# Adversarial Vulnerabilities in Neural Operator Digital Twins: Gradient-Free Attacks on Nuclear Thermal-Hydraulic Surrogates

arXiv: https://arxiv.org/abs/2603.22525 · HTML: https://mlsanity.com/paper/2603.22525/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 45 references that are in the map.
- First posted on arXiv 23 Mar 2026.

## Builds on (most cited first, 7 of 7)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Robust Learning with Jacobian Regularization](https://mlsanity.com/paper/1908.02729/) (2019)
- [Online Adversarial Purification based on Self-Supervision](https://mlsanity.com/paper/2101.09387/) (2021)
- [State-space models are accurate and efficient neural operators for dynamical systems](https://mlsanity.com/paper/2409.03231/) (2024)
- [PIAT: Physics Informed Adversarial Training for Solving Partial Differential Equations](https://mlsanity.com/paper/2207.06647/) (2022)
- [Agentic Physical AI toward a Domain-Specific Foundation Model for Energy Systems: A Case Study on Nuclear Reactor Control](https://mlsanity.com/paper/2512.23292/) (2025)
- [PINNsFailureRegion Localization and Refinement through White-box AdversarialAttack](https://mlsanity.com/paper/2310.11789/) (2023)

## Built on by (most cited first, 4 of 4)

- [Real-Time Sensing of Inaccessible Physical Fields via an Edge-Deployable Hardware-Portable Graph Neural Operator](https://mlsanity.com/paper/2604.01802/) (2026)
- [Beyond Uniform Sampling: Synergistic Active Learning and Input Denoising for Robust Neural Operators](https://mlsanity.com/paper/2604.13316/) (2026)
- [Neuromorphic Continual Learning for Sequential Deployment of Nuclear Plant Monitoring Systems](https://mlsanity.com/paper/2604.18611/) (2026)
- [Targeted search shows that random-device testing underestimates worst-case error in a simulated wave-based neural operator](https://mlsanity.com/paper/2610.07529/) (2026)

## Abstract (arXiv)

Operator learning models are rapidly emerging as the predictive core of digital twins for nuclear and energy systems, promising real-time field reconstruction from sparse sensor measurements. Yet their robustness to adversarial perturbations remains uncharacterized, a critical gap for deployment in safety-critical systems. Here we show that neural operators are acutely vulnerable to extremely sparse (fewer than 1% of inputs), physically plausible perturbations that exploit their sensitivity to boundary conditions. Using gradient-free differential evolution across four operator architectures, we demonstrate that minimal modifications trigger catastrophic prediction failures, increasing relative L2 error from ~1.5% (validated accuracy) to 37-63% while remaining completely undetectable by standard validation metrics. Notably, 100% of successful single-point attacks pass z-score anomaly detection. We introduce the effective perturbation dimension deff, a Jacobian-based diagnostic that, together with sensitivity magnitude, yields a two-factor vulnerability model explaining why architectures with extreme sensitivity concentration (POD-DeepONet, deff ≈ 1) are not necessarily the most exploitable, since low-rank output projections cap maximum error, while moderate concentration with sufficient amplification (S-DeepONet, deff ≈ 4) produces the highest attack success. Gradient-free search outperforms gradient-based alternatives (PGD) on architectures with gradient pathologies, while random perturbations of equal magnitude achieve near-zero success rates, confirming that the discovered vulnerabilities are structural. Our findings expose a previously overlooked attack surface in operator learning models and establish that these models require robustness guarantees beyond standard validation before deployment.