Silent Failures in Physics-Informed Neural Networks: Parameter Poisoning and the Limits of Loss-Based Validation

Abstract: Physics-informed neural networks (PINNs) embed governing equations in their loss function, enabling mesh-free solutions to partial differential equations. Low training loss is treated as evidence that the learned solution is physically correct. This paper shows that assumption breaks down when encoded physics are incorrect. By perturbing PDE parameters before training, a setting we describe as physics parameter poisoning or parameter misspecification, we produce models that train to low loss but give incorrect answers; we treat the perturbation schedule as sensitivity analysis rather than only as a security threat, and none of our claims requires an adversary. Achieving low residual loss does not discriminate accurate from inaccurate solutions: poisoned models reach losses at or below the clean baseline yet differ by large margins, so driving the residual down is not evidence of physical accuracy. Across three PDE systems (Burgers equation, Navier-Stokes cavity, and convection-diffusion), poisoned models match or beat the clean-model training loss while their solutions differ by up to 71% in the fixed sweep and up to 128% under adversarial search; at Cavity Re=400 the poisoned loss falls below the clean baseline. We define a detection difficulty ratio R (solution error divided by training loss) to summarize how invisible the corruption is, though cross-PDE comparison is complicated by differences in loss scale. We test six candidate defenses, none of which reliably detects corruption across all regimes. We propose a post-hoc defense: sweeping the PDE residual loss across parameter values without retraining. The loss minimum recovers the true training parameter without external data, and generalizes across all three PDE systems. The effect holds across five network architectures (8.7K to 133K parameters), is bidirectional, and is confirmed across multiple random seeds.

• The paper demonstrates that PINNs can achieve low training loss yet produce drastically incorrect solutions when physics parameters are poisoned.
• It systematically analyzes failure modes across multiple PDE systems and network architectures under varied parameter perturbations.
• The study introduces a post-hoc loss landscape sweep that reliably detects parameter poisoning without requiring external ground truth.

Silent Failures in Physics-Informed Neural Networks: Parameter Poisoning and the Limits of Loss-Based Validation

Introduction

This work investigates a critical vulnerability in Physics-Informed Neural Networks (PINNs): their susceptibility to silent failure under physics parameter poisoning. The prevalent workflow in PINN applications assumes that a sufficiently low training loss corresponds to physical correctness because the loss measures the residual of the governing PDEs. However, this paper systematically demonstrates that if the underlying physics (e.g., coefficients within the PDE) is misspecified—whether by unintentional misconfiguration or adversarial interference—PINNs can converge to low loss while yielding drastically incorrect solutions. This decoupling of loss and solution correctness exposes foundational limits of current loss-based validation protocols, raising both practical and theoretical concerns regarding PINN reliability.

Threat Model and Failure Characterization

The paper defines "physics parameter poisoning" as the alteration of encoded physical parameters in the PDE loss, affecting the model during training. These alterations can result from mistakes in preprocessing, errors in code pipelines, library drift, or intentional tampering. Unlike conventional adversarial attacks on inputs or training data, this attack modality directly corrupts the equations driving PINN optimization.

A "silent failure" is rigorously defined: the PINN achieves a training loss (on its self-consistent, but poisoned residual) that falls within the clean baseline, yet produces a solution with large normed error when compared to the correct PDE-grounded solution. Across Burgers’ equation, Navier-Stokes cavity flow, and 2D convection-diffusion systems, the authors show that such failures are generically achievable in both directions of parameter perturbation. Notably, for the Navier-Stokes cavity at $Re=400$, poisoning can lead to solutions with $L_2$ errors exceeding 70% without inflating the training loss beyond the clean baseline.

To quantify the subtlety of these failures, the "detection difficulty ratio" $R$ is introduced as the quotient of solution error magnitude and training loss. High $R$ indicates that a large solution discrepancy hides behind a seemingly benign loss—mimicking scenarios in which standard monitoring would signal success.

Experimental Demonstration and Analysis

The empirical study spans three canonical PDE systems, evaluates multiple architectures per task, and explores varying levels of parameter poisoning ($\delta \in \{0.05, 0.1, 0.2, 0.5, 1.0, 2.0\}$), including both increases and decreases relative to the reference parameter.

Key observations include:

• Architecture and PDE Dependence: Silent failures occur across a wide range of PINN network sizes (from 8.7K to 133K parameters) and activation functions (tanh, sinusoidal), indicating that the phenomenon is not a side effect of underfitting or architectural peculiarity.
• Loss-Error Decoupling: Poisoned models routinely match or outperform clean models on (poisoned) training loss despite very large physical errors; for instance, in the Navier-Stokes cavity (Re=400, $\delta=1$), the poisoned model achieves lower loss than the clean baseline with $0.71$ L2 error.
• Detection Difficulty Ratio: $R$ spans up to four orders of magnitude across systems, attributable to loss scaling. Interpreted within systems, the cavity system at high $Re$ is most vulnerable, with the largest errors attainable for a given loss threshold.
• Bidirectionality: Failures occur for both upward and downward parameter misspecifications. Notably, decreases in $Re$ (e.g., Re=90 from a baseline of Re=100) can yield even more egregious silent failures than increases.

Evaluation of Defensive Measures

The robustness of typical and advanced validation protocols is systematically tested:

• Naive Defenses (Six variants): Standard approaches such as residual monitoring at the stated PDE parameter, ensemble disagreement, parameter jitter, and incompressibility checking fail to reliably detect poisoning. For example, in high-variance regimes (e.g., Navier-Stokes at high $L_2$0), poisoned and clean models are statistically indistinguishable by loss, and stochastic training seed effects dominate.
• Gradient-based Parameter Recovery: Inverse PINNs, which are designed to jointly solve for parameters and solution fields, are foiled because the overparameterized network absorbs signal into its weights, preventing meaningful recovery of the true physics parameter through gradient optimization.
• Cross-System External Validation: Even comparison against external finite difference or benchmark solutions often fails to isolate subtle misconfigurations, especially when training and test procedures are inconsistent or ground truth is unavailable.

Proposed Remedy: Post-Hoc Loss Landscape Sweep

A robust, post-hoc defense is put forth: after training, sweep the encoded physical parameter in the PDE loss over a grid, evaluating the residual loss at each sweep point, without retraining the network. For unpoisoned (clean) models, the minimum is found at the true parameter; for poisoned models, it unequivocally tracks the value used during training. This method does not require ground-truth solutions, retraining, or any external labeled data—only the ability to recompute the loss for alternative PDE parameters.

Across all systems and seeds tested, this loss landscape analysis yields zero false positives or negatives, with clean and poisoned minima never overlapping, thus providing an effective diagnostic for parameter poisoning and misspecification.

Implications for Scientific ML Workflows

The findings directly undermine the widespread reliance on low PINN residual loss as a proxy for physical fidelity. This is particularly concerning as PINNs are increasingly deployed for safety-critical applications spanning cardiac modeling, gas turbine diagnostics, and fluid mechanics. The study reveals that pipelines that do not externally validate the encoded physics—or rely solely on residuals—risk propagating arbitrarily large, unrecognized solution errors whenever parameter provenance is uncertain.

From a theoretical perspective, the demonstrated failures elucidate both the expressive and inductive biases of PINNs: while highly expressive networks can fit corrupted residual landscapes with high fidelity, they exhibit no intrinsic mechanism for error correction with respect to misencoded physics. The results also indicate that detection difficulty is strongly PDE- and regime-dependent, governed by operators' spectral properties and network expressiveness.

Limitations and Future Directions

The paper's conclusions are buttressed by multi-seed experimentation for cavity flow and Burgers' equation, but further validation via larger-scale ensembles and advanced PINN architectures, such as neural operators or Fourier networks, is warranted. Extensions to Bayesian PINNs [15], adaptive weighting strategies, or inclusion of external priors may mitigate some vulnerabilities, though none are presently validated. Broader automation in model provenance auditing becomes essential as pretrained PINNs propagate through public repositories and collaborative pipelines.

Future research should develop cross-PDE normalization protocols for error/loss ratios, integrate unsupervised anomaly detection within scientific ML workflows, and explore systematic defenses against both accidental and adversarial parameter poisoning in PINNs.

Conclusion

This study establishes that low loss in PINNs is insufficient evidence for physical correctness when the governing equations are misspecified. Silent failures induced by physics parameter poisoning are both practically and theoretically unavoidable under current loss-based validation standards. Post-hoc loss landscape analysis provides a practical, effective defense, but a broader rethinking of trust, provenance, and validation in PINN-based scientific inference is required.