Pith. sign in

REVIEW 4 major objections 5 minor 42 references

On the Promise for Assurance of Differentiable Neurosymbolic Reasoning Paradigms

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper shows that differentiable neurosymbolic systems offer higher assurance than fully neural counterparts specifically when known arithmetic or logic operations are present and the input space is high-dimensional.

desk verdict Useful empirical map of neurosymbolic assurance, but the headline adversarial-robustness advantage is likely a gradient-masking artifact and needs stronger attack evaluation. read the letter →

arxiv 2502.08932 v1 pith:SPSHC46Z submitted 2025-02-13 cs.AI cs.CV

Luke E. Richards , Jessie Yaros , Jasen Babcock , Coung Ly , Robin Cosbey , Timothy Doster , Cynthia Matuszek This is my paper · ORCID
classification cs.AIcs.CV
keywords neurosymbolicAIdifferentiablereasoningassuranceadversarialrobustnesscalibrationinterpretabilityScallopdataefficiency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether end-to-end differentiable neurosymbolic systems—neural networks whose outputs feed a symbolic program—deliver measurable assurance advantages over fully neural models. The authors test the question across image and audio tasks, measuring accuracy, calibration, robustness to corruption and adversarial attack, fairness across users, and interpretability. They find the advantage is real but narrow: when the task contains known arithmetic or counting operations and the input space is high-dimensional, neurosymbolic models far outstrip neural baselines in accuracy and adversarial robustness. Elsewhere the picture is mixed; notably, when a neurosymbolic model exploits an interpretable shortcut, it becomes more attack-vulnerable, and data efficiency appears only under class imbalance. The paper's contribution is empirical scoping of where assurance-by-design claims for this model class actually hold.

What carries the argument

The load-bearing object is the differentiable neurosymbolic program: a perception network (a residual CNN or M5 audio CNN) whose outputs are fed into a symbolic program written in Scallop, a Datalog-based probabilistic reasoning engine. Scallop computes top-$k$ proofs over provenance semirings for each candidate answer, producing a differentiable function of the network's probabilities; the hyperparameter $k$ sets how many most-likely proofs are kept, trading computational cost against coverage of the solution space. The paper's comparisons replace a neural MLP classification head with this symbolic program while keeping the same backbone, so that differences in assurance are attributed to the symbolic reasoning component rather than to architecture. This mechanism carries the argument because it is exactly the known-logic-operation inductive bias that lets neurosymbolic models maintain accuracy and low attack success under adversarial perturbation, and it is the traceable symbolic proof structure that lets analysts observe shortcut circuits.

What would settle it

Give the fully neural model an output head that can explicitly represent arithmetic or counting (e.g., a small counter module or a transformer with a scratchpad) and run the same five-image MNIST sum task under the same $L_\infty$ adversarial budget; if its accuracy and attack success rate match or beat the neurosymbolic models, the claim that the symbolic program itself provides the assurance advantage collapses. Alternatively, train the Pathfinder neurosymbolic model with a regularizer that penalizes single-dot circuits; if accuracy remains high but attack success rate does not drop, the shortcut-robustness link would be refuted.

Watch

Extended reading notes

Core claim

The central claim is that differentiable neurosymbolic reasoning offers assurance benefits—not across the board, but in a specific regime: tasks with known logic or arithmetic operations, high input dimensionality, and class imbalance, where a fully neural model must learn the operation from data and fails. Concretely, on a 5-image MNIST sum task, neurosymbolic models attain 0.963–0.968 accuracy and an adversarial success rate of about 10–11%, while a neural network with the same backbone reaches 0.283 accuracy and a 99% attack success rate. The authors argue the symbolic program provides a stronger inductive bias for combinatorial operations, and that this is visible across robustness, calibration, and data efficiency measures. They also show that interpretable symbolic outputs can expose shortcut reasoning—illustrated on Pathfinder, where the model toggles a single dot rather than grounding perception—and that such shortcuts correlate with higher adversarial vulnerability. Finally, they report that proof-depth $k$ barely affects assurance, and that data efficiency materializes only when the logic task is class-imbalanced.

Load-bearing premise

The comparisons assume the fully neural baselines fairly represent standard deep learning: same backbone, with only the output head swapped for the symbolic program, so that performance and assurance gaps are attributable to the reasoning component rather than to capacity or output-space differences.

Editorial extensions

If this is right

  • Deployers of arithmetic- or counting-heavy vision and audio systems can expect neurosymbolic models to degrade far less under adversarial attack and corruption than equally-sized neural models, provided the operation is specified symbolically.
  • The assurance gap will widen with problem dimensionality: as the number of input images or reasoning steps grows, fully neural heads that must learn the operation become fragile while the symbolic program keeps its inductive bias.
  • Interpretability tools should treat a neurosymbolic model's symbolic trace as a diagnostic: if the proof uses a stable, trivial circuit (like a single dot), the model is likely to be adversarially fragile even at good accuracy.
  • Tuning the proof-depth $k$ at inference time is largely free with respect to assurance, so practitioners can choose $k$ for computational cost without expecting large robustness or calibration shifts.
  • Data-efficiency claims for this paradigm should be scoped to class-imbalanced logic tasks; in balanced classification, neurosymbolic models did not consistently beat neural baselines with less data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit: the same framework predicts that any compositional task with known operators—relational queries, graph reachability, rule-based constraints—should show a similar assurance gap, and that gap should grow with the combinatorial width of the program.
  • One could test whether the adversarial-robustness advantage transfers to non-gradient attacks or to attacks on the symbolic program's inputs; if it does not, the claimed assurance would be specific to the PGD/$L_\infty$ threat model used here.
  • The Pathfinder shortcut finding suggests a quantitative interpretability score (e.g., mutual information between individual neural facts and the final answer) could predict adversarial vulnerability ahead of time; measuring that correlation across tasks would turn the observation into a deployable diagnostic.
  • Because the paper uses a single reasoning engine, the regime boundaries it draws may shift with the reasoning library; repeating the protocol with sample-based reasoning (REINFORCE-style) or full-coverage probabilistic logic programming would test whether the assurance pattern is engine-independent.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents an empirical study of assurance properties of end-to-end differentiable neurosymbolic models built with Scallop, compared with fully neural baselines, across five task families (MNIST arithmetic, MNIST counting, CIFAR-10 knowledge-based classification, LEAF-ID attribute reasoning, Pathfinder, and Common Voice speech commands). Assurance is measured through accuracy, calibration (ECE/MCE), corruption robustness (CSR), adversarial robustness (ASR), user-performance disparity, and interpretability. The main findings are that neurosymbolic models offer assurance advantages in arithmetic/logic tasks with high input dimensionality, that symbolic shortcuts are observable and are associated with increased adversarial vulnerability, that inference-time reasoning depth k has little effect, and that data efficiency only occurs in class-imbalanced reasoning problems. The conclusions are carefully hedged, but the central robustness and fairness claims rely on assumptions about attack quality and baseline comparability that the manuscript does not yet establish.

Significance. If the core claims hold, this would be a useful multi-axis assurance evaluation of an emerging neurosymbolic paradigm, filling a gap noted by prior surveys that mostly measure interpretability alone. The paper deserves credit for its breadth across image and audio modalities, for explicitly seeking performance-parity conditions rather than only comparing 'can' versus 'cannot' cases, and for honestly reporting negative results such as the lack of data efficiency and the CIFAR-10 performance gap. The connection between observable symbolic shortcuts and later adversarial vulnerability is a valuable hypothesis that could motivate verification tools. However, the significance is currently contingent on two unresolved issues: whether the white-box adversarial attacks actually optimize the end-to-end Scallop objective rather than being blocked by nondifferentiable or piecewise-constant regions, and whether the neural baselines are adequately matched to the neurosymbolic models in capacity and task difficulty. Without resolving these, the headline assurance advantages in Tables 1 and 2 are not yet demonstrated.

major comments (4)
  1. [§5.1, Table 1] The strongest claim, Takeaway 1, rests on the adversarial success rate gap between NESY (ASR ≈ 0.104–0.113) and NN (ASR ≈ 0.991) on the 5-image MNIST sum task. The paper does not establish that the 100-step PGD attack reliably optimizes the end-to-end objective through Scallop's top-k proof selection and provenance semirings. Over regions where the selected proof set is unchanged, the loss can be piecewise flat or carry non-informative gradients, so low ASR can reflect attack failure rather than genuine robustness. The reported results include no convergence checks, random restarts, ensemble attacks, transfer attacks, or alternative attack algorithms. Since the same attack recipe is applied to both model families, the ASR gap could be an artifact of the optimizer rather than of the architecture. The fact that CIFAR-10 NESY models show high ASR with the same setup does not resolve this, because suspected gradient masking is concentrated exactly in the tasks where the assurance claim is strongest. The authors should supplement the ASR tables with attack-quality evidence, e.g., loss trajectories, restarts, or successful transfer of the NN baseline's perturbations to NESY models.
  2. [§4.1, §4.1.1, §4.1.4] The fairness of the neural baselines is load-bearing for all takeaway claims, but the baselines differ from the neurosymbolic models in output space, reasoning burden, and architecture. On MNIST tasks, the NN must learn the arithmetic operation in an MLP while the NESY model receives the operation as a symbolic program; on CIFAR-10, the NESY model predicts 11 concept heads that are then reasoned over, whereas the NN predicts 10 classes directly; on Common Voice, the NESY model predicts phoneme facts while the NN predicts words. These differences make it difficult to attribute performance and assurance differences to the reasoning component rather than to output-space mismatch, label structure, or effective model capacity. The authors should either match the baselines more closely (e.g., add an auxiliary concept head to the NN, or give the NN an additional MLP of comparable capacity) or explicitly analyze the sensitivity of the main results to those differences.
  3. [Tables 1–6] The main results tables report single runs without error bars, confidence intervals, or significance tests, even though several claims rely on small numerical differences. For example, in Table 4 the LEAF-ID CSR values are 0.297 (NESY k=3) and 0.302 (NN), and in Table 5 the Pathfinder accuracy values are 0.726 and 0.727. The text states trends such as 'the CSR is always lower for the NESY models' and compares ASR gaps across model families, but without repeated seeds the reader cannot distinguish signal from noise. The data-efficiency tables (Tables 7–10) report ± values and should be extended to the main experiments, or the qualitative claims should be limited to differences that survive multiple seeds.
  4. [§5.5, Figure 2] Takeaway 2 claims that interpretable shortcuts in the symbolic space are related to adversarial vulnerability, but the shortcut evidence is qualitative: Figure 2 shows selected visualizations, and the text states that models 'routinely and across multiple k values' use a single-dot circuit. The relationship between that shortcut and the high ASR of the Pathfinder NESY models (Table 5: ASR 0.971–0.990) is inferred, not demonstrated. The causal direction is also unclear: the high ASR could arise from the same gradient-masking issues discussed above, or from the pixel-level grounding itself, rather than from the specific shortcut. A quantitative shortcut metric (e.g., a measure of proof-set concentration or a controlled intervention that removes the shortcut) would make this claim testable.
minor comments (5)
  1. [Acknowledgements] The sentence 'This work was conducted under the Laboratory Directed Research and Development (LDRD) Program at at Pacific Northwest National Laboratory' contains a duplicated 'at'.
  2. [Throughout] The dataset name is rendered as 'Common V oice Clips' in several places (Tables 6, 10, 16, and Section 4.1.4); this appears to be an unintended spacing artifact and should be corrected to 'Common Voice Clips'. Also, Section 5.1 contains 'NESY k = 5case' without a space.
  3. [§4.1] Training hyperparameters for the MNIST and Pathfinder experiments (number of epochs, learning rate, batch size, optimizer) are not stated, unlike the CIFAR-10, LEAF-ID, and Common Voice sections. This makes replication unnecessarily difficult. The authors should also state whether code is available.
  4. [§3.2] The phrase 'reactionary or single-pass information processing' is vague; 'reactive' or 'feed-forward' would be clearer.
  5. [§5.1] The discussion of MCE acknowledges that NESY outputs do not form a normalized distribution over all combinations, which penalizes MCE. Since Tables 1–6 report MCE as a head-to-head comparison, the paper should either use a calibration metric that is invariant to the output factorization or explicitly present normalized or conditional calibration results for the NESY models.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an empirical benchmark comparison with external baselines and tools, and its assurance claims are measured rather than built into the definitions.

full rationale

The paper makes no formal derivation whose output is presupposed by an input. Its central claims (Takeaways 1-4) are empirical comparisons of Scallop-based neurosymbolic models against fully neural baselines on MNIST, CIFAR-10, LEAF-ID, Pathfinder, and Common Voice. The symbolic programs are supplied as task definitions, and the assurance metrics (accuracy, ECE/MCE, ASR, CSR, disparity) are measured post hoc; no metric is defined in terms of a claim it is used to support. Scallop [18] is an external library, not a prior work by the present authors, and no uniqueness theorem or ansatz is imported from the authors' own prior papers. The only self-citation is [6] (Bynum et al., including co-author Doster) used as an example of representational learning in the introduction; it is not load-bearing for any takeaway. The baseline-fairness question (e.g., NESY receives the arithmetic operation as a program while the NN must learn it, and the CIFAR-10 NESY predicts 11 concepts vs. 10 classes) is a validity or confounding concern about the comparison, not a circularity: the conclusion is not equivalent to the setup by construction. Similarly, a possible gradient-masking explanation for the low ASR of NESY models would be an attack-optimization artifact, not a circular reduction. Accordingly, no circular step is identified.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims are empirical and depend primarily on hand-set experimental design choices (k, attack budgets, data fractions, program structures) rather than on fitted parameters. No new theoretical entities are introduced. The main assumptions concern the correctness and representativeness of Scallop, the perturbation benchmarks, and the threat model.

free parameters (5)
  • top-k reasoning depth k = varied: 1, 3, 5, 10, 15, 20
    Chosen by hand per task to control the number of proofs considered in Scallop; the paper's Takeaway 3, that k has little effect on assurance, depends on this sweep. It is not fitted to data but is a hand-set hyperparameter.
  • L∞ adversarial attack budgets = 0.03 (MNIST, CIFAR-10), 0.007 (LEAF-ID), 0.001 (Common Voice)
    Chosen per task to produce nonzero ASR values; comparative adversarial robustness conclusions in Tables 1-6 depend on these budget choices.
  • Low-data training fractions = 5%, 10%, 25% of training data
    Used in Section 5.8 to assess data efficiency; the claim that NESY data efficiency appears only in class-imbalanced tasks is framed relative to these fractions.
  • CIFAR-10 concept truth table = 11 hand-picked binary concepts
    The knowledge base used in Section 4.1.1 was designed by the authors to disentangle CIFAR-10 classes; the negative CIFAR result depends on this particular concept set.
  • Speech phoneme program slots = 6 slots x 24 phonemes = 144 facts
    Hand-set program structure for Common Voice; the speech results depend on this design choice.
assumptions (4)
  • domain assumption Scallop's top-k differentiable reasoning correctly approximates the probabilistic reasoning semantics needed for gradient-based training and evaluation.
    The paper relies on Scallop (cite [18]) without verifying its semantic approximation properties independently; if Scallop's top-k proofs misrepresent the true solution distribution, the NESY assurance measurements may not generalize to other differentiable neurosymbolic frameworks.
  • domain assumption The selected datasets and corruption benchmarks (MNIST-C, CIFAR-10-C, imagecorruptions, Common Voice) are representative probes of distribution shift for these tasks.
    Corruption robustness claims in Tables 1-4 and 7-9 assume these perturbations reflect real-world distribution shift.
  • domain assumption White-box PGD attacks with the stated L∞ budgets and step counts provide a meaningful estimate of worst-case adversarial robustness for both NN and NESY models.
    Adversarial success rate comparisons assume the attacks are converged and the budgets are appropriate; the paper does not check attack convergence per model.
  • domain assumption Accuracy, ECE/MCE, ASR, CSR, and performance parity metrics jointly capture the paper's definition of assurance.
    The paper's definition of assurance follows [5], and the operationalization is a choice; other assurance dimensions, such as formal verification or safety guarantees, are not measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Promise for Assurance of Differentiable Neurosymbolic Reasoning Paradigms." pith.science (2026). https://pith.science/paper/SPSHC46Z

@misc{pith2026250208932,
  author       = {Pith},
  title        = {Pith review of: On the Promise for Assurance of Differentiable Neurosymbolic Reasoning Paradigms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SPSHC46Z}},
  note         = {Machine review of arXiv:2502.08932}
}
read the original abstract

To create usable and deployable Artificial Intelligence (AI) systems, there requires a level of assurance in performance under many different conditions. Many times, deployed machine learning systems will require more classic logic and reasoning performed through neurosymbolic programs jointly with artificial neural network sensing. While many prior works have examined the assurance of a single component of the system solely with either the neural network alone or entire enterprise systems, very few works have examined the assurance of integrated neurosymbolic systems. Within this work, we assess the assurance of end-to-end fully differentiable neurosymbolic systems that are an emerging method to create data-efficient and more interpretable models. We perform this investigation using Scallop, an end-to-end neurosymbolic library, across classification and reasoning tasks in both the image and audio domains. We assess assurance across adversarial robustness, calibration, user performance parity, and interpretability of solutions for catching misaligned solutions. We find end-to-end neurosymbolic methods present unique opportunities for assurance beyond their data efficiency through our empirical results but not across the board. We find that this class of neurosymbolic models has higher assurance in cases where arithmetic operations are defined and where there is high dimensionality to the input space, where fully neural counterparts struggle to learn robust reasoning operations. We identify the relationship between neurosymbolic models' interpretability to catch shortcuts that later result in increased adversarial vulnerability despite performance parity. Finally, we find that the promise of data efficiency is typically only in the case of class imbalanced reasoning problems.

Figures

Figures reproduced from arXiv: 2502.08932 by the authors.

Figure 1
Figure 1. Visualizations of the two paradigms examined and the assurance metrics measured. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Internals of the Pathfinder symbolic models on the input (left), the joint neural facts imposed [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 29 canonical work pages

  1. [1]

    Addison- Wesley Reading, 1995

    Serge Abiteboul, Richard Hull, and Victor Vianu.Foundations of databases, volume 8. Addison- Wesley Reading, 1995. 13

    work page 1995

  2. [2]

    Measuring trustworthiness in neuro-symbolic integration

    Andrea Agiollo and Andrea Omicini. Measuring trustworthiness in neuro-symbolic integration. In 2023 18th Conference on Computer Science and Intelligence Systems (FedCSIS), pages 1–10. IEEE, 2023

    work page 2023

  3. [3]

    Neurosymbolic reinforce- ment learning with formally verified exploration

    Greg Anderson, Abhinav Verma, Isil Dillig, and Swarat Chaudhuri. Neurosymbolic reinforce- ment learning with formally verified exploration. Advances in neural information processing systems, 33:6172–6183, 2020

    work page 2020

  4. [4]

    wav2vec 2.0: A framework for self-supervised learning of speech representations

    Alexei Baevski, Yuhao Zhou, Abdelrahman Mohamed, and Michael Auli. wav2vec 2.0: A framework for self-supervised learning of speech representations. Advances in neural information processing systems, 33:12449–12460, 2020

    2020

  5. [5]

    A survey on artificial intelligence assurance

    Feras A Batarseh, Laura Freeman, and Chih-Hao Huang. A survey on artificial intelligence assurance. Journal of Big Data, 8(1):60, 2021

    work page 2021

  6. [6]

    Rotational equivariance for object classification using xview

    Lucius Bynum, Timothy Doster, Tegan H Emerson, and Henry Kvinze. Rotational equivariance for object classification using xview. In IGARSS 2020 IEEE International Geoscience and Remote Sensing Symposium, pages 3684–3687. IEEE, 2020

    work page 2020

  7. [7]

    Remote timing attacks on efficient language model inference

    Nicholas Carlini and Milad Nasr. Remote timing attacks on efficient language model inference. arXiv preprint arXiv:2410.17175, 2024

    arXiv 2024

  8. [8]

    Neurosymbolic programming

    Swarat Chaudhuri, Kevin Ellis, Oleksandr Polozov, Rishabh Singh, Armando Solar-Lezama, and Yisong Yue. Neurosymbolic programming. Foundations and Trends® in Programming Languages, 7(3):158–243, 2021

    work page 2021

Show all 42 references
  1. [9]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pages 1310–1320. PMLR, 2019

    2019

  2. [10]

    Very deep convolutional neural networks for raw waveforms

    Wei Dai, Chia Dai, Shuhui Qu, Juncheng Li, and Samarjit Das. Very deep convolutional neural networks for raw waveforms. In 2017 IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 421–425. IEEE, 2017

    2017

  3. [11]

    David Danks and Alex J. London. Algorithmic bias in autonomous systems. In Proceedings of the 26th International Joint Conference on Artificial Intelligence (IJCAI), pages 4691–4697, 2017

    2017

  4. [12]

    AdverTorch v0.1: An adversarial robustness toolbox based on pytorch

    Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. AdverTorch v0.1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623, 2019

    1902 arXiv

  5. [13]

    Towards deep neural network architectures robust to adversarial examples

    Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples. arXiv preprint arXiv:1412.5068, 2014

    2014 arXiv

  6. [14]

    Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Heylar, Rachel Dias, Andrea Vallone, Hongyu Ren, and Jason Wei

    Melody Y . Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Heylar, Rachel Dias, Andrea Vallone, Hongyu Ren, and Jason Wei. Deliberative alignment: Reasoning enables safer language models. arXiv preprint arXiv:2412.16339, 2024

    2024 arXiv

  7. [15]

    On calibration of modern neural networks

    Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pages 1321–1330. PMLR, 2017

    2017

  8. [16]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  9. [17]

    Benchmarking neural network robustness to common corruptions and perturbations

    Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261, 2019

    1903 arXiv

  10. [18]

    Scallop: From probabilistic deductive databases to scalable differentiable reasoning

    Jiani Huang, Ziyang Li, Binghong Chen, Karan Samel, Mayur Naik, Le Song, and Xujie Si. Scallop: From probabilistic deductive databases to scalable differentiable reasoning. Advances in Neural Information Processing Systems, 34:25134–25145, 2021

    2021

  11. [19]

    An empirical study of rich subgroup fairness for machine learning

    Michael Kearns, Seth Neel, Aaron Roth, and Zhiwei Steven Wu. An empirical study of rich subgroup fairness for machine learning. In Proceedings of the conference on fairness, accountability, and transparency, pages 100–109, 2019. 14

    2019

  12. [20]

    Deepproblog: Neural probabilistic logic programming

    Robin Manhaeve, Sebastijan Dumancic, Angelika Kimmig, Thomas Demeester, and Luc De Raedt. Deepproblog: Neural probabilistic logic programming. Advances in neural informa- tion processing systems, 31, 2018

    2018

  13. [21]

    Not all neuro- symbolic concepts are created equal: Analysis and mitigation of reasoning shortcuts

    Emanuele Marconato, Stefano Teso, Antonio Vergari, and Andrea Passerini. Not all neuro- symbolic concepts are created equal: Analysis and mitigation of reasoning shortcuts. Advances in Neural Information Processing Systems, 36, 2024

    2024

  14. [22]

    Ecker, Matthias Bethge, and Wieland Brendel

    Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexander S. Ecker, Matthias Bethge, and Wieland Brendel. Benchmarking robustness in object detection: Autonomous driving when winter is coming. arXiv preprint arXiv:1907.07484, 2019

    1907 arXiv

  15. [23]

    Neuro-symbolic methods for trustworthy ai: a systematic review

    Cyprien Michel-Delétie and Md Kamruzzaman Sarker. Neuro-symbolic methods for trustworthy ai: a systematic review. Neurosymbolic Artificial Intelligence, 2024

    2024

  16. [24]

    Mnist-c: A robustness benchmark for computer vision

    Norman Mu and Justin Gilmer. Mnist-c: A robustness benchmark for computer vision. arXiv preprint arXiv:1906.02337, 2019

    1906 arXiv

  17. [25]

    Do machine learning models learn statistical rules inferred from data? In International Conference on Machine Learning, pages 25677–25693

    Aaditya Naik, Yinjun Wu, Mayur Naik, and Eric Wong. Do machine learning models learn statistical rules inferred from data? In International Conference on Machine Learning, pages 25677–25693. PMLR, 2023

    2023

  18. [26]

    Fairness in machine learning

    Luca Oneto and Silvia Chiappa. Fairness in machine learning. In Recent trends in learning from data: Tutorials from the inns big data and deep learning conference (innsbddl2019), pages 155–196. Springer, 2020

    2020

  19. [27]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P), pages 372–387. IEEE, 2016

    2016

  20. [28]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, and Luca Antiga. Pytorch: An imperative style, high-performance deep learning library. Advances in Neural Information Processing Systems, 32, 2019

    2019

  21. [29]

    Formal explanations for neuro-symbolic ai

    Sushmita Paul, Jinqiang Yu, Jip J Dekker, Alexey Ignatiev, and Peter J Stuckey. Formal explanations for neuro-symbolic ai. arXiv preprint arXiv:2410.14219, 2024

    2024 arXiv

  22. [30]

    An empirical study on the robustness of knowledge injection techniques against data degradation

    Andrea Rafanelli, Matteo Magnini, Andrea Agiollo, Giovanni Ciatto, and Andrea Omicini. An empirical study on the robustness of knowledge injection techniques against data degradation. In CEUR Workshop Proceedings, volume 3735, pages 20–32. Sun SITE Central Europe, RWTH Aachen ...

    2024

  23. [31]

    Certified robustness to label-flipping attacks via randomized smoothing

    Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. Certified robustness to label-flipping attacks via randomized smoothing. In International Conference on Machine Learning, pages 8230–8241. PMLR, 2020

    2020

  24. [32]

    Neuro-symbolic artificial intelligence: Current trends

    Md Kamruzzaman Sarker, Lu Zhou, Aaron Eberhart, and Pascal Hitzler. Neuro-symbolic artificial intelligence: Current trends. AI Communications, 34(3):197–209, 2022

    2022

  25. [33]

    Part-based models improve adversarial robustness

    Chawin Sitawarin, Kornrapat Pongmala, Yizheng Chen, Nicholas Carlini, and David Wagner. Part-based models improve adversarial robustness. In The Eleventh International Conference on Learning Representations, 2023

    2023

  26. [34]

    Data-efficient learning with neural programs

    Alaia Solko-Breslin, Seewon Choi, Ziyang Li, Neelay Velingker, Rajeev Alur, Mayur Naik, and Eric Wong. Data-efficient learning with neural programs. arXiv preprint arXiv:2406.06246, 2024

    2024 arXiv

  27. [35]

    Measuring robustness to natural distribution shifts in image classification

    Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness to natural distribution shifts in image classification. Advances in Neural Information Processing Systems, 33:18583–18599, 2020

    2020

  28. [36]

    Long range arena: A benchmark for efficient transformers

    Yi Tay, Mostafa Dehghani, Samira Abnar, Yikang Shen, Dara Bahri, Philip Pham, Jinfeng Rao, Liu Yang, Sebastian Ruder, and Donald Metzler. Long range arena: A benchmark for efficient transformers. In International Conference on Learning Representations, 2020. 15

    2020

  29. [37]

    How fair can we go in machine learning? assessing the boundaries of accuracy and fairness

    Ana Valdivia, Javier Sánchez-Monedero, and Jorge Casillas. How fair can we go in machine learning? assessing the boundaries of accuracy and fairness. International Journal of Intelligent Systems, 36(4):1619–1643, 2021

    2021

  30. [38]

    Wagner and Artur d’Avila Garcez

    Benedikt J. Wagner and Artur d’Avila Garcez. A neurosymbolic approach to ai alignment. Neurosymbolic Artificial Intelligence, pages 1–12, 2024

    2024

  31. [39]

    Simple statistical gradient-following algorithms for connectionist reinforce- ment learning

    Ronald J Williams. Simple statistical gradient-following algorithms for connectionist reinforce- ment learning. Machine learning, 8:229–256, 1992

    1992

  32. [40]

    Safe neurosymbolic learning with differentiable symbolic execution

    Chenxi Yang and Swarat Chaudhuri. Safe neurosymbolic learning with differentiable symbolic execution. In International Conference on Learning Representations (ICLR), 2022

    2022

  33. [41]

    Fairness beyond disparate treatment & disparate impact: Learning classification without dis- parate mistreatment

    Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez Rodriguez, and Krishna P Gummadi. Fairness beyond disparate treatment & disparate impact: Learning classification without dis- parate mistreatment. In Proceedings of the 26th international conference on world wide web, pages 11...

    2017

  34. [42]

    Detect adversarial attacks against deep neural networks with gpu monitoring

    Tommaso Zoppi and Andrea Ceccarelli. Detect adversarial attacks against deep neural networks with gpu monitoring. IEEE Access, 9:150579–150591, 2021. A Appendix A.1 Models Introduced MiniResNet is used for both the MNIST and Pathfinder tasks. The model is made up of residual b...

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.