NeuroShield: A Neuro-Symbolic Framework for Adversarial Robustness

TL;DR

NeuroShield introduces a neuro-symbolic AI framework that augments a ResNet18 backbone with symbolic attribute heads and soft-rule supervision to enhance adversarial robustness and interpretability on traffic sign recognition. By enforcing semantic consistency via a semantic loss and a joint symbolic logic loss, the model learns rule-consistent representations that remain robust under FGSM and PGD perturbations at $\$\varepsilon = 8/255 ext{ extdollar}$, achieving substantial improvements over standard adversarial training while preserving clean accuracy. Compared to transformer-based defenses, NeuroShield delivers competitive robustness with far lower training cost and improved interpretability, and it maintains a modest inference-time overhead. The results demonstrate that symbolic reasoning provides a powerful, layout-aware mechanism to constrain learned features, guiding robust behavior in safety-critical settings like autonomous driving. Future work targets edge-device efficiency, adaptive symbolic reasoning, and scalable rule induction for dynamic decision-making.

Abstract

Adversarial vulnerability and lack of interpretability are critical limitations of deep neural networks, especially in safety-sensitive settings such as autonomous driving. We introduce \DesignII, a neuro-symbolic framework that integrates symbolic rule supervision into neural networks to enhance both adversarial robustness and explainability. Domain knowledge is encoded as logical constraints over appearance attributes such as shape and color, and enforced through semantic and symbolic logic losses applied during training. Using the GTSRB dataset, we evaluate robustness against FGSM and PGD attacks at a standard $\ell_\infty$ perturbation budget of $\varepsilon = 8/255$. Relative to clean training, standard adversarial training provides modest improvements in robustness ($\sim$10 percentage points). Conversely, our FGSM-Neuro-Symbolic and PGD-Neuro-Symbolic models achieve substantially larger gains, improving adversarial accuracy by 18.1\% and 17.35\% over their corresponding adversarial-training baselines, representing roughly a three-fold larger robustness gain than standard adversarial training provides when both are measured relative to the same clean-training baseline, without reducing clean-sample accuracy. Compared to transformer-based defenses such as LNL-MoEx, which require heavy architectures and extensive data augmentation, our PGD-Neuro-Symbolic variant attains comparable or superior robustness using a ResNet18 backbone trained for 10 epochs. These results show that symbolic reasoning offers an effective path to robust and interpretable AI.

Figures (5)

• Figure 1: Soft errors in an NN accelerator can lead to image misclassification in a self-driving car, potentially causing it to accelerate instead of braking abruptly. (adopted from ref28).
• Figure 2: Modified ResNet18 architecture used in our framework. The network preserves high spatial resolution in early layers by replacing the initial 7×7 convolution with a 3×3 kernel and removing the max pooling layer. The final fully connected layer is removed, and the resulting 512-dimensional feature vector is shared between the traffic sign classifier and symbolic attribute heads.
• Figure 3: Original traffic sign image alongside adversarial perturbations and the corresponding adversarial examples generated at different perturbation budgets ($\varepsilon = 0.03$, $0.1$, $0.5$, and $1$). The perturbation maps illustrate how increasing $\varepsilon$ intensifies pixel-level noise, while the resulting adversarial images show progressively severe corruption of the underlying sign.
• Figure 4: Illustration of our training strategy. Each input image is used to generate an adversarial example, and both clean and adversarial samples are passed through a shared modified ResNet18 backbone followed by the classifier and symbolic heads. The final loss combines classification cross-entropy with semantic and symbolic-logic losses, which jointly update the model.
• Figure 5: Comparison of clean and adversarial sample distributions using t-SNE projections. (a) Our Neuro-Symbolic model better preserves semantic structure, with adversarial samples remaining closely aligned with their clean counterparts, highlighting the benefits of rule-based reasoning in maintaining robustness. (b) Baseline ResNet model shows disrupted structure and significant overlap between clean and adversarial samples.