arXiv:2606.25151cs.LGcs.AI2026-06被引 1

PINN训练损失低不等于物理正确,参数错误会导致模型看似准确实则严重偏差。

Silent Failures in Physics-Informed Neural Networks: Parameter Poisoning and the Limits of Loss-Based Validation

  • 通过扰动偏微分方程参数制造物理误导,使模型在低损失下输出错误解。
  • 污染模型损失低于或持平干净模型,但解误差高达71%甚至128%。
  • 提出无需重训练的后处理扫描法,可自动恢复真实参数,适用于多种网络结构。

物理信息神经网络(PINNs)将控制方程嵌入损失函数,实现偏微分方程的无网格求解。通常认为低训练损失即表示解具备物理正确性。本文指出,当编码的物理规律本身错误时,该假设失效。通过在训练前扰动PDE参数(称为参数中毒或误设定),我们构建出训练损失极低但解严重偏离真实值的模型;将扰动过程视为敏感性分析而非仅安全威胁,且无需假设攻击者存在。低残差损失无法区分正确与错误解:污染模型损失达到甚至低于干净基线,但解误差可达71%(固定扫描)至128%(对抗搜索)。在三个典型PDE系统(Burgers方程、纳维-斯托克斯腔流、对流-扩散方程)中均观察到此现象,其中腔流在Re=400时污染模型损失低于干净模型。定义检测难度比R(解误差/训练损失)量化污染隐蔽性,但不同方程间损失尺度差异使跨系统比较复杂。测试六种候选防御方法,均未能在所有场景可靠检测污染。提出一种后处理防御:在不重新训练的前提下,对参数进行扫描并寻找残差损失最小值,该最小值能恢复真实训练参数,且在三种系统上均有效。该方法适用于五种网络架构(8.7K至133K参数),具有双向性,并经多个随机种子验证。

原文摘要 · Abstract (English)

Physics-informed neural networks (PINNs) embed governing equations in their loss function, enabling mesh-free solutions to partial differential equations. Low training loss is treated as evidence that the learned solution is physically correct. This paper shows that assumption breaks down when encoded physics are incorrect. By perturbing PDE parameters before training, a setting we describe as physics parameter poisoning or parameter misspecification, we produce models that train to low loss but give incorrect answers; we treat the perturbation schedule as sensitivity analysis rather than only as a security threat, and none of our claims requires an adversary. Achieving low residual loss does not discriminate accurate from inaccurate solutions: poisoned models reach losses at or below the clean baseline yet differ by large margins, so driving the residual down is not evidence of physical accuracy. Across three PDE systems (Burgers equation, Navier-Stokes cavity, and convection-diffusion), poisoned models match or beat the clean-model training loss while their solutions differ by up to 71% in the fixed sweep and up to 128% under adversarial search; at Cavity Re=400 the poisoned loss falls below the clean baseline. We define a detection difficulty ratio R (solution error divided by training loss) to summarize how invisible the corruption is, though cross-PDE comparison is complicated by differences in loss scale. We test six candidate defenses, none of which reliably detects corruption across all regimes. We propose a post-hoc defense: sweeping the PDE residual loss across parameter values without retraining. The loss minimum recovers the true training parameter without external data, and generalizes across all three PDE systems. The effect holds across five network architectures (8.7K to 133K parameters), is bidirectional, and is confirmed across multiple random seeds.

PINN物理约束模型可信度参数扰动

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。