Generating adversarial inputs for a graph neural network model of AC power flow

Researchers have demonstrated a method to generate adversarial inputs that cause a graph neural network model of AC power flow to produce large prediction errors, raising concerns about the reliability of machine-learning surrogates for power grid operations [1]. The work, led by Robert Parker, formulates and solves optimization problems to identify input points that maximize the discrepancy between a neural network's predicted power flow solution and the true solution derived from AC power flow equations [1][2]. The team tested the approach on an instance of the CANOS-PF graph neural network model, implemented using the PFΔ benchmark library, operating on a 14-bus test grid [2]. The generated adversarial points produced errors as large as 3.7 per-unit in reactive power and 0.08 per-unit in voltage magnitude [2]. The researchers also found that the constraints necessary to trigger these errors could be satisfied with a perturbation as small as 0.04 per-unit in voltage magnitude applied to a single bus [2]. Neural network surrogate models are increasingly explored for accelerating power system analysis, where solving the full AC power flow equations is computationally intensive. The findings underscore a vulnerability: small, carefully crafted changes to input data can lead to significant inaccuracies in model outputs. The paper explicitly states that this work motivates the development of rigorous verification and robust training methods for such surrogate models [2]. While the study focuses on a specific model and a small test grid, the broader field of AI-driven design automation has seen machine learning applied to complex physical systems where verification is critical [3]. The concept of adversarial examples—inputs designed to fool a model—has been studied extensively in other domains, such as image classification, but its application to physics-informed neural networks for critical infrastructure remains an active area of investigation. The paper's submission history shows it was first posted in February 2026 and revised in June 2026 [1].