Source-linked AI summary
Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective
Marco Antonio Corallo, Andrea Agiollo, Mauro Conti, Alberto Giaretta
TL;DR
Neuro-symbolic models are often considered trustworthy, but their robustness under deliberately manipulated training remains underexplored. This paper evaluates DeepProbLog against neural baselines across backdoor settings and reasoning tasks, finding that symbolic reasoning mitigates attacks when targets conflict with enforced logic but offers limited protection otherwise.
Problem
Neuro-symbolic models' adversarial robustness, particularly under backdoor attacks, remains underexplored despite claims that symbolic integration improves trustworthiness.
Method
The paper systematically compares DeepProbLog with neural counterparts across eight backdoor settings and four reasoning tasks, analyzing target reachability.
Results
NeSy robustness depends on target compatibility with symbolic reasoning: logically inconsistent targeted outputs can be rejected, while untargeted attacks generally remain highly successful.
Takeaways & Limitations
Robustness comes from symbolic inference blocking malicious representations from producing logically inconsistent outputs, not from preventing the neural encoder from learning triggers.
Takeaways & Limitations
The experiments are restricted to one-input reasoning tasks, and the threat model allows poisoning only final task labels rather than intermediate concepts.
Abstract
from arXiv · showhide
Neuro-Symbolic (NeSy) AI has recently emerged as a novel paradigm to enable trustworthy AI, aiming at integrating sub-symbolic neural perception with grounded symbolic reasoning. The neuro-symbolic integration process that characterizes these models has been proven beneficial to achieve more transparent, explainable and efficient AI systems. Meanwhile, their properties under adversarial settings have been overlooked being frequently deemed robust-by-design. However, the neural-symbolic integration process they leverage constitutes an additional layer of complexity that may provide an attack entry-point. Therefore, in this paper, we claim that an in-depth investigation of the adversarial robustness of NeSy models is necessary and provide the first systematic evaluation of backdoor attacks against NeSy. To this end, we compare the most popular NeSy framework, namely DeepProbLog, against baseline neural networks across a total of eight backdoor settings and four reasoning tasks. Our experimental results show that while NeSy models are indeed more robust than their neural counterpart on average, their robustness vastly depend on the strictness of the reasoning process being enforced and its compatibility with the chosen adversarial target. The source code to reproduce our experiments is made available at https://github.com/marcoantoniocorallo/NeSy-Backdoor.
1 Introduction
Neuro-symbolic AI combines neural perception with symbolic knowledge and reasoning, but its adversarial robustness remains underexplored. This paper systematically evaluates backdoor attacks against NeSy models and identifies when symbolic reasoning mitigates them.
- Motivation: Neural networks offer strong task performance but remain data-hungry, opaque, and susceptible to adversarial manipulation.These limitations hinder deployment in safety-critical domains requiring control over decisions.
- Motivation: Neuro-symbolic AI combines neural representation learning and perception with structured knowledge and symbolic reasoning.The paradigm aims to address limitations associated with unconstrained neural predictors.
- Motivation: NeSy architectures incorporate symbolic knowledge through logical constraints, differentiable reasoning, or semantic regularization, supporting interpretability, data efficiency, and domain consistency.Their desirable properties are associated with symbolic constraints restricting admissible outputs.
- Adversarial gap: Adversarial robustness cannot be inferred from robustness to natural uncertainty because attackers can exploit the neural–symbolic interface and reasoning shortcuts.A model may preserve symbolic consistency while relying on incorrect concepts.
- Research question: The paper asks whether symbolic integration inherently resists adversarial attacks or instead changes how attacks affect NeSy models.It focuses on the limited evidence about symbolic components under deliberately manipulated training.
- Results: NeSy robustness depends on the interaction between learned triggers and symbolic reasoning: reasoning can block logically inconsistent targeted outputs but offers limited protection against untargeted disruption.The paper formalizes this relationship through target reachability and finds that symbolic reasoning does not prevent poisoned perceptual representations from being learned.
- Contribution: The study provides the first systematic NeSy backdoor analysis, comparing NeSy with neural counterparts across eight backdoor settings and four reasoning tasks.The work also identifies conditions under which symbolic knowledge improves resistance and characterizes relative failure modes.
2 Background
Neuro-symbolic systems combine neural concept extraction with symbolic inference, while backdoor attacks implant attacker-controlled behavior through poisoned training data. Their operation can be understood through the interaction of neural predictions, symbolic programs, and attack objectives.
- Neuro-symbolic systems: Neuro-symbolic AI combines neural perceptual representations with symbolic interpretability, explicit knowledge representation, and logical inference.NeSy frameworks differ in how they represent knowledge, combine learning and reasoning, and define semantics.
- Neuro-symbolic systems: Concept-based NeSy models extract task-relevant intermediate concepts from raw inputs and combine them with domain knowledge to solve tasks.For example, neural digit recognition can feed symbolic arithmetic rules.
- DeepProbLog: DeepProbLog extends ProbLog with neural predicates whose outputs parameterize selected predicates while preserving probabilistic logic semantics.It computes query probabilities over possible worlds induced by probabilistic choices.
- DeepProbLog: DeepProbLog grounds relevant programs, evaluates neural predicates, and compiles formulas into tractable arithmetic circuits for differentiable query-level training.Gradients are propagated through probabilistic inference.
- Backdoor attacks: Backdoor attacks implant hidden attacker-defined behavior while preserving benign performance, typically by poisoning a subset of training data.Triggered inputs produce attacker-selected outputs while clean inputs retain normal behavior.
- Backdoor attacks: Dirty-label attacks alter poisoned labels, whereas clean-label attacks retain original labels and require learning without explicit input-label inconsistency.These are distinct poisoning strategies within the broader backdoor setting.
- Backdoor attacks: Backdoor triggers include visible patches, blended patterns, semantic or hidden triggers, frequency perturbations, and input-dependent designs.These designs trade off effectiveness, stealthiness, and robustness to defenses.
3 Related Work
Related work shows that logical consistency and task-specific symbolic defenses do not establish that existing NeSy architectures are robust by design. This paper addresses the experimental gap concerning adaptive adversarial backdoors.
- Trustworthiness limits: Reasoning shortcuts show that a model can satisfy available knowledge without guaranteeing trustworthy predictions.Logical consistency alone is therefore insufficient as a trustworthiness guarantee.
- Non-adversarial robustness: Prior work studies NeSy robustness under distribution shifts, concept ambiguity, and bounded perturbations rather than adaptive adversarial backdoors.Those settings address naturally occurring failures and verification under bounded changes.
- Threat models: Framework-level evaluation principles and threat models identify neural, symbolic, reasoning, orchestration, and data layers as potential attack surfaces.They do not experimentally determine how established NeSy frameworks behave under backdoor attacks.
- Task-specific defenses: Task-specific NeSy systems demonstrate robustness supported by symbolic knowledge, but their logic and training procedures were constructed as defenses for particular tasks.These results do not establish that existing NeSy architectures are robust by design.
4 Threat Model
The threat model uses a dirty-label training-time attacker who can poison data but cannot alter training, model architecture, parameters, context, or symbolic programs. Attacks influence reasoning indirectly by changing neural concept predictions.
- Attacker capabilities: The attacker modifies a fraction of training samples but cannot control subsequent training or access the victim architecture and parameters.This models a malicious data provider under a dirty-label poisoning setting.
- System model: The evaluated tasks use a neural component to extract concepts from raw inputs and a fixed symbolic program to produce outputs, optionally using clean context.This defines the concept-based NeSy prediction pipeline.
- Attack constraints: The attacker can poison the image and task label but cannot modify clean context, the symbolic program, or the learning algorithm.Only the input image is altered, while contextual information and symbolic theory remain unchanged.
- Attack constraints: Because context and symbolic programs remain fixed, attacks influence symbolic reasoning only indirectly through concepts predicted from triggered images.Changing both the input and context would collapse the task into a trivial neural backdoor.
- Attack objectives: Targeted attacks map all poisoned examples to an attacker-selected label, whereas untargeted attacks map each output to a different valid output.The formulation accommodates both single-label and structured-output tasks.
- Attack objectives: A successful backdoor must preserve benign predictive performance while inducing the malicious output on triggered inputs.For NeSy models, the trigger must alter predicted concepts so the unchanged symbolic program produces the desired output.
5 Methodology
The methodology compares DeepProbLog with a matched neural counterpart across four reasoning tasks and four backdoor attacks. It measures clean utility and attack success while analyzing whether symbolic reasoning makes attacker-selected targets reachable.
- Experimental comparison: DeepProbLog and its neural counterpart share the visual encoder, inputs, data partitions, and optimization process, differing only in output mapping.The neural model uses a classification head, whereas DPL predicts intermediate concepts and applies a probabilistic logic program.
- Reasoning tasks: The evaluation covers four reasoning tasks spanning arithmetic, contextual FashionMNIST reasoning, and autonomous-driving reasoning over SDDOIA.The tasks vary in concept spaces, contextual information, output structure, and symbolic constraints.
- MNIST addition and multiplication: MNIST addition and multiplication combine a recognized digit z with symbolic context c through y = z + c or y = z · c.Both tasks use a single visual operand and impose stringent symbolic mappings.
- FashionMNIST contextual reasoning: FashionMNIST binding predicts a clothing class from an image and contextual item while enforcing season and body-part compatibility rules.The neural component predicts the image class, and the symbolic program determines contextual compatibility.
- SDDOIA autonomous driving: SDDOIA derives multi-label actions from 21 binary visual concepts under rules such as the incompatibility between moving forward and stopping.Its symbolic theory is more complex but less stringent because no a-priori context is provided.
- Backdoor protocol: Four trigger mechanisms, including BadNet patches and WaNet geometric warping, are tested in targeted and untargeted settings with unchanged context and symbolic programs.A successful DPL attack must alter predicted concepts so the unchanged reasoning process produces the malicious output.
- Metrics and reachability: Clean accuracy and F1-scores measure benign utility, while ASR is computed only on samples initially classified correctly before trigger insertion.Targeted analysis evaluates multiple labels and quantifies target reachability through the symbolic program.
6 Experimental Results
Across targeted tasks, DeepProbLog generally reduces backdoor success relative to neural baselines when targets conflict with symbolic constraints, but protection weakens for logically reachable targets and untargeted attacks.
- Targeted Attacks: Targeted attacks generally succeed on neural baselines, whereas DeepProbLog consistently reduces ASR for most target labels without reducing clean accuracy.In MNIST Addition, DPL ASR reaches at most 0.101; in Multiplication, robustness varies sharply by target.
- MNIST Addition and Multiplication: In MNIST Multiplication, DPL resists prime target 13 but remains vulnerable to target 0, the absorbing element of multiplication.The target 13 is logically unsatisfiable, while any operand multiplied by a triggered sample targeted as 0 can produce a valid output.
- FashionMNIST Binding: FashionMNIST Binding remains challenging: DPL improves robustness unevenly, while Bag and Trouser attacks retain ASR_t ≥0.8.These labels are compatible with 9 of 10 context cases, giving them higher target reachability.
- Autonomous Driving: In autonomous driving, DPL completely suppresses the Forward + Stop attack but offers limited rejection of legitimate action targets compatible with the symbolic knowledge.Forward + Stop is logically unsatisfiable; other targets remain effectively learnable after perceptual manipulation.
- Untargeted Attacks: Untargeted attacks remain highly successful on most tasks, showing that reasoning provides generally limited protection when the attacker only needs any incorrect prediction.The main exception is MNIST Multiplication, where DPL is substantially more robust than the neural baseline.
7 Analyzing NeSy Backdoor Feasibility
The analysis shows that DPL can learn malicious triggers, while symbolic reasoning limits their propagation according to target reachability and logical compatibility. Attacks remain effective when targets are reachable or when untargeted attacks need only produce any incorrect prediction.
- Trigger representations: DPL learns a dedicated trigger representation even at poison ratio ρ=0.01, so symbolic reasoning does not prevent trigger learning.As poisoning increases, the trigger cluster becomes more compact and separated.
- Untargeted attacks: Confusion matrices for untargeted addition attacks show predictions shifting by one position while preserving the underlying sum logic.This illustrates how an attack can produce logically consistent but incorrect outputs.
- Target reachability: The reachability metric R(y_t) is a training-free, attack-agnostic upper bound on target attack success: ASR(y_t) ≤ R(y_t).It represents the largest fraction of inputs that a fixed trigger can redirect to target y_t.
- Target reachability: Observed ASR closely follows target reachability, including multiplication target y_t=0 with R(y_t)=1 and ASR_t=0.766, versus target y_t=13 with both values equal to 0.Reachability therefore predicts target-dependent attack feasibility before deployment.
- Context compatibility: In FashionMNIST binding, ASR reaches 0.99–1 for compatible t-shirt or bag contexts and drops exactly to zero for incompatible target-context pairs.The symbolic compatibility rules act as a sharp gate on backdoor propagation.
8 Limitations and Future Work
The paper presents a first analysis of NeSy backdoor robustness but leaves broader threat models and multi-input settings for future work.
- Scope boundary: The experiments cover only one-input reasoning tasks, leaving jointly manipulated multiple perceptual elements outside the evaluated scope.Many NeSy problems involve multiple perceptual elements that may be jointly manipulated.
- Threat model: The threat model permits poisoning only final task labels, not intermediate concepts.A stronger grey-box attacker could poison concept-level and task-level supervision.
- Future work: Trusted contextual constraints and protections for concept learning are identified as promising directions for improving targeted-attack robustness.The paper suggests these directions because logically reachable outputs may be reduced or the reasoning layer bypassed through malicious concepts.
9 Conclusions
The paper evaluates targeted and untargeted backdoors in NeSy models and finds that robustness depends on task logic. Symbolic inference, rather than a more resilient neural encoder, blocks propagation to logically inconsistent outputs.
- Conclusions: The evaluation covers targeted and untargeted backdoor attacks across four reasoning tasks.This provides the paper’s experimental scope for assessing NeSy robustness.
- Conclusions: Incompatible targets can be rejected by the symbolic layer, whereas satisfiable targets remain vulnerable.The robustness advantage therefore depends strongly on the task logic.
- Conclusions: Robustness arises from symbolic inference preventing malicious representations from propagating to logically inconsistent outputs, not from a more resilient neural encoder.The neural encoder still learns the trigger.
A.1 Experimental Details
The appendix identifies the experimental hyperparameters, reproducibility details, poisoning-ratio ablation, and WaNet ablation settings used in the study.
- Experimental details: Table 8 reports the hyperparameters and reproducibility details for the experiments.These details document the experimental configuration.
- Ablations: The poisoning-ratio ablation is reported in Table 9.This isolates experimental behavior across poisoning ratios.
- Ablations: Table 10 reports the WaNet ablation over grid size and warp strength.These are the two varied WaNet settings identified in the appendix.
A.2 Ablation Study
The ablation study reports selected attack-parameter analyses and clean NN/DPL performance across four learning tasks, including an autonomous-driving logic constraint that makes one target unsatisfiable.
- A.2 Ablation Study: Attack ablations select poisoning-ratio and WaNet parameters using a validation set formed from 20% of the training data.The selected configurations are marked with a star in Tables 9 and 10.
- A.2 Ablation Study: Table 11 reports clean accuracies and F1-scores for NN and DPL models across four learning tasks.The supplied passage identifies the metrics and model comparison but does not provide their numerical values.
- A.2 Ablation Study: In autonomous driving, sharing one FS concept block makes the target label Forward + Stop unsatisfiable.The stated logic rule links the move_forward and stop actions to this unsatisfiability condition.
A.5 FTrojan on MNIST Tasks
This section reports FTrojan performance on MNIST digit classification, Addition, and Multiplication, while the work uses public benchmark data in controlled settings and acknowledges possible misuse.
- A.5 FTrojan on MNIST Tasks: FTrojan performance is reported for MNIST digit classification, Addition, and Multiplication in Table 12.The supplied passages identify the evaluated tasks but do not provide numerical results.
- A.5 FTrojan on MNIST Tasks: The study uses publicly available benchmark datasets and excludes personal, sensitive, and user-generated data.Experiments are conducted in controlled research settings.
- A.5 FTrojan on MNIST Tasks: The disclosed attack configurations could be misused to compromise learning systems and should be applied only to authorized models and datasets.The statement frames disclosure as supporting reproducibility and countermeasure development while preserving an authorization boundary.