The backdoor that passes the physics check—and uses the wrong physics

A partial differential equation, or PDE, describes how a field such as fluid velocity or temperature changes through space and time. A neural operator learns to imitate an expensive PDE solver. Give it an initial field and a physical parameter such as viscosity; it returns an entire predicted solution field in one fast pass.

Liang and Liu study a supply-chain attack on the solver archive used for training. A small stamp is added to an input tensor, while its target is relinked to the same latent simulation under a different viscosity. The resulting output can be smooth, structured, and valid somewhere in the PDE family—just not under the parameter the user requested.

Let z identify one latent simulation and let Gλ(z) be its solution under physical parameter λ. A clean archive pairs its tensor with Gclean(z). The attack stamps the input and substitutes Gbackdoor(z)—the alternate-parameter solution for that same z. This sample matching matters: the learner sees a deterministic two-branch function rather than incoherent target noise.

The paper tests 476 campaigns and 1,428 seed-level runs across Burgers, advection–diffusion, 2D Navier–Stokes, and an appendix Poisson case. FNO and DeepONet are the main operator families; Transformer, GRU, and LSTM runs are calibrated existence checks, not an architecture leaderboard.

For a triggered prediction, the paper measures distance to the clean and backdoor targets using one denominator: the larger target norm. Without that shared scale, whichever target has the smaller norm can receive a distorted relative error. The margin is clean error minus backdoor error; positive means the prediction lies closer to the alternate branch.

def target_errors(prediction, clean, backdoor, eps=1e-8):
    clean_sq = 0.0
    backdoor_sq = 0.0
    clean_norm_sq = 0.0
    backdoor_norm_sq = 0.0
    for i in range(len(prediction)):
        clean_sq += (prediction[i] - clean[i]) ** 2
        backdoor_sq += (prediction[i] - backdoor[i]) ** 2
        clean_norm_sq += clean[i] ** 2
        backdoor_norm_sq += backdoor[i] ** 2
    scale = max(clean_norm_sq ** 0.5, backdoor_norm_sq ** 0.5, eps)
    clean_error = clean_sq ** 0.5 / scale
    backdoor_error = backdoor_sq ** 0.5 / scale
    return clean_error, backdoor_error, clean_error - backdoor_error

The TypeScript routine behind the chart below implements this same loop; Python and C++ are faithful translations. Backdoor success rate (BSR) then counts the strict comparisons where backdoor error is smaller. Ties are failures.

The shuffled-backdoor control keeps the trigger and the distribution of alternate-parameter targets but breaks latent-sample identity: input z receives the target for some other simulation z′. It can still land on the backdoor side of the comparison often enough to score BSR 1.0, while missing the sample-matched field badly.

A parameter-agnostic validator asks whether the output resembles some valid member of the PDE family. The attack is designed to pass that weaker question: its target was produced by the solver under another viscosity. An intended-parameter audit asks which candidate family is nearest for the same latent sample, then checks that choice against the parameter recorded in the job.

The experiments demonstrate the gap cleanly, but they do not show a production weather or engineering system being fooled. The Poisson result is kept in the appendix because its residual scale changes strongly with the coefficient; it supports targeted output closeness, not a universal physics-residual bypass.

• Bind every input and target to the latent sample ID, physical parameters, and solver version.
• Sign or checksum that manifest before downstream ETL repackages tensors.
• Verify sample-level parameter consistency, not only aggregate residuals or smoothness.
• Report target distance and clean quality beside any branch-choice success rate.
• Probe unseen trigger locations, shapes, scales, and distribution shifts.

The lesson transfers beyond PDEs: if multiple valid targets coexist in a data archive, the join key is part of the model's security boundary. The learned surrogate may be a neural network or a Transformer; neither architecture can recover provenance that the training pairs discarded.

The most useful follow-up is a closed-loop test: let a triggered surrogate drive a design or parameter-estimation decision and measure the actual consequence, rather than only which candidate field is closer. Mechanistic probes could also ask whether the trigger selects a distinct internal branch that can be detected or causally interrupted. Until then, the honest claim is narrower and still important: clean accuracy and generic physical plausibility do not certify the parameter identity of a scientific surrogate's output.