pith. sign in

arxiv: 2606.25151 · v1 · pith:N3KT22I7new · submitted 2026-06-23 · 💻 cs.LG · cs.AI

Silent Failures in Physics-Informed Neural Networks: Parameter Poisoning and the Limits of Loss-Based Validation

David McShannon , Nicholas Dietrich This is my paper

Pith reviewed 2026-06-25 23:53 UTC · model grok-4.3

classification 💻 cs.LG cs.AI
keywords physics-informed neural networksPINNsparameter poisoningresidual lossPDE parameter misspecificationBurgers equationNavier-Stokesconvection-diffusion
0
0 comments X

The pith

Physics-informed neural networks can reach low residual loss with incorrect PDE parameters, so loss minimization alone does not confirm physical accuracy.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that embedding the wrong PDE parameters in a PINN loss function still allows the network to train to low or even lower residual loss than the correct baseline. Across Burgers, Navier-Stokes cavity, and convection-diffusion problems, these poisoned models produce solutions that differ from reference solutions by tens to over 100 percent. The authors treat the parameter perturbation as a sensitivity probe rather than solely an attack and show that six tested detection methods fail to flag the mismatch reliably. They introduce a post-training sweep of the residual loss over candidate parameter values; the location of the minimum recovers the parameter that was actually used during training. This holds for five different network sizes and multiple random seeds.

Core claim

When the PDE parameters supplied to the loss are perturbed before training, the resulting PINN models achieve residual losses at or below the clean baseline while their learned solutions deviate from the correct reference by up to 71 percent in a fixed sweep and up to 128 percent under parameter search; at cavity Re=400 the poisoned loss falls below the clean value. Defining a detection difficulty ratio as solution error divided by training loss shows the corruption can be nearly invisible on loss alone. A parameter sweep of the residual loss after training recovers the true training parameter without external data and generalizes across the three PDE systems.

What carries the argument

Physics parameter poisoning (or misspecification), in which the PDE coefficients inside the residual loss are changed while all other training choices remain fixed; the loss minimum under a post-hoc parameter sweep recovers the value actually used during training.

If this is right

  • Poisoned models match or beat clean-model loss yet differ by large margins in solution error across three PDE systems.
  • None of six candidate defenses reliably detects the corruption in all regimes tested.
  • Sweeping the PDE residual loss across parameter values without retraining recovers the true training parameter.
  • The effect is bidirectional and appears across five network architectures ranging from 8.7K to 133K parameters.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Validation protocols for PINNs should include explicit checks that the loss surface is minimized at the physically intended parameter values rather than relying on loss magnitude alone.
  • The same loss-sweep procedure could be used to estimate unknown PDE parameters from data when the correct values are not known in advance.
  • The result raises the possibility that similar loss-based validation weaknesses exist in other physics-constrained or equation-informed learning methods beyond PINNs.

Load-bearing premise

The only difference between clean and poisoned runs is the PDE parameter value inserted into the loss, with architecture, optimizer, collocation points, and reference solution held fixed.

What would settle it

A new PDE system in which the minimum of the residual loss sweep does not occur at the parameter value that was actually used to train the network.

Figures

Figures reproduced from arXiv: 2606.25151 by David McShannon, Nicholas Dietrich.

Figure 1
Figure 1. Figure 1: The Danger Zone: physics parameter poisoning across PDEs. Left: Training loss remains low regardless of perturbation magnitude. Center: Solution error grows silently; squares mark silent failures. Right: Detection difficulty ratio varies by orders of magnitude across PDE types. 80 100 120 140 160 180 200 220 Reynolds number used for residual evaluation 0.00 0.01 0.02 0.03 0.04 0.05 PDE residual loss (no re… view at source ↗
Figure 2
Figure 2. Figure 2: Post-hoc loss landscape defense (n = 3 seeds). The PDE residual loss is evaluated at a range of Re values without retraining. Thin lines show individual seeds; thick lines show the mean. The clean model’s mean minimum falls at Re=100 (the stated value); the poisoned model’s mean minimum falls at Re=150 (the true training value). Individual seed minima range Re=100–105 (clean) and Re=145–155 (poisoned), wit… view at source ↗
read the original abstract

Physics-informed neural networks (PINNs) embed governing equations in their loss function, enabling mesh-free solutions to partial differential equations. Low training loss is treated as evidence that the learned solution is physically correct. This paper shows that assumption breaks down when encoded physics are incorrect. By perturbing PDE parameters before training, a setting we describe as physics parameter poisoning or parameter misspecification, we produce models that train to low loss but give incorrect answers; we treat the perturbation schedule as sensitivity analysis rather than only as a security threat, and none of our claims requires an adversary. Achieving low residual loss does not discriminate accurate from inaccurate solutions: poisoned models reach losses at or below the clean baseline yet differ by large margins, so driving the residual down is not evidence of physical accuracy. Across three PDE systems (Burgers equation, Navier-Stokes cavity, and convection-diffusion), poisoned models match or beat the clean-model training loss while their solutions differ by up to 71% in the fixed sweep and up to 128% under adversarial search; at Cavity Re=400 the poisoned loss falls below the clean baseline. We define a detection difficulty ratio R (solution error divided by training loss) to summarize how invisible the corruption is, though cross-PDE comparison is complicated by differences in loss scale. We test six candidate defenses, none of which reliably detects corruption across all regimes. We propose a post-hoc defense: sweeping the PDE residual loss across parameter values without retraining. The loss minimum recovers the true training parameter without external data, and generalizes across all three PDE systems. The effect holds across five network architectures (8.7K to 133K parameters), is bidirectional, and is confirmed across multiple random seeds.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The paper claims that low residual loss in PINNs does not guarantee physically accurate solutions when PDE parameters are misspecified (parameter poisoning). Experiments across Burgers equation, Navier-Stokes cavity flow, and convection-diffusion show poisoned models achieving losses at or below clean baselines while solutions differ by up to 71% (fixed sweep) or 128% (adversarial), with a proposed post-hoc loss-sweep defense recovering the true parameter without external data; results hold across five architectures and multiple seeds.

Significance. If the empirical findings hold, this is significant for scientific machine learning because it directly challenges the widespread assumption that minimizing the physics residual loss validates solution accuracy in PINNs. The multi-PDE, multi-architecture consistency, bidirectional effect, and a defense that requires no retraining or external data provide concrete evidence of the limitation and a practical mitigation, strengthening calls for improved validation beyond loss values.

major comments (2)
  1. [Abstract] Abstract: the central claim that poisoned models produce inaccurate solutions (differing by 71-128%) while reaching low loss rests on quantitative comparison to a reference solution obtained with correct parameters, yet the manuscript provides no details on verification of this reference (grid convergence, analytical cross-checks for Burgers, or solver validation for Navier-Stokes); this is load-bearing because non-negligible reference error would weaken the evidence that low loss fails to discriminate accuracy.
  2. [Abstract] The loss-sweep defense is presented as recovering the true parameter post-hoc, but the manuscript does not report whether the sweep minimum is unique or how its sharpness varies with network size or collocation density; without this, it is unclear whether the defense generalizes robustly beyond the tested regimes.
minor comments (1)
  1. [Abstract] The detection difficulty ratio R is introduced to quantify invisibility of corruption, but the text notes that cross-PDE comparison is complicated by loss-scale differences; a normalized variant or explicit discussion of scale invariance would improve clarity.

Simulated Author's Rebuttal

2 responses · 0 unresolved

Thank you for the constructive feedback. We address the two major comments point-by-point below. Both concern missing details that we will supply in the revision to strengthen the evidence.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central claim that poisoned models produce inaccurate solutions (differing by 71-128%) while reaching low loss rests on quantitative comparison to a reference solution obtained with correct parameters, yet the manuscript provides no details on verification of this reference (grid convergence, analytical cross-checks for Burgers, or solver validation for Navier-Stokes); this is load-bearing because non-negligible reference error would weaken the evidence that low loss fails to discriminate accuracy.

    Authors: We agree that explicit verification of the reference solutions is essential for the quantitative claims. In the revised manuscript we will add a dedicated paragraph (and supplementary figures) documenting the reference generation: Burgers' equation uses the closed-form analytical solution, cross-checked against standard literature values at the evaluation points; the Navier-Stokes lid-driven cavity reference is computed with a high-resolution finite-difference solver whose grid-convergence study shows L2 errors below 0.5% at the resolutions employed; the convection-diffusion reference is similarly validated by successive grid refinement. These additions confirm that reference error is negligible relative to the reported 71-128% solution discrepancies, preserving the central finding that low residual loss does not discriminate accuracy under parameter misspecification. revision: yes

  2. Referee: [Abstract] The loss-sweep defense is presented as recovering the true parameter post-hoc, but the manuscript does not report whether the sweep minimum is unique or how its sharpness varies with network size or collocation density; without this, it is unclear whether the defense generalizes robustly beyond the tested regimes.

    Authors: We will expand the loss-sweep section in the revision to report that the minimum is unique in every experiment across all three PDEs, five architectures, and multiple seeds. We will also include new sensitivity plots demonstrating that the sharpness of the minimum (quantified by the loss ratio at the true parameter versus neighboring values) remains stable across the tested network sizes (8.7K-133K parameters) and across collocation densities spanning the range used in the main experiments. These results support that the defense recovers the correct parameter without external data within the regimes studied. revision: yes

Circularity Check

0 steps flagged

No significant circularity; empirical study with external benchmarks

full rationale

The paper reports experimental results on PINN training under parameter poisoning across three PDEs. Claims rest on direct measurements of training loss versus solution error relative to an external reference solution, plus a post-hoc parameter sweep on fixed network outputs. No mathematical derivation, prediction, or uniqueness claim reduces by construction to fitted inputs, self-defined quantities, or self-citations. The loss minimum recovering the training parameter is a measurement, not a fitted model. The work is self-contained against external benchmarks (reference solutions, multiple architectures, random seeds), so no load-bearing circular steps exist.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central claim rests on standard PINN training assumptions plus the experimental premise that parameter misspecification is the sole source of discrepancy. No new physical entities are introduced. The perturbation values themselves are the experimental variables rather than fitted constants.

axioms (1)
  • domain assumption The residual loss is computed from the same PDE form used to generate the reference solution, only with altered parameter values.
    This is the definition of the poisoning experiment; if the loss formulation differed in other ways the comparison would not isolate parameter misspecification.

pith-pipeline@v0.9.1-grok · 5846 in / 1500 out tokens · 17897 ms · 2026-06-25T23:53:15.446802+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

15 extracted references · 3 canonical work pages · 1 internal anchor

  1. [1]

    Recipes for when physics fails: Recovering robust learning of physics informed neu- ral networks.Machine Learning: Science and Tech- nology, 4(1):015013, 2023

    Chandrajit Bajaj, Luke McLennan, Timothy An- deen, and Avik Roy. Recipes for when physics fails: Recovering robust learning of physics informed neu- ral networks.Machine Learning: Science and Tech- nology, 4(1):015013, 2023

    2023

  2. [2]

    Atuahene Kwasi Barimah, Ogwo Precious Onu, Octavian Niculita, Andrew Cowell, and Don McGlinchey. Scalable data transformation mod- els for physics-informed neural networks (PINNs) in digital twin-enabled prognostics and health manage- ment (PHM) applications.Computers, 14(4):121, 2025

    2025

  3. [3]

    Poisoning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. InInternational Conference on Machine Learning, 2012

    2012

  4. [4]

    Personalising left-ventricular biophysical mod- els of the heart using parametric physics-informed neural networks.Medical Image Analysis, 71:102066, 2021

    Stefano Buoso, Thomas Joyce, and Sebastian Koz- erke. Personalising left-ventricular biophysical mod- els of the heart using parametric physics-informed neural networks.Medical Image Analysis, 71:102066, 2021

    2021

  5. [5]

    High-Re solutions for incompressible flow using the Navier- Stokes equations and a multigrid method.Journal of Computational Physics, 48(3):387–411, 1982

    Urmila Ghia, Kirti N Ghia, and CT Shin. High-Re solutions for incompressible flow using the Navier- Stokes equations and a multigrid method.Journal of Computational Physics, 48(3):387–411, 1982

    1982

  6. [6]

    Explaining and Harnessing Adversarial Examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial ex- amples.arXiv preprint arXiv:1412.6572, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  7. [7]

    DeepXDE: A deep learning library for solving differential equations.SIAM Review, 63(1): 208–228, 2021

    Lu Lu, Xuhui Meng, Zhiping Mao, and George Em Karniadakis. DeepXDE: A deep learning library for solving differential equations.SIAM Review, 63(1): 208–228, 2021

    2021

  8. [8]

    To- wards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. InInternational Conference on Learning Representations, 2018

    2018

  9. [9]

    McNichols, Paht Juangphanich, Mallory S

    Ezra O. McNichols, Paht Juangphanich, Mallory S. Hawke, Ethan J. Shoemaker, Mackinnon J. Poul- son, Meghan E. Brandt, and Jeffrey P. Bons. Flow reconstruction in a transonic turbine cascade us- ing physics-informed neural networks (PINNs). In ASME Turbo Expo 2024, 2024. GT2024-128885

    2024

  10. [10]

    On the spectral bias of neural networks

    Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred Hamprecht, Yoshua Bengio, and Aaron Courville. On the spectral bias of neural networks. InInternational Conference on Machine Learning, 2019

    2019

  11. [11]

    Maziar Raissi, Paris Perdikaris, and George E Kar- niadakis. Physics-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differ- ential equations.Journal of Computational Physics, 378:686–707, 2019

    2019

  12. [12]

    Poison frogs! targeted clean-label poisoning attacks on neural networks

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octa- vian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. InAdvances in Neural Information Processing Systems, 2018

    2018

  13. [13]

    Respecting causality is all you need for training physics-informed neural networks.arXiv preprint arXiv:2203.07404, 2022

    Sifan Wang, Shyam Sankaran, and Paris Perdikaris. Respecting causality is all you need for training physics-informed neural networks.arXiv preprint arXiv:2203.07404, 2022

    work page arXiv 2022

  14. [14]

    Discovery of unsta- ble singularities.arXiv preprint arXiv:2509.14185, 2025

    Yongji Wang, Mehdi Bennani, James Martens, S´ ebastien Racani` ere, Sam Blackwell, Alex Matthews, Stanislav Nikolov, Gonzalo Cao-Labora, Daniel S Park, Martin Arjovsky, et al. Discovery of unsta- ble singularities.arXiv preprint arXiv:2509.14185, 2025

    work page arXiv 2025

  15. [15]

    B-PINNs: Bayesian physics-informed neural net- works for forward and inverse PDE problems with noisy data.Journal of Computational Physics, 425: 109913, 2021

    Liu Yang, Xuhui Meng, and George Em Karniadakis. B-PINNs: Bayesian physics-informed neural net- works for forward and inverse PDE problems with noisy data.Journal of Computational Physics, 425: 109913, 2021. 7

    2021