FLIPNET: Neural Transform & Attack Paradigms

• FLIPNET is a context-dependent term describing neural network models used for continuous nonlinear Fourier transforms, PIC/FLIP fluid enhancement, and bit-flip attack strategies.
• In fiber-optic communications, FLIPNET employs an autoencoder-style design to learn both NFT and INFT mappings, achieving low RMSE values and bridging linear and nonlinear spectral regimes.
• Distinct implementations extend FLIPNET to intrusive deconvolution in fluid simulations and targeted bit-flip attacks, underscoring its tailored applicability across diverse scientific domains.

FLIPNET is not a single standardized term across the cited arXiv literature. In the most direct usage here, it denotes a neural network that learns both the forward and inverse continuous nonlinear Fourier transforms associated with the normalized nonlinear Schrödinger equation for fiber-optic communication (Zhang et al., 2024). Closely related but distinct usages attach the label to an intrusive deconvolutional network embedded in a PIC/FLIP fluid solver (Halder et al., 2021), or to a broader paradigm of deployment-stage attacks that induce malicious behavior by flipping a small number of stored weight bits (Bai et al., 2021). By contrast, the training framework Flipping Error Reduction is explicitly not a “FlipNet” architecture (Deng et al., 2022), and NetFlipPA is a separate signflip-based spectral method for network embedding dimension selection (Hong et al., 6 Sep 2025).

1. Terminological scope and disambiguation

The supplied sources use the FLIPNET or FlipNet label in multiple, non-equivalent senses. The most concrete architectural use is in nonlinear Fourier processing for nonlinear frequency-division multiplexing, where a single neural network approximates both NFT and INFT between linear and nonlinear spectral domains (Zhang et al., 2024). A second, explicitly “FLIPNET-like” usage appears in computational fluid dynamics, where a deconvolutional network is inserted intrusively into a PIC/FLIP time-stepping loop to map coarse-grid velocities and occupancy information to a high-fidelity velocity field (Halder et al., 2021). A third usage is taxonomic rather than nominative: TA-LBF is described as sitting within a broader FlipNet paradigm of attacks that manipulate behavior by flipping limited weight bits in deployed models (Bai et al., 2021).

A separate clarification is necessary because several papers include “flip” terminology without defining a FlipNet architecture. FER is a training-time regularization framework called Flipping Error Reduction; its authors “do not introduce a separate network or use the name ‘FlipNet’,” and the method is “purely a training objective and bookkeeping mechanism” (Deng et al., 2022). NetFlipPA, despite the phonetic similarity, is a randomization-based spectral method for heterogeneous networks and is unrelated to neural architectures for optics, fluid simulation, or weight-bit attacks (Hong et al., 6 Sep 2025).

Usage in the supplied literature	Object	Defining role
FLIPNET (Zhang et al., 2024)	Neural network for NFT/INFT	Maps between linear and continuous nonlinear spectra
FLIPNET-like PIC/FLIP method (Halder et al., 2021)	Intrusive deconvolutional CNN	Enhances low-fidelity PIC/FLIP solutions each time step
FlipNet paradigm (Bai et al., 2021)	Deployment-stage bit-flip attack class	Achieves malicious behavior by flipping limited weight bits
FER clarification (Deng et al., 2022)	Training framework	Not a separate network and not called FlipNet
NetFlipPA (Hong et al., 6 Sep 2025)	Spectral signflip method	Selects embedding dimension via a recovered noise floor

This multiplicity of meanings implies that FLIPNET should be interpreted contextually. In optical communication it denotes a specific learned transform; in PIC/FLIP simulation it denotes a neural enhancement mechanism integrated into a legacy solver; in security it names a family of bit-flip attack strategies rather than a single architecture.

2. FLIPNET in nonlinear Fourier-domain optical communication

In fiber-optic communication, FLIPNET is introduced as a single neural network architecture for both the forward and inverse continuous nonlinear Fourier transforms associated with the focusing normalized nonlinear Schrödinger equation (Zhang et al., 2024). The governing equation is

$$\frac{\partial}{\partial z}q(t,z)=-i\frac{\partial^2}{\partial t^2}q(t,z)-2i\left|q(t,z)\right|^2 q(t,z),$$

with propagation in the scattering domain given by

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$

The formal background is the Zakharov–Shabat spectral problem,

$$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$

with boundary condition

$$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$

The scattering coefficients are defined by asymptotic limits,

$$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$

and the continuous nonlinear spectrum is the reflection coefficient on the real axis. In the formulation used here,

$$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$

while only continuous spectra are considered and no discrete eigenvalues or solitons are included.

The communication setting is continuous-spectrum NFDM with pure $Q$-modulation. Symbols $c_n$ are modulated on carriers $w_n(\lambda)$,

$s(\lambda)=\sum_n c_n w_n(\lambda),$

and in this work $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$0. Pulse energy is controlled by scaling $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$1 by a factor $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$2, with

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$3

A central physical property reproduced by the network is the low-power limit in which the nonlinear spectrum converges to the linear Fourier spectrum. The paper motivates this through integral identities for the Jost solutions. In the small-signal regime $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$4, the reflection coefficient approaches the linear Fourier transform of $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$5, with linear angular frequency $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$6. This behavior is not ancillary: it is treated as a key hallmark of the continuous NFT that the learned mapping must preserve. At low pulse energies, the transform becomes close to identity between linear and nonlinear spectral descriptions; at higher energies, nonlinear and linear spectra differ markedly (Zhang et al., 2024).

The inverse direction is also learned. Rather than reconstructing $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$7 directly from Gel’fand–Levitan–Marchenko equations, the learned INFT maps from the continuous nonlinear spectrum back to the linear Fourier spectrum. A plausible implication is that the architecture is positioned as a neural replacement for a numerically burdensome spectral conversion stage, while leaving the final inverse FFT or related downstream DSP outside the learned transform itself.

3. Architecture, training data, and optimization in the NFT/INFT formulation

FLIPNET in the optical setting is a 1D autoencoder-style network that interleaves convolutional blocks with recurrent LSTM blocks (Zhang et al., 2024). Complex spectra are represented as two real channels, so an $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$8-point complex spectrum is a $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$9 tensor. The encoder halves the sequence length three times with stride-2 convolutions and increases feature counts from $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$0 to $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$1 to $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$2, with LeakyReLU activations and an LSTM following each convolutional block. The decoder mirrors this structure with transpose convolutions, Tanh activations, and LSTMs, restoring the output to $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$3. For $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$4, the layer stack is explicitly:

• Input: $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$5.
• Encoder: Conv1D $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$6 $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$7 LeakyReLU$$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$8 $$v_t= \begin{pmatrix} -i\lambda & q(t)\ -q^*(t) & i\lambda \end{pmatrix}v,$$9 LSTM, repeated three times, producing lengths $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$0.
• Decoder: ConvTrans1D $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$1 $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$2 Tanh $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$3 LSTM, repeated three times, returning to length $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$4.

The same parameterization is used for both directions. For the forward NFT mapping, the input is the linear Fourier spectrum and the output is the continuous nonlinear spectrum $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$5. For the inverse mapping, the input is $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$6 and the output is the linear Fourier spectrum, with LeakyReLU and Tanh swapped to improve reverse-direction accuracy. The stated architectural rationale is physics-guided: convolutions approximate multiplicative kernels in the integral identities, while LSTMs emulate the time-ordered integrations appearing in the scattering relations.

Training data are generated with the FNFT library using continuous-spectrum NFDM-QAM bursts only (Zhang et al., 2024). The sampling setup is $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$7 points per burst at $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$8 GS/s, corresponding to an approximately $$v(t,\lambda)\to \begin{pmatrix} 1\ 0 \end{pmatrix} e^{-j\lambda t}, \qquad t\to -\infty.$$9 ns window. Randomization spans energy scaling coefficients in $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$0, pulse width $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$1 in $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$2 ns, random constant phase in $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$3, QAM formats from $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$4, and subcarrier counts from $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$5. The subcarriers are either sinc-based,

$$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$6

or a flat-top design expressed with error functions. The corpus contains $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$7 training bursts and $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$8 validation bursts.

Optimization uses ADAM with learning rate $$a(\lambda)=\lim_{t\to\infty} v_1(t,\lambda)e^{j\lambda t}, \qquad b(\lambda)=\lim_{t\to\infty} v_2(t,\lambda)e^{-j\lambda t},$$9 for $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$0 epochs. Labels are normalized to unit peak modulus, and the objective is RMSE on complex spectra:

$$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$1

The model has $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$2 trainable parameters, approximately $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$3 MB in single precision, and about $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$4 million FLOPs per forward pass. The reported FLOP decomposition is dominated by the convolutional blocks, with a smaller but explicit LSTM contribution (Zhang et al., 2024).

4. Accuracy, generalization, and system-level implications of the optical FLIPNET

Across the validation set, FLIPNET achieves forward NFT RMSE of approximately $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$5 and inverse NFT RMSE of approximately $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$6 (Zhang et al., 2024). The inverse direction is consistently harder: INFT errors are reported as $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$7–$$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$8 larger than NFT errors at comparable energy levels. Subcarrier count also matters. For $$Q(\lambda)=\frac{b(\lambda)}{a(\lambda)}, \qquad \lambda\in\mathbb{R},$$9 subcarriers, NFT RMSE is $Q$0 and INFT RMSE is $Q$1; for $Q$2, the corresponding values are $Q$3 and $Q$4; for $Q$5, they are $Q$6 and $Q$7. The paper states that errors scale approximately linearly with energy and carrier count.

Performance is also stratified by modulation format. For 4-QAM, the reported energy is approximately $Q$8 pJ with NFT RMSE $Q$9 and INFT RMSE $c_n$0. For 16-QAM, the energy is approximately $c_n$1 pJ with NFT RMSE $c_n$2 and INFT RMSE $c_n$3. For 64-QAM, the energy is approximately $c_n$4 pJ with NFT RMSE $c_n$5 and INFT RMSE $c_n$6. These results are presented alongside the qualitative claim that the network reproduces the transition between nearly linear behavior at low energy and strongly nonlinear behavior at higher energy.

Back-to-back demodulation tests compare neural INFT$c_n$7NFT chains against classical FNFT processing (Zhang et al., 2024). Over $c_n$8 bits, the neural networks produce $c_n$9 total error bits, whereas FNFT produces $w_n(\lambda)$0. The energy dependence is non-monotonic in relative advantage: FNFT has lower BER at low energy, but its BER rises sharply with energy, while the neural BER increases more modestly and outperforms FNFT beyond approximately $w_n(\lambda)$1 pJ. For $w_n(\lambda)$2 subcarriers, neural BER is approximately $w_n(\lambda)$3 versus FNFT approximately $w_n(\lambda)$4; for $w_n(\lambda)$5 subcarriers, FNFT is approximately $w_n(\lambda)$6 while the neural result is approximately $w_n(\lambda)$7.

Generalization beyond the training pulse family is explicitly tested. For forward NFT, inputs $w_n(\lambda)$8 and $w_n(\lambda)$9 yield nonlinear spectra with RMSE approximately $s(\lambda)=\sum_n c_n w_n(\lambda),$0 and $s(\lambda)=\sum_n c_n w_n(\lambda),$1, respectively. For inverse NFT, inputs $s(\lambda)=\sum_n c_n w_n(\lambda),$2 and $s(\lambda)=\sum_n c_n w_n(\lambda),$3 yield linear spectra with RMSE approximately $s(\lambda)=\sum_n c_n w_n(\lambda),$4 and $s(\lambda)=\sum_n c_n w_n(\lambda),$5. The paper notes that some outputs acquire nontrivial imaginary components even when the linear spectra are purely real, indicating that the network is learning genuinely nonlinear spectral structure rather than a trivial linear surrogate.

The practical positioning is therefore specific. FLIPNET is fully differentiable end-to-end and can be inserted into transmitter and receiver pipelines for NFDM, with FFT and matched filtering remaining conventional stages (Zhang et al., 2024). At the transmitter, FLIPNET-INFT maps $s(\lambda)=\sum_n c_n w_n(\lambda),$6 to a linear Fourier spectrum from which a time-domain burst can be synthesized by inverse FFT. At the receiver, FLIPNET-NFT maps the observed linear Fourier spectrum to an estimated nonlinear spectrum, after which deterministic propagation de-rotation and symbol recovery proceed. The principal limitations stated are equally specific: continuous spectrum only, no discrete eigenvalues, degradation of INFT accuracy at high power, omission of b-modulation, and the fact that the learned inverse outputs linear Fourier spectra rather than $s(\lambda)=\sum_n c_n w_n(\lambda),$7 directly.

5. FLIPNET-like intrusive neural enhancement in PIC/FLIP simulation

A distinct FLIPNET-like construction appears in fluid simulation, where a deconvolutional neural network is embedded intrusively inside a PIC/FLIP solver to enhance low-fidelity free-surface flows (Halder et al., 2021). The method targets the gap between low-fidelity coarse-grid PIC/FLIP simulations, which are fast but inaccurate, and high-fidelity simulations, which are accurate but too slow for real-time use. The network is trained on paired low- and high-fidelity data and is executed during each time step, after pressure projection on the coarse grid and before grid-to-particle transfer. Its output is a high-fidelity face-velocity field on a fine MAC grid, used immediately for particle velocity interpolation.

The underlying solver retains standard incompressible-flow structure:

$s(\lambda)=\sum_n c_n w_n(\lambda),$8

Pressure projection uses

$s(\lambda)=\sum_n c_n w_n(\lambda),$9

with a standard 7-point 3D finite-difference Poisson stencil, homogeneous Neumann boundary conditions at solid walls, and preconditioned conjugate gradients. The FLIP update is given as

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$00

evaluated at the particle, and the paper also gives the PIC/FLIP blend

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$01

The neural inputs are coarse-grid face velocities $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$02 after projection and a scaled per-cell particle occupancy

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$03

which encodes wet, dry, and partially filled cells. The output is a fine-grid velocity field $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$04. The architecture is a 3D CNN with an initial 3D convolution followed by $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$05 pairs of transposed-convolution upsampling and $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$06 standard 3D convolutions. The transposed convolutions use stride $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$07 and $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$08 kernels; the standard convolutions use $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$09 kernels with zero padding. Hidden layers use ELU activations and the output layer is linear. Training minimizes

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$10

The data-generation setup is unusually large (Halder et al., 2021). The test case is free-surface sloshing in a rectangular tank on the domain $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$11. The high-fidelity solver uses $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$12, giving a $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$13 grid with up to approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$14 million particles, $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$15, and $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$16. The low-fidelity solver uses $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$17, giving a $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$18 grid with approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$19 million particles and the same $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$20 and $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$21. The dataset contains approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$22 samples with a $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$23 train/validation/test split. Hyperparameter search spans $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$24, $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$25, $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$26, and Adam step size $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$27, with batch size $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$28 and $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$29 epochs. The best validation configuration is $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$30.

The reported outcome is a multi-fidelity solver that can reduce computational time by up to $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$31 relative to full high-fidelity PIC/FLIP while improving accuracy markedly over low-fidelity runs (Halder et al., 2021). The “fluid-match” metric improves clearly, especially during and after strong sloshing, and converges close to $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$32 as the fluid comes to rest. Generalization is strong across filling height and several solver parameters, but weaker for parameters that significantly change dynamics, notably PICness $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$33 and gravity magnitude $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$34. The paper also reports slightly compressible ML outputs and small surface oscillations, especially in a wet dambreak scene outside the training distribution. This motivates the explicitly stated limitations: stability still requires a time step equal to the high-fidelity solver’s stable $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$35, divergence penalties were not included, and cases such as dry beds, obstacles, or large parameter shifts may fail without broader training coverage.

6. FlipNet as a bit-flip attack paradigm, and its distinction from other “flip” methods

In model security, FlipNet denotes a broader attack paradigm in which malicious behavior is induced by flipping a limited number of stored weight bits in deployed neural networks (Bai et al., 2021). TA-LBF is placed squarely in this paradigm. It targets a specific sample $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$36, forcing the attacked model $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$37 to predict a chosen target class $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$38 after deployment, without modifying the input and without substantially degrading performance on other samples. The threat model assumes white-box access to the architecture, parameters, and parameter locations, the ability to flip arbitrary bits in memory by fault injection, and access to a small auxiliary validation set for stealthiness control.

The paper formulates the attack as a binary integer program over the two’s complement bit representation of the last-layer weights for the source and target classes. The targeted loss is

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$39

with $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$40, while stealthiness over an auxiliary validation set is controlled by

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$41

The complete problem minimizes $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$42 subject to binary feasibility and a flip-budget constraint $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$43, where the Hamming distance equals squared $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$44 distance because the variables are binary. The optimization is then reformulated with the $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$45-box trick and solved by ADMM using projections onto the box, sphere, and nonnegative slack constraints, together with a gradient step for the nonconvex network loss.

This is a concrete, deployment-stage use of “FlipNet” that has nothing to do with nonlinear Fourier transforms or PIC/FLIP simulation. Its empirical signature is similarly specific (Bai et al., 2021). On CIFAR-10, TA-LBF achieves $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$46 attack success rate with approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$47 flips on 8-bit ResNet-20 and approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$48 flips on 8-bit VGG-16. On ImageNet, it achieves $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$49 attack success rate with approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$50 flips on 8-bit ResNet-18 and only approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$51 accuracy degradation on non-target samples; on 8-bit VGG-16, it requires approximately $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$52 flips for $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$53 attack success. The paper emphasizes that optimization-driven bit selection outperforms heuristic methods because it enforces the flip budget and stealthiness constraints globally rather than greedily ranking bits.

Two further distinctions are important. First, FER is not FlipNet. FER addresses prediction flips across epochs through a training-time regularization framework that maintains an exponential, confidence-weighted moving average of past correct behaviors and applies a KL-based consistency term only to samples that have been correctly classified before (Deng et al., 2022). Its purpose is to reduce wrongly flipped samples on unseen data, not to define a separate architecture. Second, NetFlipPA is unrelated to any of the above. It is a spectral signflip procedure on normalized adjacency matrices, where a symmetric Rademacher sign matrix $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$54 is applied entrywise,

$Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$55

and the embedding dimension is selected by comparing eigenvalues of $Q(\lambda,z)=Q(\lambda,0)e^{-4i\lambda^2 z}.$56 to a high quantile of the largest eigenvalues from the signflipped replicates (Hong et al., 6 Sep 2025). The shared vocabulary of “flip” therefore masks fundamentally different objects: training regularization, spectral randomization, intrusive solver enhancement, nonlinear spectral transforms, and deployment-stage fault attacks.

In this sense, FLIPNET is best treated not as a universally fixed concept but as a context-dependent label. The most explicit architectural meaning in the supplied literature is the neural NFT/INFT model for fiber-optic communication (Zhang et al., 2024). Beyond that use, the term serves either as a descriptive analogue for intrusive PIC/FLIP enhancement (Halder et al., 2021) or as an umbrella label for limited-bit-flip attack methods (Bai et al., 2021), while some superficially similar “flip” methods are explicitly not FlipNet at all (Deng et al., 2022, Hong et al., 6 Sep 2025).