Neural PDE Operators Vulnerable to "Wrong-Physics" Backdoors.

Neural PDE operators, increasingly used for scientific simulations, are often trained on large archives of solver data. However, current validation methods primarily focus on prediction accuracy and general plausibility. This paper reveals a critical vulnerability: "wrong-physics backdoors." This attack involves subtly poisoning training data such that a specific trigger input causes the model to produce a physically plausible output, but one that corresponds to an incorrect physical parameter for the given input. The attack, termed "cross-parameter relinking," leverages issues in how tensor-to-parameter origins are tracked within multi-parameter datasets. It essentially stamps a surrogate input and links its supervision to a solution from the same PDE family but with a different physical parameter. This means the model learns to associate the trigger with the wrong physics. Extensive testing across various PDE types (Burgers, advection-diffusion, Navier-Stokes, Poisson) and neural operator architectures (FNO, DeepONet, Transformer, GRU, LSTM) showed alarming success rates. Fourier Neural Operators, for instance, achieved a 100% backdoor success rate on advection-diffusion and 2D Navier-Stokes, all while maintaining excellent performance on clean, untriggered data. This highlights a significant validation gap: simply checking for smooth or solver-like behavior is insufficient; verifying the provenance of the intended physical parameters is crucial.