Safety, Security, and Cognitive Risks in Neuro-Symbolic AI

• URL: http://arxiv.org/abs/2606.17223v1
• Date: Mon, 15 Jun 2026 19:11:55 GMT
• Title: Safety, Security, and Cognitive Risks in Neuro-Symbolic AI
• Abstract summary: Neuro-symbolic AI (NeSy) pairs neural perception with symbolic reasoning.<n>NeSy attacks five layers: neural perception, symbolic knowledge bases, reasoning engines, agentic orchestration, and data stores.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Neuro-symbolic AI (NeSy) pairs neural perception with symbolic reasoning, making it attractive for high-stakes domains where explainability and structured inference are required. However, this hybrid architecture introduces an enlarged attack surface spanning five layers: neural perception, symbolic knowledge bases, reasoning engines, agentic orchestration, and data stores -- each exploitable in ways absent from purely neural systems. This paper makes six contributions: (1) formal definitions of NeSy Attack Surface, Symbolic Integrity Violation (SIV), and Cross-Layer Amplification Ratio $\mathcal{X}$, decomposed into neural-caused and autonomous symbolic sensitivity components; (2) a unified threat model extending MITRE ATLAS with 11 NeSy-specific tactic extensions and a five-profile attacker taxonomy; (3) a symbolic-layer threat catalogue covering knowledge graph (KG) poisoning, ontology-merging, and inference-engine subversion; (4) analysis of cognitive risks -- automation bias, authority bias, and sycophantic reinforcement -- structurally amplified by NeSy's explicit logical explanations relative to black-box neural outputs; (5) interdisciplinary mitigations with measurable acceptance criteria aligned to NIST AI 600-1 and the EU AI Act; (6) three empirical benchmarks: (E1) targeted KG poisoning achieves break-even SIV at injection budget $B=5$ on a 205-entity medical KG, with a KG-specific stealth/SIV trade-off; (E2) PGD-10 at $\varepsilon=0.01$ yields $\mathcal{X}=5.884$ (95% CI $[4.64,\, 8.00]$, $p<0.0001$), confirmed adversarially specific by a matched-random baseline ($E^{R}_{\mathrm{rand}}=0$), on a DistilBERT+ProbLog pipeline; (E3) single-axiom OWL edits achieve 93.3% SIV success with 100% Pellet-consistency stealth, but held-out STIX detection fails at 50% (random-guessing level), an open problem.

Related papers

• PhysSAE: Mechanistic Interpretability of PINNs with Sparse Autoencoders [0.0]
  PhysSAE is a mechanistic interpretability framework that trains overcomplete sparse autoencoders on PINN penultimate-layer activations.<n>We show that PINNs develop sparse, physically structured latent representations that can be identified and causally interrogated post-hoc.
  arXiv  Detail & Related papers  (2026-09-07T05:32:03Z)
• From Training to Deployment: Post-Hoc Causal Feature Identification via Sensitivity Ratios [10.912482254600478]
  Given a model that is already trained, which features does it rely on causally versus spuriously?<n>We introduce the textbfNormalised Sensitivity Ratio(NSR), a post-hoc, model-agnostic diagnostic for this question.
  arXiv  Detail & Related papers  (2026-07-28T10:26:09Z)
• Imbuing Large Language Models with Bidirectional Logic for Robust Chain Repair [44.80087038178069]
  We introduce Teleological Reasoning Infilling (TRI), a training framework that endows decoder-only transformers with a native emphgoal-conditioned bridging capability.<n>At inference, TRI operates as a surgical repair module within a dual-system loop.<n>Experiments on three benchmarks demonstrate that TRI achieves state-of-the-art performance across all tasks, while reducing per-problem token expenditure by 31.2%.
  arXiv  Detail & Related papers  (2026-06-03T15:58:48Z)
• The Deterministic Horizon: When Extended Reasoning Fails and Tool Delegation Becomes Necessary [13.891522069967507]
  Extended chain-of-thought reasoning can degrade performance on deterministic state-tracking tasks.<n>We show that tool-integrated reasoning consistently outperforms neural chain-of-thought.<n>Our results provide principled guidance for when pure neural reasoning should yield to hybrid approaches in agentic systems.
  arXiv  Detail & Related papers  (2026-05-29T21:35:23Z)
• Stochastic Estimation of the Layer-wise Hessian Trace for Monitoring Neural-network Training [45.88028371034407]
  We present a parameter estimator of the trace of the diagonal blocks of the Hessian matrix of the empirical risk of a neural network.<n>The procedure combines the Hutchinson trace estimator with a single Hessian-vector product over the whole parameter vector.<n>We show that correctness under weight sharing requires the layer-wise Hessian to be assembled before the second differentiation.
  arXiv  Detail & Related papers  (2026-05-25T10:24:32Z)
• What Do EEG Foundation Models Capture from Human Brain Signals? [64.48249643001402]
  Modern EEG foundation models learn directly from raw signals via self-supervised pretraining.<n>We decompose into three sub-questions: emphwhat does the model learn, emphwhat does the model use, and emphhow much can be explained<n>The audit covers three foundation models (CSBrain, CBraMod, LaBraM), five clinical tasks (MDD, Stress, ISRUC-Sleep, TUSL, Siena), and a 6-family 63-feature lexicon.
  arXiv  Detail & Related papers  (2026-05-12T01:57:53Z)
• TRUST: A Framework for Decentralized AI Service v.0.1 [47.384270414446604]
  Large Reasoning Models (LRMs) and Multi-Agent Systems (MAS) in high-stakes domains demand reliable verification.<n>We introduce TRUST (Transparent, Robust, and Unified Services for Trustworthy AI), a decentralized framework with three innovations.<n>We prove a Safety-Profitability Theorem ensuring honest auditors profit while malicious actors incur losses.
  arXiv  Detail & Related papers  (2026-04-29T19:32:58Z)
• BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning [34.60596020541521]
  We present BadSkill, a backdoor attack formulation that targets model-in-skill threat surface.<n>In BadSkill, an adversary publishes a seemingly benign skill whose embedded model is backdoor-fine-tuned to activate a hidden payload.<n>Our benchmark spans 13 skills, including 8 triggered tasks and 5 non-trigger control skills, with a combined main evaluation set of 571 negative-class queries and 396 trigger-aligned queries.<n>BadSkill achieves up to 99.5% average attack success rate (ASR) across the eight triggered skills while maintaining strong benign-side accuracy on negative-class queries.
  arXiv  Detail & Related papers  (2026-04-10T14:48:29Z)
• Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks [0.0]
  State-Space Models (SSMs) are deployed in safety-critical long-studied applications.<n>We present the first systematic treatment of SSM safety, security, and cognitive risks.
  arXiv  Detail & Related papers  (2026-04-04T13:08:38Z)
• Fundamental Limits of Neural Network Sparsification: Evidence from Catastrophic Interpretability Collapse [7.167095059974211]
  This work investigates feature survival under severe capacity constraints in Variational Autoencoder--Sparse Autoencoder architectures.<n>We introduce an adaptive sparsity scheduling framework that progressively reduces active neurons from 500 to 50 over 50 training epochs.<n>Our key finding reveals a pervasive paradox: while global representation quality remains stable, local feature interpretability collapses systematically.
  arXiv  Detail & Related papers  (2026-03-18T00:16:38Z)
• NeuroShield: A Neuro-Symbolic Framework for Adversarial Robustness [2.3049380625910945]
  Adrial vulnerability and lack of interpretability are critical limitations of deep neural networks.<n>We introduce DesignII, a neuro-symbolic framework that integrates symbolic rule supervision into neural networks.
  arXiv  Detail & Related papers  (2026-01-19T15:39:24Z)
• Graph-Symbolic Policy Enforcement and Control (G-SPEC): A Neuro-Symbolic Framework for Safe Agentic AI in 5G Autonomous Networks [0.0]
  Graph-Symbolic Policy Enforcement and Control (G-SPEC) is a neuro-symbolic framework that constrains probabilistic planning with deterministic verification.<n>G-SPEC achieves zero safety violations and a 94.1% remediation success rate, significantly outperforming the 82.4% baseline.<n>With a processing overhead of 142ms, G-SPEC is viable for SMO-layer operations.
  arXiv  Detail & Related papers  (2025-12-23T11:27:17Z)
• Exact Certification of (Graph) Neural Networks Against Label Poisoning [50.87615167799367]
  We introduce an exact certification method for label flipping in Graph Neural Networks (GNNs)<n>We apply our method to certify a broad range of GNN architectures in node classification tasks.<n>Our work presents the first exact certificate to a poisoning attack ever derived for neural networks.
  arXiv  Detail & Related papers  (2024-11-30T17:05:12Z)
• Robustness Certificates for Implicit Neural Networks: A Mixed Monotone Contractive Approach [60.67748036747221]
  Implicit neural networks offer competitive performance and reduced memory consumption. They can remain brittle with respect to input adversarial perturbations. This paper proposes a theoretical and computational framework for robustness verification of implicit neural networks.
  arXiv  Detail & Related papers  (2021-12-10T03:08:55Z)
• Scalable Lipschitz Residual Networks with Convex Potential Flows [120.27516256281359]
  We show that using convex potentials in a residual network gradient flow provides a built-in $1$-Lipschitz transformation. A comprehensive set of experiments on CIFAR-10 demonstrates the scalability of our architecture and the benefit of our approach for $ell$ provable defenses.
  arXiv  Detail & Related papers  (2021-10-25T07:12:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.