PaperlayerView exact revision on arXiv

Source-linked AI summary

Attack logics, not outputs: Concept-based Property Attacks for Shortcut Elimination in Neural Networks

Raik Dankworth, Felix Mächtle, Thomas Eisenbarth, Gesina Schwalbe

arXiv:2610.34923v2cs.CRcs.LG

TL;DR

Existing adversarial attacks target changes in final-class outputs, leaving logical inconsistencies in concept-level reasoning untested. ConPAtt instead searches for perturbations that falsify concept-based properties; experiments report competitive robustness and improved semantic-bias correction, with instability for some model and dataset configurations.

  • Problem

    Existing adversarial attacks focus on changing final-class outputs rather than testing whether predictions violate interpretable concept-level properties.

    Source: §1 · p. 2

  • Method

    ConPAtt searches for minimal input perturbations that falsify symbolic properties over concepts, using post-hoc concept outputs to extend classical attack goals.

    Source: §1 · p. 2, §3 · p. 4, §4.1 · p. 5

  • Results

    Across vision and language models, ConPAtt retraining achieves competitive robustness and improved semantic-bias correction; in the biased setting, R↓ outperforms PGD, and R↓ achieves mostly competitive F1 scores on unseen PGD examples.

    Source: §1 · p. 2, §5.2 · p. 8, §6 · p. 9

  • Takeaways & Limitations

    Concept-level falsification can expose semantically inconsistent, high-confidence predictions that standard output-focused attacks miss.

    Source: §1 · p. 2

    Some ConPAtt retraining runs do not converge, with increased variance particularly for VGG-16 on MNIST.

    Source: §5.2 · p. 7, §6 · p. 9

Abstract

from arXiv · show

Deep neural networks (NNs) for computer vision are vulnerable to adversarial attacks, such that minuscule malicious changes to inputs may induce unintuitive outputs. One key approach to verify and mitigate such robustness issues is to falsify expected output behavior, which enables local robustness guarantees and adversarial training. Due to the black-box nature of NNs, current attacks only falsify a class of the final output, such as flipping from $\text{stop_sign}$ to $\neg \text{stop_sign}$. In this work we argue that robustness analysis should focus more generally on logical inconsistencies in concept-level reasoning rather than solely on output misclassification. We formalize this perspective through concept-based properties, i.e., constraints over human-interpretable concepts such as $\text{red} \land \text{octogonal} \implies \text{stop_sign}$ and study the falsification of such properties as a principled form of adversarial attack. Furthermore, an implementation of concept-based properties on already trained NNs is proposed using techniques from concept-based explainable artificial intelligence (C-XAI). For that we formally prove that attacks on concept-based properties are expected to have a reduced search space compared to simple class falsification, whilst arguably be more aligned with intuitive robustness targets. The practical effectiveness of our approach for logically informed adversarial training is shown in an empirical study across multiple models and datasets, including both vision and a security-relevant code processing task. Our results demonstrate that concept-level falsification generalizes classical adversarial attacks: Retraining on our novel attacks maintains robustness gains as compared to classical adversarial retraining whilst better eliminating semantic biases.

1 Introduction

The introduction argues that output-only adversarial attacks miss logical inconsistencies in concept-level reasoning. It proposes ConPAtt, an attack objective that falsifies concept-based properties and can reveal semantically inconsistent predictions while retaining the predicted class.

1 Introduction

  • Existing attacks alter final outputs but do not test whether predictions conform to interpretable properties such as red and octagonal implying stop-sign.Such properties constrain local logical reasoning, rather than requiring the local output itself to be correct.Source: §1 · p. 2
  • Post-hoc concept explainability can recover concepts already encoded in hidden representations with relatively little data and minimal structural additions.This avoids requiring concept outputs during original training, when data, tuning, or known specifications may be unavailable.Source: §1 · p. 2
  • ConPAtt targets concept-based properties rather than only NN outputs, and its attacks can expose semantic inconsistencies invisible to standard attacks.The paper reports competitive robustness gains under adversarial retraining and improved semantic-bias correction in vision and language models.Source: §1 · p. 2

2 Related Work

The related work spans adversarial attacks, concept-based explainability, and verification. The paper positions its contribution as attacking relationships between concepts and model outputs on non-symbolic inputs.

Adversarial Attacks and Verification

  • Scenic and VerifAI use formal specifications for simulation-based scenarios with symbolic inputs, while this approach targets adversarial attacks on non-symbolic image inputs.The paper notes that this difference prevents direct use of those tools.Source: §2 · pp. 2–3

Concept-based Explainability

  • Post-hoc concept methods train a simple predictor from a hidden-layer activation to a concept; linear models trade off interpretability, representation entanglement, and simplicity.The paper distinguishes these methods from ante-hoc approaches that train concept-associated neurons when labeled concept samples are available.Source: §2 · p. 3

XAI and Verification

  • Prior attacks on concepts generally study concept vulnerabilities in isolation, whereas this work targets their joint relation to model predictions.The related work describes that relationship as having received little attention.Source: §2 · p. 3
  • Earlier verification approaches either use vision-language similarity, output-layer specifications, or semantic losses, with limitations including ambiguity, layer dependence, or reliance on direct concept outputs.The paper instead uses explainability techniques to access concepts while keeping training and verification effort low.Source: §2 · p. 3

3 Background

The background defines adversarial attacks as minimal input perturbations that induce sufficiently different outputs, then introduces post-hoc concept extraction to augment a trained network with concept predictions.

Adversarial Attacks

  • An adversarial attack seeks a minimally perturbed input whose model output enters a malicious set distinct from the benign set.The perturbation objective commonly uses an L1, L2, or L-infinity input norm for digital attacks.Source: §3 · p. 3
  • The classification setting distinguishes targeted from untargeted attacks by how the malicious output set is defined.The satisfaction relation indicates whether an instance is assigned a specified class.Source: §3 · p. 3

Post-hoc Concept Extraction

  • Post-hoc concept extraction attaches a linear concept classifier to a hidden layer, trains its new weights on concept-labeled examples, and keeps the original network weights fixed.The resulting concept predictions augment the task outputs in a combined output set.Source: §3 · p. 4, Figure 1 · p. 4

t-Norm Fuzzy Logic

  • Fuzzy t-norm logic extends Boolean connectives to confidence values in [0, 1], allowing logical-expression confidence to be propagated from network outputs.Its piecewise differentiability supports use in backpropagation and gradient-based attacks.Source: §3 · p. 4

4 Approach

The approach defines attacks that falsify logical properties over concept and task outputs, then shows that classical attacks are special cases and that the generalized attacks have no larger task-output search spaces.

4 Approach

  • The approach chapter first defines concept-based attacks, then establishes the classical special case and adaptation of existing attack techniques.Source: §4 · p. 4

4.1 Concept-based Property Attacks

  • The approach frames classical attacks as property attacks and permits higher-order conditions, such as requiring simultaneous predictions of multiple classes.The attacked property is the logical negation of the condition being enforced.Source: §4.1 · p. 4
  • A concept-based property links conjunctive concept literals in an antecedent to disjunctive task literals in its consequent, and ConPAtt seeks a minimal perturbation that falsifies it.The implication-based representation is notational and does not restrict expressiveness.Source: §4.1 · p. 5
  • Falsifying an implication can result from a concept predicted true when it should be false, a task literal predicted negative when it should be positive, or both.For example, changing a red sign to gray may leave the red concept predicted true.Source: §4.1 · p. 5

4.2 ConPAtts as Generalized Adversarial Attacks

  • Standard targeted and untargeted attacks are special cases of ConPAtt when the property uses only a task literal and no concept restriction.The generalized forms express untargeted and targeted attacks as α implies l and α implies not l, respectively.Source: §4.2 · p. 5
  • Theorem 4.5 states that generalized targeted and untargeted attacks have task-output spaces no larger than their standard counterparts.For generalized untargeted attacks, an adversarial output must both satisfy the concept condition and lack the specified class prediction.Source: §4.2 · pp. 5–6
  • ConPAtt adapts existing attack methods by optimizing a fuzzy-logic property evaluation over the task and concept predictions toward false.This uses the property evaluation in place of the network output as the attack target.Source: §4.2 · p. 6

5 Evaluation

The evaluation tests whether concept-based attacks support competitive adversarial retraining and reduce semantic bias across vision and code-understanding tasks. Vision experiments assess clean-data generalization, robustness to PGD examples, and rule satisfaction; the code study extends the framework to vulnerability classification.

5.1 Experimental Setup

  • Vision experiments use MNIST, GTSRB, and a biased GTSRB variant across convolutional, residual, and transformer models, with linear probes for task-specific concepts.MNIST concepts are geometric primitives; GTSRB concepts cover shape, colour, and symbol categories.Source: §5.1 · p. 6
  • The experiments compare PGD with rule-compliance-decreasing R↓ and rule-compliance-increasing R↑, retraining on clean/adversarial mixtures and testing F1 and cross-attack robustness.PGD uses ϵ = 0.3; concept classifiers remain fixed during retraining.Source: §5.1 · pp. 6–7

5.2 Results

  • In the biased setting, R↓ significantly improves F1 over PGD on larger models, while across datasets and architectures R↓ is comparable to PGD and R↑ is slightly lower.Table 1 reports mean ± standard deviation across five runs; several R↓ and R↑ runs for VGG-16 on MNIST do not converge, increasing variance and lowering means.Source: Table 1 · p. 7, §5.2 · p. 7

5.1 Experimental Setup

  • Rule compliance measures satisfied rules but does not establish that rules are causally used for prediction, so it is reported as an attack check rather than a primary metric.High compliance can arise from spurious correlations, including biased settings where only a biased feature is predicted.Source: §5.1 · p. 7

5.2 Results

  • Models retrained with R↓ and R↑ achieve substantially higher F1 on unseen PGD adversarial examples than non-retrained models, while PGD-retrained models perform best on PGD examples.R↓ is mostly competitive with PGD retraining, indicating robustness beyond ConPAtt’s own attack distribution.Source: §5.2 · p. 8, Table 2 · p. 8
  • R↓ adversarial examples lower rule compliance relative to PGD, whereas R↑ raises it above PGD and original samples, showing the variants systematically manipulate rule satisfaction.Figure 2 shows examples generated by PGD, R↓, and R↑ for the same randomly selected input.Source: §5.2 · p. 8, Figure 2 · p. 8

5.3 Extension to Large Language Models

  • The code study fine-tunes a Qwen-3.5 base model for binary vulnerability classification and uses hidden-layer probes for five memory-safety concepts.Attacks use semantics-preserving code transformations; five seeds are evaluated per configuration.Source: §5.3 · pp. 8–9
  • On code vulnerability detection, ConPAtt retraining preserves clean F1 and improves the score, while standard adversarial fine-tuning lowers clean F1 by 0.15 on average.ConPAtt also reduces standard deviation across all metrics relative to baseline, which the authors suggest may indicate regularization of internal representations.Source: §5.3 · p. 9, Table 3 · p. 9

6 Discussion

ConPAtt generates adversarial examples with systematically different semantic properties from standard attacks, and its retraining can outperform PGD on semantic rule violations in biased settings. The discussion also identifies limitations in rule compliance as an evaluation metric and convergence instability for some architectures.

6 Discussion

  • ConPAtt’s restricted search space may bias optimization toward semantically meaningful perturbations, a possible explanation for its qualitative differences from PGD.The discussion describes systematic changes in semantic properties, reflected in distinct behavior of R↓ and R↑.Source: §6 · p. 9
  • In biased settings, R↓ outperforms PGD under adversarial retraining, though whether this holds for more realistic biases remains open.For the small spurious features studied, PGD can also mitigate shortcut behavior to some extent.Source: §6 · p. 9
  • ConPAtt-based retraining generalizes to unseen PGD adversarial examples, which were not observed during training.The discussion interprets this as indirect mitigation of vulnerabilities also exploited by standard attacks.Source: §6 · p. 9
  • Rule compliance does not establish that a model causally uses a rule; it can be high when the rule’s antecedent is constantly false.The authors call for new metrics that assess the correctness of model reasoning.Source: §6 · p. 9
  • Further work should investigate and optimize ConPAtt convergence to address instability observed for some architectures, particularly VGG-16 on MNIST.Source: §6 · p. 9

7 Conclusion

ConPAtt targets falsification of neural-network compliance with symbolic knowledge about sufficient indicators for output classes, rather than targeting output-class changes. The paper reports theoretical generality and a restricted adversarial search space, alongside semantically structured attacks and promising retraining results.

7 Conclusion

  • ConPAtt attacks compliance with prior symbolic knowledge about sufficient indicators for an output class, rather than requiring a change in the output class.Source: §7 · p. 10
  • The paper shows theoretically that standard adversarial attacks are a special case of ConPAtt and that more concepts can restrict the adversarial search space.Source: §7 · p. 10
  • Experiments show semantically structured adversarial examples, improved robustness after ConPAtt retraining, promising behavior in biased settings, and generalization beyond vision.Source: §7 · p. 10

A.1 MNIST Concept Dataset

The MNIST concept dataset contains six labeled visual concepts rendered with parameter variations and global transformations. It contains 1,500 28 × 28 images per concept, partitioned into fixed training, validation, and test sets.

A.1 MNIST Concept Dataset

  • The dataset covers lines, curves, circles, semicircles, right angles, and crossings, with parameterized variations generated for each concept.Source: §A.1 · p. 14
  • Each concept is rendered on a 112 × 112 canvas, downsampled to 28 × 28 with anti-aliasing, then globally transformed by rotations and translations.The scale factor is fixed at 1.0, and drawing parameters are specified on the final 28 × 28 grid.Source: §A.1 · p. 14
  • The dataset contains 1,500 labeled 28 × 28 images per concept, split into 72.25% training, 12.25% validation, and 15% test data.Source: §A.1 · p. 14

A.2 GTSRB Concept Dataset

The GTSRB concept dataset combines traffic-sign shape, color, and symbol concepts with random backgrounds, including combinations that are unrealistic. Its 7,227 labeled RGB images are partitioned into fixed training, validation, and test sets.

A.2 GTSRB Concept Dataset

  • Each sample combines one shape, one color, and one symbol concept with a random background, including unrealistic sign combinations.These combinations prevent concept recognition from relying on the “clever Hans” effect that could arise when concepts co-occur only in realistic signs.Source: §A.2 · p. 14
  • The dataset’s concept groups cover five shapes, six color categories, and symbols including sign graphics and lettering.Source: §A.2 · p. 14
  • The dataset contains 7,227 labeled 64 × 64 RGB images, split into 60% training, 20% validation, and 20% test data.Each symbol appears at least 15 times, and shape and color concepts are included to the same extent.Source: §A.2 · p. 14

B Experimental Setup Details

The experiments use several model architectures and task-specific concept representations, with standardized training and concept-probe procedures. Rules encode relationships between concepts and classes, and models are adversarially retrained on equal mixtures of clean and adversarial samples.

B Experimental Setup Details

  • The evaluated architectures include VGG-16 pretrained on ImageNet and Vision Transformer (ViT), configured with 8 attention heads, hidden dimension 256, dropout rate 0.1, and patch size 4.Source: B Experimental Setup Details · p. 15
  • Training uses Adam, cross-entropy, temperature scaling, validation-loss early stopping, five random seeds, and standard image augmentation.Learning rates are 10^-3 for MNIST and 10^-4 for GTSRB, with batch size 64; inputs are resized when required by the architecture.Source: B Experimental Setup Details · p. 15
  • Concept probes are trained on intermediate representations, using up to three layers and ensembles of five calibrated linear classifiers per concept.The ensemble averages classifier weights and biases; concept datasets are augmented and partially mixed with task data to mitigate domain shift.Source: B Experimental Setup Details · p. 15
  • Concept datasets are augmented and partially mixed with task data to mitigate domain shift, with task-specific concept definitions.MNIST concepts form a hierarchy of geometric primitives; GTSRB concepts are grouped into shape, color, and symbol.Source: B Experimental Setup Details · pp. 15–16, Rules · p. 16
  • PGD uses ϵ = 0.3, and adversarial retraining combines clean and adversarial samples in a 1:1 mixture.The appendix says ϵ was selected by a sweep on MNIST; experiments use fixed random seeds and a containerized PyTorch environment.Source: B Experimental Setup Details · p. 16, Rules · p. 16

Rules

  • Table 4 reports mean ± standard deviation attack success rates for standard attacks and ConPAtt variants across datasets and architectures.Table 5 reports original-data F1 scores after retraining each model on examples generated by the corresponding method, averaged over five runs.Source: Table 4 · p. 17, Table 5 · p. 17

C CV Additional Experimental Results

Additional vision experiments test attack-method generality, rule compliance, attack success, and concept-probe performance. The appendix also specifies a code-vulnerability experiment using concept-based properties and semantics-preserving code transformations.

C CV Additional Experimental Results

  • The appendix reports attack success rates for standard attacks and ConPAtt variants, plus rule compliance on original and attacked samples.It provides rule-compliance tables for original data and samples attacked with R↓ or R↑; the supplied passages do not give their cell values.Source: C CV Additional Experimental Results · p. 17, Table 12 · p. 23, Table 13 · p. 24
  • The observed differences between standard attacks and ConPAtt variants remain comparable across PGD, FGSM, and VMI-FGSM, and the conclusions generalize beyond PGD.For FGSM and VMI-FGSM, standard attacks also produce few misclassifications on adversarially retrained models, as observed for PGD.Source: C CV Additional Experimental Results · p. 17
  • R↓ generates adversarial examples with lower rule compliance than PGD on vanilla models, while R↑ raises compliance above PGD and original samples.Figure 4 differentiates rule compliance by architecture and sample type; its caption says R↓ has the lowest average compliance and R↑ the highest.Source: Figure 4 · p. 18
  • Concept-probe performance changes after retraining depend on model and dataset; VGG-16 has the largest decrease, especially for symbol concepts.Remaining architectures show moderate changes, and biased-trained GTSRB generally has larger performance differences than original GTSRB; post-retraining probe results are reported for transparency.Source: C CV Additional Experimental Results · pp. 17–18, Table 8 · p. 20, Table 9 · p. 21

D LLM Vulnerability Detection: Setup

  • The code task uses Devign function-level vulnerable/safe classification with a 0.8B Qwen-3.5 model and five AST-derived memory-safety concepts.Linear probes use mean-pooled hidden states and achieve AUROC between 0.918 and 0.951 across runs; adversarial fine-tuning continues from baseline LoRA on the adversarial subset.Source: D LLM Vulnerability Detection: Setup · pp. 18–19
  • Code attacks use eight semantics-preserving transformations, while ConPAtt-targeted generation yields 2,536 candidates per run versus 27,032 for output-targeted generation on average.The reported ranges are 2,475–2,623 and 18,017–40,064, respectively; adversarial sets are uniformly subsampled to equalize examples for fine-tuning comparisons.Source: D LLM Vulnerability Detection: Setup · pp. 19, 21

Related papers

Loading 2610.34923v2…