UIUC Fixes DeepONet's Catastrophic Fragility, Slashing Errors by 87%
A hybrid defense combining active learning with a learnable input bottleneck cuts adversarial error on Burgers equation surrogates by 87 percent.
PRO- A combined active learning plus input denoising defense cuts neural operator adversarial error 87% on the Burgers equation.
- Standard DeepONet training degrades 3.7x under attack: 3.27% clean error to 12.15% under adversarial perturbation.
- Combined method achieves 1.21% baseline plus 0.83% robustness error under a fixed 600-simulation budget.
- Key twist: active learning uses physics-corrected labels from the solver, not adversarial labels, avoiding accuracy-robustness trade-off.
- Architecture adds a learnable 64 to 32 to 64 autoencoder bottleneck before DeepONet's branch network to filter perturbations.
- Authors hypothesize uniform data sampling is suboptimal because each architecture concentrates sensitivity in a different subspace.
Neural operators like DeepONet have become the go-to fast surrogate for physics simulations, replacing hour-long finite element runs with millisecond inference. A growing body of work shows they hide a nasty flaw: they can look perfect on validation data and still collapse when the input is nudged by a barely perceptible perturbation. A new paper from researchers at UIUC and IIT Delhi proposes a two-pronged defense that closes most of that gap on a canonical PDE benchmark.
The paper combines active learning that hunts for a model's weak spots with a small autoencoder bottleneck bolted onto the front of the network. Together they drop combined error from 15.42% to 2.04% on the viscous Burgers equation, an 87% reduction that neither technique achieves alone.
Why neural operators break under tiny nudges
A neural operator learns the mapping from an input function (say, an initial condition) to a solution function (the state at some later time). Prior work by the same group established that these models are catastrophically fragile: on a multi-physics CFD benchmark, models with relative L2 errors below 10 to the minus 5 on clean validation data suffered five orders of magnitude degradation under sparse perturbations affecting fewer than 1% of input dimensions.
The physics itself does not misbehave. When the same perturbed input is fed to both the neural operator and the physics solver, the solver produces a solution close to the unperturbed one, while the neural operator's prediction diverges catastrophically. The learned mapping amplifies noise that the underlying PDE would smooth out. Worse, 100% of successful single-point attacks evaded standard anomaly detection, meaning conventional monitoring pipelines would never see them coming. For digital twins running on nuclear reactors, that failure mode is disqualifying.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
