Physics Parameter Poisoning

• The literature defines physics parameter poisoning as the corruption or mis-specification of critical physical parameters, leading models to yield low-loss yet physically incorrect solutions.
• Stage-specific analyses reveal that detectability varies across methods, with different vulnerabilities observed in PINNs, 3D Gaussian Splatting, catalysis, and superconducting qubits.
• Robust defenses require internal parameter auditing and trusted measurement channels to certify system fidelity despite seemingly optimal training metrics.

Searching arXiv for the cited works on physics parameter poisoning and closely related poisoning in physics-informed or physical-system settings. Physics parameter poisoning denotes the corruption, misspecification, or unauthorized modification of parameters that encode physical laws, physical operating conditions, or physically grounded internal representations. Recent work uses the term in several related senses: wrong coefficients embedded in a physics-informed loss, physically meaningful latent parameters altered during reconstruction or deployment, poisoned measurements that implicitly encode plant behavior for control, and poisoning processes in physical systems themselves, such as sulfur adsorption on catalytic nanoclusters or quasiparticle generation in superconducting qubits (McShannon et al., 23 Jun 2026, Bui-Huynh et al., 2 Jun 2026, Shinohara et al., 18 Jun 2026, Monteiro et al., 20 Jan 2026, Larson et al., 10 Mar 2025). Across these settings, a recurring theme is that poisoning is often not an input-only phenomenon: it reshapes internal parameter spaces, training dynamics, or physically operative states, and its detectability depends on which representation is inspected.

1. Conceptual scope and domain structure

The literature does not use a single narrow definition. In physics-informed machine learning, the most explicit formulation is training-time parameter misspecification: the intended governing equation uses a parameter $\lambda$, but optimization is carried out with a corrupted value $\lambda'=\lambda(1+\delta)$, so the model can fit the wrong physics to low residual loss (McShannon et al., 23 Jun 2026). In 3D Gaussian Splatting, poisoning is defined more broadly as any unauthorized intervention that modifies the learned 3DGS representation, including direct modification of Gaussian attributes and indirect attacks that begin in images or geometry but manifest in learned Gaussian parameters (Bui-Huynh et al., 2 Jun 2026). In data-driven control, arbitrary poisoning of offline output data corrupts the behavioral surrogate from which the controller infers plant dynamics, so the attack targets the control-relevant representation of the plant rather than an explicit state-space parameter vector (Shinohara et al., 18 Jun 2026). In physical chemistry and quantum hardware, “poisoning” retains its classical materials or device meaning: sulfur binds strongly to catalytically relevant sites, and ionizing radiation produces offset-charge shifts and quasiparticle bursts that degrade qubit operation (Monteiro et al., 20 Jan 2026, Larson et al., 10 Mar 2025).

Setting	Poisoned object	Reported consequence
PINNs	PDE parameter in the residual loss	Low loss can coexist with wrong solutions
3DGS	Gaussian attributes, geometry, or training dynamics	Detectability is stage dependent
DeePC	Offline output data encoding plant behavior	Unprotected outputs are non-informative for worst-case guarantees
Nanoclusters	Catalytic sites under sulfur adsorption	Active sites are blocked or fundamentally altered
Superconducting qubits	Offset charge and quasiparticle density	Correlated errors spread across qubit arrays

A plausible unifying interpretation is that physics parameter poisoning concerns failures in which physically meaningful parameters cease to be trustworthy, whether because the parameter itself is wrong, because a learned surrogate internalizes corrupted physics, or because a physical subsystem enters a poisoned state. Under that reading, the common scientific problem is not merely attack success, but whether available diagnostics certify physical correctness, safe controllability, or faithful internal structure.

2. Parameter misspecification in physics-informed neural networks

The most explicit arXiv treatment of the phrase appears in "Silent Failures in Physics-Informed Neural Networks: Parameter Poisoning and the Limits of Loss-Based Validation" (McShannon et al., 23 Jun 2026). The paper studies boundary-value and initial-value problems of the form

$$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$

with a PINN approximation $\hat u$ trained by

$$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$

All terms are equally weighted, and the corruption mechanism is

$\lambda'=\lambda(1+\delta).$

The central claim is that low PINN training loss is not a reliable validation signal when the encoded PDE is wrong. A silent failure is defined by

$$\mathcal{L}(\lambda')<\tau_{\text{loss}} \quad\text{and}\quad \frac{\|\hat u_{\lambda'}-\hat u_{\lambda}\|_{L^2}}{\|\hat u_{\lambda}\|_{L^2}}>\tau_{\text{error}},$$

with $\tau_{\text{loss}}=0.01$ and $\tau_{\text{error}}=0.05$. The paper introduces the detection difficulty ratio

$$R= \frac{\|\hat u_{\lambda'}-\hat u_{\lambda}\|_{L^2}/\|\hat u_{\lambda}\|_{L^2}} {\mathcal{L}(\lambda')},$$

and also discusses a normalized alternative $\lambda'=\lambda(1+\delta)$0 because raw loss scales differ strongly across PDEs.

Empirically, the paper evaluates Burgers, lid-driven cavity flow, and convection–diffusion. The headline result is that poisoned models can match or beat clean-model training loss while producing materially wrong solutions. Across the three systems, solution deviations reach up to 71% in fixed sweeps and up to 128% under adversarial search (McShannon et al., 23 Jun 2026). The canonical case is the cavity at $\lambda'=\lambda(1+\delta)$1: when the Reynolds number is doubled to $\lambda'=\lambda(1+\delta)$2, the poisoned loss is $\lambda'=\lambda(1+\delta)$3, below the clean baseline $\lambda'=\lambda(1+\delta)$4, while the relative solution error is $\lambda'=\lambda(1+\delta)$5. The paper is explicit that this phenomenon does not require an adversary; ordinary misconfiguration, pipeline error, parameter drift, and sensitivity analysis fall under the same mechanism.

The work also tests six candidate defenses—residual monitoring against the intended PDE, same-parameter ensembles, parameter-jitter ensembles, inverse parameter recovery by optimization, incompressibility checking, and loss elevation relative to clean baseline—and reports that none reliably detects corruption across all regimes (McShannon et al., 23 Jun 2026). Its main post-hoc defense freezes the trained network and sweeps the residual over candidate parameter values,

$\lambda'=\lambda(1+\delta)$6

without retraining or external data. In the reported experiments, the loss minimum recovers the true training parameter across all three PDE systems, is bidirectional, and remains stable across five architectures ranging from 8.7K to 133K parameters (McShannon et al., 23 Jun 2026).

A common misconception is that a low PDE residual certifies physical accuracy. The paper’s evidence directly rejects that view: the optimizer can solve the wrong equation extremely well.

3. Stage-wise parameter poisoning in 3D Gaussian Splatting

"Characterizing Detectability in 3DGS Poisoning: A Stage-wise Benchmark" reframes poisoning in 3D Gaussian Splatting as a defender-centric problem centered on where poisoning becomes observable in the pipeline (Bui-Huynh et al., 2 Jun 2026). The 3DGS scene representation is

$\lambda'=\lambda(1+\delta)$7

where $\lambda'=\lambda(1+\delta)$8 is the center, $\lambda'=\lambda(1+\delta)$9 the covariance, $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$0 the opacity, and $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$1 the view-dependent color coefficients. Because 3DGS is a reconstruction pipeline rather than a feed-forward network with fixed weights, poisoning can appear at data level, geometry level, optimization level, or the final Gaussian parameter tensor.

The paper defines four stages: S1 Data, S2 3D Information, S3 Training Dynamics, and S4 Final Model. This stage structure is the paper’s core conceptual contribution. The attack injection stage is not necessarily the best detection stage. A perturbation introduced at S1 may be weak in pixel space yet amplified into abnormal Gaussian growth at S3 or S4; a post hoc modification injected at S4 leaves no evidence in earlier stages and can only be detected by inspecting the final Gaussian representation (Bui-Huynh et al., 2 Jun 2026).

The benchmark, Poison-3DGS, contains 37 clean scenes from Free, Mip-NeRF 360, and Tanks-and-Temples, and 414 poisoned variants spanning four attack families: StealthAttack, Poison-Splat, 3D-GSW, and GuardSplat (Bui-Huynh et al., 2 Jun 2026). For parameter poisoning in the strict sense, 3D-GSW and GuardSplat are the clearest cases because they modify a trained Gaussian representation while leaving raw data and SfM geometry clean. 3D-GSW changes color, opacity, rotation, and scale; GuardSplat concentrates changes in spherical harmonic coefficients.

Detection is unsupervised and stage-specific. At S3, the monitored quantity includes per-Gaussian update magnitudes such as

$$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$2

with $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$3. At S4, frozen Gaussian encoders embed the final Gaussian cloud and score anomaly by

$$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$4

The experimental takeaway is that no single stage dominates across attacks. For StealthAttack, the strongest detector is a GradNorm-style method at S3, reaching AUROC 0.780 with FPR@95 0.784. For Poison-Splat, S4 is best: Gaussian-MAE reaches AUROC 0.806 and FPR@95 0.486, while the best S1 AUROC is only 0.496. For 3D-GSW, SplatFormer reaches AUROC 0.689 at S4. GuardSplat remains difficult, with best AUROC only 0.488, near chance (Bui-Huynh et al., 2 Jun 2026).

The paper’s strongest lesson for physics-like latent models is that parameter poisoning is parameter-subspace dependent. Broad changes over geometry, density, scale, or opacity are more detectable than narrow modifications concentrated in spherical harmonic appearance coefficients. A plausible implication is that internal-parameter auditing must be attribute-aware rather than relying only on global embeddings.

4. Poisoning as a physical mechanism: catalysis and superconducting qubits

In nanocatalysis, "Interpretable, Physics-Informed Learning Reveals Sulfur Adsorption and Poisoning Mechanisms in 13-Atom Icosahedra Nanoclusters" treats poisoning as strong adsorption of sulfur-containing species on catalytically relevant sites, such that the adsorbate blocks or fundamentally alters those sites (Monteiro et al., 20 Jan 2026). The study spans 30 transition metals in $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$5 icosahedra using spin-polarized PBE-D3 DFT in VASP and interpretable machine learning. A central energetic decomposition is

$$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$6

which separates direct interaction from structural accommodation. For atomic sulfur, adsorption energies are all exothermic, ranging from about $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$7 for Hg to $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$8 for Mo, with most values in the $$\mathcal{N}[u;\lambda]=0 \text{ on } \Omega,\quad \mathcal{B}[u]=g \text{ on } \partial\Omega,\quad u(\cdot,0)=u_0,$$9 to $\hat u$0 range (Monteiro et al., 20 Jan 2026). Hollow sites are generally favored, with notable exceptions at W, where bridge is favored, and Ir, where top is favored. The paper concludes that sulfur poisoning is primarily an electronic bonding problem first and a structural accommodation problem second. It identifies Ti, Zr, and Hf as a balanced group combining strong sulfur binding with relatively small structural disruption.

In superconducting quantum hardware, "Quasiparticle poisoning of superconducting qubits with active gamma irradiation" studies poisoning induced by controlled $\hat u$1 irradiation (Larson et al., 10 Mar 2025). A $\hat u$2-ray impact deposits on average about 190 keV in the silicon substrate, generating both an $\hat u$3 cloud and high-energy phonons above the pair-breaking threshold $\hat u$4. The paper distinguishes charge poisoning, which shifts local offset charge $\hat u$5, from quasiparticle poisoning, in which pair-breaking phonons create excess quasiparticles and raise parity-switching rates. Charge poisoning is local: the average radius of the $\hat u$6 contour is about 1060 $\hat u$7. Quasiparticle poisoning is much less local. On the chip without Cu mitigation, charge-triggered poisoning probabilities across six qubits range from 0.72 to 1.00; with a 1-$\hat u$8m Cu backside island array, the corresponding probabilities become 0.18, 0.20, 0.47, 0.20, 0.99, and 0.20 (Larson et al., 10 Mar 2025). The Cu structure lowers $\hat u$9 by about an order of magnitude and contracts the poisoning footprint from essentially chip-wide to a few-millimeter region.

These two literatures differ from ML parameter poisoning, but they clarify that “poisoning” in physics often means a change in the effective physical parameters governing operation: catalytic site availability, local bonding environment, quasiparticle density, offset charge, or correlated error footprint.

5. Poisoned data as poisoned plant behavior in data-driven control

"Data-Driven Control from Poisoned Data: Fundamental Limitations and Secure DeePC" studies an unknown discrete-time LTI system

$$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$0

in a setting where offline input data are protected but a subset of offline output channels is stored in unprotected locations and may be arbitrarily poisoned (Shinohara et al., 18 Jun 2026). The attack acts on measurements rather than on explicit state-space coefficients, yet in DeePC those measurements determine the control-relevant behavioral model. Under that view, poisoning the dataset is effectively poisoning the inferred plant representation.

The paper’s first contribution is a sequence of impossibility results. If at least one offline output channel is unprotected, poisoning cannot be certifiedly detected or identified from the dataset alone. More strongly, if $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$1 denotes the protected subset of the data and $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$2 the full poisoned dataset, then the consistency classes satisfy

$$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$3

so the unprotected outputs are non-informative for controller design with worst-case guarantees (Shinohara et al., 18 Jun 2026). The paper also proves that hard constraints on unprotected outputs are not certifiable under arbitrary poisoning. The design implication is explicit: any output entering a hard safety constraint should be protected.

The positive result is Secure DeePC. The algorithm first runs output-truncated DeePC using only protected outputs and a small exploratory dither until the online input becomes persistently exciting; it then uses trusted online measurements to reconstruct the clean offline unprotected outputs and finally returns to full-output DeePC (Shinohara et al., 18 Jun 2026). Under controllability, observability of the protected outputs, $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$4, a PE condition, and feasibility assumptions, Secure DeePC achieves MPC-equivalent performance in finite time almost surely.

The experiments use a linearized inverted pendulum with

$$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$5

sampled at $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$6 s, with the third output channel unprotected and poisoned by $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$7, $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$8 (Shinohara et al., 18 Jun 2026). Regularized DeePC diverges in all trials, output-truncated DeePC violates the unprotected-output constraint, and Secure DeePC recovers full tracking and post-switch constraint satisfaction. This is not a generic robustification result; it is a structured recovery result that depends on trusted online data and protected observability.

6. Detection, certification, and transferable methodological lessons

Several adjacent works do not study physics systems directly, but they sharpen the methodological picture of parameter poisoning. "Certified Robustness to Data Poisoning in Gradient-Based Training" develops Abstract Gradient Training (AGT), which over-approximates all poisoned training trajectories by a reachable parameter interval $$\mathcal{L}= \frac{1}{N_r}\sum_{i=1}^{N_r}|\mathcal{N}[\hat u;\lambda](x_i)|^2 +\frac{1}{N_b}\sum_{j=1}^{N_b}|\mathcal{B}[\hat u](x_j)-g_j|^2 +\frac{1}{N_0}\sum_{k=1}^{N_0}|\hat u(x_k,0)-u_{0,k}|^2.$$9 and then certifies worst-case behavior over that set (Sosnin et al., 2024). The key theorem reduces poisoning certification to optimization over reachable parameters rather than over poisoned datasets. For physics-oriented learning, this suggests a formal route from poisoned observations to certified bounds on learned physical or surrogate parameters.

Two model-inspection papers highlight how poisoning may appear in internal state space rather than in obvious weight histograms. In "Measuring Impacts of Poisoning on Model Parameters and Neuron Activations: A Case Study of Poisoning CodeBERT", attention weights and biases show no significant differences between clean and poisoned models, while activation values and [CLS] embeddings exhibit strong poisoning signatures, especially in upper layers and in trigger-specific embedding clusters (Hussain et al., 2024). In "Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning", PEFT is reported to be more susceptible than full fine-tuning, and the PSIM detector exploits abnormally high confidence on triggered inputs after training with randomly reset labels (Zhao et al., 2024). These are not physics papers, but they suggest that poisoning may be easier to detect in latent trajectories, layerwise activations, or restricted-parameter adaptation regimes than in raw parameter marginals.

Taken together, the current literature supports several broad conclusions. First, parameter poisoning need not be adversarial; misconfiguration and misspecification can be sufficient (McShannon et al., 23 Jun 2026). Second, low training loss or good rendering fidelity is not a trustworthy certificate when the internal physics or parameterization is wrong (McShannon et al., 23 Jun 2026, Bui-Huynh et al., 2 Jun 2026). Third, detectability is representation-dependent: the decisive signal may reside in gradient dynamics, Gaussian population statistics, protected behavioral trajectories, vibrational descriptors, or parity-switching footprints rather than in raw inputs or outputs alone (Bui-Huynh et al., 2 Jun 2026, Shinohara et al., 18 Jun 2026, Monteiro et al., 20 Jan 2026, Larson et al., 10 Mar 2025). Fourth, channel specificity matters. Broad perturbations over geometry, density, or multiple Gaussian attributes are more detectable than narrowly targeted appearance-channel changes; similarly, protected outputs that are not state-informative are insufficient for recovery (Bui-Huynh et al., 2 Jun 2026, Shinohara et al., 18 Jun 2026).

A plausible implication is that future work on physics parameter poisoning will be most effective when it treats physically meaningful parameter groups as first-class forensic objects. In the present literature, the dominant failure mode is not simply “bad data in, bad prediction out,” but corrupted internal physics that remains superficially well validated until the relevant parameter space is explicitly audited.