Adversarial Vulnerabilities in Neural Operator Digital Twins: Gradient-Free Attacks on Nuclear Thermal-Hydraulic Surrogates

Samrendra Roy; Kazuma Kobayashi; Souvik Chakraborty; Rizwan-uddin; Syed Bahauddin Alam

cs.LGMar 23, 2026

Adversarial Vulnerabilities in Neural Operator Digital Twins: Gradient-Free Attacks on Nuclear Thermal-Hydraulic Surrogates

Authors: Samrendra Roy, Kazuma Kobayashi, Souvik Chakraborty, Rizwan-uddin, Syed Bahauddin Alam

Organizations: Department of Nuclear, Plasma & Radiological Engineering, University of Illinois Urbana-Champaign, Urbana, IL 61801, USA · Department of Applied Mechanics, Indian Institute of Technology Delhi, New Delhi 110016, India · National Center for Supercomputing Applications, University of Illinois Urbana-Champaign, Urbana, IL 61801, USA

Abstract

Operator learning models are rapidly emerging as the predictive core of digital twins for nuclear and energy systems, promising real-time field reconstruction from sparse sensor measurements. Yet their robustness to adversarial perturbations remains uncharacterized, a critical gap for deployment in safety-critical systems. Here we show that neural operators are acutely vulnerable to extremely sparse (fewer than 1% of inputs), physically plausible perturbations that exploit their sensitivity to boundary conditions. Using gradient-free differential evolution across four operator architectures, we demonstrate that minimal modifications trigger catastrophic prediction failures, increasing relative $L_2$ error from $\sim$ 1.5% (validated accuracy) to 37-63% while remaining completely undetectable by standard validation metrics. Notably, 100% of successful single-point attacks pass z-score anomaly detection. We introduce the effective perturbation dimension $d_{\text{eff}}$ , a Jacobian-based diagnostic that, together with sensitivity magnitude, yields a two-factor vulnerability model explaining why architectures with extreme sensitivity concentration (POD-DeepONet, $d_{\text{eff}} \approx 1$ ) are not necessarily the most exploitable, since low-rank output projections cap maximum error, while moderate concentration with sufficient amplification (S-DeepONet, $d_{\text{eff}} \approx 4$ ) produces the highest attack success. Gradient-free search outperforms gradient-based alternatives (PGD) on architectures with gradient pathologies, while random perturbations of equal magnitude achieve near-zero success rates, confirming that the discovered vulnerabilities are structural. Our findings expose a previously overlooked attack surface in operator learning models and establish that these models require robustness guarantees beyond standard validation before deployment.

Figures & tables

Figure 1: Differential-evolution-driven vulnerability mapping in a cyber-physical twin. Attack Surface (top): Using sensor knowledge

(v_{\mathrm{in}},\,T_{\mathrm{in}},\,q^{\prime\prime}(z))

and bounds, Differential Evolution probes the input space and yields a heatmap with vulnerability hotspots at indices 28 and 68 of the 100-point

q^{\prime\prime}(z)

profile (Branch 2). All trials respect

\,v_{\mathrm{in}}\in[4.0,5.0]~\mathrm{m\,s^{-1}},\;T_{\mathrm{in}}\in[263,323]~\mathrm{K}\,

(panel c), enabling stealth. Physical System (middle): Branch 1 encodes

[v_{\mathrm{in}},T_{\mathrm{in}}]

; Branch 2 encodes axial wall heat flux

q^{\prime\prime}(z)

. Single-coordinate injections (

L_{0}=1

) enter via sensor/SCADA/preprocessing tampering. Digital Twin (bottom): Surrogates (MIMONet, S-DeepONet, POD-DeepONet, NOMAD) map

G:(b^{(1)},b^{(2)})\!\to\!(P,u,v,w)

; S-DeepONet is most vulnerable. Fields & impact (right): Nominal vs attacked temperature shows hotspot displacement and

34.2\%

relative

L_{2}

error, achieved with black-box access and physics-respecting inputs, revealing dangerous but bounds-compliant failures in learned operator models.

Error	Model	$L_{0}$ (number of inputs perturbed)
Threshold		1	3	5	10
10%	MIMONet	100	100	100	100
	NOMAD	87.0	100	100	100
	S-DeepONet	100	100	100	100
	POD-DeepONet	100	100	100	100
20%	MIMONet	55.8	67.4	73.8	91.7

Table 1: Attack success rates across neural operator families. Percentage of tested samples for which differential evolution found a feasible adversarial example within the specified sparsity budget and error threshold. All perturbations respect physical bounds. The test set comprises 310 samples.

Figure 2: Field-level impact of sparse adversarial attacks. Each row shows clean prediction (left), attacked prediction (middle), and absolute error (right). Rows 1–3 : S-DeepONet velocity components under $L_{0}=3$ attack. Row 4 : NOMAD pressure field under $L_{0}=1$ attack. Error maps reveal localized failures with normalized errors approaching 1.0 in safety-critical regions, despite models achieving $<2\%$ error on clean data. White rectangles indicate geometric obstacles.

Model	$\mathbf{d_{\text{eff}}}$	Mean col. norm	Interpretation
POD-DeepONet	$1.02\pm 0.01$	$3\times 10^{-4}$	Extreme concentration, low magnitude
S-DeepONet	$4.35\pm 0.50$	$8\times 10^{-4}$	Concentrated, moderate magnitude
MIMONet	$31.93\pm 5.39$	$2.3\times 10^{-3}$	Distributed, high magnitude
NOMAD	$31.32\pm 4.98$	$2.2\times 10^{-3}$	Distributed, high magnitude

Table 2: Effective perturbation dimension across architectures. Lower

d_{\text{eff}}

indicates concentrated sensitivity. Mean

\pm

std computed over 50 test samples using randomized Jacobian projections (

n_{\text{proj}}=30

Figure 3: Jacobian sensitivity profiles and DE attack targeting across architectures. Top panels (bars): Mean Jacobian column norms $s_{i}=\|J_{b}[:,i]\|_{2}$ ( $\times 10^{-3}$ ) for each of the 102 input coordinates, averaged over 50 test samples with 30 randomized projections each. Dashed red line marks the Branch 1/Branch 2 boundary (index 2). Middle strips (Sensitivity): Same data as a log-scale heatmap for cross-model comparison. Bottom strips (DE Target): Normalized DE attack targeting frequency, aggregated across $L_{0}\in\{1,3,5,10\}$ weighted by successful attacks. S-DeepONet’s targeting concentrates at indices 0 and 99–101, matching its Jacobian peaks ( $r=0.99$ ). POD-DeepONet’s apparently diffuse Branch 2 targeting reflects random budget-filling at higher $L_{0}$ rather than genuine vulnerability: Branch 2 Jacobian norms are ${\sim}10^{-12}$ , and targeting is uncorrelated with sensitivity ( $r=-0.47$ ); see Section 2.5.4 and Fig. 9 for details.

Figure 4: Visualizing adversarial perturbations at

L_{0}=3

. To illustrate what successful adversarial inputs look like in practice, we plot both a representative single attack (rows 1–2) and averaged statistics across 200 successful attacks (rows 3–5) for each architecture at

L_{0}=3

with 20% error threshold. All values are in physical units. Rows 1 and 3 (Branch 1): Inlet velocity

v_{\text{in}}

(m s -1 ) and temperature

T_{\text{in}}

(K) before and after perturbation. Rows 2 and 4 (Branch 2): Wall heat flux profiles

q^{\prime\prime}(z)

in kW m -2 along the 100 axial positions; red circles mark where perturbations were applied in the single examples. Row 5 : Perturbation difference (

\Delta q^{\prime\prime}

) in kW m -2 showing where attacks concentrate along the boundary. Interestingly, S-DeepONet attacks cluster at the right boundary (positions 97–99), while MIMONet and NOMAD target both boundaries more symmetrically. A normalized version is provided in Fig. 13 .

Figure 5: DE vs. random perturbation baseline. Comparison of DE (blue) and random

k

-sparse perturbation (gray) success rates at the 30% threshold over 310 test samples (50 random trials per sample). Random perturbations achieve

<

9% across all configurations while DE reaches 9–100%, confirming that DE exploits structured vulnerability subspaces rather than inherent input-output instability.

Figure 6: Genome encoding and decoding for one-point adversarial perturbation. Top left: each candidate perturbation vector encodes position (index $K$ into the 102-dimensional input) and replacement value, which are decoded into modified branch vectors. Top center: the perturbed and original branch inputs are independently evaluated through the neural operator to compute the relative $L_{2}$ error as fitness. Top right: decoded perturbation applied to the original Branch 1 and Branch 2 vectors, with modified entries highlighted. Bottom: the population-level evolutionary loop (initialization, mutation, recombination, clipping, fitness evaluation, and selection) iterated over $n$ generations until convergence. See Fig. 14 for the complete algorithmic pipeline including physical feasibility enforcement.

Input	Training	Training	DE-Accessible	Physical Operating
Coordinate	Mean ( $\mu$ )	Std ( $\sigma$ )	Range ( $\mu\pm\sigma$ )	Envelope
$v_{\text{in}}$ (m s -1 )	4.51	0.26	$[4.25,\;4.77]$	$[4.0,\;5.0]$
$T_{\text{in}}$ (K)	292.4	17.0	$[275.4,\;309.4]$	$[263,\;323]$
$q^{\prime\prime}(z)$ (W m -2 )	12,588	6,303	$[6{,}285,\;18{,}891]$	$[0,\;20{,}000]$

Table 3: Physical feasibility verification. The DE search bounds

[-1,+1]

in standardized space map to physical ranges that are strict subsets of the system operating envelope, ensuring all perturbations correspond to realizable operating conditions.

Appendix figures & tables28 assets

Supplementary material from the paper’s appendix.

Appendix

Property	Value	Range/Distribution
Total samples	1,546	–
Training set	1,236 (80%)	Random split, seed=42
Test set	310 (20%)	Random split, seed=42
Inlet velocity $v_{\text{in}}$ [m s -1 ]	–	Uniform(4.0, 5.0)
Inlet temperature $T_{\text{in}}$ [K]	–	Uniform(263, 323)
Max heat flux $q_{\max}$ [kW m -2 ]	–	Uniform(8, 20)

Appendix

Table 4: Complete dataset composition and statistics.

Input	Mean ( $\mu$ )	Std ( $\sigma$ )	Transformation
Branch 1: $v_{\text{in}}$	4.5145	0.2615	$\mathbf{u}_{1}^{\text{norm}}=(\mathbf{u}_{1}-\boldsymbol{\mu}_{\text{B1}})/\boldsymbol{\sigma}_{\text{B1}}$
Branch 1: $T_{\text{in}}$	292.43	17.033
Branch 2: $q^{\prime\prime}(z)$ [W m -2 ]	12,588	6,303	$\mathbf{u}_{2}^{\text{norm}}=(\mathbf{u}_{2}-\mu_{\text{B2}})/\sigma_{\text{B2}}$
Trunk: $x,y,z$	Min-max to $[-1,1]$ : $\xi^{\text{norm}}=2(\xi-\xi_{\min})/(\xi_{\max}-\xi_{\min})-1$
	$(x,y,z)_{\min}=(0,0,0)$ m; $(x,y,z)_{\max}=(0.5,0.1,1.0)$ m

Appendix

Table 5: Input normalization parameters.

Channel	$\mathbf{s}_{\min}$	$\mathbf{s}_{\max}$	Units
Pressure ( $P$ )	98,450	102,380	Pa
$u$ (x-velocity)	$-0.82$	6.34	m s -1
$v$ (y-velocity)	$-1.21$	1.18	m s -1
$w$ (z-velocity)	$-0.94$	0.97	m s -1

Appendix

Table 6: Output normalization ranges (from training set).

Property	NOMAD	S-DeepONet	POD-DeepONet	MIMONet
Operator structure	Yes	Yes	Yes	No
Sequential modeling	No	Yes (GRU)	No	No
Dimensionality reduction	No	No	Yes (POD)	No
Spatial amortization	Yes	Yes	Yes	No
Parametric efficiency	Medium	High	Highest	Low

Appendix

Table 7: Architectural comparison of neural operator models.

Model	Component	Input dim	Hidden layers	Params
NOMAD	Branch 1	2	$[512,512,512,256]$	660,224
	Branch 2	100	$[512,512,512,256]$	577,024
	Trunk	2	$[256,256,256,1280]$	526,336
	Decoder	1280	$[512,256,5]$	919,045
	Total			2,682,629
S-DeepONet	Branch 1	2	Id.	660,224

Appendix

Table 8: Layer-level architectural specifications. All hidden layers use ReLU + Dropout(0.1). “Id.” denotes identical to the NOMAD specification for that component.

Parameter	Value
Optimizer	Adam ( $\beta_{1}{=}0.9$ , $\beta_{2}{=}0.999$ , $\epsilon{=}10^{-8}$ )
Initial learning rate	$10^{-3}$
Weight decay	$10^{-6}$ (L2 regularization)
LR scheduler	ReduceLROnPlateau (factor 0.5, patience 10, min $10^{-7}$ )
Batch size	4 (memory-constrained; 15,908 DOF per sample)
Maximum epochs	100 (early stopping typically at $\sim$ 50)

Appendix

Table 9: Training hyperparameters (identical across all four models).

Model	Epochs to Converge	Final Train MSE	Final Val MSE	LR Decays
NOMAD	$52\pm 6$	$0.0040\pm 0.0003$	$0.0120\pm 0.0008$	$2.8\pm 0.4$
S-DeepONet	$48\pm 5$	$0.0042\pm 0.0004$	$0.0130\pm 0.0010$	$2.6\pm 0.4$
POD-DeepONet	$44\pm 4$	$0.0045\pm 0.0003$	$0.0140\pm 0.0009$	$2.4\pm 0.3$
MIMONet	$46\pm 5$	$0.0038\pm 0.0003$	$0.0120\pm 0.0007$	$2.5\pm 0.3$

Appendix

Table 10: Training convergence statistics (mean

\pm

std across 5 random seeds).

Component	Parameter	Value
Initialization	Method	Latin Hypercube Sampling
	Population size	$M=20\times 2k$ ( $k$ : sparsity budget)
	Bounds	Indices $\in[0,101]$ ; values $\in[-1,1]$
Mutation	Strategy	best1bin
	Scaling factor $F$	Dithered, $\sim$ Uniform(0.5, 1.0) per generation
	Formula	$\mathbf{g}_{\text{mut}}=\mathbf{g}^{(\text{best})}+F(\mathbf{g}^{(r_{1})}-\mathbf{g}^{(r_{2})})$

Appendix

Table 11: Complete DE hyperparameter specification.

Model	Params	Val MSE	Test Rel. $L_{2}$ (%)	Inference (ms)	Train (hrs)	Mem. (GB)
MIMONet	1.2M	$0.012\pm 0.001$	$1.34\pm 0.08$	$1.8\pm 0.1$	$7.2\pm 0.5$	18.3
NOMAD	2.1M	$0.012\pm 0.001$	$1.28\pm 0.07$	$2.3\pm 0.2$	$8.1\pm 0.6$	23.7
S-DeepONet	1.8M	$0.013\pm 0.001$	$1.45\pm 0.09$	$2.1\pm 0.1$	$7.8\pm 0.5$	21.4
POD-DeepONet	1.6M	$0.014\pm 0.001$	$1.52\pm 0.10$	$1.5\pm 0.1$	$6.9\pm 0.4$	19.8

Appendix

Table 12: Baseline model performance on clean test set (310 samples). All models trained with identical protocol. Metrics computed on unnormalized predictions. Standard errors from 5 random initializations (seeds 42–46).

Model	Pressure	$\mathbf{u}$	$\mathbf{v}$	$\mathbf{w}$
MIMONet	$0.82\pm 0.05$	$1.45\pm 0.09$	$1.68\pm 0.12$	$1.52\pm 0.10$
NOMAD	$0.79\pm 0.04$	$1.38\pm 0.08$	$1.62\pm 0.11$	$1.47\pm 0.09$
S-DeepONet	$0.91\pm 0.06$	$1.58\pm 0.11$	$1.82\pm 0.13$	$1.65\pm 0.11$
POD-DeepONet	$0.95\pm 0.06$	$1.67\pm 0.12$	$1.91\pm 0.14$	$1.73\pm 0.12$

Appendix

Table 13: Per-channel performance breakdown on test set. Relative

L_{2}

error (%) computed independently for each output channel.

Model	$\mathbf{L_{0}}$	P (%)	u (%)	v (%)	w (%)
MIMONet	1	72.6	17.3	15.4	35.0
	3	71.6	19.7	17.5	35.5
	5	64.7	22.0	19.7	35.4
	10	64.6	25.0	22.5	35.8
NOMAD	1	71.6	17.3	15.3	34.9
	3	57.5	21.2	19.0	37.9

Appendix

Table 14: Per-channel adversarial error breakdown. Mean relative

L_{2}

error (%) per output channel for successful attacks at the 30% threshold, by model and sparsity budget

L_{0}

. All configurations evaluated on 310 test samples. Pressure (

P

) consistently exhibits the largest error across all architectures.

Model	$\boldsymbol{L_{0}}$	Success (%)	CI lower	CI upper
MIMONet	1	9.4	6.2	14.1
	3	13.1	8.6	19.3
	5	22.6	18.3	27.6
	10	36.1	27.2	46.0
NOMAD	1	8.6	5.6	13.0
	3	22.6	18.3	27.6

Appendix

Table 15: Wilson score 95% confidence intervals for attack success rates at 30% threshold. All configurations evaluated on 310 test samples. Success rate and CI bounds reported as percentages.

Model	$\boldsymbol{L_{0}}$	B1-only		B2-only		Mixed
		%	err	%	err	%	err
MIMONet	1	100	25.0	0	–	0	–
	3	0	–	0	–	100	24.4
	5	0	–	0	–	100	26.6
	10	0	–	0.5	16.5	99.5	28.4
NOMAD	1	100	26.2	0	–	0	–

Appendix

Table 16: Branch vulnerability analysis. Classification of successful attacks (aggregated across all thresholds) into Branch 1-only (indices 0–1), Branch 2-only (indices 2–101), and Mixed. Fractions shown as percentages; mean relative

L_{2}

error (%) of successful attacks in each category. All configurations evaluated on 310 test samples.

Model	Mean (%)	Median (%)	Max (%)	Std	Degrad.
MIMONet	24.3	24.6	38.3	0.060	25.5 $\times$
NOMAD	27.8	27.8	47.7	0.071	31.8 $\times$
POD-DeepONet	24.7	24.4	37.0	0.066	24.7 $\times$
S-DeepONet	42.3	44.4	62.8	0.123	41.9 $\times$

Appendix

Table 17: Error contextualization across architectures. Summary statistics aggregated across all successful attacks for each model (310 test samples per configuration). The collapse from baseline error (

\sim

1.5%) to adversarial error represents a degradation factor of 25–42

\times

Figure 7: DE convergence curves. Mean (solid blue)

\pm

std (shaded) relative

L_{2}

error vs. DE generation for each model and sparsity budget, over 20 independent runs. Red dashed line indicates 30% attack success threshold. S-DeepONet converges fastest (fewer than 40 generations at

L_{0}=1

to exceed 30% error) and achieves the highest final errors (

>

50% at

L_{0}\geq 5

). POD-DeepONet converges quickly but plateaus at lower errors due to the POD output projection. MIMONet and NOMAD show gradual convergence reflecting their high

d_{\text{eff}}\approx 32

Figure 8: Attack error distributions across sparsity budgets. Box plots of relative

L_{2}

error (%) for all attacks at each sparsity budget

L_{0}

, by model (310 test samples per configuration). Boxes show median (line) and interquartile range; whiskers extend to 1.5

\times

IQR. Red dashed line marks the 30% success threshold. S-DeepONet exhibits a sharp error escalation at

L_{0}\geq 3

, with medians exceeding 43% and maxima reaching 62.8%. POD-DeepONet errors are tightly clustered and capped near 37% regardless of

L_{0}

, consistent with its low-rank POD output projection limiting maximum achievable error. MIMONet and NOMAD show gradual median increases with

L_{0}

Figure 9: Vulnerability heatmaps. Normalized frequency with which each of the 102 input indices is selected by DE in successful attacks, aggregated across all error thresholds (10%, 20%, 30%, 40%) to maximize statistical power. Inset labels show the percentage of total perturbation budget allocated to Branch 1 (indices 0–1). At

L_{0}=1

, all models except S-DeepONet target Branch 1 exclusively (100%). At higher

L_{0}

, POD-DeepONet’s Branch 2 bars are uniformly spread (random filler from DE exhausting its budget after saturating the single sensitive direction), consistent with

d_{\text{eff}}\approx 1

and the observed success rate plateau. In contrast, S-DeepONet’s Branch 2 bars concentrate at specific positions (indices

\sim

99–100), reflecting genuine GRU-mediated sequential sensitivity.

Figure 10: PGD vs. DE success rates. Comparison of DE (blue) and PGD (orange) attack success rates at the 30% threshold across

L_{0}\in\{1,3,5,10\}

for all four architectures. DE outperforms PGD on POD-DeepONet (34% vs. 0–6%) and S-DeepONet (26–100% vs. 8–44%). NOMAD is the only model where PGD is competitive at high

L_{0}

(82% vs. 66% at

L_{0}=10

). MIMONet shows convergence at

L_{0}=10

(both 36%).

Figure 11: Validation metric blindness: z-score pass rates. Percentage of successful adversarial attacks whose outputs pass standard z-score (

<3\sigma

) anomaly detection, shown per model and sparsity budget

L_{0}

. At

L_{0}=1

, 100% of successful attacks pass z-score validation for all four models, exposing a critical blind spot in standard deployment monitoring. Pass rates drop sharply at

L_{0}\geq 3

, reaching 0% for most configurations (Table 21 ).

Figure 12: Input-output amplification ratios. (a) Mean amplification ratio (output % change / input % change) for successful attacks, by model and sparsity budget. At

L_{0}=1

, all architectures exhibit 5–8

\times

amplification: a perturbation affecting

<

1% of the input vector produces 5–8

\times

larger relative change in the output field. Amplification drops sharply at

L_{0}\geq 3

and falls below 1

\times

(diminishing returns) at

L_{0}=10

for all models. (b) Scatter plots of relative input change vs. output error for successful attacks only (those exceeding the 30% threshold, indicated by the dotted red line). The 30% floor is a selection artifact: only attacks surpassing this threshold are plotted, compressing the visible output range. Points above the dashed 1:1 diagonal indicate net amplification. The

k=1

points (blue) sit far above the diagonal at low input change, confirming disproportionate leverage from single-point perturbations. S-DeepONet is the only architecture where higher

L_{0}

substantially increases output error beyond the 30% floor (reaching 62%), while MIMONet and POD-DeepONet remain compressed near the threshold regardless of

L_{0}

Figure 13: Visualizing adversarial perturbations at

L_{0}=3

(normalized coordinates). Same attack data as Fig. 4 , but shown in standardized (z-scored) coordinates for easier comparison across input dimensions with different physical scales. (a–d) Example Branch 1 values for one successful attack per model. (e–h) Example Branch 2 heat flux profiles; red circles mark perturbation locations. (i–l) Averaged Branch 1 (

\pm 1\sigma

). (m–p) Averaged Branch 2 profiles. (q–t) Perturbation difference

\Delta

. In normalized units, the S-DeepONet right-boundary perturbations reach

{\sim}2\sigma

, while POD-DeepONet stays within

\pm 0.3\sigma

Figure 14: Complete differential evolution pipeline for sparse adversarial attacks on neural operators. The framework is organized into two tiers: single-candidate evaluation (top) and population-level optimization (bottom), connected by a constraint strip encoding the optimization objective, physical feasibility guarantee, and detection invisibility argument. a, Genome encoding: each DE candidate represents

k

index–value pairs decoded into perturbed branch vectors. b, Black-box fitness evaluation: perturbed and clean inputs are independently passed through the neural operator (requiring no gradient access) to compute the relative

L_{2}

error across 15,908 output dimensions. c, Fitness score

\mathcal{E}

returned to the DE optimizer; attack succeeds when

\mathcal{E}>\tau=0.30

. d–i, Population-level DE loop: ( d ) Latin Hypercube initialization (

M=20\times 2k

), ( e ) best1bin mutation (

F\in[0.5,1.0]

), ( f ) binomial crossover (

\text{CR}=1.0

), ( g ) physical bounds clipping (

\tilde{b}_{i}^{\text{adv}}\in[-1,+1]

), ( h ) fitness evaluation, and ( i ) greedy selection. Convergence in 80–120 generations (

\sim

2 min per attack on GPU).

Model	$\boldsymbol{L_{0}}$	PGD (%)	PGD err	DE (%)	PGD time (s)	Winner
MIMONet	1	0	0.155	12	4.2	DE
	3	10	0.222	16	4.1	DE
	5	10	0.239	30	4.2	DE
	10	36	0.288	36	4.1	Tie
NOMAD	1	16	0.224	12	4.7	PGD
	3	30	0.265	22	4.7	PGD

Appendix

Table 18: PGD vs. DE comparison. Success rates (%) at the 30% threshold. PGD uses 100 iterations with step size

10^{-2}

and random restarts. PGD mean error is the average relative

L_{2}

error across all samples (including failures). Mean PGD wall-clock time per attack shown in seconds.

Model	$\boldsymbol{L_{0}}$	Rand (%)	Rand err	DE (%)	Ratio
MIMONet	1	0.3	0.062	9.4	29 $\times$
	3	0.3	0.116	13.1	41 $\times$
	5	0.3	0.141	22.6	70 $\times$
	10	0.6	0.176	36.1	56 $\times$
NOMAD	1	0.0	0.062	8.6	$\infty$
	3	0.0	0.120	22.6	$\infty$

Appendix

Table 19: Random perturbation baseline. Comparison of DE success rates against random

k

-sparse perturbations (50 trials per sample, same

[-1,+1]

bounds) at the 30% threshold over 310 test samples. Random success rates are near-zero, confirming that DE exploits structural vulnerabilities.

Source $\rightarrow$ Target	MIMONet	NOMAD	POD-DeepO.	S-DeepO.
MIMONet	12.5	12.5	25.0	25.0
NOMAD	9.1	9.1	18.2	36.4
POD-DeepONet	5.9	5.9	11.8	11.8
S-DeepONet	2.1	4.3	6.4	83.0

Appendix

Table 20: Cross-architecture transferability matrix. Transfer success rate (%) at the 30% threshold using successful

L_{0}=1

attacks from 50 test samples. Rows indicate source model (perturbation crafted for), columns indicate target model (perturbation applied to). Diagonal entries are self-transfer. Adversarial perturbations are predominantly architecture-specific.

Model	$\boldsymbol{L_{0}}$	Z-pass (%)	Amplification	Thresh.
MIMONet	1	100	5.2 $\times$	0.20
	3	8.8	1.6 $\times$	0.10
	5	0.0	1.1 $\times$	0.30
	10	0.0	0.9 $\times$	0.10
NOMAD	1	100	5.9 $\times$	0.30
	3	0.0	1.2 $\times$	0.10

Appendix

Table 21: Validation metric blindness analysis. For successful attacks at each

L_{0}

, we evaluate whether adversarial outputs pass z-score (

<3\sigma

) anomaly detection relative to the clean test set output distribution, and compute mean input-to-output amplification ratios. All configurations evaluated on 310 test samples. At

L_{0}=1

, 100% of successful attacks pass z-score validation across all models, with 5–8

\times

amplification.

Model	$\boldsymbol{L_{0}}$	Rate std (pp)	Error std
MIMONet	1	1.6	0.009
	3	0.8	$<$ 0.001
	5	2.0	$<$ 0.001
	10	0.8	0.001
NOMAD	1	0.0	0.005
	3	0.8	$<$ 0.001

Appendix

Table 22: Seed sensitivity analysis. Cross-seed standard deviation in success rate (percentage points) and mean error over 5 independent DE runs per (model,

L_{0}

) configuration at the 30% threshold. Low variance confirms that vulnerability patterns are intrinsic model properties.

			Thm. 4	Predicted	Empirical	Empirical
Model	$d_{\mathrm{eff}}$	$\\|\mathbf{s}\\|_{2}$	$\rho(1)\geq$	max error	mean error	success %
POD-DeepONet	1.02	$3\times 10^{-4}$	$0.99$	Low (capped)	12%	25.2%
S-DeepONet	4.35	$8\times 10^{-4}$	$0.48$	High	50%	94.5%
MIMONet	31.93	$2.3\times 10^{-3}$	$0.18$	Moderate	28%	20.4%
NOMAD	31.32	$2.2\times 10^{-3}$	$0.18$	Moderate	29%	22.1%

Appendix

Table 23: Predicted vs. observed vulnerability metrics. Theoretical predictions computed using measured Jacobian column norms; empirical values from DE attack experiments at

L_{0}=3

\epsilon=1\sigma

\tau=0.3

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 477 papers

Apr 14, 2026

Beyond Uniform Sampling: Synergistic Active Learning and Input Denoising for Robust Neural Operators

Neural operators have emerged as fast surrogate models for physics simulations, yet they remain acutely vulnerable to adversarial perturbations, a critical liability for safety-critical digital twin deployments. We present a synergistic defense that combines active learning-based data generation with an input denoising architecture. The active learning component adaptively probes model weaknesses using differential evolution attacks, then generates targeted training data at discovered vulnerability locations while an adaptive smooth-ratio safeguard preserves baseline accuracy. The input denoising component augments the operator architecture with a learnable bottleneck that filters adversarial noise while retaining physics-relevant features. On the viscous Burgers' equation benchmark, the combined approach achieves a 2.04% combined error (1.21% baseline + 0.83% robustness), representing an 87% reduction relative to standard training (15.42% combined) and outperforming both active learning alone (3.42%) and input denoising alone (5.22%). More broadly, our results, combined with cross-architecture vulnerability analysis from prior work, suggest that optimal training data for neural operators is architecture-dependent: because different architectures concentrate sensitivity in distinct input subspaces, uniform sampling cannot adequately cover the vulnerability landscape of all models. These findings have potential implications for the deployment of neural operators in safety-critical energy systems including nuclear reactor monitoring.

Samrendra Roy, Souvik Chakraborty, Syed Bahauddin Alam

Department of Nuclear, Plasma, and Radiological Engineering, University of Illinois Urbana-Champaign, Urbana, IL, USA · Department of Applied Mechanics, Indian Institute of Technology Delhi, New Delhi, India · National Center for Supercomputing Applications, University of Illinois Urbana-Champaign, Urbana, IL, USA

Adversarial Robustness Neural Operators Adversarial Training Active Learning

Ask PDF

Oct 21, 2025

Solver-Integrated Adversarial Attacking and Training of Neural Operators

Neural operators are widely used as fast surrogates for numerical PDE solvers, mapping input functions to solution functions. However, their generalizability and robustness are not yet clearly defined in the operator-learning setting, which differs from traditional adversarial robustness definitions. This paper studies the generalizability and robustness of a learned neural operator from a solver-integrated perspective, addressing the challenge that the output of a learned operator and a numerical solver tends to change in tandem under input perturbation. First, we formalize the definition of generalization and robustness through a model-solver error operator, identifying fixed-input model-solver loss as generalization metric, and norm-bounded adversarial attack loss increase and Jacobian-error function norm as robustness metric. Second, we identify the solver-integrated adversarial attack as appropriate for PDE operator learning and show why model-only or fixed-ground-truth attacks can be insufficient when the solver output also changes with the input. Third, we develop solver-integrated adversarial training methods for neural operators. Experiments on representative PDE benchmarks show that this solver-integrated adversarial training clearly improves both generalizability and robustness. Deeper solver integration yields more effective attacks, more informative samples, and more efficient training than less integrated alternatives. These results provide a general framework for robust operator training and automatic sample selection without heavy manual intervention. More broadly, the formulation applies to adversarial regression whenever a ground-truth oracle can evaluate, and ideally differentiate, the true input-output map; PDE operator learning is one such case.

Yifei Sun

Adversarial Training Adversarial Attacks Neural Network Robustness Adversarial Robustness PDE Operator Learning Neural Operators

Ask PDF

Jun 1, 2026

Spectral Audit of In-Context Operator Networks

Existing evaluations of neural operators and in-context operator learning rely primarily on prediction error, but accurate output prediction does not guarantee the correct local dynamical structure. A model may match solutions while exhibiting incorrect sensitivities, distorted frequency response, spurious mode coupling, or unstable tangent behavior. We introduce a Jacobian-based spectral audit for in-context operator learning. For a fixed prompt, we differentiate the network output with respect to the query function and view the resulting Jacobian as a learned tangent operator. Projecting it onto Fourier modes, we obtain a local spectral characterization of the inferred operator, including frequency-dependent gains, phase structure, and cross-mode coupling. The audit complements standard prediction metrics by testing whether the model reproduces local mechanisms of the underlying PDE operator rather than only outputs. Across benchmarks, the audit reveals distinct operator-level phenomena, including phase transport, viscosity-dependent damping, nonlinear mode coupling, and reaction--diffusion stability structure. It also detects failures partially hidden by prediction-error metrics, including high-frequency degradation, incorrect phase recovery, and prompt--operator inconsistencies. Corrupted or internally inconsistent prompts lead to degraded tangent-operator structure even when pointwise predictions remain partially accurate. Our results suggest that prediction accuracy and local operator fidelity are distinct properties of learned neural operators. Our framework also provides a diagnostic for stability, sensitivity, and operator consistency.

Zhiwei Gao, Liu Yang, George Em Karniadakis

Division of Applied Mathematics, Brown University, Providence, RI, USA · Department of Mathematics, National University of Singapore, Singapore

PDE Operator Learning Operator Learning Neural Operators

Ask PDF

Abstract

Adversarial Robustness

Explore similar work

Beyond Uniform Sampling: Synergistic Active Learning and Input Denoising for Robust Neural Operators

Solver-Integrated Adversarial Attacking and Training of Neural Operators

Spectral Audit of In-Context Operator Networks