Solver-Integrated Adversarial Attacking and Training of Neural Operators

Abstract

Neural operators are commonly utilized as fast surrogates for numerical solvers in PDE problems, mapping input functions to solution functions. However, their generalizability and robustness are not yet clearly defined in the solver-surrogate setting, which differs from traditional adversarial robustness definitions. This paper studies the generalizability and the robustness of a neural operator from a solver-integrated perspective, where the learned operator and the numerical solver act on the same perturbed input. We make three contributions. First, we define and distinguish generalization and robustness for neural operators through an error-operator view, identifying fixed-input model-solver loss as a generalization metric and separating it from perturbation-based robustness metrics such as norm-bounded adversarial attack loss increase. Second, we study which adversarial attack loss is appropriate for PDE operator learning and show why model-only or fixed-ground truth attacks can be misaligned when the solver output also changes with the input. Third, we develop solver-integrated adversarial attacks and training methods. Experiments on representative PDE benchmarks show that this solver-integrated adversarial training clearly improves both generalizability and robustness. Deeper solver integration yields more effective attacks, more informative samples, and more efficient training than less integrated alternatives. These results provide a general framework for robust operator training and automatic sample selection without heavy manual intervention.