# Beyond Uniform Sampling: Synergistic Active Learning and Input Denoising for Robust Neural Operators

arXiv: https://arxiv.org/abs/2604.13316 · HTML: https://mlsanity.com/paper/2604.13316/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 18 references that are in the map.
- First posted on arXiv 14 Apr 2026.

## Builds on (most cited first, 16 of 16)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [DeepONet: Learning nonlinear operators for identifying differential equations based on the universal approximation theorem of operators](https://mlsanity.com/paper/1910.03193/) (2019)
- [Spectral Normalization for Generative Adversarial Networks](https://mlsanity.com/paper/1802.05957/) (2018)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [Regularisation of Neural Networks by Enforcing Lipschitz Continuity](https://mlsanity.com/paper/1804.04368/) (2018)
- [Fourier-DeepONet: Fourier-enhanced deep operator networks for full waveform inversion with improved accuracy, generalizability, and robustness](https://mlsanity.com/paper/2305.17289/) (2023)
- [Online Adversarial Purification based on Self-Supervision](https://mlsanity.com/paper/2101.09387/) (2021)
- [Deep Neural Operator Driven Real Time Inference for Nuclear Systems to Enable Digital Twin Solutions](https://mlsanity.com/paper/2308.07523/) (2023)
- [Improved generalization with deep neural operators for engineering systems: Path towards digital twin](https://mlsanity.com/paper/2301.06701/) (2023)
- [Virtual Sensing-Enabled Digital Twin Framework for Real-Time Monitoring of Nuclear Systems Leveraging Deep Neural Operators](https://mlsanity.com/paper/2410.13762/) (2024)
- [From Proxies to Fields: Spatiotemporal Reconstruction of Global Radiation from Sparse Sensor Sequences](https://mlsanity.com/paper/2506.12045/) (2025)
- [Adversarial Vulnerabilities in Neural Operator Digital Twins: Gradient-Free Attacks on Nuclear Thermal-Hydraulic Surrogates](https://mlsanity.com/paper/2603.22525/) (2026)
- [Distribution-Free Uncertainty-Aware Virtual Sensing via Conformalized Neural Operators](https://mlsanity.com/paper/2507.11574/) (2025)
- [Evaluating the Adversarial Robustness for Fourier Neural Operators](https://mlsanity.com/paper/2204.04259/) (2022)

## Built on by (most cited first, 2 of 2)

- [Staying on the Attractor: Supervising Neural Surrogates of 3D Turbulence Where They Leave It](https://mlsanity.com/paper/2609.32864/) (2026)
- [Targeted search shows that random-device testing underestimates worst-case error in a simulated wave-based neural operator](https://mlsanity.com/paper/2610.07529/) (2026)

## Abstract (arXiv)

Neural operators have emerged as fast surrogate models for physics simulations, yet they remain acutely vulnerable to adversarial perturbations, a critical liability for safety-critical digital twin deployments. We present a synergistic defense that combines active learning-based data generation with an input denoising architecture. The active learning component adaptively probes model weaknesses using differential evolution attacks, then generates targeted training data at discovered vulnerability locations while an adaptive smooth-ratio safeguard preserves baseline accuracy. The input denoising component augments the operator architecture with a learnable bottleneck that filters adversarial noise while retaining physics-relevant features. On the viscous Burgers' equation benchmark, the combined approach achieves a 2.04% combined error (1.21% baseline + 0.83% robustness), representing an 87% reduction relative to standard training (15.42% combined) and outperforming both active learning alone (3.42%) and input denoising alone (5.22%). More broadly, our results, combined with cross-architecture vulnerability analysis from prior work, suggest that optimal training data for neural operators is architecture-dependent: because different architectures concentrate sensitivity in distinct input subspaces, uniform sampling cannot adequately cover the vulnerability landscape of all models. These findings have potential implications for the deployment of neural operators in safety-critical energy systems including nuclear reactor monitoring.