- Physical Review Journals
All JournalsPhysics Magazine

Physical Review Research

Reuse & Permissions

It is not necessary to obtain permission to reuse this article or its components as it is available under the terms of the Creative Commons Attribution 4.0 International license. This license permits unrestricted use, distribution, and reproduction in any medium, provided attribution to the author(s) and the published article's title, journal citation, and DOI are maintained. Please note that some figures may have been included with permission from other third parties. It is your responsibility to obtain the proper permission from the rights holder directly for these figures.

Export citation

Export citation

Choose format for download:

Download Citation
  • Open Access

Adversarial vulnerability of machine-learning surrogates for computational fluid dynamics

Jian-Nan Chen1,2,*,†, Xiao-Yan Cao3,*,‡, and Jun-Jie Zhang2,§

  • *These authors contributed equally to this work.
  • †Contact author: chennn1994@alumni.sjtu.edu.cn
  • ‡Contact author: mosescao@mail.ustc.edu.cn
  • §Contact author: zjacob@mail.ustc.edu.cn
PDF

Phys. Rev. Research 8, 033002 – Published 1 July, 2026

DOI: https://doi.org/10.1103/n5kp-jjcp

Abstract

Machine-learning surrogates are increasingly used to accelerate computational fluid dynamics (CFD), yet their robustness to small, structured input perturbations remains insufficiently characterized. Conventional adversarial training is largely impractical for artificial intelligence for CFD (AI4CFD), since perturbed inputs alter the underlying partial differential equation (PDE) solutions and require costly resimulation for valid labels. We propose a systematic post hoc robustness audit and apply it to the Fourier neural operator (FNO) and UNet on three canonical two-dimensional flows—laminar tube flow, transient dam break, and cylinder wake—using Gaussian, random, and fast gradient sign method (FGSM) perturbations together with normalized mean-squared error, attack gain, and signed-bias diagnostics. Adversarial vulnerability is found to arise from a coupling between flow physics and architectural inductive bias: The transient dam break exhibits heavy-tailed gains with rare amplification of order 102, while steadier flows remain bounded. A spectral analysis with a proposed attack separability index shows that FNO behaves like a spectral solver with global mode coupling, whereas UNet acts as a dissipative low-pass scheme, with the distinction modulated by PDE type. A physical-realizability audit, including a divergence-free Helmholtz projection control, rules out continuity violation and distributional shift, indicating that the vulnerability is intrinsic to the learned operator rather than a generalization artifact. We therefore argue that robustness auditing should accompany accuracy reporting in AI4CFD, and provide a practical three-step audit protocol.

View figure in article

Physics Subject Headings (PhySH)

Article Text

References (41)

  1. S. L. Brunton, B. R. Noack, and P. Koumoutsakos, Machine learning for fluid mechanics, Annu. Rev. Fluid Mech. 52, 477 (2020).
  2. R. Vinuesa and S. L. Brunton, Enhancing computational fluid dynamics with machine learning, Nat. Comput. Sci. 2, 358 (2022).
  3. D. Kochkov, J. A. Smith, A. Alieva, Q. Wang, M. P. Brenner, and S. Hoyer, Machine learning–accelerated computational fluid dynamics, Proc. Natl. Acad. Sci. USA 118, e2101784118 (2021).
  4. K. Bi, L. Xie, H. Zhang, X. Chen, X. Gu, and Q. Tian, Accurate medium-range global weather forecasting with 3D neural networks, Nature (London) 619, 533 (2023).
  5. C. Zhao, F. Zhang, W. Lou, X. Wang, and J. Yang, A comprehensive review of advances in physics-informed neural networks and their applications in complex fluid dynamics, Phys. Fluids 36, 101301 (2024).
  6. P. Garnier, J. Viquerat, J. Rabault, A. Larcher, A. Kuhnle, and E. Hachem, A review on deep reinforcement learning for fluid mechanics, Comput. Fluids 225, 104973 (2021).
  7. M. Raissi, P. Perdikaris, and G. E. Karniadakis, Physics-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations, J. Comput. Phys. 378, 686 (2019).
  8. X. Liu, W. Peng, X. Zhang, X. Zhao, W. Zhou, W. Yao, and X. Chen, Enhancing deep learning-based field reconstruction with a differentiable learning framework, Nat. Mach. Intell. 7, 1129 (2025).
  9. N. Thuerey, K. Weißenow, L. Prantl, and X. Hu, Deep learning methods for Reynolds-averaged Navier-Stokes simulations of airfoil flows, AIAA J. 58, 25 (2020).
  10. L. Lu, P. Jin, G. Pang, Z. Zhang, and G. E. Karniadakis, Learning nonlinear operators via DeepONet based on the universal approximation theorem of operators, Nat. Mach. Intell. 3, 218 (2021).
  11. Z. Li, N. B. Kovachki, K. Azizzadenesheli, B. Liu, K. Bhattacharya, A. Stuart, and A. Anandkumar, Fourier neural operator for parametric partial differential equations, in International Conference on Learning Representations (ICLR), Virtual Event (2021).
  12. N. Kovachki, Z. Li, B. Liu, K. Azizzadenesheli, K. Bhattacharya, A. Stuart, and A. Anandkumar, Neural operator: learning maps between function spaces with applications to PDEs, J. Mach. Learn. Res. 24, 1 (2023).
  13. S. Wang, H. Wang, and P. Perdikaris, Learning the solution operator of parametric partial differential equations with physics-informed DeepONets, Sci. Adv. 7, eabi8605 (2021).
  14. J. Viquerat, J. Rabault, A. Kuhnle, H. Ghraieb, A. Larcher, and E. Hachem, Direct shape optimization through deep reinforcement learning, J. Comput. Phys. 428, 110080 (2021).
  15. C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, Intriguing properties of neural networks, in International Conference on Learning Representations (ICLR) (Banff, AB, Canada, 2014).
  16. I. J. Goodfellow, J. Shlens, and C. Szegedy Explaining and harnessing adversarial examples, in International Conference on Learning Representations (ICLR) (San Diego, CA, USA, 2015).
  17. S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, DeepFool: A simple and accurate method to fool deep neural networks, in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (Las Vegas, NV, USA, 2016), pp. 2574–2582.
  18. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, Towards deep learning models resistant to adversarial attacks, in International Conference on Learning Representations (ICLR) (Vancouver, BC, Canada, 2018).
  19. S. G. Finlayson, J. D. Bowers, J. Ito, J. L. Zittrain, A. L. Beam, and I. S. Kohane, Adversarial attacks on medical machine learning, Science 363, 1287 (2019).
  20. K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, Robust physical-world attacks on deep learning visual classification, in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (Salt Lake City, UT, USA, 2018), pp. 1625–1634.
  21. A. Kurakin, I. J. Goodfellow, and S. Bengio, Adversarial examples in the physical world, in Artificial Intelligence Safety and Security, edited by R.V. Yampolskiy (Chapman and Hall/CRC, Boca Raton, FL, USA, 2018) pp. 99–112.
  22. P. J. Roache, Code verification by the method of manufactured solutions, J. Fluids Eng. 124, 4 (2002).
  23. C. J. Roy, Review of code and solution verification procedures for computational simulation, J. Comput. Phys. 205, 131 (2005).
  24. O. Ronneberger, P. Fischer, and T. Brox, U-Net: Convolutional networks for biomedical image segmentation, in Medical Image Computing and Computer-Assisted Intervention – MICCAI 2015, Lecture Notes in Computer Science Vol. 9351 (Munich, Germany, 2015), pp. 234–241.
  25. Y. Luo, Y. Chen, and Z. Zhang, CFDBench: A large-scale benchmark for machine learning methods in fluid dynamics, arXiv:2310.05963.
  26. C. H. K. Williamson, Vortex dynamics in the cylinder wake, Annu. Rev. Fluid Mech. 28, 477 (1996).
  27. M. Provansal, C. Mathis, and L. Boyer, Bénard-von Kármán instability: Transient and forced regimes, J. Fluid Mech. 182, 1 (1987).
  28. E. Konstantinidis, S. Balabani, and M. Yianneskis, The timing of vortex shedding in a cylinder wake imposed by periodic inflow perturbations, J. Fluid Mech. 543, 45 (2005).
  29. D. Sipp and A. Lebedev, Global stability of base and mean flows: A general approach and its applications to cylinder and open cavity flows, J. Fluid Mech. 593, 333 (2007).
  30. P. J. Schmid and D. S. Henningson, Stability and Transition in Shear Flows, Applied Mathematical Sciences (Springer-Verlag, New York, 2001), Vol. 142.
  31. K. M. T. Kleefsman, G. Fekken, A. E. P. Veldman, B. Iwanowski, and B. Buchner, A volume-of-fluid based simulation method for wave impact problems, J. Comput. Phys. 206, 363 (2005).
  32. J. C. Martin and W. J. Moyce, Part IV. An experimental study of the collapse of liquid columns on a rigid horizontal plane, Philos. Trans. R. Soc. A 244, 312 (1952).
  33. J. Long, E. Shelhamer, and T. Darrell, Fully convolutional networks for semantic segmentation, in Proceedings of the IEEE Conferenceon Computer Vision and Pattern Recognition (CVPR) (Boston, MA, USA, 2015), pp. 3431–3440.
  34. M. Takamoto, F. Alesiani, and M. Niepert, Learning neural PDE solvers with parameter-guided channel attention, Proceedings of the 40th International Conference on Machine Learning (PMLR), Vol. 202 (2023), pp. 33448–33467.
  35. C. Canuto, M. Y. Hussaini, A. Quarteroni, and T. A. Zang, Spectral methods: Evolution to Complex Geometries and Applications to Fluid Dynamics, Scientific Computation, 1st ed (Springer-Verlag, Berlin, Heidelberg, 2006).
  36. J. H. Ferziger, M. Perić, and R. L. Street, Computational Methods for Fluid Dynamics (Springer-Verlag, Berlin, 2002), 3rd ed.
  37. E. Ott, Chaos in Dynamical Systems, 2nd ed (Cambridge University Press, Cambridge, 2002).
  38. G. E. Karniadakis, I. G. Kevrekidis, L. Lu, P. Perdikaris, S. Wang, and L. Yang, Physics-informed machine learning, Nat. Rev. Phys. 3, 422 (2021).
  39. J. Brandstetter, D. E. Worrall, and M. Welling, Message passing neural PDE solvers, in The Tenth International Conference on Learning Representations (ICLR) (Virtual Event, 2022).
  40. B. List, L.-W. Chen, K. Bali, and N. Thuerey, Differentiability in unrolled training of neural physics simulators on transient dynamics, Comput. Methods Appl. Mech. Eng. 433, 117441 (2025).
  41. J. Chen, J. Zhang, and X. Cao, “CFD benchmark with attack”, Science Data Bank, https://doi.org/10.57760/sciencedb.31177, 2026.

Outline

Information

Phys. Rev. Research 8, 033002– Published 1 July, 2026
  • Received 23 December 2025
  • Accepted 26 May 2026
Crossmark - Check for updates button
Creative Commons Logo

Published by the American Physical Society under the terms of the Creative Commons Attribution 4.0 International license. Further distribution of this work must maintain attribution to the author(s) and the published article's title, journal citation, and DOI.

Published by the American Physical Society

Sign In to Your Journals Account

Filter

Filter

Article Lookup

Enter a citation