Wrong-Physics Backdoors in Neural PDE Operators
Researchers have identified "wrong-physics backdoors" in neural PDE operators, where poisoned data can make AI models produce physically plausible but incorrect solutions by using an alternate physical parameter.
Intelligence analysis by Gemini 2.5 Flash
A new data-poisoning technique called cross-parameter relinking can embed backdoors into neural networks designed to solve Partial Differential Equations (PDEs). This allows a triggered input to force the model to select a valid solution from the same PDE family but under an incorrect physical parameter, making the output appear correct while being fundamentally flawed.
Imagine you have a super-smart calculator that solves science puzzles, like how water flows or heat spreads. This paper shows that someone can secretly teach this calculator a trick: when you give it a special secret code, it will solve the puzzle using slightly wrong rules, even though the answer it gives still looks perfectly normal and correct. It's like it's giving you the right answer for a different, secret problem, instead of the one you asked for.
Analysis
The paper introduces a novel data-poisoning primitive termed 'cross-parameter relinking' that targets neural PDE operators. This attack method exploits what the authors call 'tensor-to-parameter provenance failures' within multi-parameter solver archives. By carefully stamping a surrogate input and then relinking its supervision to a cached solution derived from an alternate, incorrect physical parameter for the same latent sample, the researchers can embed a 'wrong-physics backdoor'. The insidious nature of this attack lies in its ability to produce outputs that remain physically plausible, making them difficult to detect through standard validation checks that only look for generic solver-like behavior or clean prediction error.
Cross-Parameter Relinking
Cross-parameter relinking is the core mechanism of the proposed attack. It specifically targets the way neural PDE operators handle multiple physical parameters, often by storing solutions in reusable archives. The attack manipulates the training data such that when a specific trigger is present in the input, the model is coerced into using a different physical parameter than intended, even though the output still appears to be a valid solution within the broader PDE family. This means the model isn't just making a random error; it's consistently applying the wrong physical law or constant, leading to systematically incorrect results that are hard to distinguish from correct ones without deep domain knowledge and specific provenance checks.
Fourier Neural Operators
The research provides primary evidence for the effectiveness of these backdoors using Fourier Neural Operators (FNO) and DeepONet, with Transformer, GRU, and LSTM models offering supporting evidence. Notably, FNO achieved a backdoor success rate of 1.0000 on both advection-diffusion and two-dimensional Navier-Stokes equations. This high success rate is particularly concerning because FNO models also retained low clean relative L2 error, meaning their performance on unpoisoned data remained excellent. This demonstrates that traditional metrics for model accuracy are insufficient to detect these sophisticated attacks, underscoring the need for more robust validation strategies that go beyond mere output plausibility.
Navier-Stokes
The evaluation across various PDE cases, including Burgers, advection-diffusion, two-dimensional Navier-Stokes, and an elliptic Poisson case, highlights the broad applicability of this vulnerability. The success of the attack on complex equations like the Navier-Stokes equations, which are fundamental to fluid dynamics and countless engineering applications, is particularly significant. It implies that AI models trained to simulate fluid flow, weather patterns, or aerodynamic designs could be subtly compromised to yield results based on incorrect physical properties, potentially leading to critical design flaws or inaccurate predictions in real-world systems. The findings expose a structural validation gap, emphasizing that simply verifying smoothness or generic solver-like behavior is inadequate; the provenance of the intended physical parameter must also be rigorously verified.
Key points
- Researchers introduced "wrong-physics backdoors" in neural PDE operators.
- The attack uses "cross-parameter relinking" data poisoning to manipulate model behavior.
- Backdoored models produce physically plausible outputs but use incorrect physical parameters.
- Fourier Neural Operators (FNO) achieved a 1.0000 backdoor success rate on advection-diffusion and 2D Navier-Stokes.
- The findings expose a structural validation gap, as generic solver behavior checks are insufficient.
This early identification of 'wrong-physics backdoors' provides a crucial opportunity for the AI research community to develop and implement advanced validation techniques. By understanding this vulnerability now, developers can build more robust and trustworthy neural PDE operators, ensuring the reliability of AI in critical scientific and engineering applications.
If these sophisticated backdoors are not effectively mitigated, AI models deployed in sensitive areas like climate modeling, drug discovery, or infrastructure design could consistently produce subtly incorrect results. This could lead to flawed scientific conclusions, unsafe engineering designs, or misinformed policy decisions, with potentially severe real-world consequences.
