Physical Response Attack: Exposing Hidden Response Discrepancies in Neural Operators

Neural operators have emerged as efficient surrogates for numerical PDE solvers. However, a reliable neural operator should not only achieve low prediction error, but also preserve the response characteristics dictated by the underlying physical equations. Existing robustness evaluations are largely model-centric and focus on how perturbations affect the model output, while overlooking whether the learned operator responds consistently with the true physical system. To address this gap, we propose Physical Response Attack (PRA), a fully black-box framework that exploits the physical response structure of the governing PDE. Using only forward queries to a reference numerical solver, PRA identifies physically informative per- turbation directions and constructs a compact search subspace, within which it searches for perturbations that maximize the response discrepancy between the neural operator and the solver. PRA requires no access to model parameters, gra- dients, or internal architecture; it does not require a differentiable solver and per- forms no backpropagation through either system. We evaluate PRA on the Poisson equation, Darcy flow, and two-dimensional Navier–Stokes equations across four representative neural operator architectures. Experimental results show that PRA effectively reveals failure directions tied to the underlying physical structure; in particular, for time-dependent systems, PRA can induce pronounced deviations in predicted dynamical trajectories. These results demonstrate that the reliability of neural operators should not be determined by prediction accuracy alone; they must also faithfully reproduce the local response and dynamical behavior dictated by the governing equations.