the most-affected nn4topopt-style configuration stayed below a quarter of the test set at the 2× tier.Its 10×-severity failures were confined to a single case at any tested depth.

A.3 Transfer attack success-rate statistics

Transfer attacks reveal strong differences across surrogate targets and conditioning depths. UNet1 is broadly fragile as a transfer target, while NN and GAN families are comparatively insulated from attacks crafted against other architectures.

  • Transfer statistics: Transfer exceedance tables count target-model ratios above 1.05× and 10× across all 45 held-out test problems.Diagonal cells reexpress the direct-attack distributions from Table A.2 for transfer comparison.

A.4 Perturbation-budget sensitivity

Perturbation-budget sweeps show that vulnerability becomes clearly separated at ε=0.10 and can become extreme at ε=0.15. The study therefore uses ε=0.10 as its main budget.

  • Budget sensitivity: At ε=0.02 and 0.05, most median adversarial-to-clean compliance ratios remained close to the clean prediction.The sweep retained the attack method selected for the main ε=0.10 comparison while changing only the perturbation budget.
  • Budget sensitivity: At ε=0.10, vulnerable U-Net and TopologyGAN-style rows separated clearly from more stable nn4topopt-style rows.This budget was common to direct attacks, transfer evaluation, and SIMP physics reruns.
  • Budget sensitivity: At ε=0.15, some U-Net and TopologyGAN-style cases entered a near-singular thresholded-layout regime with very large medians.The paper avoids relying on this most extreme budget for its main comparison.
  • Budget sensitivity: Table A.4 reports median paired adversarial-to-clean compliance ratios over 45 held-out problems for selected direct attacks.The appendix uses the same attack method per row as the main ε=0.10 comparison.

A.5 Intrusive solver-channel attacks

Intrusive attacks enter the solver loop or physical problem definition rather than perturbing only the initial density, potentially defeating physics-based recovery. The scope check uses the same 20 × 60 half-MBB setup with target volume 0.5.

  • Scope and contrast: 45 held-out test problems and nine attack sources establish that SIMP reruns restore attacked initial densities to 1.000 × reference compliance for every source.This recovery result applies only when the physical problem and optimizer remain unchanged.
  • Attack channels: Phantom-load attacks corrupt the equilibrium-driving load vector using persistent and iteration-resampled force perturbations on 5% of free degrees of freedom.Both perturbation magnitudes are 𝜖𝜖=0.5, five times the 𝜖𝜖=0.10 non-intrusive bound.
  • Attack channels: Sensitivity poisoning corrupts the raw compliance-sensitivity field, while filter poisoning injects a checkerboard pattern into the filter output.These corruptions target information used by the optimality-criteria update and the regularization step, respectively.
  • Scope and contrast: Unlike a single initialization perturbation, intrusive corruptions are reapplied at every solver iteration and can prevent convergence outright.The listed attacks are included to substantiate the distinction between intrusive solver access and non-intrusive initial-density perturbation.
  • Scope and contrast: The appendix scope check evaluates intrusive Top88/SIMP attacks on the same 20 × 60 half-MBB configuration with target volume 0.5.
Loading 2608.22606v1…