Paper deep dive
Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective
Marco Antonio Corallo, Andrea Agiollo, Mauro Conti, Alberto Giaretta
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 9/2/2026, 4:50:20 AM
Summary
This paper investigates the adversarial robustness of Neuro-Symbolic (NeSy) AI models, specifically DeepProbLog, against backdoor attacks. The authors argue that while NeSy models are often assumed to be robust-by-design due to symbolic constraints, the neural-symbolic interface introduces new attack vectors. Through systematic evaluation across eight backdoor settings and four reasoning tasks, they find that NeSy models are generally more robust than pure neural networks, but this robustness is highly dependent on the strictness of the reasoning process and the logical compatibility between the adversarial target and the symbolic knowledge. The study introduces the concept of 'reachability' to explain how symbolic reasoning can mitigate backdoors if the attack target is logically inconsistent with the encoded knowledge.
Entities (7)
Relation Signals (6)
DeepProbLog → isa → Neuro-Symbolic AI
confidence 98% · we compare the most popular NeSy framework, namely DeepProbLog
DeepProbLog → isevaluatedagainst → Backdoor Attacks
confidence 97% · provide the first systematic evaluation of backdoor attacks against NeSy... compare... DeepProbLog... across a total of eight backdoor settings
Neuro-Symbolic AI → ismorerobustthan → Neural Networks
confidence 95% · NeSy models are indeed more robust than their neural counterpart on average
Reasoning shortcuts → iscausedby → Incorrect Concept Grounding
confidence 92% · the concept grounding is incorrect, although the subsequent reasoning remains logically consistent
Backdoor Robustness → dependson → Reachability
confidence 90% · NeSy models robustness against backdoors is entirely determined by the compatibility between the attacker-selected target and the symbolic knowledge
Symbolic Reasoning → mitigates → Backdoor Attacks
confidence 90% · symbolic reasoning alone cannot prevent poisoned perceptual representations from being learned, but can effectively mitigate their impact whenever the adversarial objective is logically inconsistent
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Neuro-Symbolic (NeSy) AI has recently emerged as a novel paradigm to enable trustworthy AI, aiming at integrating sub-symbolic neural perception with grounded symbolic reasoning. The neuro-symbolic integration process that characterizes these models has been proven beneficial to achieve more transparent, explainable and efficient AI systems. Meanwhile, their properties under adversarial settings have been overlooked being frequently deemed robust-by-design. However, the neural-symbolic integration process they leverage constitutes an additional layer of complexity that may provide an attack entry-point. Therefore, in this paper, we claim that an in-depth investigation of the adversarial robustness of NeSy models is necessary and provide the first systematic evaluation of backdoor attacks against NeSy. To this end, we compare the most popular NeSy framework, namely DeepProbLog, against baseline neural networks across a total of eight backdoor settings and four reasoning tasks. Our experimental results show that while NeSy models are indeed more robust than their neural counterpart on average, their robustness vastly depend on the strictness of the reasoning process being enforced and its compatibility with the chosen adversarial target. The source code to reproduce our experiments is made available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2609.00464v1
- Canonical: https://arxiv.org/abs/2609.00464v1
Trouble viewing inline? Open PDF directly →
Full Text
86,896 characters extracted from source content.
Expand or collapse full text
Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective Marco Antonio Corallo Affiliation: Örebro University, Örebro, Sweden email: marco-antonio.corallo@oru.se , Andrea Agiollo Affiliation: Delft University of Technology, Delft, The Netherlands email: a.agiollo-1@tudelft.nl , Mauro Conti Affiliation: University of Padua, Padua, Italy Affiliation: Örebro University, Örebro, Sweden email: mauro.conti@unipd.it and Alberto Giaretta Affiliation: Örebro University, Örebro, Sweden email: Alberto.Giaretta@oru.se © none Abstract. Neuro-Symbolic (NeSy) AI has recently emerged as a novel paradigm to enable trustworthy AI, aiming at integrating sub-symbolic neural perception with grounded symbolic reasoning. The neuro-symbolic integration process that characterizes these models has been proven beneficial to achieve more transparent, explainable and efficient AI systems. Meanwhile, their properties under adversarial settings have been overlooked being frequently deemed robust-by-design. However, the neural-symbolic integration process they leverage constitutes an additional layer of complexity that may provide an attack entry-point. Therefore, in this paper, we claim that an in-depth investigation of the adversarial robustness of NeSy models is necessary and provide the first systematic evaluation of backdoor attacks against NeSy. To this end, we compare the most popular NeSy framework, namely DeepProbLog, against baseline neural networks across a total of eight backdoor settings and four reasoning tasks. Our experimental results show that while NeSy models are indeed more robust than their neural counterpart on average, their robustness vastly depend on the strictness of the reasoning process being enforced and its compatibility with the chosen adversarial target. The source code to reproduce our experiments is made available at https://github.com/marcoantoniocorallo/NeSy-Backdoor. Keywords: Machine Learning Security, Neuro-Symbolic AI, Trustworthy ML 1. Introduction Neural networks (NNs) have achieved super-human level of performance across a variety of tasks (He et al., 2015; Luo et al., 2025). Nevertheless, their increased deployment has exposed several of their limitations, such as data-hungerness, limited transparency and susceptibility to adversarial manipulations (Zhao et al., 2024; Zhou et al., 2022). These characteristics hinder their application in safety-critical domains, where full control over the decision process is a must. To address these limitations, Neuro-Symbolic (NeSy) AI has emerged as a novel paradigm aiming to combine the representation-learning and perceptual capabilities of neural networks with the structured knowledge and reasoning mechanisms traditionally associated with symbolic AI (Marra et al., 2024; Ciatto et al., 2024). Recently, several NeSy architectures have been proposed, each characterized by a different way of incorporating the desired symbolic knowledge, either through logical constraints, differentiable reasoning operators, semantic regularization objectives, or others (Manhaeve et al., 2018; Xu et al., 2018; Winters et al., 2022). These architectures have been commonly proven to be associated with several desirable properties, including improved interpretability, data efficiency and consistency with domain knowledge (DeLong et al., 2024; Agiollo et al., 2023; Agiollo et al., 2022). An underlying root cause for such properties is to be found in the symbolic constraints restricting the space of admissible predictions and penalizing violations of known relations. This property has also motivated the view that NeSy models may be more robust and trustworthy than their purely neural counterparts, with existing studies reporting benefits under noisy observations and distributional shifts (Rafanelli et al., 2024; Manginas et al., 2025). As such, one of the principal motivations for combining learning and reasoning in NeSy AI is now frequently pointed as their increased robustness. Robustness under naturally occurring uncertainty, however, does not imply robustness against an adversary. While, random noise and distribution shifts do not deliberately exploit the internal structure of a model, an adversary can manipulate inputs and training data with the explicit objective of inducing a desired failure. This distinction is particularly relevant for NeSy systems, where the symbolic knowledge may penalize inconsistent outputs, but the neural–symbolic interface introduces an additional attacker target. Indeed, a NeSy model may satisfy the encoded knowledge while relying on incorrect concepts, a phenomenon known as reasoning shortcuts (Marconato et al., 2023b). Therefore, an attacker could theoretically exploit such shortcuts to preserve apparent symbolic consistency while compromising the model reasoning. These concerns raise a fundamental question: does the integration of symbolic knowledge make NeSy models inherently more resistant to adversarial attacks, or does it merely alter the way in which attacks affect the model? Despite the increasing emphasis placed on NeSy AI, their adversarial robustness remains comparatively underexplored. In particular, the robustness benefits attributed to symbolic integration are often inferred from the ability of symbolic knowledge to regularize neural learning (Diligenti et al., 2017; Badreddine et al., 2022). However, such evidence is insufficient for determining whether symbolic components remain effective when the training process is deliberately manipulated as hinted by Agiollo and Omicini (2023). In this work, we investigate this question in the context of backdoor attacks. A backdoor attack aims to embed a hidden, attacker-controlled behavior into a model, commonly by poisoning a small fraction of its training data. The compromised model behaves normally on benign inputs but produces an attacker-selected prediction when a predefined trigger is present (Barni et al., 2019; Hanif et al., 2025). Backdoor attacks provide a particularly informative setting for evaluating NeSy robustness as they allow to investigate if symbolic knowledge can operate as an effective structural safeguard preventing trigger learning. Therefore, we present a systematic evaluation of NeSy models against backdoor attacks and compare their behavior with that of matched neural counterparts. Our experimental design controls for the underlying neural architecture, training data, and optimization settings, thereby isolating the effect of symbolic knowledge integration on backdoor robustness. We consider the most popular NeSy framework, namely DeepProbLog (Manhaeve et al., 2018), against baseline NNs across a total of eight backdoor settings and four reasoning tasks. Our experimental evaluation shows that the robustness of NeSy models against backdoor attacks strongly depends on the interaction between the learned trigger and the symbolic reasoning process. The reasoning layer can substantially improve robustness in targeted scenarios by preventing adversarial predictions that violate the encoded logical constraints, while it provides only limited protection against untargeted attacks that aim only at disrupting the model prediction. To analyze more in detail these phenomena, we introduce the notion of reachability of a backdoor target and show that NeSy models robustness against backdoors is entirely determined by the compatibility between the attacker-selected target and the symbolic knowledge enforced in the NeSy model. Overall, these findings demonstrate that symbolic reasoning alone cannot prevent poisoned perceptual representations from being learned, but can effectively mitigate their impact whenever the adversarial objective is logically inconsistent with the underlying reasoning process. Therefore, this paper motivates broader investigation into the adversarial robustness of NeSy models across architectures, reasoning mechanisms, and threat models. Contributions. The main contributions of this work are: (i) we provide the first systematic analysis of the robustness of NeSy against adversarial backdoor attacks; (i) we experimentally evaluate the robustness of NeSy against its neural counterpart across eight backdoor settings and four reasoning tasks; and (i) we identify the conditions under which symbolic knowledge improves resistance to backdoor attack and characterize the relative failure modes. Organization: The remainder of this paper is organized as follows. In Section 2, we provide the necessary background on NeSy models and backdoor attacks, while Section 3 presents the related work. Subsequently, we define the threat model and methodology we use to analyze backdoors over NeSy in Sections 4 and 5, respectively. Section 6 provides the obtained experimental results, while Section 7 analyzes when backdoors are logically effective. Lastly, Sections 8 and 9 present the limitations, future directions and conclusions. 2. Background 2.1. Neuro-Symbolic AI Neuro-symbolic artificial intelligence aims to combine the complementary strengths of deep neural networks and symbolic reasoning systems. Neural networks excel at learning perceptual representations from high-dimensional data such as images and text, whereas symbolic methods provide interpretable reasoning, explicit knowledge representation, and logical inference. Recently, several NeSy frameworks emerged, which differ depending on the way they represent explicit knowledge, combine learning and reasoning, or define their semantics (Marra et al., 2024). As such, NeSy encompasses a broad range of models rather than a single architecture. An intuitive categorization of such integration models presented in (Ciatto et al., 2024) distinguishes them according to how symbolic knowledge is integrated into their computation. For example, symbolic knowledge may be translated into differentiable constraints that guide the training of a neural model (Xu et al., 2018; Marra et al., 2019), or encoded within a differentiable architecture whose components implement logical structures or operations (Riegel et al., 2020). Alternatively, neural components may be integrated into an explicit symbolic reasoning system, which may differ depending on the symbolic formalism and inference semantics (Manhaeve et al., 2018; Yang et al., 2020; Winters et al., 2022). For the context of this paper, we focus on this last family of models which are also referred to as concept-based NeSy when their neural components extract task-relevant intermediate concepts from raw inputs (Bortolotti et al., 2026). The symbolic component then combines these concepts with domain knowledge to solve the task at hand. For example, a neural network may recognize the digits contained in two images, while symbolic arithmetic rules determine their sum. We focus on concept-based NeSy models because their explicit concept layer defines an interface between neural perception and symbolic reasoning which is commonly assumed to introduce a robustness property against manipulations. 2.1.1. DeepProbLog. We instantiate our NeSy architecture using DeepProbLog (Manhaeve et al., 2018), which extends the probabilistic logic programming language ProbLog (De Raedt et al., 2007) with neural predicates. ProbLog represents uncertainty through probabilistic facts and annotated disjunctions and computes query probabilities over the possible worlds induced by these choices. DeepProbLog preserves this semantics while allowing neural networks to parameterize selected predicates. Given an input x, a neural predicate NθN_θ produces a distribution over a finite set of symbolic outputs z1,…,zKz_1,…,z_K, (1) Nθ(x)=[pθ(z1∣x),…,pθ(zK∣x)],s.t.,∑k=1Kpθ(zk∣x)=1,N_θ(x)= [p_θ(z_1 x),…,p_θ(z_K x) ],\,s.t.,\, _k=1^Kp_θ(z_k x)=1, which instantiates an annotated disjunction. In our concept-based setting, these outputs represent intermediate concepts that participate in logical inference together with the program’s facts and rules. To answer a query, DPL grounds the relevant program, evaluates the required neural predicates, and compiles the resulting formula into a tractable arithmetic circuit (Maene et al., 2025). During training, query-level gradients are propagated through probabilistic inference (enabling differentiation) to the neural networks, enabling end-to-end learning without direct supervision of the intermediate concepts (z1,…,zKz_1,…,z_K). 2.2. Backdoor Attacks Backdoor attacks implant a hidden, attacker-defined behavior into a machine learning model while preserving its performance on benign inputs. A backdoored model behaves normally when the trigger is absent but produces a maliciously selected output when the trigger is present. Backdoors are commonly introduced by poisoning a subset of the training data (Gu et al., 2017; Liu et al., 2018), although more complex threat models may allow the adversary to control the training procedure or directly modify a pretrained model (Li et al., 2024). Formally, let fθf_θ be a model trained on a clean dataset =(xi,yi)i=1nD=\(x_i,y_i)\_i=1^n, let τ:→τ:X be a trigger-insertion function, and let yty_t denote an attacker-selected target label. The adversary aims to learn parameters θbdθ^bd such that (2) fθbd(x)=yandfθbd(τ(x))=yt,f_θ^bd(x)=y f_θ^bd(τ(x))=y_t, for benign samples (x,y)(x,y) and eligible triggered inputs, respectively. Thus, a successful attack simultaneously maximizes the attack success rate on triggered inputs and preserves the model’s predictive performance on clean data. In data-poisoning attacks, the adversary constructs a poisoned training set by replacing or augmenting a subset p⊆D_p : (3) bd=(∖p)∪(τ(x),y~):(x,y)∈p.D^bd= (D _p )∪ \(τ(x), y):(x,y) _p \. In dirty-label attacks, the attacker changes the labels of poisoned samples, typically by setting y~=yt y=y_t (Gu et al., 2017; Chen et al., 2017; Liu et al., 2018). In clean-label attacks, the original labels are retained, y~=y y=y, requiring the backdoor to be learned without introducing an explicit inconsistency between the poisoned inputs and their labels (Turner et al., 2019; Barni et al., 2019). Backdoor attacks also differ in their trigger design. Early methods commonly used fixed, visible patches (Gu et al., 2017), while subsequent attacks introduced blended patterns (Chen et al., 2017), hidden or semantic triggers (Saha et al., 2020), frequency-domain perturbations (Wang et al., 2022), and input-dependent triggers (Salem et al., 2022). These designs pursue different trade-offs among attack effectiveness, trigger stealthiness, and robustness to defenses, but share the objective of associating a trigger condition with attacker-selected model behavior while maintaining performance on benign inputs. However, a comprehensive overview of available backdoor attacks taxonomy is out of the scope of this work and we refer interest readers to (Bai et al., 2025; Zhang et al., 2025; Li et al., 2024). 3. Related Work Neuro-symbolic models are often motivated as more trustworthy than unconstrained neural predictors because they expose semantically meaningful intermediate concepts and use explicit knowledge to constrain their outputs. These benefits, however, depend on whether the learned concepts acquire the semantics assigned to them by the symbolic theory. Marconato et al. (2023a) first highlighted this limitation in continual learning, showing that a model can satisfy the available knowledge and achieve high predictive accuracy while learning concepts with unintended meanings. This phenomenon was later formalized as a reasoning shortcut (Marconato et al., 2023b) with subsequent work proposing benchmarks for detecting such shortcuts (Bortolotti et al., 2024) and analyzing how their occurrence depends on the knowledge base and hypothesis space (Yang et al., 2024). Unlike conventional input-level shortcuts, reasoning shortcuts arise at the interface between subsymbolic inputs and symbolic concepts: the concept grounding is incorrect, although the subsequent reasoning remains logically consistent. While not adversarial, reasoning shortcuts demonstrate that logical consistency alone does not guarantee trustworthy predictions. Extending the results of Marconato et al. (2023a), related work has examined NeSy robustness under non-adversarial failures. For example, Rafanelli et al. (2024) study naturally occurring distribution shifts and report benefits under data and label noise, while Liang et al. (2022) use neuro-symbolic generative models to capture out-of-distribution samples. Complementarily, Manginas et al. (2025) develop a formal method for verifying probabilistic NeSy models against bounded perturbations. These works address naturally occurring shifts and concept ambiguity. In contrast, we consider an adaptive adversary that deliberately modifies training to implant trigger-dependent behavior. At a broader level, Agiollo and Omicini (2023) argue that NeSy trustworthiness should be evaluated with respect to the coupling between neural and symbolic components. Similarly, Parmar (2026) argue that NeSy systems are not inherently safe and model them as attack surfaces spanning neural perception, symbolic knowledge, reasoning, orchestration, and data layers. These works provide valuable evaluation principles and threat models, but do not experimentally determine how established NeSy frameworks behave under concrete adversarial training-time attacks. Our work complements them with an empirical analysis of how backdoors enter through neural concept learning and propagate through an otherwise unchanged symbolic program. Finally, Sarvestani et al. (2026) and Vilamala et al. (2023) design NeSy systems that explicitly improve robustness to adversarial perturbations in traffic-sign recognition and data-stream event processing, respectively. Their results demonstrate how task-specific symbolic knowledge can support robustness, but do not establish whether existing NeSy architectures are robust by design. In particular, their logic and training procedures are constructed as defenses for specific tasks, whereas we evaluate standard concept-based NeSy models without adding robustness mechanisms. Moreover, they consider inference-time perturbations, while we study backdoors implanted through partial control of the training process and activated only by triggered inputs. 4. Threat Model We consider a dirty-label training-time data-poisoning adversary, which represents the most widely adopted model for evaluating backdoor attacks against N models (Hanif et al., 2025). We assume the attacker acts as a malicious data provider who can modify a fraction of the training samples before they are supplied to the victim. However, the attacker cannot control the subsequent training procedure and has no knowledge of the victim model architecture or parameters, similarly to (Jiang et al., 2023; Wang et al., 2022). This setting captures realistic scenarios in which data collection, annotation, or dataset curation is outsourced to a third party. We consider concept-based NeSy tasks in which a neural component extracts intermediate concepts from a raw input and a fixed symbolic program uses these concepts, possibly together with contextual information, to produce the task output. Let x∈x denote an input (i.e., an image in this paper), c∈c an optional clean context, z∈z the concepts extracted from x, and y∈y the task output. A neuro-symbolic predictor can be represented abstractly as (4) x→gθpθ(z∣x)→(⋅,c)y,x \,g_θ\,p_θ(z x) \,K(·,c)\,y, where gθg_θ is the neural concept extractor and K is the symbolic program. The attacker can poison the image and its task-level label, but cannot modify the clean context c, the symbolic program K, or the learning algorithm. Practically speaking, the attack modifies only the input image, leaving the context and symbolic theory unchanged: (5) (x,c,)⟼(τϕ(x),c,).(x,c,K) ( _φ(x),c,K). Consequently, the attack can influence symbolic reasoning only indirectly, by changing the concepts predicted from a triggered image. We rely on these assumptions since (i) the attacker is assumed to be capable only of modifying a subset of the training data and in practical applications the input context c may be given a-priori, and (i) modifying the concept c to c′c together with the input x to activate the backdoor would collapse the task to a trivial backdoor attack over the neural component of the DPL model. Let the clean training dataset be =(xi,ci,yi)i=1ND= \(x_i,c_i,y_i) \_i=1^N, where cic_i is omitted for tasks without an independent context. The adversary selects a poisoning ratio ρ∈(0,1)ρ∈(0,1) and a subset p⊆D_p , with |p|=ρN|D_p|=ρ N. Each selected example is replaced by (6) (x,c,y)⟼(τϕ(x),c,η(y)),(x,c,y) ( _φ(x),c,η(y) ), where τϕ:→ _φ:X is an attack-specific trigger transformation and η:→η:Y is the malicious label mapping. The context remains unchanged and the resulting poisoned dataset is (7) bd=(∖p)∪(τϕ(x),c,η(y))∣(x,c,y)∈p.D^bd= (D _p )∪ \ ( _φ(x),c,η(y) ) (x,c,y) _p \. In the targeted (i.e., all-to-one) setting, all poisoned examples are assigned an attacker-selected target yty_t: η(y)=ytη(y)=y_t. In the untargeted (i.e., all-to-all) setting, η maps each output to a different valid output according to a predetermined mapping. This general definition accommodates both single-label tasks and structured outputs, for which the standard cyclic class mapping may not be applicable. The victim trains the model normally on bdD^bd, obtaining parameters θbdθ^bd, and the attack has two objectives. First, the backdoored model should preserve its predictive performance on benign inputs: fθbd,(x,c)=yf_θ^bd,K(x,c)=y. Second, applying the trigger at inference time should induce the malicious output: fθbd,(τϕ(x),c)=η(y)f_θ^bd,K ( _φ(x),c )=η(y). For the neuro-symbolic model, the attacker must achieve this behavior through the compromised neural component while the symbolic reasoning process remains unchanged. In particular, the trigger must alter pθbd(z∣τϕ(x))p_θ^bd(z _φ(x)) so that the predicted concepts, when combined with the clean context by K, produce the desired malicious output. Whether the symbolic program permits this behavior depends on the task and target. We quantify this relationship through the reachability analysis introduced in Section 5.4. Figure 1 visualizes the threat model defined for this paper. Figure 1. Dirty-label data poisoning threat model against concept-based neuro-symbolic models such as DPL. 5. Methodology We investigate whether symbolic reasoning protects neuro-symbolic models against backdoor attacks. Specifically, we consider the most commonly used NeSy model, namely DeepProbLog, and compare it against equivalent N models across reasoning tasks that differ in their output structure and symbolic constraints. Our evaluation addresses two questions: (i) whether DPL exhibits different robustness from its neural counterpart, and (i) whether this difference depends on the task and attacker-selected target. To this end, we consider four reasoning tasks and four backdoor attacks. For each task, the DPL model and its neural counterpart share the same visual encoder, receive the same input and are trained using the same data partitions and optimization process. The two models differ solely on the way they map the encoder representation to the task output. The neural model defines a fully-connected classification head, while DPL maps the encoder outputs to intermediate concepts and obtains the final prediction through a probabilistic logic program. This controlled comparison isolates the influence of symbolic reasoning on backdoor behavior. 5.1. Reasoning Tasks We instantiate the concept-based pipeline introduced in Section 4 using four tasks over three datasets: modified MNIST addition and multiplication, contextual reasoning over FashionMNIST, and autonomous-driving reasoning over SDDOIA. The tasks differ in their concept spaces, contextual information, output structure, and symbolic constraints, allowing us to evaluate backdoor behavior across progressively different reasoning settings. Following the same notation of Section 4, given a task input x∈x , an optional contextual variable c∈c , an intermediate concept assignment z∈z , and the task output y∈y , DPL assigns probability (8) Pθ,(y∣x,c)=∑z∈pθ(z∣x)[(z,c)⊧y],P_θ,K(y x,c)= _z p_θ(z x)\,I\! [K(z,c) y ], and predicts the output with the highest probability. Its neural counterpart instead applies the learned classifier head hψh_ψ to the encoder representation: (9) fθ,ψN(x,c)=hψ(eθ(x),c).f^N_θ,ψ(x,c)=h_ψ\! (e_θ(x),c ). MNIST addition and multiplication. The first two tasks are modified versions of the standard MNIST arithmetic benchmarks (LeCun et al., 1998; Manhaeve et al., 2018). Each example contains one handwritten-digit image x and an integer c∈0,…,9c∈\0,…,9\ provided as symbolic context. If z∈0,…,9z∈\0,…,9\ is the digit represented by the image, the outputs are y=z+cy=z+c and y=z⋅cy=z· c for addition and multiplication, respectively. DPL therefore computes (10) Pθ+(y∣x,c) P_θ^+(y x,c) =∑z=09pθ(z∣x)[y=z+c], = _z=0^9p_θ(z x)\,I[y=z+c], (11) Pθ×(y∣x,c) P_θ^×(y x,c) =∑z=09pθ(z∣x)[y=z⋅c]. = _z=0^9p_θ(z x)\,I[y=z· c]. We use a single visual operand, rather than the two images employed in the original benchmarks, to preserve the conventional single-image backdoor setting. This avoids introducing additional choices concerning which input should contain the trigger. Both arithmetic tasks impose stringent symbolic mappings, but differ in how their outputs are distributed across digits and contexts. FashionMNIST contextual reasoning. The third task is constructed from FashionMNIST (Xiao et al., 2017). Besides the original visual concepts, we introduce a novel neuro-symbolic reasoning task, referred to as binding, where each example contains a clothing image x and the class c of a second item supplied as context. The neural component predicts the class z of the image, while the symbolic program determines whether it is compatible with the contextual item. Let s(z)s(z) and b(z)b(z) denote the season and body part associated with class z. Practically, the models are supposed to learn the sample class by knowing that classes must satisfy the compatibility constraints, where compatibility is defined as (12) RF(z,c)=[seasonMatch(s(z),s(c))∧b(z)≠b(c)],R_F(z,c)=I\! [seasonMatch(s(z),s(c)) b(z)≠ b(c) ], where the season-matching relation includes a wildcard category compatible with every season. DPL assigns probability (13) PθF(y∣x,c)=pθ(y∣x)RF(y,c),P_θ^F(y x,c)=p_θ(y x)\,R_F(y,c), normalized over compatible classes. In practice, the compatibility relation is defined in DPL by the following logical rule: (14) compatible_class(C,Ctx):− compatible\_class(C,Ctx)\;:- season_of(C,S1), season\_of(C,S_1), season_of(Ctx,S2), season\_of(Ctx,S_2), season_match(S1,S2), season\_match(S_1,S_2), part_of(C,P1), part\_of(C,P_1), part_of(Ctx,P2), part\_of(Ctx,P_2), P1≠P2, P_1≠ P_2, and the corresponding prediction rule is: (15) predict_class(Img,Ctx,C):− predict\_class(Img,Ctx,C)\;:- class(Img,C), class(Img,C), ctx_class(Ctx,Cx), ctx\_class(Ctx,C_x), compatible_class(C,Cx). compatible\_class(C,C_x). Therefore, this task evaluates the ability of neuro-symbolic models to perform contextual reasoning, where the correct prediction depends not only on visual recognition but also on the satisfaction of symbolic compatibility rules. SDDOIA autonomous driving. The final task uses SDDOIA from the RSBench benchmark suite (Bortolotti et al., 2024). Given a traffic scene image x, the neural component predicts 2121 binary concepts describing relevant entities and road conditions: z=(z1,…,z21)∈0,121z=(z_1,…,z_21)∈\0,1\^21. The symbolic program derives the multi-label action vector (16) y=(yforward,ystop,yleft,yright)∈0,14,y=(y_forward,y_stop,y_left,y_right)∈\0,1\^4, with probability (17) PθS(y∣x)=∑z∈0,121pθ(z∣x)[S(z)⊧y].P_θ^S(y x)= _z∈\0,1\^21p_θ(z x)\,I\! [K_S(z) y ]. The knowledge base contains concept-to-action rules and dependencies among actions, such as the incompatibility between moving forward and stopping. SDDOIA therefore provides a more complex, multi-label reasoning setting, but where the logic is less stringent as no a-priori context is given. The complete symbolic theory used within the DPL model for the SDDOIA task is reported in Appendix A.4. 5.2. Backdoor Attacks We instantiate the backdoor threat model introduced in Section 4 using four attacks representative of different trigger mechanisms. The same attacks are applied to DPL and its neural counterpart in both targeted and untargeted settings. The context and symbolic program remain unchanged in all experiments, consistently with the assumed threat model. A successful attack against DPL must change the concepts predicted from a triggered input so that the unchanged reasoning process produces the malicious output: (18) Pθbd,(η(y)∣τϕ(x),c)=∑z∈pθbd(z∣τϕ(x))[(z,c)⊧η(y)].P_θ^bd,K (η(y) _φ(x),c )= _z p_θ^bd(z _φ(x))I\! [K(z,c) η(y) ]. By contrast, the neural baseline can directly associate the triggered representation with the malicious output through its learned classification head. We evaluate four attacks covering different trigger mechanisms, which we describe as follows. BadNet Proposed by Gu et al. (2017), BadNet is widely regarded as the seminal work introducing backdoor attacks against NNs. Formally, BadNets defines the poisoning function τ(⋅)τ(·) by superimposing a fixed visual trigger onto the input image. The trigger typically consists of a small patch located at a predefined position, although its exact appearance may vary depending on the application. WaNet Introduced by Nguyen and Tran (2021), WaNet extends the conventional trigger-based paradigm by replacing additive visual perturbations with a geometric image transformation. Rather than inserting a visible trigger into the input, WaNet generates poisoned samples through a subtle elastic warping of the entire image, producing triggers that are significantly less perceptible to human observers while maintaining high attack effectiveness. FTrojan Wang et al. (2022) introduce an invisible backdoor attack in which the trigger is injected into the frequency domain rather than directly into the visual domain of the input image. The attack exploits the fact that small modifications of selected frequency components correspond to low-magnitude perturbations distributed across the entire image. This makes the resulting trigger difficult to perceive while still allowing the model to learn a reliable association between the perturbation and the attacker-defined target label. By combining mid- and high-frequency components, FTrojan balances attack robustness and visual stealthiness. The high-frequency component reduces perceptibility, whereas the mid-frequency component improves resistance to low-pass filtering and other smoothing operations. ReFool Liu et al. (2020) introduce a backdoor attack based on natural image reflections rather than artificial trigger patterns. Instead of superimposing a fixed patch or imperceptible perturbations, ReFool generated poisoned samples by blending a natural reflection image with the original input according to simplified physical reflection models that simulate common optical phenomena, such as out-of-focus and ghost reflections. While being originally proposed as a clean-label backdoor, we here implement it as a dirty-label attack, matching the threat model and the adversarial mechanism of other tested attacks. Each attack is evaluated in targeted and untargeted settings. For targeted attacks, we deliberately consider multiple target labels. This allows us to determine whether DPL robustness is consistent across targets or depends on the output selected by the attacker. We defer the detailed analysis of the relationship between target labels and the symbolic theory to Sections 5.4 and 7. 5.3. Experimental Protocol and Metrics Whenever the datasets presented in Section 5.1 come with disjoint partitions for training and testing data we rely on them. Meanwhile, SDDOIA provides mechanisms to customize the size of the dataset splits, allowing us to fix the test set to be 10%10\% of the total samples. We leave out 20%20\% of the training set samples to be used for a validation set for model selection and the attack ablation study (see Appendix A.2). Lastly, the test set is reserved for the final clean accuracy and attack effectiveness evaluation. Unless otherwise specified, the poisoning ratio is set to ρ=0.1ρ=0.1. Each experiment is repeated over five random seeds, and we report the mean and standard deviation across these runs. Additional optimization, hardware, and reproducibility details are provided in Appendix A.1. We evaluate benign utility reporting clean accuracies and F1-scores to compare the clean performance of the original and backdoored models and measure the utility loss introduced by poisoning. Meanwhile, we measure the attack success using the Attack Success Rate (ASR) metric and evaluate its success only on samples that the backdoored model predicts correctly before trigger insertion, thereby excluding errors unrelated to the backdoor. Therefore, we define the ASR for a targeted attack with target yty_t as (19) ASRt=∑(x,c,y)∈test[fθbd(x,c)=y∧y≠yt∧fθbd(τϕ(x),c)=yt]∑(x,c,y)∈test[fθbd(x,c)=y∧y≠yt].ASR_t= _(x,c,y) _testI\! [f_θ^bd(x,c)=y y≠ y_t f_θ^bd( _φ(x),c)=y_t ] _(x,c,y) _testI\! [f_θ^bd(x,c)=y y≠ y_t ]. Meanwhile, for untargeted attacks, success only requires an initially correct prediction to become incorrect, thus defining the ASR as: (20) ASRu=∑(x,c,y)∈test[fθbd(x,c)=y∧fθbd(τϕ(x),c)≠y]∑(x,c,y)∈test[fθbd(x,c)=y].ASR_u= _(x,c,y) _testI\! [f_θ^bd(x,c)=y f_θ^bd( _φ(x),c)≠ y ] _(x,c,y) _testI\! [f_θ^bd(x,c)=y ]. Lastly for multi-label tasks like SDDOIA, we note that equality denotes an exact match between complete action vectors. 5.4. Target Reachability For targeted attacks, we evaluate multiple target labels to analyze how the symbolic program treat outputs differently. Depending on the task, a target may be derivable under many, few, or no values of the given contextual information (i.e., cic_i). We formalize this property for the MNIST and FashionMNIST tasks, where the prediction combines a concept extracted from the attacker-controlled image with a clean context that is not modified by the attacker. Recalling the notation where z∈z denotes the concept extracted from the input image x, c∈c the clean contextual concept, and (z,c)∈K(z,c) the output derived by the symbolic program, we define the reachability of a target label yty_t as (21) ℛ(yt)=maxz∈Prc∼π[(z∘c)=yt]=maxz∈∑c∈π(c)[(z,c)=yt],R(y_t)= _z _c π\! [\,K(z c)=y_t\, ]= _z _c π(c)\, 1\! [K(z,c)=y_t ], where π is the empirical distribution of clean contexts among the samples considered when computing the targeted attack success rate for target yty_t. Specifically, let (22) ℰyt=(x,c,y)∈test:fθbd,(x,c)=y∧y≠ytE_y_t= \(x,c,y) _test:f_θ^bd,K(x,c)=y y≠ y_t \ denote the set of test samples that are correctly classified by the backdoored model before trigger insertion and whose ground-truth output differs from the target. The context distribution is then (23) π(c)=∑(xi,ci,yi)∈ℰyt[ci=c]|ℰyt|.π(c)= _(x_i,c_i,y_i) _y_t 1[c_i=c]|E_y_t|. For a fixed concept z, the inner sum in Equation 21 is the proportion of evaluated inputs whose clean context allows the symbolic program to derive yty_t. The maximization then selects the concept that gives the attacker the highest success rate. Consequently, ℛ(yt)R(y_t) represents the largest targeted ASR permitted by the symbolic program for a given target label. Moreover, under the assumption that the trigger induces the same intermediate concept for the evaluated inputs, we obtain the bound ASRt≤ℛ(yt)ASR_t (y_t), for which the equality can be approached when the trigger reliably forces the maximizing concept and the remaining prediction pipeline introduces no additional errors. For single-image tasks, where no clean concept cic_i is present, such as SDDOIA, all concepts zi,…,zkz_i,…,z_k used by the symbolic program K are extracted from the input image x. Therefore, the reachability property reduces to a satisfiability indicator, (24) ℛ(yt)=[∃z∈0,1K:(z)=yt].R(y_t)\;=\; 1\! [\,∃\,z∈\0,1\^K:K(z)=y_t\, ]. Thus, the reachability analysis distinguishes satisfiable from unsatisfiable SDDOIA targets but does not predict differences in attack success among satisfiable action vectors. Practically, the satisfiability metric introduced in our analysis serves two different purposes: (i) from the defender perspective (which is assumed to have a complete knowledge of the concept distribution π), it allows to measure the robustness that the defined NeSy can achieve across all possible target labels that an attacker may select yt∈y_t , and (i) from an attacker perspective, it allows to identify the best label to target for the injection of the backdoor. The latter purpose assumes an attacker knowledgeable of the symbolic knowledge K used by the NeSy model being targeted and the concept distribution π. While reasonable, these two assumptions can be relaxed to the case of an attacker with no prior knowledge of π and assume a uniform distribution over the clean concepts. Therefore, to achieve a reasonable estimate of the attack effectiveness, a black-box attacker can reduce Equation 21 to: (25) ℛu(yt)=maxz∈1||∑c∈[(z,c)=yt],R_u(y_t)= _z 1|C| _c 1\! [K(z,c)=y_t ], where C represents the space of clean concepts, and achieve ASRt≲ℛu(yt)ASR_t _u(y_t). 6. Experimental Results This section investigates the DPL model robustness compared to the baseline, following the methodology described in Section 5. We first present the results for targeted backdoor attacks and later evaluate the untargeted setting. 6.1. Targeted Attacks We report the results of the DPL and N clean accuracies (F1-scores are made available in Appendix A.3) and ASRtASR_t in Tables 1, 2, 3 and 4. Before discussing the overall results, we note that the performance of the FTrojan attack for the MNIST-based tasks is reported in the results tables with (∗)( ). Although the attack was implemented and evaluated using the same hyperparameter configuration successfully adopted by the authors on the standard MNIST digit classification task (Wang et al., 2022), it consistently failed to implant an effective backdoor in the neuro-symbolic arithmetic tasks. To verify that this behavior was not due to an incorrect implementation or configuration, we additionally evaluated the attack on the standard MNIST digit classification benchmark using the same hyperparameter setting, where it successfully achieved the expected ASR (ASR) (see Appendix A.5). This suggests that the ineffectiveness of FTrojan is specific to the arithmetic reasoning tasks rather than to the attack itself. Therefore, we report its results but focus our discussion on BadNet, WaNet and ReFool. 6.1.1. MNIST Addition and Multiplication Tables 1 and 2 show that the clean accuracy of both the DPL and N models does not decrease under targeted attacks, showcasing the models ability to learn the clean task. However, a clear distinction emerges when considering the ASR. The attack is consistently successful over the baseline models (across target labels and attack types), indicating that the attacks successfully enforce the desired malicious behaviour. Conversely, DPL models exhibit a consistent reduction in ASR for most target labels. This behavior is particularly evident in the Multiplication task, where the attacks become almost completely ineffective for nearly all target labels, except when yt=0y_t=0, for which all attacks remain considerably more successful. This suggests that the robustness of the DPL models is not uniform across target labels since certain concepts are inherently easier to enforce than others. In particular, we observe that the only effective target for the Multiplication task over DPL is yt=0y_t=0 which is the absorbing element of multiplication, meaning that any clean operand multiplied by a triggered sample targeted as 00 can produce a valid output. This allows the model to consistently associate the trigger with the target label. Meanwhile, when the attacker targets a prime number (yt=13y_t=13), the underlying logic is unsatisfiable, resulting in an unsuccessfull attack. This behaviour is not true for the baseline N model for which the attacker gets ASRt≥0.84ASR_t≥ 0.84 for all attacks targeting yt=13y_t=13. These results provide strong evidence that enforcing logical consistency through NeSy can constitute an effective defense whenever the symbolic constraints make the target logically unreachable, while being insufficient to mitigate attacks targeting logically satisfiable outputs. Namely, adversarial inputs compatible with context items achieve a higher target reachability ℛ(yt)R(y_t) and thus can be effective backdoors (see Section 7). Attack Target Label Clean Accuracy ↑ ASRt ↓ N DPL N DPL BadNet (Gu et al., 2017) 0 0.984 ± 0.001 0.987 ± 0.002† 0.999 ± 0.000 0.079 ± 0.034† 9 0.984 ± 0.001 0.987 ± 0.002† 0.998 ± 0.001 0.098 ± 0.002† 13 0.982 ± 0.001 0.986 ± 0.001† 0.999 ± 0.000 0.101 ± 0.003† WaNet (Nguyen and Tran, 2021) 0 0.969 ± 0.015 0.987 ± 0.002† 0.871 ± 0.176 0.010 ± 0.001† 9 0.977 ± 0.003 0.984 ± 0.001† 0.863 ± 0.131 0.099 ± 0.002† 13 0.976 ± 0.003 0.984 ± 0.001† 0.840 ± 0.205 0.082 ± 0.010† FTrojan (∗)( ) (Wang et al., 2022) 0 0.976 ± 0.003 0.988 ± 0.001† 0.010 ± 0.000 0.009 ± 0.000† 9 0.981 ± 0.000 0.987 ± 0.001† 0.102 ± 0.003 0.101 ± 0.003† 13 0.981 ± 0.001 0.988 ± 0.000† 0.059 ± 0.001 0.058 ± 0.001† ReFool (Liu et al., 2020) 0 0.979 ± 0.002 0.987 ± 0.000† 0.882 ± 0.029 0.046 ± 0.008† 9 0.980 ± 0.003 0.986 ± 0.001† 0.885 ± 0.049 0.099 ± 0.003† 13 0.981 ± 0.002 0.985 ± 0.001† 0.894 ± 0.027 0.094 ± 0.005† Table 1. MNIST Addition Results. The attacks generally succeed on N, while the ASR reaches at most 0.101 on DPL. Attack Target Label Clean Accuracy ↑ ASRt ↓ N DPL N DPL BadNet (Gu et al., 2017) 0 0.984 ± 0.001 0.988 ± 0.001† 0.999 ± 0.001 0.999 ± 0.000† 1 0.985 ± 0.001 0.988 ± 0.000† 0.801 ± 0.395 0.082 ± 0.035† 13 0.983 ± 0.003 0.987 ± 0.002† 0.599 ± 0.489 0.000 ± 0.000† 24 0.984 ± 0.002 0.987 ± 0.001† 0.807 ± 0.383 0.1 ± 0.001† 81 0.985 ± 0.001 0.986 ± 0.001† 0.801 ± 0.395 0.073 ± 0.031† WaNet (Nguyen and Tran, 2021) 0 0.973 ± 0.007 0.982 ± 0.004† 0.95 ± 0.018† 0.963 ± 0.025 1 0.975 ± 0.007 0.987 ± 0.002† 0.927 ± 0.025 0.011 ± 0.001† 13 0.979 ± 0.001 0.987 ± 0.002† 0.890 ± 0.115 0.000 ± 0.000† 24 0.974 ± 0.004 0.985 ± 0.001† 0.803 ± 0.314 0.067 ± 0.013† 81 0.978 ± 0.004 0.988 ± 0.001† 0.916 ± 0.040 0.01 ± 0.000† FTrojan (∗)( ) (Wang et al., 2022) 0 0.986 ± 0.000 0.988 ± 0.000† 0.190 ± 0.003 0.190 ± 0.002† 1 0.984 ± 0.002 0.987 ± 0.002† 0.011 ± 0.000† 0.011 ± 0.001 13 0.977 ± 0.003 0.99 ± 0.000† 0.000 ± 0.000 0.000 ± 0.000 24 0.985 ± 0.001 0.989 ± 0.001† 0.038 ± 0.002 0.038 ± 0.002 81 0.985 ± 0.001 0.988 ± 0.000† 0.010 ± 0.000 0.010 ± 0.000 ReFool (Liu et al., 2020) 0 0.982 ± 0.001 0.986 ± 0.002† 0.927 ± 0.023 0.913 ± 0.018† 1 0.981 ± 0.003 0.987 ± 0.002† 0.894 ± 0.027 0.047 ± 0.013† 13 0.981 ± 0.004 0.987 ± 0.002† 0.894 ± 0.038 0.000 ± 0.000† 24 0.980 ± 0.001 0.987 ± 0.001† 0.896 ± 0.019 0.088 ± 0.005† 81 0.978 ± 0.003 0.987 ± 0.000† 0.934 ± 0.007 0.036 ± 0.008† Table 2. MNIST Multiplication Results. ASR is strongly dependent on the target label for DPL: high for the absorbing element ( 0) and null for a prime number ( 13). 6.1.2. FashionMNIST Binding Differently from the arithmetic benchmarks, in the FashionMNIST binding task the backdoor attacks seem to be considerably more effective also against the DPL model (see Table 3). While the symbolic reasoning process still improves robustness, it is no longer sufficient to consistently suppress the targeted attacks. More in detail, the magnitude of the robustness improvement from N to DPL strongly depends on the targeted label. In particular, the largest reductions are obtained for the ankle_boot and tshirt classes, whereas the attack remains highly effective for the bag and trouser targets, with ASRt≥0.8ASR_t≥ 0.8. The relationship between the ASR and the target labels is to be found in the reachability of those labels. bag and trouser are compatible with a much larger number of context items than the remaining classes and thus achieve a higher target reachability ℛ(yt)R(y_t) (see Section 7). Indeed, both items can be worn in every season, and no other items share the same part_of_body. Therefore, attacks targeting these labels satisfy the compatibility rules in 9 out of 10 of the possible cases, making the backdoor learnable for all these 9 settings. Overall, the FashionMNIST Binding benchmark appears substantially more challenging than the arithmetic reasoning tasks from a robustness perspective. Although the symbolic constraints remain beneficial, they are unable to suppress the attacks as effectively as in MNIST Addition and Multiplication. Attack Target Label Clean Accuracy ↑ ASRt ↓ N DPL N DPL BadNet (Gu et al., 2017) bag 0.925 ± 0.004 0.927 ± 0.003† 0.999 ± 0.000 0.816 ± 0.003† trouser 0.925 ± 0.004 0.928 ± 0.001† 0.999 ± 0.000 0.815 ± 0.002† ankle_boot 0.924 ± 0.004 0.931 ± 0.003† 0.999 ± 0.000 0.567 ± 0.001† tshirt 0.925 ± 0.003 0.927 ± 0.002† 0.994 ± 0.011 0.588 ± 0.004† WaNet (Nguyen and Tran, 2021) bag 0.921 ± 0.006 0.924 ± 0.005† 0.997 ± 0.002 0.806 ± 0.004† trouser 0.919 ± 0.006 0.920 ± 0.004† 0.974 ± 0.027 0.805 ± 0.008† ankle_boot 0.922 ± 0.005 0.924 ± 0.003† 0.977 ± 0.024 0.559 ± 0.005† tshirt 0.925 ± 0.001† 0.922 ± 0.003 0.980 ± 0.021 0.578 ± 0.010† FTrojan (Wang et al., 2022) bag 0.791 ± 0.255† 0.776 ± 0.241 0.578 ± 0.388 0.560 ± 0.268† trouser 0.892 ± 0.039† 0.829 ± 0.188 0.794 ± 0.115 0.431 ± 0.241† ankle_boot 0.887 ± 0.066† 0.800 ± 0.142 0.732 ± 0.283 0.254 ± 0.122† tshirt 0.618 ± 0.361 0.766 ± 0.129† 0.659 ± 0.294 0.288 ± 0.119† ReFool (Liu et al., 2020) bag 0.925 ± 0.004† 0.924 ± 0.001 0.989 ± 0.006 0.802 ± 0.005† trouser 0.920 ± 0.007 0.923 ± 0.005† 0.988 ± 0.005 0.802 ± 0.006† ankle_boot 0.924 ± 0.003 0.927 ± 0.004† 0.981 ± 0.015 0.553 ± 0.012† tshirt 0.923 ± 0.005 0.928 ± 0.002† 0.985 ± 0.005 0.578 ± 0.005† Table 3. FashionMNIST Binding Results. Bag and Trouser exhibit an higher ASR across all the tasks. 6.1.3. Autonomous Driving Table 4 reports the results for the autonomous driving task. Being formulated as a multi-label classification problem, the target labels in SDDOIA correspond to binary vectors representing the set of actions that the autonomous vehicle is expected to perform. Among these, the labels No Action and Forward + Stop are not originally present in the SDDOIA dataset, meaning that the model cannot learn these actions without the adversarial data poisoning process. The obtained results show that the DPL model is more robust than the baseline only for the Forward + Stop target label. While the N still exhibit a non-negligible ASR when the attacker attempts to induce this contradictory action, DPL completely suppresses the attack. Since this output violates the logical constraints encoded by the reasoning layer, the target label renders the logic unsatisfiable, allowing the symbolic component to effectively prevent the backdoor from enforcing such an impossible prediction. The remaining labels correspond to legitimate driving actions, which are compatible with the symbolic knowledge encoded in the DPL model. Consequently, once the perceptual component has been successfully manipulated, the reasoning layer has only limited ability to reject the poisoned prediction. Therefore, a target label is either logically satisfiable or unsatisfiable, either getting an ASR of 00 or effectively unbounded. Attack Target Label Clean Accuracy ↑ ASRt ↓ N DPL N DPL BadNet Forward 0.830 ± 0.010 0.834 ± 0.005† 0.979 ± 0.005 0.973 ± 0.016† Stop 0.825 ± 0.011 0.833 ± 0.005† 0.979 ± 0.029† 0.984 ± 0.010 No Action 0.833 ± 0.007 0.834 ± 0.008† 0.996 ± 0.004 0.993 ± 0.009† Forward + Stop 0.834 ± 0.009† 0.829 ± 0.006 0.997 ± 0.001 0.000 ± 0.000† WaNet Forward 0.829 ± 0.005† 0.814 ± 0.017 0.512 ± 0.092† 0.585 ± 0.125 Stop 0.822 ± 0.008 0.829 ± 0.008† 0.523 ± 0.087 0.475 ± 0.102† No Action 0.838 ± 0.004† 0.832 ± 0.009 0.532 ± 0.148 0.465 ± 0.168† Forward + Stop 0.825 ± 0.010 0.835 ± 0.004† 0.422 ± 0.101 0.000 ± 0.000† FTrojan Forward 0.839 ± 0.006 0.839 ± 0.004 0.858 ± 0.023† 0.913 ± 0.048 Stop 0.840 ± 0.007† 0.758 ± 0.159 0.909 ± 0.037† 0.913 ± 0.042 No Action 0.842 ± 0.008† 0.841 ± 0.007 0.916 ± 0.051† 0.928 ± 0.019 Forward + Stop 0.844 ± 0.002† 0.830 ± 0.012 0.934 ± 0.012 0.000 ± 0.000† ReFool Forward 0.835 ± 0.006 0.836 ± 0.010† 0.913 ± 0.027 0.913 ± 0.034 Stop 0.841 ± 0.008† 0.835 ± 0.007 0.936 ± 0.012 0.931 ± 0.031† No Action 0.836 ± 0.015 0.847 ± 0.004† 0.943 ± 0.019 0.943 ± 0.018 Forward + Stop 0.840 ± 0.008 0.845 ± 0.003† 0.939 ± 0.010 0.000 ± 0.000† Table 4. Autonomous Driving Results. ASR is generally very high for both baseline and DPL. Only the label Forward + Stop has null ASR on DPL because it is logically unsatisfiable. 6.2. Untargeted Attacks We here present the experimental evaluation of the backdoor attacks under the untargeted setting, where the adversary aims to induce an incorrect prediction without enforcing a specific target label. Untargeted attacks do not require steering the model toward a predefined output, making them intrinsically less constrained and more practical from an adversarial perspective. We follow the state-of-the-art approach to dirty-label untargeted backdoor attacks and map the label y∈y to y′=y+1 mod ||y =y+1 mod |Y| (Nguyen and Tran, 2021). The N and DPL performance is reported in Table 5. We observe that the robustness of the DPL model is generally not higher than that of the baseline. In particular, most backdoors remain highly successful on almost all the considered tasks, with only marginal improvements that are insufficient to mitigate the attack. These results suggest that the symbolic reasoning layer is unable to prevent the corruption of the perceptual representations when the adversary merely seeks to induce an arbitrary incorrect prediction. The only exception to this phenomenon is the MNIST Multiplication task where DPL is substantially more robust than the N. However, this behaviour is not to be found on the intrinsic DPL robustness, but rather on the large output space which makes it more difficult for the attack to learn a mapping that satisfies the underlying logical constraints. Recalling that Equation 20 defines a successful attack when fθbd(τϕ(x),c)≠yf_θ^bd( _φ(x),c)≠ y, these results suggest that the enforcing a reasoning process does not prevent attacks where the attacker only needs to disrupt the inference pipeline sufficiently to obtain any incorrect prediction. Indeed, the DPL model is still able to identify a logically consistent prediction y′y that satisfies the knowledge base K and is different from the original y (e.g., for the Addition task with logic :y=z+cK:y=z+c, assume the original image xix_i with true concept zi=5z_i=5, the given concept ci=8c_i=8, and the original label yi=13y_i=13; the DPL model can map the input image to the concept zi′=7z _i=7, and thus to the logically valid label yi′=15y _i=15 different from the original label). Since the reasoning module ultimately relies on the perceptual predictions produced by the neural encoder, successfully corrupting these intermediate representations is often sufficient to propagate an erroneous symbolic inference. Task Target Label Clean Accuracy ↑ ASRu ↓ N DPL N DPL Addition BadNet 0.985 ± 0.001 0.986 ± 0.001† 0.984 ± 0.007 0.926 ± 0.029† WaNet 0.969 ± 0.007 0.977 ± 0.013† 0.556 ± 0.242† 0.864 ± 0.018 FTrojan (∗)( ) 0.980 ± 0.003 0.987 ± 0.000† 0.000 ± 0.000 0.000 ± 0.000 ReFool 0.979 ± 0.002 0.984 ± 0.002† 0.820 ± 0.056† 0.832 ± 0.039 Multiplication BadNet 0.983 ± 0.003 0.988 ± 0.001† 0.798 ± 0.398 0.516 ± 0.420† WaNet 0.978 ± 0.002 0.988 ± 0.000† 0.833 ± 0.094 0.006 ± 0.001† FTrojan (∗)( ) 0.983 ± 0.003 0.988 ± 0.001† 0.000 ± 0.000 0.000 ± 0.000 ReFool 0.980 ± 0.003 0.987 ± 0.000† 0.912 ± 0.027 0.127 ± 0.058† Binding BadNet 0.927 ± 0.003 0.929 ± 0.001† 0.997 ± 0.000 0.783 ± 0.064† WaNet 0.923 ± 0.004 0.927 ± 0.002† 0.983 ± 0.007 0.738 ± 0.019† FTrojan 0.915 ± 0.007† 0.827 ± 0.173 0.302 ± 0.345 0.199 ± 0.160† ReFool 0.915 ± 0.012 0.926 ± 0.001† 0.976 ± 0.011 0.763 ± 0.019† Autonomous Driving BadNet 0.829 ± 0.002 0.834 ± 0.005† 0.946 ± 0.016† 0.957 ± 0.015 WaNet 0.835 ± 0.007 0.833 ± 0.008† 0.441 ± 0.108 0.429 ± 0.106† FTrojan 0.837 ± 0.005† 0.833 ± 0.009 0.851 ± 0.015 0.849 ± 0.075† ReFool 0.838 ± 0.007 0.842 ± 0.003† 0.832 ± 0.020 0.815 ± 0.026† Table 5. Untargeted attack results. The attack is slightly mitigated on Multiplication, mainly due to the large classes space. 7. Analyzing NeSy Backdoor Feasibility The experimental results presented in Section 6 show that the robustness of DPL models is highly dependent on the attack setting (i.e., target label) and whether if such setting can satisfy the logic reasoning specified in K. This suggests that the DPL model can learn the trigger and that attack mitigation (when successful) happen only at the reasoning layer. We first check this intuition visualizing the DPL learned latent space in Figure 2. The DPL embedding space contains a dedicated representation for the malicious trigger, independently of the observed ASR. Interestingly, the trigger cluster emerges even earlier than in the baseline model. Already at a poison ratio of ρ=0.01ρ=0.01, the latent space clearly exhibits the formation of a trigger-specific cluster. As the poison ratio increases, this cluster becomes progressively more compact and better separated. In contrast, the baseline model experiences a sharp increase in ASR as soon as the trigger representation becomes sufficiently discriminative. These observations confirm that the symbolic reasoning layer does not prevent the neural encoder from learning the malicious trigger, but rather prevents this learned representation from consistently propagating to the desired target prediction. Moreover, these findings back the intuitions we provided in Section 6.2 about the effectiveness of untargeted attacks to be found on them not enforcing a specific target label that may render the logic unsatisfiable. In other words, the reasoning layer cannot effectively block these attacks because the model learns to map the trigger to logically consistent labels. This behaviour is visually confirmed by visualizing the confusion matrices produced by the DPL models under untargeted attack over the MNIST addition task, reported in Figure 3. The matrices show how the predictions are shifted by a single place along the diagonal, thus correctly learning the backdoor, while not breaking the underlying logic of the sum. Model ρ=0.01ρ=0.01 ρ=0.02ρ=0.02 ρ=0.05ρ=0.05 ρ=0.1ρ=0.1 Baseline 0.100 0.982 0.999 0.999 DPL 0.097 0.100 0.095 0.101 Figure 2. Latent representations (top figure) and ASRt values (bottom table) of the baseline (left) and DPL (right) models for poison ratios =0.01 ρ=0.01 (top), 0.02 0.02 (second row), 0.05 0.05 (third row), and 0.1 0.1 (bottom). Figure 3. Confusion matrices of DPL over the addition task. Clean model (left) and model under untargeted attack (right). Having established that the models successfully learn the trigger, it is important to understand how, and to what extent, the reasoning layer is able to mitigate the attacks. In Section 5.4, we have introduced the concept of reachability, which we here use to analyze when an adversarial backdoor is feasible against a NeSy model. More in detail, the reachability metric ℛ(yt)R(y_t) (as defined in Equations 21 and 24) represents the largest fraction of inputs that any fixed trigger can redirect to the target label yty_t. This quantity provides a sound, training-free and attack-agnostic upper bound on the attack success rate for each possible target label, namely ASR(yt)≤ℛ(yt)ASR(y_t)\;≤\;R(y_t). We compute ℛ(yt)R(y_t) for all target labels and tasks used in Section 6 and compare it with the observed ASR in Table 6. Moreover, we report the reachability value that a realistic attacker can compute (ℛu(yt)R_u(y_t) as defined in Equation 25) to show how an attacker can leverage reachability to increase its chances of a successful attack. Task Target ℛu(yt)R_u(y_t) (Att) ℛ(yt)R(y_t) (Def) ASRt Addition 0 0.1000.100 0.1000.100 0.0360.036 9 0.1000.100 0.1050.105 0.0990.099 13 0.1000.100 0.1050.105 0.0840.084 Multiplication 0 1.0001.000 1.0001.000 0.7660.766 1 0.1000.100 0.1030.103 0.0380.038 13 0.0000.000 0.0000.000 0.0000.000 24 0.1000.100 0.1020.102 0.0730.073 81 0.1000.100 0.1000.100 0.0320.032 Binding bag 0.9000.900 0.8120.812 0.7460.746 ankle_boot 0.5000.500 0.5660.566 0.4830.483 trouser 0.9000.900 0.8100.810 0.7130.713 t-shirt 0.4000.400 0.6050.605 0.5080.508 Autonomous Driving Forward 1.0001.000 1.0001.000 0.6840.684 Stop 1.0001.000 1.0001.000 0.6430.643 No Action 1.0001.000 1.0001.000 0.6140.614 Forward + Stop 0.0000.000 0.0000.000 0.0000.000 Table 6. Reachability and satisfiability results for tested targeted labels compared to the average ASR across attacks. The observed ASR closely follows target reachability ℛ(yt)R(y_t), showing how an attacker/defender can accurately predict the magnitude of the attack success before it is deployed. For example, in the multiplication task, the absorbing target yt=0y_t=0 is fully reachable (ℛ(yt)=1R(y_t)=1) and achieves the highest ASRASR (0.7660.766), whereas the unsatisfiable target yt=13y_t=13 yields ℛ(yt)=ASRt=0R(y_t)=ASR_t=0. All other targets, as well as reachable addition targets, have reachability around 0.10.1 and correspondingly low ASR. In the FashionMNIST binding task, highly compatible targets such as bag and trouser achieve substantially higher reachability and ASR than more constrained targets (e.g. t-shirt and ankle_boot). Finally, in SDDOIA, satisfiable targets are fully reachable and vulnerable, while the inconsistent target forward+stop achieves ℛ(yt)=ASRt=0R(y_t)=ASR_t=0, showing that symbolic reasoning can completely prevent logically infeasible attacks. Binding Target Metric tshirt trouser pullover dress coat sandal shirt sneaker bag ankle boot tshirt N. 561 1745 550 561 585 854 694 1223 1705 816 ASRt 0.000 0.997 0.000 0.000 0.000 0.998 0.000 1.000 1.000 0.000 bag N. 556 1704 572 571 542 817 747 1231 1691 845 ASRt 1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.999 0.000 1.000 Multiplication Target Metric 0 1 2 3 4 5 6 7 8 9 0 N. 1033 1018 972 975 995 994 952 973 974 992 ASRt 1.000 1.000 1.000 1.000 0.999 1.000 1.000 1.000 1.000 1.000 13 N. 1005 1017 953 980 938 978 1007 983 1048 978 ASRt 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 24 N. 1005 1016 951 978 931 975 1004 976 1042 972 ASRt 0.000 0.000 0.000 0.137 0.331 0.000 0.367 0.000 0.144 0.000 Addition Target Metric 0 1 2 3 4 5 6 7 8 9 9 N. 986 1014 949 973 934 978 1005 976 1044 975 ASRt 0.003 0.231 0.053 0.068 0.303 0.046 0.067 0.048 0.014 0.201 0 N. 985 1016 947 976 934 972 1008 982 1042 981 ASRt 0.966 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 Table 7. Per-context breakdown of ASR. N denotes the number of instances picked from each context class or operand, while ASR reports the corresponding aggregated ASR. The bolded ASRs correspond to the compatible contexts. As a further confirmation, Table 7 decomposes the ASR of each target label over each clean context values. Overall, the results show that the ASR is high for contexts compatible with the target and drops to zero for incompatible contexts that render the logic unsatisfiable. For example, focusing on the FashionMNIST binding task, targeting either t-shirt or bag produces ASR between 0.990.99 and 11 across compatible contexts. Conversely, the ASR drops exactly to zero whenever the target and context violate the binding rules (e.g., t-shirt cannot be selected in the t-shirt, trouser, or ankle boot contexts, while bag is rejected only when paired with another bag). These results confirm that the symbolic compatibility rules act as a sharp gate on the propagation of the backdoor and that the reachability notion exactly measures this phenomenon. 8. Limitations and Future Work This work represents a first step toward analyzing the robustness of NeSy models against backdoor attacks, providing a sound understanding of when reasoning can mitigate backdoors. However, several important directions remain open. First, our experiments are restricted to one-input reasoning tasks, whereas many NeSy problems involve multiple perceptual elements that may be jointly manipulated. Another promising direction is to enrich single-input tasks with trusted contextual constraints, thereby reducing the set of logically reachable outputs and potentially improving robustness against targeted attacks. Lastly, this paper’s threat model allows only the final task labels to be poisoned. A stronger grey-box attacker with additional access to intermediate concepts could poison both concept-level and task-level supervision, potentially bypassing the reasoning layer through logically consistent but malicious concept predictions. Investigating this stronger attacker may motivate defenses designed to protect the concept learning stage. 9. Conclusions This paper evaluates the robustness of neuro-symbolic models against targeted and untargeted backdoor attacks across four reasoning tasks. Our results show that the robustness advantages offered by symbolic reasoning depend strongly on the task logic. Incompatible targets can be rejected by the symbolic layer, whereas satisfiable targets remain vulnerable. We formalized this relationship through reachability, which captures the influence of the symbolic structure on target-dependent attack success. Overall, our findings show that robustness arises not from a more resilient neural encoder, which still learns the trigger, but from symbolic inference preventing malicious representations from propagating to logically inconsistent outputs. Acknowledgements. This work has been supported by the Wallenberg AI, Autonomous Systems and Software Program (WASP) funded by the Knut and Alice Wallenberg Foundation. References Agiollo and Omicini (2023) A. Agiollo and A. Omicini Measuring trustworthiness in neuro-symbolic integration. In Conference on Computer Science and Intelligence Systems, Cited by: §1, §3. Agiollo et al. (2023) A. Agiollo, A. Rafanelli, M. Magnini, G. Ciatto, et al. Symbolic knowledge injection meets intelligent agents: qos metrics and experiments. Autonomous Agents and Multi-Agent Systems 37 (2), p. 27. Cited by: §1. Agiollo et al. (2022) A. Agiollo, A. Rafanelli, A. Omicini, et al. Towards quality-of-service metrics for symbolic knowledge injection. In CEUR Workshop Proceedings, Vol. 3261, p. 30–47. Cited by: §1. Badreddine et al. (2022) S. Badreddine, A. d’Avila Garcez, L. Serafini, and M. Spranger Logic tensor networks. Artificial Intelligence 303, p. 103649. External Links: ISSN 0004-3702 Cited by: §1. Bai et al. (2025) Y. Bai, G. Xing, H. Wu, Z. Rao, et al. Backdoor attack and defense on deep learning: a survey. IEEE Transactions on Computational Social Systems 12 (1), p. 404–434. Cited by: §2.2. Barni et al. (2019) M. Barni, K. Kallas, and B. Tondi A new backdoor attack in CNNS by training set corruption without label poisoning. In IEEE International Conference on Image Processing, ICIP 2019, Cited by: §1, §2.2. Bortolotti et al. (2024) S. Bortolotti, E. Marconato, T. Carraro, P. Morettin, et al. A neuro-symbolic benchmark suite for concept quality and reasoning shortcuts. NeurIPS 37, p. 115861–115905. Cited by: §3, §5.1. Bortolotti et al. (2026) S. Bortolotti, E. Marconato, A. Pugnana, A. Passerini, and S. Teso Concise and logically consistent conformal sets for neuro-symbolic concept-based models. arXiv preprint arXiv:2605.18202. Cited by: §2.1. Chen et al. (2017) X. Chen, C. Liu, B. Li, K. Lu, et al. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. Cited by: §2.2, §2.2. Ciatto et al. (2024) G. Ciatto, F. Sabbatini, A. Agiollo, M. Magnini, et al. Symbolic knowledge extraction and injection with sub-symbolic predictors: a systematic literature review. ACM Computing Surveys 56 (6), p. 1–35. Cited by: §1, §2.1. De Raedt et al. (2007) L. De Raedt, A. Kimmig, and H. Toivonen ProbLog: a probabilistic prolog and its application in link discovery. In Proceedings of the 20th international joint conference on Artifical intelligence, p. 2468–2473. Cited by: §2.1.1. DeLong et al. (2024) L. N. DeLong, R. F. Mir, and J. D. Fleuriot Neurosymbolic ai for reasoning over knowledge graphs: a survey. IEEE Transactions on Neural Networks and Learning Systems 36 (5), p. 7822–7842. Cited by: §1. Diligenti et al. (2017) M. Diligenti, M. Gori, and C. Sacca Semantic-based regularization for learning and inference. Artificial Intelligence 244. Cited by: §1. Gu et al. (2017) T. Gu, B. Dolan-Gavitt, and S. Garg BadNets: identifying vulnerabilities in the machine learning model supply chain. In Machine Learning and Computer Security Workshop (MLCS), Cited by: §2.2, §2.2, §2.2, §5.2, Table 1, Table 2, Table 3. Hanif et al. (2025) M. A. Hanif, N. Chattopadhyay, B. Ouni, and M. Shafique Survey on backdoor attacks on deep learning: current trends, categorization, applications, research challenges, and future prospects. IEEE Access 13 (), p. 93190–93221. Cited by: §1, §4. He et al. (2015) K. He, X. Zhang, S. Ren, and J. Sun Delving deep into rectifiers: surpassing human-level performance on imagenet classification. In ICCV 2015, p. 1026–1034. Cited by: §1. Jiang et al. (2023) W. Jiang, H. Li, G. Xu, and T. Zhang Color backdoor: a robust poisoning attack in color space. In IEEE CVPR, p. 8133–8142. Cited by: §4. LeCun et al. (1998) Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner Gradient-based learning applied to document recognition. Proceedings of the IEEE 86 (11). Cited by: §5.1. Li et al. (2024) Y. Li, Y. Jiang, Z. Li, and S. Xia Backdoor learning: a survey. IEEE Transactions on Neural Networks and Learning Systems 35 (1). Cited by: §2.2, §2.2. Liang et al. (2022) Y. Liang, J. Tenenbaum, T. A. Le, and N. Siddharth Drawing out of distribution with neuro-symbolic generative models. In NeurIPS, Cited by: §3. Liu et al. (2018) Y. Liu, S. Ma, Y. Aafer, W. Lee, et al. Trojaning attack on neural networks. In NDSS, 2018, Cited by: §2.2, §2.2. Liu et al. (2020) Y. Liu, X. Ma, J. Bailey, and F. Lu Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV 2020, Cited by: §5.2, Table 1, Table 2, Table 3. Luo et al. (2025) X. Luo, A. Rechardt, G. Sun, K. K. Nejad, et al. Large language models surpass human experts in predicting neuroscience results. Nature human behaviour 9 (2), p. 305–315. Cited by: §1. Maene et al. (2025) J. Maene, V. Derkinderen, and P. Zuidberg Dos Martires Klay: accelerating arithmetic circuits for neurosymbolic ai. In ICLR, 2025, Cited by: §2.1.1. Manginas et al. (2025) V. Manginas, N. Manginas, E. Stevinson, S. Varghese, et al. A scalable approach to probabilistic neuro-symbolic robustness verification. In Conference on Neurosymbolic Learning and Reasoning, Cited by: §1, §3. Manhaeve et al. (2018) R. Manhaeve, S. Dumančić, A. Kimmig, T. Demeester, et al. DeepProbLog: neural probabilistic logic programming. Vol. 31. Cited by: §1, §1, §2.1.1, §2.1, §5.1. Marconato et al. (2023a) E. Marconato, G. Bontempo, E. Ficarra, S. Calderara, et al. Neuro-symbolic continual learning: knowledge, reasoning shortcuts and concept rehearsal. In ICML 2023, p. 23915–23936. Cited by: §3, §3. Marconato et al. (2023b) E. Marconato, S. Teso, A. Vergari, and A. Passerini Not all neuro-symbolic concepts are created equal: analysis and mitigation of reasoning shortcuts. In NeurIPS 2023, Cited by: §1, §3. Marra et al. (2024) G. Marra, S. Dumančić, R. Manhaeve, and L. De Raedt From statistical relational to neurosymbolic artificial intelligence: a survey. Artificial Intelligence 328, p. 104062. External Links: ISSN 0004-3702 Cited by: §1, §2.1. Marra et al. (2019) G. Marra, F. Giannini, M. Diligenti, and M. Gori Lyrics: a general interface layer to integrate logic inference and deep learning. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, p. 283–298. Cited by: §2.1. Nguyen and Tran (2021) T. A. Nguyen and A. T. Tran WaNet - imperceptible warping-based backdoor attack. In ICLR 2021, Cited by: §5.2, §6.2, Table 1, Table 2, Table 3. Parmar (2026) M. Parmar Safety, security, and cognitive risks in neuro-symbolic AI. arXiv preprint arXiv:2606.17223. Note: Version 1, 15 June 2026 Cited by: §3. Rafanelli et al. (2024) A. Rafanelli, M. Magnini, A. Agiollo, G. Ciatto, et al. An empirical study on the robustness of knowledge injection techniques against data degradation. In 25th Workshop "From Objects to Agents", Cited by: §1, §3. Riegel et al. (2020) R. Riegel, A. Gray, F. Luus, N. Khan, et al. Logical neural networks. CoRR. Cited by: §2.1. Saha et al. (2020) A. Saha, A. Subramanya, and H. Pirsiavash Hidden trigger backdoor attacks. In AAAI conference on artificial intelligence, Cited by: §2.2. Salem et al. (2022) A. Salem, R. Wen, M. Backes, S. Ma, and Y. Zhang Dynamic backdoor attacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), Cited by: §2.2. Sarvestani et al. (2026) A. S. Sarvestani, J. Schmidt, and A. Roohi NeuroShield: a neuro-symbolic framework for adversarial robustness. arXiv preprint arXiv:2601.13162. Note: Version 1, 19 January 2026 Cited by: §3. Turner et al. (2019) A. Turner, D. Tsipras, and A. Mądry Clean-label backdoor attacks. Note: MIT manuscript Cited by: §2.2. Vilamala et al. (2023) M. R. Vilamala, T. Xing, H. Taylor, L. Garcia, et al. DeepProbCEP: a neuro-symbolic approach for complex event processing in adversarial settings. Expert Systems with Applications 215, p. 119376. Cited by: §3. Wang et al. (2022) T. Wang, Y. Yao, F. Xu, S. An, et al. An invisible black-box backdoor attack through frequency domain. In IEEE ECCV, p. 396–413. Cited by: §2.2, §4, §5.2, §6.1, Table 1, Table 2, Table 3. Winters et al. (2022) T. Winters, G. Marra, R. Manhaeve, and L. D. Raedt DeepStochLog: neural stochastic logic programming. In 36th AAAI Conference on Artificial Intelligence, Cited by: §1, §2.1. Xiao et al. (2017) H. Xiao, K. Rasul, and R. Vollgraf Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747. Cited by: §5.1. Xu et al. (2018) J. Xu, Z. Zhang, T. Friedman, Y. Liang, et al. A semantic loss function for deep learning with symbolic knowledge. In ICML, 2018, Cited by: §1, §2.1. Yang et al. (2024) X. Yang, W. Wei, J. Shao, Y. Li, et al. Analysis for abductive learning and neural-symbolic reasoning shortcuts. In ICML, 2024, Cited by: §3. Yang et al. (2020) Z. Yang, A. Ishay, and J. Lee NeurASP: embracing neural networks into answer set programming. In IJCAI 2020, Cited by: §2.1. Zhang et al. (2025) S. Zhang, Y. Pan, Q. Liu, Z. Yan, et al. Backdoor attacks and defenses targeting multi-domain ai models: a comprehensive review. ACM Computing Surveys 57 (4). Cited by: §2.2. Zhao et al. (2024) H. Zhao, H. Chen, F. Yang, N. Liu, et al. Explainability for large language models: a survey. ACM Transactions on Intelligent Systems and Technology 15 (2), p. 1–38. Cited by: §1. Zhou et al. (2022) S. Zhou, C. Liu, D. Ye, T. Zhu, et al. Adversarial attacks and defenses in deep learning: from a perspective of cybersecurity. ACM Computing Surveys 55 (8), p. 1–39. Cited by: §1. Appendix A Appendix A.1. Experimental Details The experimental details, hyperparameters and reproducibility details are reported in Table 8. Parameter Value Optimizer Adam Learning rate 10−310^-3 Training epochs 2020 (FTrojan, SDDOIA), 55 (All other tasks and attacks) Random seeds [0,1,2,3,42][0,1,2,3,42] Number of runs ∼7,780 7,780 Hardware NVIDIA RTX 5070 (8 GB), RTX 4080 Super (16 GB) CUDA version 12.0 Total compute ∼650 650 GPU hours Table 8. Hyperparameters and Reproducibility Details. A.2. Ablation Study ρ Target Clean Accuracy ASRt N DPL N DPL 0.0050.005 0 0.985±0.0010.985± 0.001 0.988±0.0000.988± 0.000 0.009±0.0000.009± 0.000 0.009±0.0000.009± 0.000 9 0.984±0.0020.984± 0.002 0.987±0.0010.987± 0.001 0.101±0.0030.101± 0.003 0.101±0.0030.101± 0.003 13 0.985±0.0010.985± 0.001 0.988±0.0010.988± 0.001 0.058±0.0010.058± 0.001 0.058±0.0010.058± 0.001 0.0100.010 0 0.985±0.0010.985± 0.001 0.988±0.0000.988± 0.000 0.009±0.0000.009± 0.000 0.009±0.0000.009± 0.000 9 0.983±0.0010.983± 0.001 0.987±0.0010.987± 0.001 0.101±0.0030.101± 0.003 0.098±0.0010.098± 0.001 13 0.984±0.0020.984± 0.002 0.987±0.0010.987± 0.001 0.058±0.0010.058± 0.001 0.060±0.0000.060± 0.000 0.0200.020 0 0.985±0.0010.985± 0.001 0.988±0.0010.988± 0.001 0.010±0.0010.010± 0.001 0.009±0.0000.009± 0.000 9 0.984±0.0020.984± 0.002 0.987±0.0010.987± 0.001 0.277±0.3520.277± 0.352 0.102±0.0000.102± 0.000 13 0.983±0.0010.983± 0.001 0.988±0.0000.988± 0.000 0.059±0.0010.059± 0.001 0.084±0.0190.084± 0.019 0.0500.050 0 0.984±0.0020.984± 0.002 0.987±0.0010.987± 0.001 0.790±0.3900.790± 0.390 0.026±0.0330.026± 0.033 9 0.983±0.0010.983± 0.001 0.988±0.0000.988± 0.000 0.459±0.4400.459± 0.440 0.098±0.0010.098± 0.001 13 0.982±0.0030.982± 0.003 0.988±0.0010.988± 0.001 0.972±0.0480.972± 0.048 0.101±0.0020.101± 0.002 ⋆0.100 0.100 0 0.983±0.0010.983± 0.001 0.986±0.0020.986± 0.002 0.998±0.0010.998± 0.001 0.064±0.0410.064± 0.041 9 0.982±0.0030.982± 0.003 0.985±0.0000.985± 0.000 0.999±0.0000.999± 0.000 0.100±0.0000.100± 0.000 13 0.983±0.0010.983± 0.001 0.985±0.0020.985± 0.002 0.999±0.0000.999± 0.000 0.101±0.0030.101± 0.003 Table 9. Ablation study on the poisoning ratio. GS WS Target Clean Accuracy ASRt N DPL N DPL 4 0.5 — 0.965±0.0090.965± 0.009 0.980±0.0020.980± 0.002 0.403±0.2660.403± 0.266 0.798±0.0780.798± 0.078 0 0.970±0.0040.970± 0.004 0.987±0.0010.987± 0.001 0.729±0.2250.729± 0.225 0.009±0.0000.009± 0.000 9 0.975±0.0030.975± 0.003 0.985±0.0000.985± 0.000 0.717±0.1230.717± 0.123 0.100±0.0020.100± 0.002 13 0.967±0.0100.967± 0.010 0.985±0.0010.985± 0.001 0.792±0.1320.792± 0.132 0.083±0.0110.083± 0.011 1.0 — 0.975±0.0030.975± 0.003 0.981±0.0020.981± 0.002 0.862±0.0620.862± 0.062 0.878±0.0140.878± 0.014 0 0.977±0.0020.977± 0.002 0.987±0.0010.987± 0.001 0.945±0.0440.945± 0.044 0.011±0.0020.011± 0.002 9 0.974±0.0050.974± 0.005 0.984±0.0010.984± 0.001 0.968±0.0200.968± 0.020 0.101±0.0020.101± 0.002 13 0.976±0.0050.976± 0.005 0.985±0.0010.985± 0.001 0.964±0.0260.964± 0.026 0.096±0.0030.096± 0.003 ⋆ 6 ⋆ 0.5 — 0.967±0.0070.967± 0.007 0.975±0.0090.975± 0.009 0.502±0.2740.502± 0.274 0.847±0.0410.847± 0.041 0 0.973±0.0050.973± 0.005 0.986±0.0020.986± 0.002 0.924±0.0460.924± 0.046 0.010±0.0000.010± 0.000 9 0.967±0.0090.967± 0.009 0.985±0.0010.985± 0.001 0.956±0.0370.956± 0.037 0.101±0.0010.101± 0.001 13 0.974±0.0060.974± 0.006 0.984±0.0010.984± 0.001 0.890±0.0450.890± 0.045 0.090±0.0070.090± 0.007 1.0 — 0.969±0.0030.969± 0.003 0.980±0.0040.980± 0.004 0.858±0.0250.858± 0.025 0.881±0.0340.881± 0.034 0 0.978±0.0030.978± 0.003 0.983±0.0060.983± 0.006 0.977±0.0170.977± 0.017 0.029±0.0080.029± 0.008 9 0.977±0.0060.977± 0.006 0.985±0.0010.985± 0.001 0.952±0.0270.952± 0.027 0.099±0.0010.099± 0.001 13 0.978±0.0030.978± 0.003 0.984±0.0010.984± 0.001 0.909±0.0400.909± 0.040 0.092±0.0040.092± 0.004 8 0.5 — 0.969±0.0090.969± 0.009 0.982±0.0020.982± 0.002 0.561±0.1440.561± 0.144 0.761±0.1240.761± 0.124 0 0.972±0.pa50.972± 0.pa5 0.989±0.0000.989± 0.000 0.936±0.0250.936± 0.025 0.010±0.0000.010± 0.000 9 0.972±0.0050.972± 0.005 0.985±0.0010.985± 0.001 0.901±0.0730.901± 0.073 0.100±0.0020.100± 0.002 13 0.972±0.0040.972± 0.004 0.984±0.0020.984± 0.002 0.917±0.0450.917± 0.045 0.091±0.0050.091± 0.005 1.0 — 0.972±0.0070.972± 0.007 0.981±0.0030.981± 0.003 0.893±0.0290.893± 0.029 0.870±0.0360.870± 0.036 0 0.975±0.0040.975± 0.004 0.987±0.0010.987± 0.001 0.953±0.0370.953± 0.037 0.036±0.0120.036± 0.012 9 0.977±0.0040.977± 0.004 0.986±0.0010.986± 0.001 0.956±0.0350.956± 0.035 0.102±0.0000.102± 0.000 13 0.977±0.0020.977± 0.002 0.985±0.0030.985± 0.003 0.957±0.0180.957± 0.018 0.095±0.0030.095± 0.003 Table 10. WaNet ablation study (grid size and warp strength). Specific ablation studies were conducted for each attack to find the most effective parameters. Nevertheless, for space reason we report only the analysis conducted to find the poisoning ratio (Table 9) and the WaNet parameters (Table 10). A validation set forged by using the 20%20\% of the training set has been used for this purpose. The selected attack parameters are indicated by ⋆ . A.3. Clean Performances Table 11 reports the clean accuracies and F1-scores of the N and DPL models over the four learning tasks. Task N DPL Accuracy F1-macro Accuracy F1-macro Addition 0.984±0.0010.984± 0.001 0.983±0.0010.983± 0.001 0.988±0.0010.988± 0.001 0.988±0.0010.988± 0.001 Multiplication 0.985±0.0020.985± 0.002 0.983±0.0030.983± 0.003 0.988±0.0000.988± 0.000 0.987±0.0010.987± 0.001 Binding 0.927±0.0050.927± 0.005 0.927±0.0050.927± 0.005 0.932±0.0010.932± 0.001 0.932±0.0000.932± 0.000 SDDOIA 0.852±0.0020.852± 0.002 0.825±0.0020.825± 0.002 0.848±0.0050.848± 0.005 0.819±0.0050.819± 0.005 Table 11. Clean Performances. A.4. Autonomous Driving Logic Rules invalid_fs(I) invalid\_fs(I) ←go_fs(I)∧stop_fs(I), ← go\_fs(I) stop\_fs(I), invalid_fs(I) invalid\_fs(I) ←go_fs(I)∧obstacle(I), ← go\_fs(I) obstacle(I), move_forward(I) move\_forward(I) ←go_fs(I)∧¬invalid_fs(I)∧¬stop_fs(I), ← go\_fs(I) invalid\_fs(I) stop\_fs(I), no_stop(I) no\_stop(I) ←go_fs(I)∧¬invalid_fs(I)∧¬stop_fs(I), ← go\_fs(I) invalid\_fs(I) stop\_fs(I), no_stop(I) no\_stop(I) ←¬go_fs(I)∧¬stop_fs(I), ← go\_fs(I) stop\_fs(I), not_move(I) not\_move(I) ←go_fs(I)∧¬invalid_fs(I)∧stop_fs(I), ← go\_fs(I) invalid\_fs(I) stop\_fs(I), not_move(I) not\_move(I) ←¬go_fs(I), ← go\_fs(I), stop(I) stop(I) ←go_fs(I)∧¬invalid_fs(I)∧stop_fs(I), ← go\_fs(I) invalid\_fs(I) stop\_fs(I), stop(I) stop(I) ←¬go_fs(I)∧stop_fs(I), ← go\_fs(I) stop\_fs(I), left(I) left(I) ←go_left(I), ← go\_left(I), left(I) left(I) ←¬any_left(I)∧coin(I,21), ← any\_left(I) coin(I,21), no_left(I) no\_left(I) ←¬go_left(I)∧any_left(I), ← go\_left(I) any\_left(I), no_left(I) no\_left(I) ←¬any_left(I)∧¬coin(I,21), ← any\_left(I) coin(I,21), right(I) right(I) ←go_right(I)∧¬block_right(I), ← go\_right(I) block\_right(I), right(I) right(I) ←¬any_right(I)∧coin(I,21), ← any\_right(I) coin(I,21), no_right(I) no\_right(I) ←go_right(I)∧block_right(I), ← go\_right(I) block\_right(I), no_right(I) no\_right(I) ←¬go_right(I)∧any_right(I), ← go\_right(I) any\_right(I), no_right(I) no\_right(I) ←¬any_right(I)∧¬coin(I,21), ← any\_right(I) coin(I,21), action(I,a) action(I,a) ←a(I),a∈not_move,move_forward,no_stop,stop,no_left,left,no_right,right. ← a(I), a∈ \ array[]c not\_move,\, move\_forward,\, no\_stop,\, stop,\\ no\_left,\, left,\, no\_right,\, right array \. Logic Rule 1. Autonomous Driving. The move_forward and stop actions share the same FS concept block, leading the target label Forward + Stop to be unsatisfiable. A.5. FTrojan on MNIST Tasks The performances of the FTrojan attack on MNIST digit classification, Addition and Multiplication are reported in Table 12. Task Accuracy F1 Macro ASR Classification 0.983±0.0040.983± 0.004 0.983±0.0040.983± 0.004 0.604±0.4030.604± 0.403 Addition 0.977±0.0060.977± 0.006 0.981±0.0040.981± 0.004 0.017±0.0060.017± 0.006 Multiplication 0.979±0.0050.979± 0.005 0.979±0.0050.979± 0.005 0.013±0.0060.013± 0.006 Table 12. Performance of FTrojan on the MNIST tasks. Appendix B Ethics and Privacy Statement This work uses only publicly available benchmark datasets and does not process personal, sensitive, or user-generated data. Our experiments are conducted in controlled research settings and aim to characterize, rather than facilitate, attacks against neuro-symbolic systems. We disclose attack configurations to support reproducibility and the development of effective countermeasures. Nevertheless, the demonstrated techniques could be misused to compromise learning systems, and should therefore be applied only to authorized models and datasets.