Finding one adversarial input that breaks one surrogate model is a demonstration. Finding a formula or strategy that reliably reproduces that failure — across different initial conditions, and ideally across different simulators entirely — is a result. This goal pushes past one-off adversarial examples toward a general characterization of why a class of surrogate models fails, not just a single instance of it failing.
A one-off attack answers: "does this specific input break this specific model?" A generalizable attack strategy answers a stronger question: "given the structure of this class of problem (e.g. a sharp discontinuity, a boundary-layer effect, a rare combination of physical parameters), can the agent derive a rule for constructing inputs that break any model trained on this class?" The latter is far more useful — it tells you something about the surrogate modeling approach itself, not just about one trained checkpoint.
After the agent identifies individual high-error inputs (Goal 2), we test whether it can abstract from those examples to a general hypothesis — for instance, a parametric family of inputs, or a rule tied to the underlying physics (e.g. "error spikes whenever the input places the system near a phase boundary the training distribution under-sampled") — and then validate that hypothesis by generating new attacks from the rule and confirming they transfer across simulators and across independently trained surrogate models.