Understanding and Improving Adversarial Robustness of Neural Probabilistic Circuits
Authors: Weixin Chen
Han Zhao
Venue: NeurIPS 2025 poster ()
Keywords: Concept Bottleneck Models
Neuro-Symbolic AI
Interpretability
Adversarial Robustness
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Neural Probabilistic Circuits (NPCs), a new class of concept bottleneck models, comprise an attribute recognition model and a probabilistic circuit for reasoning. By integrating the outputs from these two modules, NPCs produce compositional and interpretable predictions. While offering enhanced interpretability and high performance on downstream tasks, the neural-network-based attribute recognition model remains a black box. This vulnerability allows adversarial attacks to manipulate attribute predictions by introducing carefully crafted subtle perturbations to input images, potentially compromising the final predictions. In this paper, we theoretically analyze the adversarial robustness of NPC and demonstrate that it only depends on the robustness of the attribute recognition model and is independent of the robustness of the probabilistic circuit. Moreover, we propose RNPC, the first robust neural probabilistic circuit against adversarial attacks on the recognition module. RNPC introduces a novel class-wise integration for inference, ensuring a robust combination of outputs from the two modules. Our theoretical analysis demonstrates that RNPC exhibits provably improved adversarial robustness compared to NPC. Empirical results on image classification tasks show that RNPC achieves superior adversarial robustness compared to existing concept bottleneck models while maintaining high accuracy on benign inputs. The code is available at https://github.com/uiuctml/RNPC.

Understanding and Improving Adversarial Robustness of Neural Probabilistic Circuits
Weixin Chen
Han Zhao University of Illinois Urbana Urbana-Champata Champaign hanzhao@illinois edu
University of Illinois Champa-Champaign weixinc20illinoia edu
Abstract
Neural Probabilistic Circuits (NPCs), new class of concept bottleneck models, comprise an attribute recognition model and a probabilistic circuit for reasoning. By integrating the outputs from these two modules, NPCs produce compositional and interpretable predictions. While offering enhanced interpretability and high performance downstream tasks, the neural- network-baseed attribute recogni- tion model remains a black box. This vulnerability allows adversarial attacks to manipulate attribute predictions by introducing carefully crafted, subtle pertur- bations to input images, potentially compromising the final predictions. In this paper, theoretically analyze the adversarial robustness of NPC and demonstrate that it only depends on the robustness of the attribute recognition model and is independent of the robustness of the probabilistic circuit. Moreover, we propose RNPC, the first robust neural probabilistic circuit against adversarial attacks on the recognition module. RNPC introduces novel class-wise integration for inference, ensuring a robust combination of outputs from the two modules. Our theoretical analysis demonstrates that RNPC exhibits provably improved adversarial robust- ness compared to NPC. Empirical results on image classification tasks show that RNPC achieves superior adversarial robustness compared existing concept bot- tleneck models while maintaining high accuracy on benign inputs. The code is available http:///ggtuub.coo//uucc///////
Introduction
Deep Neural Networks (DNNs) exhibit superior performance across range of downstream tasks. However, DNNs are often criticized for their lack of interpretability, making it hard to understand the decision-making process, especially when they deployed in high-stakes domains, such as legal justice and healthcare [1. Concept Bottleneck Models (CBMs) 2 are a class of models that attempt to improve model interpretability by incorporating huuman-understanddble binary concepts (e.g., white color) as an intermediate layer, followed by simple predictors such as linear models. This bottleneck enables model predictions to interpreted using the predicted concepts due the sim- plicity of the linear predictors on top of the concepts. While demonstrating improved interpretability. CBMs usually suffer from performance drop compared to DNNs. Recently, new class concept bottleneck models, Neural Probabilistic Circuits (NPCs) 7 8) has been introduced, which offers a promising balance between model interpretability and task performance. NPC consists of attribute recognition model and probabilistic circuit [9] The attribute recognition model predicts various interpretable categorical attributes (e.g., color) from an input image. The probabilistic circuit supports tractable joint, marginal, and conditional inference over these attributes and the class variable. By integrating the probability each instantiation of attributes and the conditional probability specific class given that instantiation, NPC generates the prediction score for the class.
Despite enhanced transparency in the model architecture, the attribute recognition model within NPC, implemented using neural network, remains a black box. This raises the threat of malicious attacks
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

targeting the attribute recognition model. Adversarial attacks 12) typical type of attack against neural networks, attempt to manipulate model predictions by applying carefully crafted, imperceptible perturbations to the input images. Such attacks against the attribute recognition model can mislead attribute predictions, potentially compromising NPC's performance on downstream tasks.
In this paper, we theoretically amalyze NPC's robustness against these attacks, understanding how the robustness of individual modules affects that of the overall model. Surprisingly, we show that the robustness of the overall model only depends on the robustness of the attribute recognition model, and including a probabilistic circuit does not impact the robustness of the overall model. This is in sharp contrast to the compositional nature of NPC's estimation error, as demonstrated in Chen et al. 7 Theorem 2]. This means that adversarial robustness can be achieved for free by using probabilistiic circuits on top of intermediate concepts, rather than the linear predictors used in conventional CBMss
To further improve the adversarial robustness of NPC, we propose the Robust Neural Probabilistic Circuit (RNPC), which adopts the same model architecture as NPC while introducing a novel class-wisd wwse integration approach for inference. Specifically, we first partition the attribute space by class, where each class corresponds to a set of high-probability attribute instantiations, and then define the neighborhood for each class to allow perturbations. Rather than focusing on individual attribute instantiations, RNPC integrates the probability over the neighborhood of each class and the conditional probability of a target (class) given the high probability region of that class.
Theoretically, we show that such class wise integration enables RNPC to achieve improved adversarial robustness compared to NPC. We also perform an analysis of RNPC's performance benign inputs. Similar to NPC, the estimation error of RNPC is compositional and bounded by a linear combination of erross from its individual modules. Moreover, we provide explicit characterization to quantify the trade-off between RNPC's adversarial robustness and benign performance.
Empirical results on diverse image classification datasets demonstrate that RNPC outperforms existing concept bottleneck models in robustness against three types of adversarial attacks across various attack budgets while maintaining high accuracy on benign imputs. Additionally, conduct extensive ablation studics, including analyzing the impact of the number of attacked attributes and examining the effect of spurious correlations among various attributes.
Our main contributions are threefold. 1) RNPC, against adversarial attacks on the attribute recognition model. In particular, RNPC introduces a novel class-wise integration approach for inference, ensuring a robust combination of outputs from different modules. 2) Theoretically, we demonstrate that: a) The robustness of NPC and RNPC de- pends only on the robustness of the attribute recognition model, and introducing a probabilistic circuit on top of the attribute recognition model is free for robustness. b) RNPC is guaranteed to achieve higher robustness than NPC under certain conditions. c) RNPC maintains a compositional estimation error on benign inputs. d) There exists trade-off between RNPC's 's adversarial robustness and benign performance. 3) Empirically, we show that RNPC achieves superior robustness against diverse adversarial attacks compared to various concept bottleneck models, while maintaining high accuracy on benign inputs.
We propose the first robust neural probabilistic circuit, named
2 Preliminaries
2.1 Neural probabilistic circuits
A Neural Probabilistic Circuit (NPC) 7 consists of an attribute recognition model and probabilistic circuit. Let X E X. Y E y. Ag A& denote the input variable, the class variable, and the k-th attribute variable, respectively, with their lowercase letters representing the corresponding instantiations. Consider K attributes, A or A in short. The neural-network-basee attribute recognition model takes image x as input and outputs probability vectors for various attributes. The k-th probability vector is denoted as (Pe,, (Ax = ag X = x)) where 0g represents the model parameters related to the k-th attribute. The probabilistic circuit [9] learns the joint distribution of Y and Aμ, while also supporting tractable conditional inference such as PP,. (Y A11k), where w represents the circuit's parameters. Combining the outputs from both the attribute recognition model and the probabilistic circuit, NPC's prediction score for class is interpretable, which is the sum of the probability of each instantiation of attributes, weighted by the

---

Mipu.
6
PolAux - axxlX)
Σ
(sy(A)
x
X)
41 Aialdeai
6x
Po(Y ALs
Vi
(Ax
Attribute Recogrition Modal
des
Poldes e X)
Σ
(Y
M(nor)
Probabilisti Cirouit
RNPC
Neighborhoods
Model architectures and inference procedures of NPC and RNPC. NPC and RNPC share an attribute recognition model and a probabilistic circuit. During inference, NPC employs node-wise integration to integrate the outputs of the two modules, producing predictions for downstream tasks. In contrast, RNPC adopts class-wise integration, which leads attribute space. Vy represents the set attribute nodes with high probabilities. dmin is the minimum inter-class distance and the radius is defined as Amin J. NN, denotes the neighhorhood of class y with radius
Figure 1: Left:
robust task predictions. Right: Illustration of three classes in the
conditional probability of y given this instantiation, i.e.,
K Pe,. (Y X EI (Ai as X x)= -)- (Y= = A an.))
(1)
Am
where denotes all parameters of the attribute recognition model. An illustration of NPC is in Fig
2.2 Threat model
Consider white-box, norm-bounded untargeted adversarial attack against the attribute recognition model. Given an input (z, ():k). the attacker seeks to find a perturbed input within an nn-nrr ball of radius& & centered at ær such that the attribute recognition model's predictions for one or more attributes become incorrect. Assume m attacked attributes Aijim.. the attack objective is
1 EE C (Fo., (Ai, X = a52 where Bp E) == {a E X' | - =11p < O and L denotes a per-attribute loss function, which may vary depending the chosen attack method.
(a.)eR m
3 Understanding the adversarial robustness of neural probabilistic circuits
Chen 7 have shown that under Assumption 3.1 and 3.2 the estimation error of NPC compositional, i.e., it can be upper bounded by a linear combination of the error of the attribute recognition model and the error of the probabilistic circuit. In this section, we delve into the adversarial robustness of NPC, exploring how the adversarial robustness of the attribute recognition model as well as the probabilistic circuit affects that NPC.
Assumption 3.1 (Sufficient attributes (7).. The class label Y and the input X are conditionally independent given the attributes AI.K, i.e., 1 X AIK-
Assumption 3.2 (Complete information (7).. Given any input, all attributes are conditionally mutually independent, i.e., A₁ A2 ... Ax |X.
Definition 3.3. The prediction perturbation of NPC against an adversarial attack on the attribute recognition model is defined as the worst-case total variance (TV) distance between the class distributions conditioned on the vanilla and perturbed inputs, ie..
max drv (Po.. Px,, (Y x)) (XE,(X.0)
NPC 0,
Ex
The metric quantifies the adversarial robustness of NPC, with a lower value signifying stronger robustness. Based on this definition, the following theorem decomposes the adversarial robustness of NPC under the assumption of complete information.
For uncluttered notation, omit the dependency É if it clear from the context.

---

Theorem 3.4 (Adversarial robustness of NPCs), Under Assumption 3.2 the prediction perturbation of NPC is bounded by the worst-case TV distance between the overall attribute distributions conditioned on the vanilla and perturbed inputs, which is further bounded by the sum of the worst-case TV distances for each attribute, i.e,
K Ex
drv (Fo (Aui Px ( [Axx x)) (x
dev (Aa (As (X, (Ar 1x)) XeB,(XXa)
A
Ex
max
&
max
We denote the first bound ANPC. Theorem 3.4 demonstrates that the prediction perturbation of NPC is upper bounded by that the attribute recognition model. Different from typical DNNs whose robustness influenced by the robustness of each layer [4], the robustness of NPC depends solely on that of the attribute recognition model. Adding a probabilistic circuit on top does not affect the robustness of NPC. Note that this is in sharp contrast typical CBMs, where the linear-layer-based predictors adversely affect the robustness of the overall model [55]
Improving the adversarial robustness of neural probabilistic circuits
In this section, we propose Robust Neural Probabilistic Circuits (RNPCs). RNPCs introduce a novel approach for integrating the outputs from the attribute recognition model and the probabilistic circuit, leading to class predictions that are provably more robust than those of NPCs.
4.1 Notation and definitions
Let D == ((x, (1.k,y) v)} denote dataset, and let V == {a1:x Pp(A1: =1.k) 3 7) denote the corresponding set the attribute space that has a high probability mass, specifically larger than a constant 7 2 O. We partition V according to the most probable class a1:k is in, i.e., if y" = arg max PD = y AI:K = a1.k), then ai:K E Vy,, Overall, V = Uyey V,, and nn = 0, Vi * j. Let Ω denote the whole attribute space, and let V == 2 V denote the complement of V, which is the set of attribute instantiations with probability mass most y. In the following, we mainly focus on the attribute set V and name each 01:K as an (attribute) node. The Hamming distance between
nodes, say 01:K and K' is defined as the number of attributes in which the two nodes differ, i.e., Ham(Q1: x(.x) := ER=1 I(aa + a(²).
Definition 4.1. The inter-class distance between class i and class j is defined as the minimum Hamming distance between nodes of V, and nodes of Vj. i.e. di,j == min,,eV.,,,e,, (Ham (vi, uy)}- Definition 4.2. The minimum inter-class distance of an attribute set V is dmin == mini {dis). The radius of an attribute set V is := 1 J.
Definition 4.3. The neighborkood of class y with radius is defined the union of V and the nodes from Ve whose distance from Vy is not larger than r, Le, W(y.r) = Vy U {of.x E V min Ham (ai.x- (1.) < r].
Figure I
illustrates the high- high-probbbility attribute nodes and neighborhoods of three classes
4.2 Robust neural probabilistic circuits
RNPCs employ the same model architecture as NPCs, but use a novel inference procedure that potentially leads to more robust predictions for downstream tasks.
Model architecture and training. The architecture of RNPC is the same as that of NPC, con- sisting of an attribute recognition model and probabilistic circuit. These two modules trained independently. Specifically, the attribute recognition model is trained by minimizing the sum of cross- entropy losses over all attributes, i.e., minş কe E(e (e.001x) Σx= log Fa, (Ax = az X = x). Following Chen et al. 7 the structure of the probabilistic circuit is learned using the LearnSPN algorithm [16), and its parameters are optimized with the CCCP algorithm [17]. Note that NPC and RNPC share the same trained attribute recognition model and the same learned probabilistic circuit; the only difference between them lies in the inference procedure.
Intuition. Interpreting I Po. (Aş = ag X) as the weight of an attribute node 01:K and P.. (Y) A1:K a1:K) as the contribution of this node to Y, NPC's prediction Pe.. no (Y X) becomes

---

a weighted sum of all nodes' contributions to Y. While such predictions are generally accurate, they remain vulnerable to adversarial attacks. For example, consider an imput image depicting no-entry sign, with the attribute label ii = (red, circle, slash). For a well-trained model, both the weight of ai.k and its contribution to Yno entry are typically high, leading Uno-entry to be the most probable class. However, if an attacker attacks any m attributes, say A i.e., perturbing the predicted probabilities for these attributes, the weight of di:K will decrease due to the reduction in Pes (Ax = a XX) for k E [m]] Consequently, the weight of the set {a1:K' d1:m + dim am+ 1:K a mm++1:K 1: increases, which lies within N (Bnm--entyy)) r) when m & r. However, the contributions of these nodes (e.g.. (blue, circle, slash)) to Jnneentry could be very small, possibly causing !/ne entry no longer the most probable class. Nevertheless, if those "shifted"" weights can be aggregated and aligned with the high contribution of (i.K to Vno-entry, the adverse impact of the attacks can be alleviated.
Inference. Inspired by the example above, we propose novel inference procedure that robustly integrates the output of the attribute recognition model and the output of the probabilistic circuit to produce the final predictions. In particular, instead of adopting NPC's node- wise integration, we introduce the following class-wise integration,
D (Y (X)
Σ DEY
Po (A EN(
E V
Pu (Y A a1:x)
(2)
Equation (2) characterizes an inference procedure that integrates the weight of (neighborhood of) each class with the contribution of (high-pun -roohhbbbbbiiitty nodes of) this class to Y. Thus, RNPC's prediction ( X) becomes weighted sum of all classes' contributions to Y. In particular, &p represents an unnormalized probability. The corresponding partition function and normalized probability are denoted as (X) EgEy 00 y X) Egey (Po (AI.K E ((.rr) X) (Vgl) and
$ 10
00 (Y X)= t (Y xX/Zo(X), respectively.
In an adversarial attack, input perturbations result in perturbations in predicted attribute probabilities. If such attack shifts the probabilities originally assigned to nodes of Vy to any other nodes within N(y, r), the class-wise integration ensures that the weight of class y is barely affected. Meanwhile, the conditional probabilities generated by the probabilistic circuit remain benign. Consequently, the predictions produced by RNPC are robust.
Complexity. Let fff denote the size of the k-th neural network in the attribute recognition model, and let |S| be the size of the probabilistic circuit (i.e., the number of edges). We have the following proposition that compares the computational complexities of inference in NPC and RNPC.
Proposition 4.4. The computational complexities of inference in NPC and RNPC are respectively K k= 1fa + [S] IVI). with V < k= Axx-
O
(ΣK K k= f + [S]- - AAl)) and O
The detailed proof deferred to Appendix F Proposition shows that RNPC is more efficient than NPC in terms of the inference complexity.
4.3 Theoretical analysis
In this section, provide a theoretical analysis of the adversarial robustness and benign performance of RNPC. Similar to Definition 3.3 we first define a metric to quantify its adversarial robustness. Definition 4.5. The prediction perturbation of RNPC against an adversarial attack on the attribute recognition model is defined as the worst-case TV distance between the class distributions conditioned on the vanilla and perturbed inputs, i.e.,
max drv ($o.0 ( XX), oo (Y) x7) (x2,(X.1)
A
RNPC w
== Ex
4.3.1 Adversarial robustness of RNPCs
Lemma 4.6 (Adversarial robustness of RNPCs). The prediction perturbation of RNPC is bounded by the worst-case change in probabilities within a neighborhood caused by the attack, i.e.
Po(Au: rj X)
RNPC A 00
Ex
max XxB,(X,0)
max BEY
Pa(An: (N [X)
5

---

We denote this bound as ARNPC. Similar to NPC, the adversarial robustness of RNPC depends solely on the attribute recognition model and is not influenced by the probabilistic circuit. In particular. one can see from the above bound that, as long as the perturbation does not change the probabilities of attributes encoded in each ball N N(g r), the upper bound is 0, i.e,, the prediction robust.
4.3.2 Comparison in adversarial ro robustness
NPC and RNPC adopt node-wise and class-wise integration approaches during inference, respectively, leading to different upper bounds the prediction perturbation. Here, we investigate the relationship between these bounds and compare the adversarial robustness of NPC and RNPC.
Theorem 4.7 (Comparison in adversarial robustness). Consider p-norm-bourtn attack with a budget of E. Assume the attribute recognition model fo is randomized and satisfies e-Differential Privacy (DP) with respect to the p-norm. Let the probability of attribute taking a specific value correspond to the expected model output, i.e., Po, (Ax 0g X) =Elfo, Jyy where the expectation is taken over the randomness within the model. Under Assumption 3.2 the
adversarial
following holds: ANPC & |Ail..AAu Ot, and ARNPC & Qee where a, == max (1 e e-Ke, Ke 1}.
Moreover, there exist instances where both inequalities simultuneously hold as equalities.
The above theorem establishes the relationship between ANPC and ARNPC under the condition of DP. Specifically, compared to ARNFC. ANPc is bounded by an exponentially larger value that scales exponentially with the number of attributes. This larger bound potentially leads to significantly weaker adversarial robustness for NPC, highlighting the robustness improvement achieved by RNPC.
4.3.3 Benign task performance of RNPCs
In this section, we focus on RNPC's s benign task performance and answer the following questions: Does RNPC exhibit a compositional estimation error similar to NPC? Furthermore, while Theorem
4.7 indicates the robustness improvement of RNPC, is there trade-off in its prediction accuracy? Proposition 4.8 (Optimal RNPCs). The optimal RNPC w.r.t the expected TV distance between the predicted distribution & (Y X) and the ground-truth distribution P (Y (X) is d0' (Y X)
4' (Y / (X), where
Φ5 (Y XX) (X P' E EN(0)))
F'(Y P A1:K = =ā.:))
01:KVV;
and (X) is the partition function. Here, Pe denotes the respective ground-truth distributions. Definition 4.9. The estimation error of RNPC is defined as the expected TV distance between the predicted distribution and the optimal distribution, i.e.,
RNPC = Ex ddv (vo.w(() X). &" [x))]
Theorem 4.10 (Compositional estimation error). The estimation error of RNPC is bounded by linear combination of errors from the attribute recognition model and the probabilistic circuit, i.e.,
SRNPC 69,5
Ex
mAx
Po(ALK (A( (N(,r)) X)
(g. X)
2dv Aux),, P (Y, Al:)),
where IP* denotes respective ground-truth distributions.
Theorem 4.10 demonstrates that RNPC exhibits a compositional estimation error; improving either module w.E.. its eтrоr enhance the benign performance of RNPC.
On the other hand, under Assumption 3.1 and 3.2 is easy show that the optimal NPC corresponds to the ground-trutt distribution, which does not hold for RNPCs. Thus, we define the distance between the optimal RNPC and the ground-trun truth distribution as RNPCs' trade-off in benign performance. Theorem 4.11 (Trade-off of RNPCs). The trade-off of RNPCs in benign performance, defined as
the expected TV distance between the optimal RNPC (Y X) and the ground-truth distribution 1.( (Y X), is bounded as follows,
Ex dTv (6'(Y P), [X)] Ex max drv (P" (Y A VY), (X))]
where PY ALK E VTJ = ground-truth conditional distribution of Y given ALK Vy-
T Ee P*(Y A aI.k) represents the average

---

Theorem 4.11 characterizes an upper bound on the trade-off, which is determined by the underlying data distributions and the partitioning of the attribute space, specifically {Vy},. Changes in these factors affect the optimal RNPC"s distance from the ground-truth distribution, which can also be interpreted as the price of robustness paid by RNPCs.
5 Experiments
5.1 Experimental settings
Datasets. We create four image classification datasets. 1) MNIST-Add:: This dataset is constructed from the MNIST dataset [8]. following the standard processing procedures outlined in Manhaeve
al. [19]. Bortolotti et al. (0 Each image consists of concatenation of three digit images, with each digit serving as one attribute. The task on this dataset is to predict the sum of these three digits. 2) MNIST-Add5: This dataset is constructed similarly to MNIST-Add3, except that each image concatenates five digit images. 3) CelebA-Syn: This dataset is synthesized based on the CelebA dataset (2 using StarGAN [22]. Each synthesized image demonstrates eight facial attributes, such as hair color. Each unique combination of attribute values is assigned a group number. The task on this dataset
identify each image's s group number. 4) GTSRB-Sub: This dataset a subset the GTSRB dataset [23]. where each image represents traffic sign and is annotated with four attributes like color and shape. The task is to classify images into their corresponding sign types. To ensure certain minimum inter-class distances over the above datasets, we constrain the possible instantiations of attributes, i.e., only images aligned with these instantiations are generated or sampled. For instance, in dimenssonl attribute space, if the instantiations are limited to {0, O, 0), (2, 2, 2, the resulting minimum inter-class distance is 3. Using this approach, the minimum inter-class distances for MNIST- Add3, MNIST-Adde CelebA-Syn, and GTSRB-SHN Sub are set to 3, 5, 4, and 3.
Baseline models and architectures. We select three representative concept bottleneck models as baselines, including NPC [7]. vanilla CBM (2). and DCR [3]. We adopt independent two-layer multilayer perceptrons (MLPs) to learn different attributes in both NPC and RNPC. To ensure a fair comparison, CBM employs a two-layer MLP as its recognition module. DCR uses similar architecture with the second layer replaced with its embedding layer.
Attack configurations. To validate the robustness of RNPC, we adopt attacks that can significantly compromise the model's predictions on the attacked attribute(s). Specifically, we use the oc-norm- bounded PGD attack [II]. the morrm-bounded PGD attack M. and the 2-norm CW attack [12], all configured in the untargeted setting. Empirical results demonstrate that under our threat model, these attacks are sufficient to substantially reduce attribute prediction accuracy- often down to 0% under large norm bounds. Evaluation metrics. We adopt classification accuracy as the evaluation metric. Specifically, when testing on benign (adversarial) inputs, the accuracy is referred to as benign (adversarial) accuracy. Further details on the experimental settings can be found in Appendix F
5.2
Main results
Benign accuracy. Table that both RNPC and the baseline models perform exceptionally well across the four datasets, exhibiting benign accuracy approximating 100%. Notably, on these selected datasets, RNPC is comparable with NPC and even attains slightly higher benign accuracy on the MNIST-Add3 and MNIST-Add5 datasets. These empirical results indicate that RNPC's trade-off in benign accuracy could be negligible on these datasets.
Table 1: Benign accuracy (%) of CBM. DCR. NPC, and RNPC on four image classification datasets.
Dataset
CBM
DCR
NPC
RNPC
MNIST-Add3
99.02
98.54
99.32
99.37
MNIST-Add5
99.37
99.21
99.40
99,51
CelebA-Syn
99.83
99.45
99.95
99.95
GTSRB Sub
99.42
99.42
99.57
99.49
Unless otherwise specified, CBM refers vanilla CBM.
7

---

MNIST-Ade Ada3
MNNST-Add5
CclebA-Syn
Adverartal Accuncy
Advenuriaal Accunacy
Adversurial Accunacy
0.8
0.
0.6
CBM
CBM
CBM
04
NPC
NPC
NPC
RNFC
0.2
RNPC
90
XNPC
0.07
0.03
0.04
Nono Bound
---oom Bound
--Norm Boaad
Figure 2: Adversarial accuracy of CBM. DCR, NPC, and RNPC under the cc-norm-bounded PGD attack with varying norm bounds on the MNIST-Add3, MNIST-Add5, and CelebA-Syn datasets. The attacker attacks single attribute at time. The solid lines and the surrounding shaded regions represent the mean adversarial accuracy and the standard deviation, respectively, computed across all attacked attributes.
Adversarial accuracy. Figure 2 illustrates the adversarial accuracy of RNPC and the baseline models under the cc-norm booonde PGD attack with varying norm bounds. In this setup, the attacker attacks a single attribute time, generating an adversarial perturbation to distort the prediction result for that attribute. The solid lines and the surrounding shaded regions represent the mean adversarial accuracy and the standard deviation, respectively, computed across all attacked attributes. Additionally, Figure in Appendix G. presents presennt the accuracy of the attribute recognition model in predicting the attacked attribute, which drops to nearly 0% under large norm bounds. In Figure 2 we observe that across all datasets, the adversarial accuracy of all models decreases as the norm bound increases, demonstrating that stronger attacks cause greater harm to the models.
Importantly, NPC and RNPC consistently exhibit higher robustness compared to CBM and DCR, as their adversarial accuracy remains higher under attacks with any oo-norm bound. This finding indicates that incorporating the probabilistic circuit into a model's 's architecture can strengthen its robustness, while the task predictors used in CBM and DCR might adversely impact model robustness.
Moreover, on the MNIST-Add3 and MNIST-Add5 datasets, RNPC significantly outperforms NPC, especially under attacks with larger norm bounds. For instance, on MNIST-Add5, when the co-norm bound reaches 0. NPC's adversarial accuracy drops below 40% whereas RNPC maintains an adversarial accuracy above 80%. These results demonstrate that RNPC provides superior robustness compared to NPC on these datasets, highlighting the effectiveness of the proposed class-wise integration approach. On the CelebA-Syn dataset, RNPC performs almost the same as NPC, with both showing high robustness even under attacks with large norm bounds. The performance against the 2-norm- bounded PGD and CW attacks is deferred to Appendix G.2
5.3 Ablation studies
Impact of the number of attacked attributes. In Section 5.2 we analyze the models' performance under attacks targeting a single attribute. Here, we investigate the impact of the number of attacked attributes. To this end, vary the number of attacked attributes for the co-norm-bounde attack with a norm bound of 0. Specifically, on the MNIST-Add3 dataset, we attack the attributes "DI" ("D" stands for "Digit"), "D1, D2". and "D1, D2, D3". respectively. On MNIST-Add5. additionally attack the attributes "D1, D2, D3, D4" and "D1, D2, D3, D4, D5". The adversarial accuracy under attacks with varying numbers of attacked attributes is shown in Figure (a-b).
PGD
We observe that the adversarial accuracy of all models exhibits a downward trend as the number of attacked attributes increases, despite the perturbations remaining within the same norm bound. These results demonstrate that, compared to heavily perturbing the predicted probabilities a single attribute, perturbing the predicted probabilities of multiple attributes even if not as heavily-can have a more significant negative impact. Additionally, we find that RNPC consistently outperforms the baseline models by margin under attacks across varying numbers of attacked attributes. These results underscore the high robustness of RNPC, even with a large number of attacked attributes.
Furthermore, we discover that, when the number of attacked attributes does not exceed the radius of a dataset, RNPC has a more distinct advantage over the baseline models. Specifically, RNPC achieves up to 45% higher adversarial accuracy than the best baseline model on MNIST-Addt (r = 1) when one attribute attacked, and 37% higher on MNIST-Add5 (r = 2) when two attributes are attacked. In contrast, when this number exceeds the radius, the advantage of RNPC tends to decrease.
8

---

MNIIT-AddE
MNNIS-Ade
MNIST-
Adverartal Accuncy
DCR NPC
Advenuriall Accunacy
08
DCR
ERM
RNPC's Accurazy
NPC
0.6
66
Besige Acc
Advessanial MX
# Attacked Attihutes
Attakked Attributes
Radios r
Figure 3: (a-b): Adversarial accuracy under the oe-norm- PGD attack (norm bound = 0.11) with varying numbers of attacked attributes on MNIST-Add3 and MNIST-Add5. (c): Performance of RNPC with different values r on MNIST-Add5. This dataset has attributes, and attribute set has a radius r 2.
Impact of the radius. In Section 4.1 we define r the radius of attribute set, which is determined by the intrinsic structure of this set and fixed once the set is given. To avoid confusion, denote this intrinsic radius of an attribute set as r", In Equation (2) r appears in the formulation of RNPC. Throughout the paper, we use = r" by default. However, it can be adjusted, and in this section, we explore how varying affects the performance of RNPC. We conduct this analysis on the MNIST-Add5 dataset, which has K = 5 attributes and an intrinsic radius r 2. We vary RNPC's radius hyperparameter in the range [0, 5] and evaluate both benign and adversarial accuracy under an oc- bo-boudded PGD attack with a norm bound of 0.11.
hyperparameter
We begin with benign accuracy. As increases from 0 to 4, we observe decreasing logit gap between the top-1 and top-2 predicted classes. Nevertheless, RNPC maintains near-perfect accuracy across this range (see Figure (c)) (c). However, when reaches 5, accuracy drops sharply 29.9%. This is expected because, at (A( E NN, X) (A E X) 1. As result, Equation (2) no longer incorporates any meaningful information from the input X.
5, the neighborhood. /V ( r) spans the entire attribute space, ie.,
Next, we examine adversarial performance. When r", decreasing reduces adversarial accuracy. Conversely, increasing r beyond r* also causes accuracy degradation. This indicates that the intrinsic radius r' is optimal in the sense that deviating from r"-in either direction- hurts robustness. Nevertheless, RNPC remains substantially more robust than other baseline models in these settings, the baselines achieve less than 40% adversarial accuracy (see Figure 2 when r = 5, adversarial accuracy falls to 29.9%, matching the benign accuracy and leading to a prediction perturbation of RNPC 0. This is consistent with our theoretical findings, as Lemma 4.6 8. indicates that the upper bound on perturbation becomes zero in this case. Overall, when * K, RNPC demonstrates strong resilience to changes in r under benign settings; while its adversarial accuracy declines when deviates from r", RNPC remains superior to other baseline models.
(middle)). Notably,
Impact of spurious correlations. Figure (a) illustrates the adversarial accuracy of CBM, DCR, NPC, and RNPC the GTSRB-SUI Sub dataset, under the co-norm- bounded PGD attacks with varying norm bounds. We observe that RNPC and NPC exhibit similar performance, with both achieving higher adversarial accuracy compared to CBM and DCR under attacks with small norm bounds. However, as the norm bound increases, the advantage of RNPC and NPC gradually diminishes.
We hypothesize that, when the attribute recognition model is trained to recognize specific attribute, the model might capture an unintended relationship between this attribute and the no-occurring features of other attributes. For instance, the shape "diamond" always co-occurs with the color "white" on the GTSRB-Sub dataset. Consequently, the model might rely on the features of the "diamond" shape to determine whether the color of an input image is "white". Such unintended relationships, known as spurious correlations, are a common phenomenon in neural networks 124, 25). Due to the potential spurious correlations, attacking one attribute leads to attacking multiple attributes. We name such a phenomenon as attack propagation.
The results in Figure 4 (b) validate our hypothesis. Specifically, attacking any single attribute on the GTS dataset leads to a significant drop in the accuracy of recognizing other attributes. That is, although the attack targets only one attribute, the attack propagation induces more attacked attributes. As discussed in the study on the impact of the number of attacked attributes, when this number exceeds the radius of dataset (r = 1 for GTSRB-Sub), the performance of RNPC could be compromised. Potential solutions for mitigating the attack propagation are discussed in Section More ablation studies are deferred to Appendix G.3

---

GTSRB-Sub
GTSRR-Suh
GTSRB Sub (with AT)
110
Adversriall Accuncy
0.3
Attribucc Accuracy
088
Antrhute Accurayy
0.8
0.6
DCR
0.6
06
NPC
004
ENTT.
0.2
NPC-AT
02
0.0
RNFC AT
No0c
Shape
Systhol
Test
Coli
Stape
Systhol
Tou
--oo Bound
Attacked Alrihune
Attacked Attrillute
Figure 4: (a): Adversarial accuracy under the ce-norm-bounde PGD attack with varying norm bounds on GTSRB-Sub. The attacker attacks single attribute at time. Solid lines and shaded regions represent the mean adversarial accuracy and the standard deviation, computed across all attacked altributes. (b): Accuracy of NPC and RNPC's attribute recognition model in recognizing various attributes under the oc-norm- bounded PGD attack (norm bound = 0.11] targeting different single attribute. (c): Same setting as (b), but using adversarially trained attribute recognition models for NPC and RNPC.
Related work
Robustness of concept bottleneck models. Exploring the robustness of CBMs against adversarial attacks is crucial for understanding their reliability in practical applications. Specifically, Sinha et al. [5] demonstrate that when the predicted concept probabilities are perturbed by attacks, CBMs often produce incorrect predictions. They further investigate how to ensure that the predicted concept probabilities remain unchanged under adversarial attacks, thereby improving the robustness of CBMs, and propose training algorithm for CBMs based adversarial training. Differently, our work admits the changes the predicted concept probabilities and explores the question: Can we make CBMs robusi even when the predicted concepi probabilities are perturbed by adversarial altacks? comprehensive literature review on CBMs, adversarial attacks, the robustness of CBMs, and the robustness of DNNs using probabilistic circuits is provided in Appendix A
Discussion
In this section and Appendix B we discuss the limitations of RNPC and explore potential solutions.
Mitigating the attack propagation effect. Section 5.3 shows that RNPC suffers from the attack propagation effect, which arises from spurious correlations learned by the attribute recognition model. Conventional solutions for mitigating these correlations include data augmentation [26, (7)), adversarial-training- counterfactual data generation (28 29]. etc. Here, we propose an adversarial training- bbssd approach that leverages adversarial examples to disentangle spurious correlations between attributes. Suppose the model relies on the feature of white to identify the shape diamond. An adversarial example that perturbs the color attribute can shift its feature from white toward some another color, thereby weakening its association with diamond.
To achieve this, we generate adversarial examples that target a randomly selected attribute during training and train the model on both the adversarial and benign samples. As shown in Figure (c), compared to models trained without adversarial training (see Figure (b)), adversarially trained models exhibit significantly smaller drops in accuracy of other attributes when specific attribute is attacked. This demonstrates a reduction in the attack propagation effect. Consequently, Figure 4 (a) shows that the robustness of both NPC and RNPC is enhanced, outperforming other bascline models across different attack norm bounds.
8 Conclusions
In this paper, we delve into the adversarial robustness of Neural Probabilistic Circuits (NPCs), showing that incorporating a probabilistic circuit into a model's architecture does not affect the robustness of the overall model. Moreover, we improve the robustness of NPCs by introducing class-wise integration inference approach that produces robust predictions. Both theoretical and empirical results across various datasets and attacks demonstrate that the resulting model, named RNPC, achieves higher robustness. Due to the space limit, a more detailed conclusion is presented in Appendix C
10

---

Acknowledgment
This work is supported by NSF IIS grant No. 2416897, NSF III grant No. 2504555 and an NSF CAREER Award No. 2442290. HZ would like to thank the support of Google Research Scholar Award and Nvidia Academic Grant Award. The views and conclusions expressed in this paper are solely those of the authors and do not necessarily reflect the official policies or positions of the supporting companies and government agencies.
References
[1] Cynthia Rudin. Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead. Nat. Mach. Intell.. (()):206-115 2019.
[2] Pang Wei Koh, Thao Nguyen, Yew Siang Tang, Stephen Mussmann, Emma Pierson, Been Kim, and Percy Liang. Concept bottleneck models. In ICML, volume 119 of Proceedings of Machine Learning Research, pages 5338-5348, 2020.
[3] Pietro Barbiero, Gabriele Ciravegna, Francesco Giannini, Mateo Espinosa Zarlenga, Lucie Char- lotte Magister, Alberto Tonda, Pietro Lio, Frédéric Precioso, Mateja Jamnik, and Giuseppe Marra. Interpretable neural-symbolic concept reasoning. In ICML, volume 202 of Proceedings of Machine Learning Research, pages 1801-1825, 2023.
[4] Eunji Kim, Dahuin Jung, Sangha Park. Siwon Kim, and Sungroh Yoon. Probabilistic concept bottleneck models. In ICML, volume 202 of Proceedings of Machine Learning Research, pages 16521-16540, 2023.
[5] Mert Yüksekgönül, Maggie Wang, and James Zou. Post-hoc concept bottleneck models. In ICLR, 2023.
[6] Tuomas P. Oikarinen, Subhro Das, Lam M. Nguyen, and Tsui- Wei Weng. Label-free concept bottleneck models. In ICLR, 2023.
[7] Weixin Chen, Simon Yu, Huajie Shao, Lui Sha, and Han Zhao. Neural probabilistic circuits: Enabling compositional and interpretable predictions through logical reasoning. arXiv preprint arXiv:2501.00221, 2024.
[8] Weixin Chen, Simon Yu, Huajie Shao, Lui Sha, and Han Zhao. Neural probabilistic circuits: An overview. In Eighth Workshop Tractable Probabilistic Modeling, 2025.
[9] Hoifung Poon and Pedro M. Domingos. Sum-product networks: A new deep architecture. In UAI, pages 337-346, 2011.
[10] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In ICLR, 2015.
[11] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[12] Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. IEEE SP, pages 39-57, 2017.
[13] Xiaoyi Chen and Ni Zhang. Layer- wise adversarial training approach to improve adversarial robustness. In IJCNN, pages 1-8, 2020.
[14] Arash Rahnama, Andre T Nguyen, and Edward Raff. Robust design of deep neural networks against adversarial attacks based on Yyарunov theory. In CVPR, pages 8178-8187, 2020.
[15] Sanchit Sinha. Mengdi Huai, Jianhui Sun, and Aidong Zhang. Understanding and enhancing robustness of concept-based models. In AAAI, pages 15127-15135, 2023.
[16] Robert Gens and Pedro M. Domingos. Learning the structure of sum-product networks. In ICML, pages 873-880 2013.

---

[17] Han Zhao, Pascal Poupart, and Geoffrey J. Gordon. A unified approach for learning the parameters of sum-product networks. In NeurlPS, pages 433 441441, 2016.
[18] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proc. IEEE, 86(11):227--3222 1998.
[19] Robin Manhaeve, Sebastijan Dumancic, Angelika Kimmig, Thomas Demeester, and Luc De Raedt. Deepproblog: Neural probabilistic logie programming. In NeurlPS, pages 3753-3763, 2018.
[20] Samuele Bortolotti, Emanuele Marconato, Tommaso Carraro, Paolo Morettin, Emile van Krieken, Antonio Vergari, Stefano Teso, and Andrea Passerini. A neuro-symbolic bench- mark suite for concept quality and reasoning shorteuts. In NeurlPS (Track on Datasets and Benchmarks), 2024.
[21] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, pages 7730-3738, 2015.
[22] Yunjey Choi, Min-Je Choi, Munyoung Kim, Jung- Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Unified generative adversarial networks for multi-domain image-to-image translation. In CVPR, pages 8789-8797, 2018.
[23] Johannes Stallkamp, Mare Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: A multi-class classification competition. In IJCNN, pages 1453-1460,
2011.
[24] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard S. Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut learning deep neural networks. Nut. Mach. Intell., 2(1 11166566673, 2020.
[25] Wenqian Ye, Guangtao Zheng, Xu Cao, Yunsheng Ma, and Aidong Zhang. Spurious correlations in machine learning: A survey. arXiv preprint arXiv:2402.12271 127155 2024.
[26] Connor Shorten and Taghi M. Khoshgoftaar. A survey on image data augmentation for deep learning, J. Big Data, 6:60, 2019.
[27] Maximilian Isse, Jakub Tomezak, and Patrick Forré Selecting data augmentation for simulating interventions. In ICML, volume 139 of Proceedings of Machine Learning Research, pages 4555,4562, 2021.
[28] Axel Sauer and Andreas Geiger. Counterfactual generative networks. In ICLR, 2021.
[29] Divyansh Kaushik, Eduard H. Hovy, and Zachary Chase Lipton. Learning the difference that makes A difference with counterfactalll--agmeneed data. In ICLR, 2020.
[30] Mateo Espinosa Zarlenga, Pietro Barbiero. Gabriele Ciravegna, Giuseppe Marra, Francesco Giannini, Michelangelo Diligenti, Zohreh Shams, Frédéric Precioso, Stefano Melacci, Adrian Weller, Pietro Lió, and Mateja Jamnik. Concept embedding models: Beyond the accuracy- explainability trade-off. In NeurIPS, 2022.
[31] Chih-Kuan Yeh, Been Kim, Sercan Ömer Arik, Chun-Liang Li, Tomas Pfister, and Pradeep Ravikumar, On completeness-aware concept-based explanations deep neural networks. In NeurlPS, 2020.
[32] Dmitry Kazhdan, Botty Dimanov, Mateja Jamnik, Pietro Liò, and Adrian Weller. Now you see me (CME): concept-based model extraction. In CIKM, volume 2699 of CEUR Workshop Proceedings, 2020.
[33] Anita Mahinpei, Justin Clark, Isaac Lage, Finale Doshi- Doshi-Velez, and Weiwei Pan. Promises and pitfalls of black-box concept learning models. arXiv preprint arXiv:2106. 133114 2021.
[34] David M. Rodríguez, Manuel P. Cuéllar, and Diego Pedro Morales. Concept logic trees: enabling user interaction for transparent image classification and saman-in-the-loge learning. Appl. Intell., 5465):3667-3679 2024.
12

---

[35] Naveed Akhtar and Ajmal S. Mian. Threat of adversarial attacks on deep learning in computer vision: A survey, IEEE Access, 6: 6:14410-14430, 2018.
[36] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR Workshop, 2017.
[37] Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In EuroS&P, pages 372-387, 2016.
[38]
Seyed-Mohser Noosavi-Dezfooll Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In CVPR, pages 2574-2582, 2016.
[39] Bader Rasheed, Mohamed Abdelhamid, Adil Khan, Igor Menezes, and Asad Masood Khat- tak. Exploring the impact of conceptual bottlenecks on adversarial robustness of deep neural networks. IEEE Access,
2024.
[40] Nezihe Merve Gürel, Xiangyu Qi, Luka Rimanic, Ce Zhang, and Bo Li. Knowledge en- hanced machine learning pipeline against diverse adversarial attacks. In ICML, volume 139 of Proceedings of Muchine Learning Reseurch, pages 3976-3987, 2021.
[41] Zhuolin Yang. Zhikuan Zhao, Boxin Wang, Jiawei Zhang. Linyi Li, Hengzhi Pei, Bojan Karlas, Ji Liu, Heng Guo, Ce Zhang, and Bo Li. Improving certified robustness via statistical learning with logical reasoning. In NeurlPS, 2022.
[42] Jiawei Zhang, Linyi Li, Ce Zhang, and Bo Li. CARE: certifiably robust learning with reasoning via variational inference. In Sa7MI. pages 554-574, 2023.
[43] Mintong Kang, Nezihe Merve Gürel, Linyi Li, and Bo Li. COLEP: certifiably robust learning- reasoning conformal prediction via probabilistic circuits. In ICLR, 2024.
[44] Matthew Richardson and Pedro M. Domingos. Markov logic networks. Mach. Learn., 62(1-2): 107-136, 2006.
[45] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
[46] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pages 248-255, 2009.
[47] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In ICML, volume 139 of Proceedings of Muchine Learning Research, pages 8748-8763, 2021.
[48] Jingyi Xu, Zilu Zhang, Tal Friedman, Yitao Liang, and Guy Van den Broeck. A semantic loss function for deep learning with symbolic knowledge. In ICML. volume 80 of Proceedings of Machine Learning Research, pages 5498-5507, 2018.
[49] Thomas Winters, Giuseppe Marra, Robin Manhaeve, and Lue De Raedt. Deepstochlog: Neural stochastic logic programming. In AAAI, pages 10090-10100, 2022.
[50] Emile van Krieken, Thiviyan Thanapalasingam, Jakub M. Tomezak, Frank van Harmelen, and Annette ten Teije. A-nesi: A scalable approximate method for probabilistic neurosymbolic inference. In NeurlPS, 2023.
[51] Jiani Huang, Ziyang Li, Binghong Chen, Karan Samel, Mayur Naik, Le Song, and Xujie Si. Scallop: From probabilistic deductive databases to scalable differentiable reasoning. In NeurIPS, pages 25134-25145, 2021.
[52] Kareem Ahmed, Stefano Teso, Kai-Wei Chang, Guy Van den Broeck, and Antonio Vergari. Semantic probabilistic layers for neuro-symbolic learning. In NeurIPS, 2022.
[53] Kareem Ahmed, Kai-Wei Chang, and Guy Van den Broeck. A pseudo-semantic loss for autoregressive models with logical constraints. In NeurIPS, 2023.
13

---

[54] Connor Pryor, Charles Dickens, Eriq Augustine, Alon Albalak, William Yang Wang, and Lise
Getoor. Neupsl: Neural probabilistic soft logic. In IJCAI, pages 4145 2023.
[55] Zhun Yang, Adam Ishay, and Joohyung Lee. Neurasp: Embracing neural networks into answer set programming. In IJCAL, pages 1753-1762, 2020.
[56] Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950, 2020.
[57] Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In IEEE SP, pages 656-672, 2019.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The claims made in the abstract and introduction match theoretical and experimental results. Furthermore, claims in the introduction include the main contributions of the paper.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
It is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Appendix (ependixxBcoopredee comprehensivvll discusses the limitations of the work, including perspectives of scaling to concept-annotation free datasets, augmenting the radius of dataset, mitigating the attack propagation effect, and reducing the complete information assumption. Furthermore, this section provides potential solutions and highlights promising future directions.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specificattin, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
15

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Assumptions are stated clearly in each theorem lemma. In addition, Ap- pendix H provides a detailed proof for each theoretical result.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems. The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
The contribution of this paper is primarily a new algorithm. Section 4.1 through 4.2 provide detailed steps for reproducing the algorithm. For replicating the experimental results, Section 5. in the main paper and Appendix [F] offer comprehensive information on the experimental setting, including dataset construction, implementation details such as model architecture and training parameters, attack configurations like norm bounds and step sizes, as well as evaluation metrics.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
detailed
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
16

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The paper provides the data and code in the supplementary materials, with sufficient instructions in the README file.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cer
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https for more details.
/ //nips. t/tips.ccppubll..// wwtpppbicc/guuesee.eeoeepspeeeee heabll//guuddes/odeeuubiiiis wwweeesuummsssoooooo...
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: Section 5.1 in the main paper and Appendix Foffer comprehensive information on the experimental setting, including dataset construction, implementation details such as model architecture and training parameters, attack configurations like norm bounds and step sizes, as well as evaluation metrics.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
17

---

Justification:
Results (e.g., Figure 8 are accompanied by error bars. These bars are clearly explained in the text, both hgurr captions and experimental analysis in particular.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Information on the computer resources (e.g., type of compute workers, time of execution) reported in Appendix in Table 2 in particular.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: The research conducted in the paper conforms, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- cration due to laws or regulations their jurisdiction).
10. Broader impacts
18

---

Question:
Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Broader impacts are discussed in Appendix D We expect our work will not have any negative societal consequences if there is any.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question: Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The authors cite the original papers that produced the code package or dataset, and include the name of the license for each dataset.
Guidelines:
19

---

The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thcode. com/ com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The paper provides the new assets in the supplementary materials, with detailed documentation in the README file.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
20

---

Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
21

---

Appendix contents
More related work
22
B More discussions
24
Detailed conclusions
25
D Broader impact
25
Computational complexity comparison
26
More details on experimental settings
26
Dataset construction)
26
Implementation details
28
Attack configurations
28
More experimental results
29
Performance for the attacked attrihute
G.2
Performance against more adversarial attacks
29
More ablation studies
30
Theoretical results with omitted proofs
31
Adversarial robustness of NPCs
31
Adversarial robustness of RNPCs
32
Comparison in adversarial robustness
32
H.4 Benign task performance of RNPCs
34
A
More related work
Concept bottleneck models. Concept bottleneck models (CBMs) were first introduced in Koh et al. (2). These models are constructed by combining a concept recognition model with a task predictor. The concept recognition model, typically based on neural networks, takes an image input and outputs probabilities for various high-level concepts, such as "red "red_color" and "white_colorr.. The task predictor, often a linear model, determines the final class based on these predicted concept probabilities. Thanks to the simplicity of the linear predictor, the class predictions can be interpreted terms of the predicted concept probabilities.
Follow-up works primarily focus on improving two aspects: the model's performance on downstream tasks and its interpretability. 1) Improving task performance: Rather than using layer of concept probabilities as the bottleneck, Zarlenga et al. (30), Yeh et al. [31]. Kazhdan et al. (32 Kim et al. 4] Mahinpei al. (33] propose the use of concept embeddings. Specifically, the concept recognition model generates high-dimensional embeddings for various concepts, and the task predictor determines the final class based these embeddings. Since an embedding typically encodes more information than a single probability, these models often achieve better performance on downstream tasks compared vanilla CBMs. However, the interpretability these models is significantly compromised because the dimensions of the embeddings lack clear semantic meaning, and class predictions cannot be interpreted using the semantics these embeddings. 2) Enhancing model interpretability: To further enhance the interpretability of CBMs, several works introduce novel interpretable architectures for the task predictor. For instance, Barbiero et 3 propose a Deep Concept Reasoner (DCR) that allows class predictions to be interpreted through leamned logical rules over the predicted concepts.
22

---

Similarly, Rodriguez et al. [34] employ soft decision tree, where class predictions are generated by following specific branches within the tree. More recently, Chen al. 7 explore the use of probabilistic circuits as task predictors, introducing new model called Neural Probabilistic Circuits (NPCs). Specifically, NPC treats each group of concepts (e.g. rred_color", "white catteee_oooo)__ as one attribute (e.g., "color") and consists of two modules: an attribute recognition model and probabilistic circuit. The neural-network seall--ttwor-bbeee -based attribute recognition model takes an image as input and outputs probability vectors for various human-underssandable attributes. The probabilistic circuit learns the joint distribution over the class variable and the attribute variables, while also supporting tractable marginal and conditional inference. Combining the outputs from the attribute recognition model and the probabilistic circuit, NPC produces class predictions that can be interpreted using the predicted probabilities of various attributes and the conditional dependencies between attributes and classes. Furthermore, Chen et al. 7 demonstrate that NPC exhibits a compositional estimation error, which is upper bounded by linear combination of errors from its individual modules. Thanks to the integration of the probabilistic circuit, NPC achieves performance competitive with end-to-end DNNs while offering enhanced interpretability..
Ad Adversarial attacks. Adversarial attacks 35 refer to the process of deliberately crafting small, often imperceptible, perturbations to input images with the aim of misleading neural networks into predictiooni
producing incorrect predictions. To ensure the imperceptibility of the crafted perturbations, adversarial attacks are typically norm- boundde meaning the magnitude of the perturbation is constrained under a specified norm, such as L1, L2, or Los. Classical adversarial attacks include FGSM [T), BIM [6), PGD M. CW [2]. JSMA (37], and DeepFool (38]. The success of adversarial attacks underscores the vulnerabilities of neural networks, raising critical concerns about their robustness and reliability in practical applications.
According to the attacker's knowledge of the model, adversarial attacks can be categorized into white- box attacks and black-box attacks. In white-box attacks, the attacker has full access to the model's s architecture and parameters, whereas black-box attacks only have access to the model's outputs, relying on query-based transfer-based strategies to generate adversarial perturbations. According to the attacker's ' goal, adversarial attacks can be categorized into targeted attacks and untargeted attacks. In targeted attacks, the attacker aims to mislead the model into predicting specific, incorrect label, while untargeted attacks focus on causing the model to produce any incorrect output. In this paper, we focus on white-box, untargeted adversarial attacks. In particular, we select the ---norm-bounded CW attack [1].
PGD attack 11 the senorm-boundee PGD attack [1], and the
Robustness of concept bottleneck models. By incorporating high-level, human-understandable concepts as an intermediate layer, Concept Bottleneck Models (CBMs) provide interpretable pre- dictions that can be explained through the predicted concepts, thereby enhancing their reliability in practical applications. However, as the architectures of CBMs typically rely on neural networks, they be vulnerable to adversarial attacks 110] Exploring such vulnerabilities is crucial for understanding the potential threats underlying CBMs. In particular, Rasheed et al. [39], Sinha et al. [15], as well as work, investigate the robustness of CBMs against adversarial attacks. Despite this shared focus, these studies address distinctly different problems.
Rasheed et al. (39 investigate the question: Compared to DNNs, how robust are CBMs against adversarial attacks designed mislead class predictions? Their findings reveal that CBMs inherently exhibit higher robustness than their standard DNN counterparts. In contrast, Sinha et al. [15] and our work focus on adversarial attacks that target concept predictions rather than class predictions.
Sinha et al. 15 demonstrate that when the predicted concept probabilities are perturbed by adversarial attacks, CBMs often produce incorrect predictions. Given this vulnerability, they investigate how to ensure that the predicted concept probabilities remain unchanged under adversarial attacks, thereby improving the robustness of CBMs. To achieve this, they propose a training algorithm for CBMs based on adversarial training.
In contrast, our work admits the changes in the predicted concept probabilities and explores different question: Can we make CBM, NPC in particular, robust even when the predicted concept probabilities are perturbed by adversarial attacks? We demonstrate that by employing class-wine wiss integration approach, the final predictions of NPC are provably more robust. We also theoretically show that, unlike the linear model, the probabilistic cireuit on top of the recognition module free for robustness.
23

---

Improving robustness of end-to-end DNNs using probabilistic circuits. A line of research 44 43 explores leveraging probabilistic models sush as Markov logic networks 44 and probabilistic circuits [-] to enhance the adversarial robustness of end-to-end DNNs. These approaches typically rely on a high-perre -erffofrormeeee but vulnerable DNN to predict class labels for inputs that may contain adversarial perturbations. A probabilistic-mode potentially erroneous predictions made by the DNN. This predict-then-cowe paradigm contrasts with our approach, which aims to build a robust and interpretable model from scratch, without relying on a nigh-performance DNN as the prime predictor.
reasoning module is then used to correct
This fundamental difference in objective also leads to differences in the problem setting. Following the framework of concept bottleneck models [2] 30), we assume access set of interpretable concepts/atrribttes that are sufficient to distinguish images from different classes. In contrast, the above research treats concept- based knowledge as auxiliary information used solely for correcting DNN predictions, and may consider only a limited set of attributes (e.g., shape alone).
Among the research, Kang et al. [43] also employ probabilistic circuits. However, there are key differences in how probabilistic circuits are utilized. Specifically, our approach fully exploits the expressive power of probabilistic circuits: we learn smooth and decomposable circuits that represent the joint distribution over attributes and classes. This structure enables efficient inference-joint, marginal, and conditional distributions can all be computed with at most two forward passes through the circuit, highlighting the advantage of tractable probabilistic reasoning.
In contrast, Kang al. [45] use probabilistic circuits less efficiently. Rather than modeling the joint distribution explicitly through the circuit's structure and edge weights, they define a factor function that computes the factor of each instantiation of attributes and class labels, which is essentially the exponential of the corresponding joint probability. These factors are treated as leaf nodes in the circuit. When particular instantiation is provided input, product node connecting the corresponding factor leaf is activated, causing the circuit to output the associated joint probability. As a result, their circuit behaves more like an arithmetic circuit composed of sum and product nodes that performs arithmetic using factors, rather than a typical probabilistic circuit with embedded probabilistic semantics and tractable inference capabilities.
B More discussions
In this section, we discuss the limitations of RNPC and explore potential solutions and promising future directions.
Scaling to concept-annotation--ie datasets. Consistent with standard concept bottleneck mod- els 2 30, our work assumes access to concept annotations within the dataset. However, many image classification datasets such as CIFAR-10 (45) and ImageNet (46) lack such annotations, potentially limiting the applicability of our approach. Inspired by recent progress in label-free concept bottleneck models (5] 6) we can extend RNPC to annotation- settings by using multi- modal models [47] to transfer concepts from other datasets or from natural language descriptions of concepts.
The computational complexity of RNPC is O (ΣK I& |S| 151++s)--11))
Scaling to more attributes.
This means the complexity can be as low as [ when each class only has one high-probability attribute assignment, but can grow exponentially with K in the worst case. Scalability remains a fundamental challenge for neuro-symbolic models, particularly those grounded in graphical model structures. Recent efforts have begun exploring ppproximation-basee approaches to address this issue. That said, as demonstrated in Proposition 4.4 RNPC achieves a substantial reduction in computational complexity compared to NPC.
where [V| = = (Vyl= E [
Augmenting the radius of a dataset. The inference procedure of RNPC relies on neighborhoods of various classes defined by a specific radius. Experimental results in Section [5.3 demonstrate that RNPC's 's performance under attacks is highly correlated with this radius. Specifically, when the number of attacked attributes does not exceed the radius, RNPC typically achieves high adversarial accuracy. Moreover, larger radius generally leads to higher robustness against attacks. The radius determined by the intrinsic properties of the dataset. For real-world datasets, the radius can be very small. For example, the original GTSRB datasct [23) has minimum class distance of 1,
24

---

resulting in a radius of O. Such a small radius can limit RNPC's robustness against attacks. Conversely, augmenting this radius can enhance RNPC's performance.
A naive approach to augmenting the radius is to repeat certain attributes in the attribute annotations. For instance, the set ((0, 0), (0. 1)} has minimum inter-class distance of 1. If the second attribute is repeated, resulting in the set {(0, O, 0), (0, 1, 1, the minimum inter-class distance increases by More generally, if an attribute repeated m times, the minimum inter-class distance dmin can increase by up to m. Another solution is to introduce new attributes that provide additional semantics for the downstream recognition tasks. These new attributes can potentially increase the radius. However, introducing new attributes requires additional annotation efforts, which may be challenging for large-scale datasets.
Reducing the complete information assumption. Assumption 3.2 assumes that each input image contains complete information about all attributes, suggesting that the attributes conditionally mutually independent given the input. This assumption, commonly referred to as the conditional independence assumption, is widely adopted in neuro-symbolit learning frameworks [19] 48/51). From a computational perspective, this assumption enables a factorization of the joint distribution
over attributes into independent marginal distributions, i.e., (A X) I Po,(A, X),
which significantly reduces parameter complexity. Although this assumption is relatively mild, we consider the possibility of relaxing it in future work. When the complete information assumption does not hold, one could instead model the full joint distribution Pa (Ai.K X) using a single expressive model (5) While this approach introduces higher parameter complexity. it allows the model to capture interdependencies among attributes and accurately represent more complex joint patterns.
C Detailed conclusions
In this paper. we provide an understanding of the adversarial robustness of the Neural Probabilistic Circuit (NPC). Moreover, we improve the robustness of NPC by introducing class- wise integration inference approach that produces robust predictions, and name the resulting model as RNPC.
Theorem 3.4 and Theorem demoonstt the adversarial robustness of NPC and RNPC, respectively, showing that their robustness is upper bounded by the robustness of their attribute recognition models. These results also suggest that using a probabilistic circuit the task predictor does not impact the robustness of the overall model. Theorem 4.7 compares these two bounds, showing that RNPC enhances the robustness of NPC under certain conditions. Furthermore, we analyze RNPC's benign performance on downstream tasks. Theorem 4.10 demonstrates the compositional estimation error of RNPC, showing that its estimation error is upper bounded by a linear combination of errors from its individual modules. Finally, Theorem 4.11 presents the distance between the optimal RNPC and the ground-tran trutt distribution, revealing a trade-off between adversarial robustness and benign performance.
Empirical evaluations on diverse image classification datasets, under three types of adversarial attacks with varying norm bounds, demonstrate that RNPC achieves superior robustness compared with three baseline models while maintaining high accuracy on benign inputs. Additionally, ablation studies on the impact of the number of attacked attributes show that RNPC exhibits high robustness across varying numbers of attacked attributes. Besides, we observe that the spurious correlations captured by the attribute recognition model can induce attack propagation, which may compromise the robustness of RNPC.
Overall, with the proposed class-wise integration inference approach, RNPC achieves high robustness, capable of making correct class predictions even if the predicted attribute distributions perturbed by adversarial attacks.
D Broader impact
This paper aims to understand and improve the robustness of neural probabilistic circuits against adversarial perturbations. Specifically, we propose a class-wise integration inference method and demonstrate that the resulting model is more robust under certain assumptions. Improving adversarial robustness enhances the trustworthiness of machine learning models, making them more reliable for deployment in real-world scenarios, especially in high-stakes applications. We expect that our method
25

---

Table 2: Comparison of training and inference time for NPC and RNPC the MNIST-Add3, MIIIT-Add5,
CelebA-Syn datasets.
Dataset
Phase
NPC
RNPC
Training
78m
MNIST-Add3
Inference
6.78s
4.78s
Training
136m
MNIST-Add5
Inference
16.52s
8.57s
Training
381 m
CelebA-Syn
Inference
14.19s
8,58s
will inspire further research into enhancing the robustness of cxisting interpretable architectures or building interpretable and robust model from scratch.
E
Computational complexity comparison
This section presents comparison of the computational complexity between NPC and RNPC in both the training and inference phases.
Training. Since NPC and RNPC share the trained attribute recognition model and the same learned probabilistic circuit, their training complexities are identical. The practical training time across various datasets is reported in Table 2 with all experiments conducted using eight NVIDIA RTX A6000 GPUs.
Inference. Let [&&] denote the size of the k-th neural network in the attribute recognition model, and let [S] denote the size of the probabilistic circuit (i.c., the number of edges). During inference, given input sample, forward pass through all K neural networks in the attribute recognition model incurs a computational cost of O lffl). According the node-wise integration defined in Equation (1) NPC requires performing conditional inference over the probabilistic circuit I |Ap times, resulting in the overall inference complexity:
K
Σ
f&l++ 1
In contrast, according to the class-wise integration defined Equation 2 performing conditional inference over the probabilistic circuit [V] times, where V == Ujey Vy. resulting in the overall inference complexity:
RNPC only requires
K
[u + +1s---M)) Σ
K By construction, V C Ω = (a1:K) and therefore, V & IT AAxl It follows that O [fa [S] |V]) < O k=1 ffll + [S]. II (Al)). Thus, RNPC is more efficient than NPC in terms of
the inference complexity.
As expected, the practical inference time of RNPC, shown in Table is consistently faster than NPC. All inference was performed on single NVIDIA RTX A6000 GPU.
In summary, RNPC shares the same training complexity NPC but offers better efficiency during inference.
More details on experimental settings
F.1 Dataset construction
we describe the main properties (e-g., attributes, downstream tasks) of various datasets. Here, provide additional details about the construction process of each dataset.
In Section 5.1
26

---

MNIST-Add3 dataset. In this dataset, each image concatenates three digit images from the MNIST dataset [8] under the CC BY-SA 3.0 license. These digit images are applied with different transformations to introduce the domain shifts between them, which include rotations and color modifications. The three digits serve as the attribbtes for this dataset. The downstream task is to predict the sum of these attributes. To construct the dataset, we first identify an attribute set within the three-dimensional attribute space, ensuring a minimum inter-class distance of 3. Correspondingly, the radius of this attribute set is 1. The randomly selected attribute set V is {16 3 7J. [9 6 8J. [0 2 4), [3 O 51, 15 5 11. [7 4 3], [2 7 6]. [4] 2]. [1 9 0J. [8 8 9]}. Each attribute node in V results in a unique attribute sum, leading to total of 10 classes for the downstream task. Next, images for each class by concatenating images of specific digits corresponding to the attributes. For example, to generate an image belonging to class 16, we concatenate a digit-6 image, digit-3 image, and a digit-7 image in sequence. To introduce variability, we incorporate 1% labeling noise into the dataset. Specifically, this involves randomizing either the class labels or the attribute labels. In total, we generate 63,130 images and split them into training, validation, and testing sets by a ratio of 8:1:1. Example testing images are illustrated in (g
generate
MNIST-Add5 dataset. In this dataset, each image concatenates five digit images from the MNIST dataset [8] under the CC BYSSA 3.0 license. These digit images are applied with different transfor- mations to introduce the domain shifts between them, which include rotations, color modifications, and blurring. The five digits serve the attributes for this dataset. The downstream task is predict the sum of these attributes. To construct the dataset, we first identify an attribute set within the five-dimensional attribute space, ensuring minimum inter-class distance of 5. Correspondingly,
the radius of this attribute set is 2. The randomly selected attribute set V is [[6 3 7 4 6), [0 9 3 1]. [5 0 2 31 [2 7 8 5 4], [8 2 9 8), [7 5 0 0]. [3 4 6 1 2]. [4 1 3 0 5], [1 6 2 8 9), [98 7 7]). These attribute nodes result in 7 different attribute sums, leading to a total 7 classes. Note that a class (e.g., class 26) may correspond
multiple attribute nodes in V. Next, we generate images for each class by concatenating images of specific digits corresponding to the attributes. For example, to generate an image belonging to class 32, we concatenate a digit-9 image, a digit-8 image, digit-1 image, and two digit-7 7 images in sequence. To introduce variability, we incorporate 1% labeling noise into the dataset. Specifically, this involves randomizing either the class labels or the attribute labels. In total, we generate 63,130 images and split them into training, validation, and testing sets by a ratio of 8:1:1. Example testing images are illustrated in Figure
9 1 3
(a) MNIST-Add3
(b) MNIST-Add5
Figure 5: Examples of testing images from the MNIST-Add3 and MNIST-Add5 datasets. (a) A testing image from the MNIST-Add3 dataset, corresponding to the attribute node [6. 3, 7]. (b) A testing image from the MNIST-Add5 dataset, corresponding to the attrihute node [5, 0, 9, 2, 3].
CelebA-Syn dataset. This dataset is constructed based on the CelebA dataset 21 under its non-commercial research license, which includes annotations for forty facial attributes. In particular, select eight of them that are visually easy to distinguish, which are Color Hair, Double, Dhinne_Chin, Eyeglasses,
Mustache, Pale_Skin, Smiling, Young. Following a similar construction process as the above datasets, we first identify an attribute space, ensuring a minimum inter-class distance of 4. Correspondingly. the radius of this attribute set is 1. The randomly selected attribute set V is [[2 1 0.0 00 (1 0000 I 1I, (1 1 1 10 1 I OJ, [1 0J, [000
within the eight-dimensional attribute
O IJ, 1O 1 1011 I 1J. [00 0 F Following Zarlenga al. K0), each attribute node corresponds to a unique class, resulting in 10 classes in total. Next, we train StarGAN (22) model and use it to synthesize images for each class. StarGAN is a powerful tool for transferring the attributes of input images to designated values. Specifically, taking a face image and set of attribute values as input, the trained StarGAN generates a face image with attributes transferred to specified values. In total, we generate 50,000 training images, 10,000 validation images, and 9,990 testing images.
100100 IJ. 020
11 100100000
For the attribute Color Coior_Hair, values 0-3 correspond to Black Hair, Blond Hair, Brown Hair, and Gray_Hair, Hair, respectively. For other attributes, e.g., Double Chin, 0 indicates the absence of the feature, while I indicates its presence.
27

---

GTSRB-Sub dataset. This dataset is derived from the GTSRB dataset (2 in accordance with its research- purapose terms. which contains images of German traffic signs along with class labels indicating the sign types. Chen et al. 7 annotate each image in GTSRB with four attributes: color, shape, symbol, and text. Each class corresponds to a distinct instantiation of attributes, f.e., a unique attribute node. The attribute set corresponding to GTSRB has a minimum inter-class distance of 1, resulting in a radius of O. To increase the minimum inter-class distance, we construct a subset of GTSRB by selecting and grouping specific classes. The final classes in this subset are: 1) Direc- tion: This class consists of the original classes-
2 'regulatory- 'regulatory eeguulaory-maxiium-ppee maximum-speed- maximum-speed -paiiuuu---eeed-iiit-099 'regulatory- maximum-speed--ieeeeeee mwx.mmm-aamaaaaemmmmmmmmmaaa seenn--peeediiii limit-80', 'regulatory- limit-60', 'regulatory- www.ory--mmmmmm-mpppe Sawaxiimunn-eeee-liiit--7- 'reglltoor-mmxximun maximum-specde limil- 100', maguulattrr-mxximmmmn
'reuulaooy- sists of the original buass-"rqullorrypprrrrtttoooao wwweammm-speeedddeeeeeee 120'. 2) Priority: This class con- inal llasses-"warminge -ataamiinnn-teerdrnee.r.rr "warnin
3) Speed: This class consists of the orig- 'waminn-unnvven-rodd wwanriinngniiiiainnnnaa wwaaming-road--nrooww--rgh... "warning-roadworss 'warning- paaiaaaaaa-aaaasstaaannnssssssi "warning- chilldnen,'ld''',, "warning-bicycless bicycles-crossing! traffic-signals', wwrming-icc-oo-snoww wwwp://wwwww..arriiiiiiii--aaaao 4) Warning: This class consists of the origi-
barniing-double-cureeeeeeee
-uullloor--uu---ff---haaadd "regulatory-g--Strrighh "regulatory-keep-rihht "regulatory-keep-left "rggultoor- Note that each class may correspond multiple attribute nodes. This subset achieves minimum inter-class distance of 3, with a corresponding radius of In total, GTSRB-Sub contains 22,079 training images, 2,759 validation images, and 2,761 testing images.
nal classe--rnggllaooyytt---gghhhhha rrgulllorr---sttrihfftorm-------
F22
Implementation details
NPC [7]. To strive for simplicity in experiments, we implement the attribute recognition model of NPC using a set of independent two-layer MLPs. Specifically, each MLP is used to identify one particular attribute. The attribute recognition model is trained using the sum of cross-entropy losses over all attributes. The training process is conducted with a batch size of 256 for 100 epochs, using the SGD optimizer. The probabilistic circuit of NPC is learned with the LearnSPN algorithm (16), with its parameters optimized via the CCCP algorithm and the learned probabilistic circuit, NPC integrates their outputs through node-wise integration to produce predictions for downstream tasks.
[17]. Given the trained attribute recognition model
RNPC. RNPC uses the same trained attribute recognition model and learned probabilistic circuit as NPC. But different from NPC, RNPC adopts class-wise integration to produce predictions for downstream tasks.
To ensure fair comparison among the baselines, implement the recognition module of CBM using a two-layer MLP. Following Koh et al. (2), the predictor module of CBM is implemented with linear layer. CBM trained using the weighted sum of the cross-entropy loss over concepts and the cross-entropy loss over classes. The training process is conducted with a batch size of 256 for 100 epochs, using the SGD optimizer.
CBM [2].
DCR 33. The recognition module of DCR is implemented with two layers: a linear layer followed by ReLU activation and an embedding layer defined in Zarlenga al. [30]. The predictor module is implemented using the deep concept reasoner proposed in Barbiero et al. [3. DCR is trained using the weighted sum of the cross-entropy loss over concepts and the cross-entropy loss classes. The training process is conducted with a batch size of 256 for 100 epochs, using the SGD optimizer.
F.3 Attack configurations
The adversarial attacks used in this paper are implemented using the wat.riial-atttak---yyssss library [56).
oo-norm- cc-norm-bounded PGD attack [1]. For the MNIST-Add3, MNIST-Add5, and GTSRB-SA datasets, the co-norm bounds are set to 0.03, 0.05, 0.07, 0.09, and 0. For the CelebA-Syn dataset, where the model demonstrates greater vulnerability to adversarial attacks, the co-norm bounds are set
'The library is available ahhn:://gihbbbbooo//aaakkkaeeses
28

---

MNIST-AME
CalchA-Syn
Accuncy of Attaceed Atribuee
0.8
0.6
0.4
0.0
---oomm Bound
Figure 6: Accuracy of the attribute recognition model in predicting the attacked attribute under the cc-norm- bounded PGD attack with varying norm bounds on the MNIST-Add3, MNIST-Add5, and CelebA-Syn datasets. The attacker attacks single attribule at time, generating result for that attribute. The curves show the mean accuracy of the attacked attribute across varying norm bounds, with error bars indicating the standard deviation computed over all attacked attributes.
adversarial perturbation distort the prediction
to 0.01, 0.02, 0,03, 0.04, and 0.05. Across all datasets, we use a step size of 2/255 and perform 50 steps for the attack.
anorm-bounded PGD attack (I]] For the MNIST-Add3 and MNIST-Add5 datasets, the 2-norm bounds are set to 3, 5, 7, 9, and 11. For the CelebA-Syy dataset, where the model demonstrates greater vulnerability to adversarial attacks, the 2-norm bounds are set to 1, 2, 3, 4, and 5. Across all datasets, we use step size of 0.1 nnom bound and perform 50 steps for the attack.
We employ the 2-norm-bounden CW attack with binary search. Across all datasets, we use step size of 0.01 and perform 10 steps for the attack. The strength of the attack is varied by adjusting the number of binary search steps. Specifically, for the MNIST-Add3 and MNIST-Add5 datasets, the binary search steps set to 3, 5, 7, 9, and 11. For the CelebA-Syn dataset, the steps are set to 1, 2, 3, 4, and 5. After attack, we measure the 2-norm between the benign inputs and the perturbed inputs to quantify the magnitude of the perturbations.
mmorm-bounded CW attack 12].
G More experimental results
G.1 Performance for the attacked attribute
Consider a setting where the attacker attacks a single attribute a time. Figure illustrates the accuracy of the attribute recognition model in predicting the attacked attribute under the oc-norm- bounded PGD attack with varying norm bounds on the MNIST-Add3, MNIST-Add5, and CelebA-Syn datasets. The curves show the mean accuracy of the attacked attribute across varying norm bounds, with error bars indicating the standard deviation computed over all attacked attributes.
As the norm bound increases, the accuracy for the attacked attribute consistently decreases, demon- strating that stronger adversarial perturbations more severely degrade the model's 's predictions. Notably, on all three datasets, the accuracy drops to nearly 0% at large norm bounds (e.g., bound of 0.11 for MNIST-Add3 and MNIST-Add5) This strong adversarial effect provides compelling testbed for evaluating the robustness of RNPC.
G.2 Performance against more adversarial attacks
Performance against the 2-norm-bounded PGD attack. Figure illustrates the adversarial accuracy of RNPC and the baseline models under the --norm-bounded PGD attack with varying norm bounds. According to these results, we can conduct a similar analysis and reach similar conclusions to those in Section 5.2 Specifically, we observe that on the MNIST-Add3 MNIST-Add5, and CelebA-Syn datasets, the adversarial accuracy of NPC and RNPC is consistently higher than that of CBM and DCR under attacks with any 2-norm bound. This finding indicates that including the
29

---

MNIST-Add3
MNIST Add5
CelehA-Syn Syn
1.0
1.0
Adversrial Ascumecy
Adversarial Accuracy
Adversarial Ascuracy
0.3
0.8
CBM
0.6
CBM
CBM
0.4
84
NPC
NPC
NPC
2-Norm Bound
2-Norm Bound
2-Nonn Bound
Figure 7: Adversarial accuracy of CBM, DCR, NPC, and RNPC under the 2-norm-bounded PGD attack with
varying norm bounds on the MNIST-Add3, MNIST-Add5, and CelebA-Syn datasets.
MNIST-Adas
CelehA-SSn Syn
1.0
1.0
Adversrrial Accumbty
Adversarial Accurscy
Adversurial Accurccy
0.9
0.8
0.8
0.7
0U8
DCK
DCR
DCR
RNK
0.2
RNPC
KNPC:
3.0
2-Norm Bound
2-Norm
2-Nonm Bound
Figure 8: Adversarial accuracy of CBM, DCR, NPC, and RNPC under the 2-norm- noornebounded CW attack with varying norm hounds on the MNIST-Add3, MNIST-AddS, and CelebA-Syn datasets.
probabilistic circuit within a model's 's architecture potentially strengthens model's robustness. In contrast, the task predictors used in CBM and DCR might compromise the model's robustness.
Furthermore, on the MNIST-Add3 and MNIST-Add5 datasets, RNPC outperforms NPC by large margin, especially under attacks with larger norm bounds. For instance, on MNIST- Addd, when the 2-norm bound reaches 11, NPC's adversarial accuracy drops below 60% whereas RNPC maintains adversarial accuracy above 80%. These results demonstrate that RNPC provides superior robustness compared to NPC on these datasets, highlighting the effectiveness of the proposed class-wise integration approach. On the CelebA-Syn dataset, RNPC performs similarly to NPC, with both showing high robustness even under attacks with large norm bounds.
Performance against the 2-norm-bounded CW attack. Figure illustrates the adversarial accuracy of RNPC and the baseline models under the -bouddd CW attack with varying norm bounds. We observe that NPC and RNPC perform similarly and robustly on the MNIST-Add3 and CelebA-Syr datasets, both reaching adversarial accuracy close to 100% under attacks with any 2-norm bound. In contrast, the adversarial accuracy of CBM and DCR decreases as the norm bound increases. This comparison demonstrates that NPC and RNPC are robust against the 2-norm- 2-norm-bounded CW attack, indicating the robustness enhancement enabled by the probabilistic circuit.
On the MNIST-Add5 dataset, however, NPC's adversarial accuracy also declines as the norm bound increases, while RNPC maintains adversarial accuracy close to 100%. These results demonstrate that RNPC more robust than NPC, highlighting the robustness improvement achieved by the class-wiss wise integration approach.
G.3
More ablation studies
Impact of Differential Privacy (DP). Theorem 4.7 p-norm- p-norm-bounded adversarial attack with a budget of É higher than that of NPC when the attribute recognition model satisfies eDD with respect to the p-norm. Here, we empirically validate whether this implication holds practice.
indicates that the robustness of RNPC against
To evaluate the robustness of NPC and RNPC, we conduct the 2-norm-bounded PGD attack (targeting a single attribute) with norm bounds of 3, 3, and for the MNIST-Add3, MNIST-Add5, and CelebA- Syn datasets, respectively. Following Lécuyer et al. [57). DP within the attribute recognition model can be implemented by injecting noise after various layers. For simplicity, we directly add noise to the input images. Specifically, the noise is sampled from a Gaussian distribution with zero mean and
30

---

Models without DP
Models with DP
100
1000
Adversarial Assunec (%)
20
-0
20
NPC
NFC
RNPC
RNPPC
MNISTABIS
NNNST-AA
CaReA-90r
MNISFASS
NNNST-AB
Figure 9: Adversarial accuracy of NPC and RNPC under the 2-norm-bounded PGD attack (targeting a single attribute) with norm bounds of 3, and 1 for the MNIST-Add3, MNIST-Add5, and CelebA-Sye datasets, respectively. The left figure illustrates the performance of models without DP. i.e,, vanilla models, while the right figure illustrates the performance of models with their attribute recognition models satisfying DP.
standard deviation a V 221 21 (2.3) ) l/e, where é corresponds the attack norm bound, set to 0.5, and ò is chose as a small value (e,g., 0.01). This ensures that the attribute recognition model approximately satisfies (c, OD- Additionally, we estimate E] fo, aa, by computing the mean of for (X) a. over 20 noise draws. The performance of NPC and RNPC under these conditions is illustrated Figure
Compared to models without DP (i.e., vanilla models), the models satisfying DP generally exhibit lower adversarial accuracy across the three datasets due the noise added to the inputs. Despite this, we observe that RNPC consistently outperforms NPC on the three datasets. Notably, on the MNIST-Add3 and MNIST-Add5 datasets, the adversarial accuracy of RNPC is higher than that of NPC by large margin. These results demonstrate that while integrating DP into the attribute recognition model might compromise the overall performance on downstream tasks, it highlights the robustness enhancement achieved by RNPC, thereby validating the implication of Theorem
H Theoretical results with omitted proofs
In this section, we provide more theoretical results and elaborate the proofs omitted the main paper.
H.1 Adversarial robustness of NPCs
Theorem H.1 (Adversarial robustness of NPCs (Restatement Theorem 3.4)) Under Assumption 3.2 the prediction perturbation of NPC is bounded by the worst-case TV dis- tance between the overall attribute distributions conditioned on the vanilla and perturbed inputs, which is further bounded by the sum of the worst-case TV distances for each attribute, iee.
Age Ex max drv (Eo (Aux 1x),Po (Aix) x))
&
Ex
Ex
max drv (Fo. (X), (Ar 1x)) XrB,(X.)
(03,(X.0)
Proof. Under Assumption 3.2 Po (A1:K IX) = IT Po. (Ax X). Therefore,
drv (Y (Y| () 12))
Σ PY = X) (Y x)
K
Σ PY = ALK aix)
II Pop (Ax ax x)
II Pop (Ax ax (8)
"1:
Σ "1:K
II Po. (Ae
(X)
II
K
Poç (As as 18)
= drv (Ro (Anx X)) (AriK (x))
k
ΣΣ
(Ax (Ax
X) Poz (A az x0 Σ drv (Po X), Po x))
By successively applying the max and expectation operators to both sides, complete the proof. G
31

---

H.2
Adversarial robustness of RNPCs
Lemma H.2 (Adversarial robustness of RNPCs (Restatement of Lemma 4.6)). The prediction perturbation of RNPC is bounded by the worst-case change in probabilities within neighborhood caused by the attack, i.e.,
Po(An. E ((. X)
0,00
Rx
max (x))(X.0)
max BEy
Po(AL: (W x)
Proof. A
RNPC can be bounded as follows, 8,8
drv (o X), (Y (xx)
1
Σ
Zv(X) 42 (X) Ze(X)) (Y [8)
2 Zz( (x)
-
Zo(X) 4Y 1 (X) Zx(X). (Y X) Zo(8) oY 1x) Zo(X)- o. x3)
2 ZxX) (x(X)
1
- [2o(8) : A (Y (x) (Y |x) 20 1.8) [o(x) - zx(x)]
X) (x)
(Y (X) (Y..(Y(X))
1
Zo(X)) Zo(X) Zx(X)
2 Z
2 (x(()) Zo(X)
(Y (Y xx
[x(x)) - 7
(3)
2 (X)
where the penultimate equation is derived using Ex Φa 18) = (X)
For the first interior term in Equation
(X (x) (Y (X)
Σ
FolAux ((.r)) - e( |x1/ Σ
Pu(Y |Ax = aix).
auxeVs
Σ (Y (Y (X)
Σ FolAnx e (((.)))) xx)
(x) - Pa e. 1/00
For the second interior term in Equation 33.
[x(X)- (x)
Σ Po(ALx (( | Pa(An e (( x0/ IVs
By combining these two inequalities, Equation
is bounded by,
Equation
> Po E (( x) PolAi. E (V( |x)] ivsl
(X)
Eg FolAuxx EN ( X) -o (V(.)))) X3 IV'l
Po (( X3-1Vol
Po(AL (( r) x) Pa(A E (((.))) x)
& max
PolA E () X)
Po(AEK (().)
max
PolAnx E ((g.r) r) x)
Consequently, drv ( g. (Y X)) 6 o (Y x)) < max; E & E
By succes
sively applying the max and expectation operators to both sides, complete the proof of Lemma
4.6
H.3
Comparison adversarial robustness
Theorem H.3 (Comparison in adversarial robustness (Restatement of Theorem 4.7
Consider a p-norm- p-norm-bounded bounded adversarial attack with a budget of f. Assume the attribute recognition model fo is randomized and satisfies e-Differential Privacy (DP) with respect to the p-norm. Let the probability of an attribute taking specific value correspond to the expected model output, iee. Fe, (Ax aa X) = Elfo, (X) an where the expectation is taken over the randomness within the
32

---

model. Under Assumption 3.2 the following holds: ANpc < | ar and ARNPC & a, where a, max 111101100 e Ke equalities.
13. Moreover, there exist instances where both inequalities hold as
Proof. Firstly, aim to prove that, under the given conditions, the following two statements hold for any X E (X, f), any y V and any a1:k A1
Ag:
[B(AAL = onx X) - Po(Axx = =a.k |x0 &
Po(Aui =ax X] Po(Ani 01x X)
& ac.
(4)
PolAnic ((..r) X) Po(An: ((.rr) X)
PolArix ((( Ba E |
& a..
(5)
Given that the attribute recognition model satisfies e-DP and using the expected output stability property of DP [57].
Fex (44 = au X) & e'Fe, (A, = au X).
Building on this, and under Assumption 3.2 by.
the joint probability over all attributes AI.K is bounded
To(Aui ank X) II Fo. (A, = oo x) (c)) II Po. (A. as x) ( axx 8)-
Consequently, the probabilities within the neighborhood of any E y are bounded by.
7o(Aax E (( x)
Σ
Fo(AAx aaak X) &
MoPolAux anx (8) Pf ((G.)))) X).
Therefore,
E & EN(A:xEN(
1 1 e- Ke - and similarly, GIA.:EN((O.1))
& ke 1.
By combining these two inequalities, we obtain,
PolAsx e (((.))) X) PolAni (((,r) X) < oc.
where ag == max (1 e- Ke Ke 17.
On the other hand, the following holds,
Balduu Aig.r) 8) PolAuK (.
PolAuxx (Migrr - Aig..)) FolAix (.g.)) X)
Po(Axx N(g.r) -PPAa (iggr) |x]]
Hence, Equation is satisfied. Following a similar approach, Equation can also be proven to hold.
Secondly, we aim to prove that, when Equation and Equation 5 are satisfied, ANPC
|A Cr and ARNPC & Qg. In particular, the bound for ARNPC is apparent based on Equation Besides, for ANPC, the following holds.
2
Poldix = ()) Po(Ani anx 1811
}
|Ael.... Aal...AAkl ac.
ANIC Ex
max XEB,1X.0)
Σ $1:K
Therefore, we have proven that ANPC < conditions.
LAk a. and ARNPC & as hold under the given
2
Finally, we aim to provide an instance showing that the bounds for ANPC and ARNPC can be simulta- neously achieved.
Suppose case where VX X, there exists ÿ Y such that Po(A E N(ū.r) | X) 1. There are 2n + 1 nodes in A (ūūrr r) and the probabilities of n of them are increased after attack, in
particular, PP(AA = 01.K X) = Pa(A = a1.K
I) + a.. In contrast, the remaining n + 1
of them are decreased, in particular, Po(AI: = 01.K
X) Po(Ar: = 0i.K X)= ae- Overall,
Po (A E rū,r)) X) Pe(ALK E N(,rr) X) a. ac.
33

---

On the other hand, suppose there are 2m + 1 nodes in the complement set (g. The probabilities of of them are decreased after attack, in particular, Po = 01:K X)
Po(AL: = 01:K X) ag. In contrast, the remaining m + 1 of them are increased, in particular,
Fo(A1: = a1:K X) = Po(AL:K = a1:K X) + ag. Overall, Po(A1:K E (V,( X) =
Fo(A1:K E NN
x)+ + a die-
In the above case, is easy to show that ARNPC = dze- In addition, we notice that V01:K; [Po(A = 01:K X) (P((A 01:K X)I ac Thus, ANPC [A.l-.IAk] Oie- Therefore, in the case constructed above, the bounds for ANPC and ARNPC are simultaneously achieved.
2 00,
Theorem H.4 (Direct comparison in adversarial robustness). Assume that there exists (0, 1) such that for all X E X and ÿ E y, Fo(A1.K E (g,r)) x) > c. Then, the following inequality holds: Auspe ANrc-
Proof. By the definition of ARnPC and the given conditions, the following holds,
Awer
Ex
max
Po(Aix ((.r)) x] Po(AA. e (. x) Fo(Anx (x(G.r)
3x max Pa(Anc E ((g.r) X) Po(An e 1 x3||
Ex ddvv (Po(Anic Po( {8)] Asee.
Compared to Theorem 4.7 which compares the upper bounds for ANPC and ARNPC. Theorem H.4 provides more direct relationship between them. Specifically, Theorem HH.4 demonstrates that ARspc cannot exceed a fixed multiple of ANFC. with the multiplier inversely proportional to the lower bound c of the neighborhood probabilities.
H.4 Benign task performance of RNPCs
Definition H.5. The prediction error of RNPC defined as the expected TV dis- tance between the predicted distribution and the ground-truth distribution, i.e., 60,u Ex (drv (Y (X),P"
_RPCC
Note that the definition of prediction error is different from that of estimation error. The latter is defined as the expected TV distance between the predicted distribution and the optimal distribution.
Theorem H.6 (Prediction error of RNPC). The prediction error of RNPC is bounded as follows,
Po(AL (ū) X) max (A (N X)
(' (( X) Po(An: ((,rr) X) -
RNPC <Bx
min
max
2 drv (P P'x),
BBx dTv (Y |AL E P'(Y [X)]
where PY ALK E Vo) == [il Lonxev, PY | ALKK = a1.k) represents the average ground-truth conditional distribution Y given ALK E Vg-
Proof. Define (Y
|X) X) = E, N(Grr) XX) Eaikev, PY AL:K a1.k) and Z" (x) := E, E (((rr) IVgl-
By applying the triangle inequality, the following holds,
RNNINC F0.0
Ex
drv
4Y (X)
#' (x1 Ex drv 4' ,P'CY 1x))] ('(
Zo(X)
For the first term in Equation 6):
(Y X)
'' (x)
4' = y X)
drv
(x(X) (x)
Ex
Zo(X)
(2
Ex
70(X)-2-(x)) El (x)(()) (Y = v x) 7x(X) (Y - x
7o(X)
(x)
34

---

In particular, for the term I^(X) L0 (Y = X) Zo(X)) x- X)], we have,
= 12 y X) 2x(X) 20 = + (Y= x) Zx(X) =
(Y,x y l ( 2*(X)] (x) 10, = ()- (Y y |X]
Consequently, the following holds,
4Y X) 4'
drv
(x(X) (*(X)
< Ex
Zo(X)- (x) Σ (Y x zx() (x,)))((())))))))))))))))))))))) (x. = -2:0-0000 2' (====)=)) =
|x]
2 (x
[x(x)- 2x(xx]
Fxx
(x 2 D0. (2 x)
Moreover, we can bound the first term as follows,
Ex 2 z'(x)
Z'(x) Zo(x) 2x()) - [x]]
& Ex
Σ Fa(Anx E N((rr) x) (AAu E (((.))) (000))1(1]) x
PA(AUK N(g.r) 1x]
Ex
2
max
(A ((g.r)
and bound the second term as follows,
( (X) (X)
E N(g.r) X)
E Pu(Y Anx = (ALu (((r) X).
Σ Pu(V Aux | ank)
(ALix ((g.)) (X).
Σ
Pa(Y Anx = ānk) - (AAN E (()rr) (X)
Σ
P(Y A = ēxx)1l
ALxEV
PolAux E N(Brr) x) (Ank (((())) Xx)-
E
PolY |Ai kn.k)
(7)
Σ
Σ
Pu(Y Ank kL.)
Σ
F'Y AEx 0.x)).
ALKERS
AuKeV,
(8)
In particular, the following holds:
Ex
Σ
[Ea
?1)
= Ex
(x) Σ
Po(An E (((.) X) - P'(A e (N(())) (X)- [vs
TeLALKEN(G. IX)
Ex
mux V
(ALK E (((.))) (X)
and
Ex
Σ (F
2 (x)
<
Ex
(x( Σ Pd (A E (x)
1 Σ
Pa(Y= = Aux = = Aux = knx)
=Ex
Σ (' ((
Σ Snxeks
(Pul Anx anak. A
2x(x
< Exx
(x(x) Σ (A (()))) Anee,
Σ
(P =āx)) P- Aix k)
P' = kix)
% max
Σ IFa(Y = a.d and) - P'Y v.Ai = dnx]
& drv
Within the above derivation, utilize two facts. The first one is
35

---

div (Fu(Y Anik F. |AiK Anx =)xx))
2 PulY y Anx -F -y A
Σ PP = A (Pxx PalY =y Aux -oxx)-Pu(Aix auk)
" ('dc = aux)
PY = y Aux anx) Pu(Aii =0)) P /
- oox)) (A anx)
< 2 P'AnK anx) Σ Pu(Y y Aux (xx=ax) (ALx - Palux aux)
+5 P-AnK- auk)
PulYY y. x - (Y Abik =aai]
& (AAA==aj. Σ PulY = An =
=xx) axx) PY A a1x)
The second one is,
Vō Vg, (AL.K = ā1.k) >
Combining the above, we have, Te.. (Y X))
Po(AL:K E (( X).
2 drv
drv
Zo(X)
2x(X)
gxx
mux
P'AAKK E ((8rr) (X)
Similarly, we can derive, (Y
4 ''
('LE E (( Pa(A E (( (x)
-1] +1]+2,0 2ddiv (Y,(Y, (Y,,A.)))
drv
(x)
(x)
Ex
max
Therefore, the following holds,
Pu X) ()) drv
( Nig.r) [X] Po(Aux eWig.) Pa (NG.r) X) -m.mxx
& Ex min
(AA ((. (X) -1]
(x) (x)X)
dry PY.
For the second term in Equation
(6 The following holds,
4 (Y [x]
(Y 1x)) & Ex div (P'(Y ALi e (V) [11))
Ex drv
(X)
because:
4' (F
= -
1
Eg (ALx E (N(. X) SonKer PY An.x =a.k) (X
drv
(X)
P' (N(())) (X) -Vsl
Σg (ARK (l X) 1V/1- FY Arx Vo) -F -F 10)010/ 19)
2
ESP E NN r) X)-IV
Define Wg = (AI,K E (2,r)) XX) |V/l and ag = Ey Wy
W;
We have Eg ag = 1.
Then, for Equation 9
Equation
Σ (Y ALic E (X
ΣΣ ag (r Anx e V.) -P x)]
2
y
Σ ay drv (P' AAL E (y), X))
max dry (P |Ai E (y) (X)
By combining the bounds for the first and second terms in Equation (6. we establish the bound for .NNCC
60,0
Proposition H.7 (Optimal RNPCs (Restatement of Proposition 4.8).. The optimal RNPC w.r.. the
prediction enror =,,0 RNPC is $0 (Y) X) == *" (YIX) where
2*(X)
s (Y X) = Σ P (AUi (N(())) Ix)..
Σ
PY AER = a1:)),
VV
z²(X)= = Σ Pd (ALI (N()))) | XV-.Vol.
36

---

Proof. According to Theoremn H.6 the minimum of the bound for -NPC is achieved when Po (P(AA1K =,we X) PP* ( X) and P. (.k) = P (Y, AL.). In this case, Dg (Y X) $- (Y X) and Zu (X) = " (X).
Theorem H.8 (Trade-off of RNPCs (Restatement of Theoremn 4.11). The trade-off of RNPCs in
benign performance, defined as the expected TV distance between the optimal RNPC 4- 4 X) and the ground- -ouund-rruth distribution 1 (Y X), is bounded as follows,
Ex dIv (6 PY (XXXXX)) & Ex max drv (P" A (.),
where (Y ALKK E V3) := [Vsl EoLxEv, PY
AL.K = a1:k) represents the average
ground-truth conditional distribution of given ALK E Vj-
Proof. See proof for Theorem 6
Theorem H.9 (Compositional estimation error (Extension of Theorem 4.10 The estimation error of RNPC is bounded by linear combination of the errors from the attribute recognition model and the probabilistic circuit, i.e,,
Po(ALK (N(rr)) X) (A E (W. X)
P' (ū.r)) |x) Po(Au E ( X)
|
68,w
<
Ex
min
max
.max
drv (P PY,,
where P represents the ground-truth distribution.
Proof. See proof for Theorem 6
37


Reviews:
[{"review_id": "EVMf1ZjJlO", "reviewer": "Reviewer_YUiX", "summary": "The authors propose a new version of Neural Probabilistic Circuits (NPCs) which is robust against adversarial attacks. First, the authors establish that the vulnerability of NPC to adversary attacks is due to how the outputs of the attribute recognition modules are combined to generate the prediction label. Once an adversary fools enough attribute classifiers, the downstream probabilistic circuit will end up outputting the incorrect prediction label. Based on this insight, the authors propose a new way of combining the outputs of the attribute recognition modules that make it less susceptible to adversarial attacks. Authors provide theoretical and empirical evidence to demonstrate that this new version of NPC, called RNPC, preserves performance on benign inputs while significantly boosting performance on adversarial inputs.", "questions": "1. What if we train the recognition module adversarially? How will this affect the robustness of the NPC and the RNPC inference methods?\n2. How does NPC and RNPC compare against each other when attack the end-to-end prediction pipeline?\n3. Can we predict which attributes can be attack together based on how often attributes co-occur in the training data?", "limitations": "The authors have adequately discussed limitations of the proposed method in the paper.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n1. The paper is well-written and easy to follow. The authors motivate the problem clearly, and provided an eloquent description of the proposed method (RNPC).\n\n2. Authors provide a detailed theoretical evidence to justify the effectiveness of RNPC. All theorems are adequately defined and backed up with proofs. All assumptions and limitations are clearly stated.\n\n3. RNPC only requires inference-time changes, and therefore has much better usability than training-based defenses.\n\n4. Authors discuss several key ablation experiments that help understand RNPC in greater detail. For example, the discussion on spurious correlations demonstrated how certain attributes can be attacked together based on the characteristics of the dataset. This highlights a key vulnerability of CBMs.\n\n5. Empirical results demonstrate that RNPC yields strong robustness compared to baseline while reducing inference time.\n\n\n### Weaknesses\n1. Authors don't systematically analyze the attack propagation phenomenon. Specifically, they don't show if there is a direct correlation between co-occurence of attributes in a dataset and the possibility of attack propagation between them.\n\n2. The proposed defense scales poorly with complexity of the dataset. This is evident in Fig3-c, where NPC and RNPC have similar robustness on GTSRB-sub. Authors explain that this is because of the attack propagation effect. It appears that attack propagation becomes more severe as dataset complexity increases. Therefore, the utility of the proposed defense seems to be only applicable to small-scale toy datasets like MNIST.\n\n3. Authors back up key findings using results on small-scale toy datasets only. Results on more complex datasets are either lacking or not convincing.\n\n4. Authors propose remedies to mitigate the attack propagation effect in the Appendix. However, there is no result available that can provide evidence for whether these remedies will be effective. For example, adding synthetic training data may prevent the model from learning spurious correlations, but it may also reduce the model's performance on benign data as these spurious correlations may be driving some of the performance in the benign setting. It is important to develop a comprehensive understanding of how problematic attack propagation really is, which the paper doesn't provide.\n\n5. The authors only consider an adversary that targets the attribute recognition module. However, an adversary can also target the end-to-end RNPC prediction pipeline. Authors don't consider such an adaptive attack scenario in the paper. Strong robustness guarantees in settings where the adversary is oblivious of the defense are not as impactful.\n\n6. The authors present results using very restrictive adversarial budget (epsilon). When attacking the traditional MNIST neural network classifiers, epsilon=3.0 is used. But authors use epsilon=0.11 at max for MNIST-Add3 and MNIST-Add5. This dilutes the impact of the proposed defense.", "was_revised": true, "final_justification": "Authors have addressed several of my comments adequately. Therefore, I am increasing my rating by 1.", "rebuttal": "We sincerely thank the reviewer for your thoughtful feedback! We're glad that you found our paper well-written, the theoretical analysis sound, the proposed method effective (only requiring inference-time changes), and the ablation studies insightful!\n\n> **Q1:** How does training the recognition module adversarially affect the robustness of NPC and RNPC?\n\n**A1:** To explore the impact of adversarial training, during training, we use the PGD attack with an $l\\_\\infty$ bound of 0.11 to generate adversarial samples that perturb the recognition module’s predictions, and train the recognition module using both adversarial samples and benign samples.\n\nDenote the NPC (RNPC) with an adversarially trained recognition module as NPC-AT (RNPC-AT). We evaluate performance on MNIST-Add3 under PGD attacks targeting the first attribute. Results are provided in **Table 3**.\n\n- AT significantly improves the robustness of the recognition module.\n\n  Without AT, the accuracy of predicting the first attribute declines from 99.3\\% to 2.2\\% after the attack. In contrast, with AT, this accuracy merely drops to 85\\%.\n\n- AT also improves the robustness of both NPC and RNPC.\n\n  Without AT, the task accuracy of NPC and RNPC declines to 19\\% and 64\\% after the attack. In contrast, with AT, their accuracy remains as high as 85.8\\% and 86.3\\%, respectively. This is attributed to the fact (**Thm. 3.4** and **Lem. 4.6**) that the robustness of NPC and RNPC is only bounded by the robustness of the recognition module.\n\n- AT leads to a slight performance drop in the benign setting.\n\n  When using AT, the model's benign task accuracy drops by less than 0.5\\%.\n\nOverall, **adversarial training significantly strengthens the robustness of both NPC and RNPC by improving the robustness of their recognition module, and RNPC is still more robust than NPC thanks to the class-wise integration.**\n\n**Table 3**: Accuracy of predicting the attacked attribute (\"Attr1 Acc\") and class labels (\"Task Acc\").\n\n| Setting                  | Model   | Attr1 Acc | Task Acc |\n| ------------------------ | ------- | --------- | -------- |\n| No attack                | NPC     | 99.3      | 99.3     |\n|                          | RNPC    | 99.3      | 99.4     |\n|                          | NPC-AT  | 99.0      | 99.0     |\n|                          | RNPC-AT | 99.0      | 99.2     |\n| PGD ($l\\_\\infty = 0.11$) | NPC     | 2.2       | 19.2     |\n|                          | RNPC    | 2.2       | 64.3     |\n|                          | NPC-AT  | 85.0      | 85.8     |\n|                          | RNPC-AT | 85.0      | 86.3     |\n\n> **Q2:** How do NPC and RNPC compare against each other when attacking the end-to-end prediction pipeline?\n\n**A2:** We begin by clarifying our **threat model**. NPC is a compositional model that integrates a **graphical model**, specifically a probabilistic circuit, and the only component with a **black-box** nature (which may be pretrained and obtained from a third-party source) is the attribute recognition model. Therefore, we consider a threat model in which the adversary targets the attribute recognition model, rather than the entire pipeline.\n\nNext, to explore the impact of attacking the entire pipeline, we apply the PGD attack with varying $l_\\infty$ bounds on the end-to-end prediction pipelines of NPC and RNPC. In addition to these compositional models, we also train an end-to-end ViT-B/32 model and attack it for comparison. Results are provided in **Table 4**.\n\nSimilar performance is observed on NPC and RNPC, which is reasonable since now the adversarial samples are crafted to perturb **final class predictions**. This setting doesn't align with RNPC's design objective, i.e., to robustly integrate **incorrect attribute predictions** with outputs of probabilistic circuit. Despite the performance drop, both NPC and RNPC perform much better than ViT, highlighting the advantage of compositional models. This finding also aligns with the one in [1].\n\nOverall, **both NPC and RNPC are vulnerable to attacks targeting the entire pipelines; however, they exhibit much higher robustness than the end-to-end black-box model.** \n\n[1] Exploring the impact of conceptual bottlenecks on adversarial robustness of deep neural networks. IEEE Access. 2024.\n\n**Table 4**: Task accuracy against attacks targeting the end-to-end pipelines.\n\n| Task Acc                 | NPC  | RNPC | ViT  |\n| ------------------------ | ---- | ---- | ---- |\n| No Attack                | 99.3 | 99.4 | 99.5 |\n| PGD ($l\\_\\infty = 0.05$) | 91.1 | 91.0 | 2.3  |\n| PGD ($l\\_\\infty = 0.11$) | 20.4 | 19.4 | 0.0  |\n\n> **Q3:** Can we predict which attributes will be attacked together based on how often they co-occur in the training data?\n\n**A3:** We answer the question using three steps.\n\n- Quantify the co-occurrence between attributes\n\n  We use the **mutual information (MI)** metric, defined as $MI(X, Y) = \\sum\\_{x \\in X} \\sum\\_{y \\in Y} p(x, y) \\cdot \\log \\left( \\frac{p(x, y)}{p(x) p(y)} \\right)$. A higher MI indicates a stronger dependency between two attributes. **Table 5** displays the MI between *color* and other attributes. The attribute with the highest MI is *symbol*.\n\n- Measure the influence on other attributes when a specific attribute is attacked\n\n  **Table 5** also reports the relative **accuracy drop** of other attributes when *color* is attacked. The attribute with the largest accuracy drop is also *symbol*.\n\n- Assess the correlation between these metrics\n\n  To statistically assess this correlation, we use the **Pearson Correlation Coefficient (PCC)**, defined as $\\rho = \\frac{\\mathrm{cov}(X, Y)}{\\sigma\\_X \\sigma\\_Y}$. We observe a PCC of 0.92, indicating a strong positive linear correlation between MI and accuracy drop.\n\nOverall, these results suggest that **it's possible to utilize the mutual information in the training data to find out which attributes are more likely to be affected when a specific attribute is attacked.**\n\n**Table 5**: Mutual information between color and other attributes, and relative accuracy drop when color is attacked on GTSRB-Sub.\n\n| PCC = 0.92 | Shape  | Symbol     | Text   |\n| ---------- | ------ | ---------- | ------ |\n| MI         | 0.346  | **0.757**  | 0.222  |\n| Acc Drop   | 45.7\\% | **87.2\\%** | 54.0\\% |\n\n> **Q4:** Authors discuss remedies to mitigate the attack propagation effect in appendices. Is there any empirical evidence?\n\n**A4:** In Appendix C, we provide a detailed discussion of strategies to mitigate the attack propagation effect. Here, inspired by your previous question, we introduce **an adversarial training–based approach** for mitigation and evaluate its effectiveness on GTSRB-Sub, where spurious correlations between attributes are strong and result in significant attack propagation (see Fig. 3(d)).\n\n- Intuition\n\n  Suppose a model learns a spurious correlation between two attribute values, e.g., red color and circle shape. That is, the model may rely on features of \"red\" to identify \"circle\". To mitigate this correlation, we need to disentangle their features. Specifically, by generating adversarial examples that perturb the color attribute, we can shift the feature representation of \"red\" toward another color, thereby weakening its connection with \"circle\".\n\n- Method and Evaluation\n\n  Following this idea, during training, we generate adversarial samples that target a random attribute and train the model on both these samples and benign inputs. **Table 7** reports the performance of the resulting models. Compared to models trained without adversarial training (**Table 6**), the adversarially trained models show significantly smaller drops in accuracy of different attributes when color is attacked, which indicates a reduction in the attack propagation effect. Consequently, the advantage of RNPC over NPC becomes evident again.\n\nOverall, **the adversarial-training-based approach leverages adversarial perturbations during training to disentangle spurious correlations between attributes, which effectively mitigates the attack propagation effect and enhances the robustness of RNPC on real-world datasets.**\n\n**Table 6**:  Col2-4: Relative accuacy drop (\\%) of different attributes when color is attacked by the PGD attack. Col5-6: Task accuracy (\\%) of NPC and RNPC on GTSRB-Sub with a **standard** attribute recognition model.\n\n| Budget | $\\Delta$Shape | $\\Delta$Symbol | $\\Delta$Text | NPC  | RNPC |\n| ------ | ------------- | -------------- | ------------ | ---- | ---- |\n| 0.07   | 30.3          | 70.7           | 43.7         | 28.4 | 31.8 |\n| 0.09   | 40.0          | 79.9           | 49.3         | 17.8 | 21.6 |\n| 0.11   | 45.5          | 87.1           | 53.9         | 10.9 | 12.9 |\n\n**Table 7**: Col2-4: Relative accuacy drop (\\%) of different attributes when color is attacked by the PGD attack. Col5-6: Task accuracy (\\%) of NPC and RNPC on GTSRB-Sub with an **adversarially trained** attribute recognition model.\n\n| Budget | $\\Delta$Shape | $\\Delta$Symbol | $\\Delta$Text | NPC  | RNPC |\n| ------ | ------------- | -------------- | ------------ | ---- | ---- |\n| 0.07   | 6.4           | 5.6            | 6.3          | 76.2 | 78.4 |\n| 0.09   | 10.0          | 7.9            | 8.5          | 62.4 | 69.3 |\n| 0.11   | 13.6          | 11.2           | 10.6         | 50.5 | 60.0 |\n\n> **Q5:** The authors use a small adversarial budget ($\\epsilon = 0.11$) for MNIST datasets compared to a standard value of 3.0.\n\n**A5:** We'd like to clarify that the commonly cited value of 3.0 applies to **$l_2$-norm-bounded** attacks, **not $l_\\infty$-norm-bounded** ones. Fig. 2 in Sec. 5.2 corresponds to the latter. In fact, we **did** use $l_2$-norm-bounded PGD attacks with **$\\epsilon$ ranging from 3.0 to 11.0** on MNIST datasets. Please refer to **Fig. 6 of Appendix G.2** for detailed results.\n\nOnce again, thanks for your insightful questions, which inspire us to better understand our method and propose effective solutions to potential limitations!"}, {"review_id": "F5XLFoG74Y", "reviewer": "Reviewer_44wq", "summary": "This paper proposes a robust approach to tackle adversarial attacks on Neural Probabilistic Circuits (NPCs). While NPCs produce interpretable results through an attribute recognition model, a carefully designed attack based on the attributes can reduce their performance. Therefore, this paper adopts a different inference strategy to tackle the adversarial attacks, without sacrificing the benign accuracies. Their theoretically grounded inference approach is validated with four different adversarial datasets with superior performances.", "questions": "See weaknesses", "limitations": "N/A", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The strengths of the paper are \n\n**1. Well-written:** The paper is well-written with a clear motivation behind designing a robust NPC inference method. The distinction between NPC and RNPC is highlighted in the overview figure. Intuitions and theoretical discussions are also well-crafted and aptly put in the paper. \n\n**2. Good results:**  The method shows comparable performance under benign settings and significantly improved performance under adversarial settings, bolstering the hypothesis. \n\n**3. Proper ablation studies:** The paper performs adequate ablation studies to further verify their hypothesis. Impact of the number of attributes is studied and a future research direction is proposed based on the spurious correlation shown in Fig 5 (d). \n\nThe weaknesses of the paper are:\n\n**1. No ablation study on the neighbourhood radius.** The weighted inference is based on some neighbourhood of radius r. It would be interesting to see how the performance varies with this radius. \n\n**2. Is RNPC a generalized version of NPC?** Is there any way to collapse the RNPC formulation to the NPC-one? Under which conditions Eqn (2) will be identical to Eqn (1) ?", "was_revised": true, "final_justification": "In the provided rebuttal, the authors have successfully addressed both of my questions. Therefore, I increase my rating to 'Accept'.", "rebuttal": "We sincerely thank the reviewer for the constructive feedback! We're glad that you found the paper well-written with clear motivation and sound theoretical analysis, the empirical results compelling, and the ablation studies effective in validating our hypothesis and highlighting meaningful future directions!\n\n> **Q1:** The proposed inference is based on some neighbourhoods of radius $r$. It would be interesting to see how the performance of RNPC varies with this radius.\n\n**A1:** We answer this question with the following steps.\n\n- Clarification on radius. \n  First, we'd like to clarify that, as defined in **Def. 4.2**, $r$ denotes the **radius of the dataset**, which is determined by its intrinsic structure. This value is fixed unless the dataset itself is modified. To avoid confusion, we explicitly denote this radius as **$r^\\*$**. In contrast, it's possible to adjust the value of $r$ used in RNPC (see **Eq. 2**).\n- Explore the effect of changing $r$ on the performance of RNPC.\n  - **Setting:** We conduct this analysis using the MNIST-Add5 dataset, which has 5 attributes and a radius of $r^\\* = 2$. We vary $r$ in the range [0, 5] and evaluate both benign accuracy and adversarial accuracy of RNPC under an $l\\_\\infty$-norm-bounded PGD attack with a perturbation budget of 0.11. Results are provided in **Table 8**.\n  - **Benign Accuracy:** As $r$ increases from 0 to 4, we observe a decreasing logit gap between the top-1 and top-2 predicted classes. Nevertheless, as shown in Table 8, RNPC consistently achieves **near-perfect accuracy**. However, when $r$ reaches 5, the accuracy drops to 29.9%. This is expected because, at $r = 5$, we have $\\mathbb{P}\\_\\theta(A\\_{1:K} \\in \\mathcal{N}(\\tilde{y},r) | X) = \\mathbb{P}\\_\\theta(A\\_{1:K} \\in \\Omega | X) = 1$, meaning Eq. 2 no longer contains any information from the input $X$.\n  - **Adversarial Accuracy:** When $r\\leq r^\\*$ ($r\\geq r^\\*$), reducing $r$ (increasing $r$) results in worse performance. That is, deviating from the dataset radius $r^\\*$ leads to a drop in adversarial accuracy. Despite this drop, **RNPC ($r\\neq 5$) still outperforms other baseline models**, which achieve below 40% accuracy (see Fig. 2 (middle)). Notably, when $r = 5$, adversarial accuracy drops to 29.9%, matching the benign accuracy and thus indicating a prediction perturbation of $\\Delta\\_{\\theta, w}^{RNPC}=0$. This aligns with our theoretical result, because in this case, the right-hand side of **Lem. 4.6** becomes zero.\n\nOverall, when $r \\neq$ #attributes, **RNPC demonstrates strong resilience to changes in $r$ under benign settings; while adversarial accuracy declines when $r$ deviates from $r^\\*$, RNPC remains superior to baseline models.**\n\n**Table 8**: Performance of RNPC with various $r$ on MNIST-Add5.\n\n|            | $r=0$ | $r=1$ | $r=2=r^\\*$ | $r=3$ | $r=4$ | $r=5$ |\n| ---------- | ----- | ----- | ---------- | ----- | ----- | ----- |\n| Benign Acc | 99.53 | 99.53 | 99.51      | 99.46 | 99.24 | 29.90 |\n| Adv Acc    | 71.84 | 81.53 | 81.86      | 78.47 | 60.56 | 29.90 |\n| Acc Drop   | 27.68 | 18.00 | 17.65      | 20.99 | 38.68 | 0.00  |\n\n> **Q2:** Under which conditions will Eq. 2 be identical to Eq. 1? Is RNPC a generalized version of NPC?\n\n**A2:** We will answer this question using two steps. **First**, we will directly compare $\\mathbb{P}\\_{\\theta, w}(Y|X)$ (Eq. 1) with $\\Phi\\_{\\theta, w}(Y|X)$ (Eq. 2), showing why RNPC is not a generalized version of NPC. **Second**, we will provide a more accurate comparison, comparing $\\mathbb{P}\\_{\\theta, w}(Y|X)$ (Eq. 1) with the **normalized** probability distribution $\\hat{\\Phi}\\_{\\theta, w}(Y|X)$ (Line 183), showing when these two distributions are the same.\n\n**Step 1**: Under Assump. 3.2 and the assumption that $\\Omega = \\bigcup\\_{\\tilde{y}}\\mathcal{N}(\\tilde{y}, r)$, we can write Eq. 1 as follows:\n$$\n\\mathbb{P}\\_{\\theta, w}\\left(Y=y \\mid X=x\\right) = \\sum\\_{a\\_{1:K}} \\mathbb{P}\\_{\\theta}\\left(A\\_{1:K}=a\\_{1:K} \\mid X=x\\right) \\cdot \\mathbb{P}\\_{w}\\left(Y=y \\mid A\\_{1:K} = a\\_{1:K}\\right)\\\\\n= \\sum\\_{\\tilde{y}}\\sum\\_{a_{1:K}\\in\\mathcal{N}(\\tilde{y}, r)} \\mathbb{P}\\_{\\theta}\\left(A\\_{1:K}=a\\_{1:K} \\mid X=x\\right) \\cdot \\mathbb{P}\\_{w}\\left(Y=y \\mid A\\_{1:K} = a\\_{1:K}\\right)\n$$\nMeanwhile, Eq. 2 is:\n$$\n\\Phi\\_{\\theta, w}(Y\\mid X) = \\sum\\_{\\tilde{y} \\in \\mathcal{Y}} \\left( \\mathbb{P}\\_{\\theta}\\left(A\\_{1:K} \\in \\mathcal{N}(\\tilde{y}, r) \\mid X\\right) \\cdot \\sum\\_{\\tilde{a}\\_{1:K} \\in V\\_{\\tilde{y}}} \\mathbb{P}\\_{w}\\left(Y \\mid A\\_{1:K}=\\tilde{a}\\_{1:K}\\right) \\right)\\\\\n= \\sum\\_{\\tilde{y} \\in \\mathcal{Y}} \\sum\\_{a\\_{1:K}\\in \\mathcal{N}(\\tilde{y}, r)} \\left( \\mathbb{P}\\_{\\theta}\\left(A\\_{1:K} = a\\_{1:K} \\mid X\\right) \\cdot \\sum\\_{\\tilde{a}\\_{1:K} \\in V\\_{\\tilde{y}}} \\mathbb{P}\\_{w}\\left(Y \\mid A\\_{1:K}=\\tilde{a}\\_{1:K}\\right) \\right)\n$$\nThese two equations only differ in the final terms. Specifically, the final term in NPC is **independent** of the class $\\tilde{y}$, while the final term in RNPC is **dependent** on$\\tilde{y}$, suggesting that it is doing the class-wise integration.\n\nTherefore, RNPC is **not** a generalized version of NPC; they represent fundamentally different ways of integrating over attribute probabilities.\n\n**Step 2**:  Consider a scenario where we learn an optimal attribute recognition model and an optimal probabilistic circuit, i.e., $\\mathbb{P}\\_{\\theta}(A\\_{1:K}|X) = \\mathbb{P}^\\*(A\\_{1:K}|X)$ and $\\mathbb{P}\\_{w}(Y|A\\_{1:K}) = \\mathbb{P}^\\*(Y|A\\_{1:K})$. Consequently, we have: $\\mathbb{P}\\_{\\theta, w}(Y|X) = \\mathbb{P}^\\*(Y|X)$ and $\\hat{\\Phi}\\_{\\theta, w}(Y|X) = \\hat{\\Phi}^\\*(Y|X)$ (Refer to **Prop. 4.8**).\n\nThen, the comparison between $\\mathbb{P}\\_{\\theta, w}(Y|X)$ and $\\hat{\\Phi}\\_{\\theta, w}(Y|X)$ **reduces to** evaluating the difference between $\\mathbb{P}^\\*(Y|X)$ and $\\hat{\\Phi}^\\*(Y|X)$. \n\nAs shown in **Thm. 4.11**,the expected total variance distance between these two distributions is upper bounded by:\n$$\n\\mathbb{E}\\_X\\left[ \\max\\_{\\tilde{y}}~d_{\\mathrm{TV}}\\left( \\bar{\\mathbb{P}}^\\*(Y\\mid A\\_{1:K}\\in V\\_{\\tilde{y}}), \\mathbb{P}^\\*(Y\\mid X) \\right) \\right]\n$$\nThe detailed proof is provided in **Appendix H.4**, specifically Lines 1033-1038.\n\nHence, when this bound is zero, and both modules are optimally learned, we have: $\\mathbb{P}\\_{\\theta, w}(Y|X) = \\hat{\\Phi}\\_{\\theta, w}(Y|X)$, i.e, the predicted distributions of NPC and RNPC are the same.\n\nOnce again, thanks for your questions, which lead us to better illustrate our method and intepret our theoretical results!"}, {"review_id": "AOkhfon2kC", "reviewer": "Reviewer_Cj51", "summary": "The authors study the robustness of neural probabilistic circuits, which is a new class of bottleneck models comprising an attribute recognition model and a probabilistic circuit for reasoning. They analyze the robustness of NPC and show that its robustness depends only on the robustness of the attribute recognition model. They proposed a novel algorithm for training a robust attribute recognition model. Empirically, the proposed RNPC outperforms existing concept bottleneck models.", "questions": "- How does the proposed approach for class-wise prediction scale to tasks with many attributes?\n- Does RNPC method achieve similar robustness improvements against other types of adversarial attacks and natural corruptions? Can the authors include robustness results against corruptions and other types of adversarial attacks, e.g. $\\ell_1$, $\\ell_2$, stAdv?\n- How sensitive is RNPC to the parameter $r$ used for partitioning the attribute space?", "limitations": "The authors extensively discussed limitations of the proposed work and suggested preliminary solutions to the limitations of RNPC method.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths:\n- Novel analysis of robustness of NPC models, showing that their robustness depends only on the robustness of the attribute recognition model.\n- Robust class-wise integration, which improves the robustness of NPC models without expensive adversarial retraining.\n- Experimental evaluation shows improved robustness of RNPC model compared to the baseline methods.\n\n## Weaknesses:\n- RNPC is vulnerable to attack propagation. The authors acknowledge this issues in limitations section but didn't propose any ways to mitigate it.\n- The theoretical analysis depends on the dataset having a sufficiently large minimum hamming distance. If the distance is small and the number of attributes is large, the number of partitions can be exponential, leading to poor scalability of the proposed approach.\n- The experimental evaluation is limited only to $\\ell_\\infty$ norm bounded attacks.", "was_revised": true, "final_justification": "I thank the authors for their thorough and detailed responses, which addressed my main concerns and clarified several key aspects of their work. In particular:\n- Expanded Robustness Evaluation: The authors added experiments on robustness to $\\ell_1$-norm attacks. Combined with the existing $\\ell_2$-norm results from the appendix, this resolves my initial concern about the limited scope of adversarial evaluation and strengthens the empirical claims.\n- Clarification of Parameter $r$: The explanation of the dataset-dependent radius $r$, along with the accompanying ablation study on its impact, provides a much clearer understanding of this parameter.\n- Defense againt Attack Propagation: The authors proposed and empirically validated an adversarial training approach to mitigate this vulnerability.\n\nConsidering these responses, along with clarifications provided to other reviewers, I maintain my positive assessment. My final recommendation remains the same: accept.", "rebuttal": "We sincerely thank the reviewer for the comprehensive feedback! We're glad you found our robustness analysis insightful (*model robustness only depends on robustness of the attribute recognition model*) and appreciated the efficiency and effectiveness of RNPC (*only requiring inference-time changes*)!\n\n> **Q1:** Can authors include robustness results against corruptions and $l_1$, $l_2$-norm-bounded attacks?\n\n**A1:** We answer this question in two steps.\n\n- Point out existing results against $l\\_2$-norm-bounded attacks\n\n  The evaluations in this paper are **not** limited to $ l\\_\\infty$-norm-bounded attacks. We performed extensive evaluations using both **$l\\_2$-norm-bounded PGD and CW attacks** with varying budgets. Results are presented in **Appendix G.2 (Fig. 6&7)**.\n\n- Explore new results against $l\\_1$-norm-bounded attacks and corruptions\n\n  - Setting: We adopt the EADL1 attack [1] with varying values of $\\beta$, which controls the $l\\_1$ regularization strength with a larger value yielding a sparser perturbation, and use different types of corruptions, respectively.\n  - Results: As shown in **Table 9**, RNPC consistently outperforms other baselines across EADL1 attacks with different $\\beta$ values, demonstrating robustness of RNPC against $l_1$-norm-bounded attacks. For corruptions, as shown in Table 10, all models appear robust to defocus blur and Gaussian noise. CBM and DCR are notably vulnerable to fog, whereas RNPC still exhibits high robustness.\n\nOverall, **these additional results for corruptions and $l\\_1$-norm-bounded attacks, together with the results for $l\\_\\infty$ and $l\\_2$-norm-bounded attacks provided in the paper, validate the robustness of RNPC under various types of perturbations.**\n\n[1] \"Ead: elastic-net attacks to deep neural networks via adversarial examples.\" AAAI.\n\n**Table 9**: Adversarial accuracy against EADL1 on MNIST-Add3.\n\n| $\\beta$ | CBM   | DCR   | NPC   | RNPC      |\n| ------- | ----- | ----- | ----- | --------- |\n| 0.0001  | 13.47 | 46.11 | 98.96 | **99.21** |\n| 0.001   | 12.86 | 80.79 | 98.75 | **99.10** |\n| 0.01    | 12.03 | 95.27 | 97.83 | **98.77** |\n\n**Table 10**: Performance against corruption on MNIST-Add3.\n\n|              | CBM   | DCR   | NPC   | RNPC      |\n| ------------ | ----- | ----- | ----- | --------- |\n| Defocus Blur | 99.11 | 98.53 | 99.35 | **99.37** |\n| Gauss Noise  | 96.06 | 95.36 | 99.10 | **99.11** |\n| Fog          | 42.80 | 45.95 | 81.71 | **83.72** |\n\n> **Q2:** How sensitive is RNPC to the parameter $r$ used for partitioning the attribute space?\n\n**A2:** We answer this question in two steps.\n\n- Clarification on radius.\n  We clarify that, as defined in **Def. 4.2**, $r$ denotes the **radius of the dataset**, which is determined by its intrinsic structure. This value is fixed unless the dataset itself is modified. To avoid confusion, we explicitly denote this radius as **$r^\\*$**. In contrast, it's possible to adjust the value of $r$ used in RNPC (see Eq. 2).\n- Explore the effect of changing $r$ on the performance of RNPC\n  - Setting: We conduct this analysis using MNIST-Add5, which has 5 attributes and a radius of $r^\\* = 2$. We vary $r$ in the range [0, 5] and evaluate performance of RNPC under an $l\\_\\infty$-norm-bounded PGD attack with a perturbation budget of 0.11.\n  - Benign Accuracy: As $r$ increases from 0 to 4, we observe a decreasing logit gap between the top-1 and top-2 predicted classes. Nevertheless, as shown in **Table 10**, RNPC consistently achieves **near-perfect accuracy**. When $r$ reaches 5, the accuracy drops to 29.9%. This is expected because, at $r = 5$, $\\mathbb{P}\\_\\theta(A\\_{1:K} \\in \\mathcal{N}(\\tilde{y},r) | X) = \\mathbb{P}\\_\\theta(A\\_{1:K} \\in \\Omega | X) = 1$, meaning Eq. 2 no longer contains any information from the input $X$.\n  - Adversarial Accuracy: When $r$ deviates from $r^\\*$, the adversarial accuracy declines. Despite this drop, **RNPC ($r\\neq 5$) still outperforms other baseline models**, which achieve below 40% accuracy (see Fig. 2 (middle)). Notably, when $r = 5$, adversarial accuracy drops to 29.9%, matching the benign accuracy and thus indicating a prediction perturbation of $\\Delta\\_{\\theta, w}^{RNPC}=0$. This aligns with theoretical results, because in this case, the right-hand side of **Lem. 4.6** becomes zero.\n\nOverall, when $r \\neq$ #attributes, **RNPC demonstrates strong resilience to changes in $r$ under benign settings; while adversarial accuracy declines when $r$ deviates from $r^\\*$, RNPC remains superior to baseline models.**\n\n**Table 10**: Performance of RNPC with various $r$ on MNIST-Add5\n\n|            | $r=0$ | $r=1$ | $r=2=r^\\*$ | $r=3$ | $r=4$ | $r=5$ |\n| ---------- | ----- | ----- | ---------- | ----- | ----- | ----- |\n| Benign Acc | 99.53 | 99.53 | 99.51      | 99.46 | 99.24 | 29.90 |\n| Adv Acc    | 71.84 | 81.53 | 81.86      | 78.47 | 60.56 | 29.90 |\n| Acc Drop   | 27.68 | 18.00 | 17.65      | 20.99 | 38.68 | 0.00  |\n\n> **Q3:** The theoretical analysis depends on the dataset having a sufficiently large minimum hamming distance. If the distance is small and the number of attributes is large, the number of partitions can be exponential. How does the proposed approach scale to tasks with many attributes?\n\n**A3:** We answer this question in three steps.\n\n- Clarifications\n\n  **First**, we clarify that the theoretical results do not assume a specific radius $r$ or the minimum Hamming distance $d\\_{\\min}$. The results hold for any non-negative radius $r \\geq 0$, which corresponds to $d\\_{\\min} \\geq 1$. But technically, larger values of $r$ (and thus larger $d\\_{\\min}$) are expected to provide higher robustness.\n\n  **Second**, the number of partitions is determined solely by the number of classes in the dataset, i.e., $|\\\\{V\\_y\\\\}| = |\\mathcal{Y}|$, and is **independent** of both $d\\_{\\min}$ and the number of attributes $K$.\n\n- Scaling to large $K$\n\n  We interpret the reviewer’s concern as follows: When $K$ increases, the size of the attribute space $\\prod\\_{k=1}^K |\\mathcal{A}\\_k|$ grows exponentially. How does RNPC handle this scaling?\n\n  As shown in **Prop. 4.4**, the computational complexity of RNPC is:\n\n$$\nO\\left(\\sum\\_{k=1}^K |f\\_k| + |S|\\cdot|V|\\right)\n$$\n\nHere, $|\\mathcal{Y}| \\leq |V| = \\sum\\_{y\\in\\mathcal{Y}} |V\\_y| \\leq \\prod\\_{k=1}^K |\\mathcal{A}\\_k|$. Therefore, although $|V|$ can be exponential in $K$ in the worst case, it can also be as small as $|\\mathcal{Y}|$ (when every class only has one high-probability attribute assignment), depending on the dataset's structure. In contrast, the computational complexity of NPC is always exponential in $K$.\n\n- More discussion\n\n  In fact, scaling remains an open challenge in neuro-symbolic models, especially those built upon graphical models. Some recent work explores approximation-based solutions. We will include this point in the discussion section.\n\nNevertheless, as demonstrated in **Prop. 4.4**, RNPC significantly reduces computational complexity compared to NPC, with improved inference time shown in Table 2 of **Appendix E**. \n\n> **Q4:** Authors discuss the vulnerability of RNPC to attack propagation in Limitations Section but didn't propose ways to mitigate it.\n\n**A4:** In **Appendix C**, we provide a detailed discussion of strategies to mitigate the attack propagation effect. Here, we also introduce **an adversarial training–based approach** for mitigation and evaluate its effectiveness on GTSRB-Sub, where spurious correlations between attributes are strong and result in significant attack propagation (see Fig. 3(d)).\n\n- Intuition\n\n  Suppose a model learns a spurious correlation between two attribute values, e.g., red color and circle shape. That is, the model may rely on features of \"red\" to identify \"circle\". To mitigate this correlation, we need to disentangle their features. Specifically, by generating adversarial examples that perturb the color attribute, we can shift the feature representation of \"red\" toward another color, thereby weakening its connection with \"circle\".\n\n- Method and Evaluation\n\n  Following this idea, during training, we generate adversarial samples that target a random attribute and train the model on both these samples and benign inputs. Table 13 reports performance of resulting models. Compared to models trained without adversarial training (Table 12), the adversarially trained models show significantly smaller drops in accuracy of different attributes when color is attacked, which indicates a reduction in the attack propagation effect. Consequently, the advantage of RNPC over NPC becomes evident again.\n\nOverall, **the adversarial-training-based approach leverages adversarial perturbations during training to disentangle spurious correlations between attributes, which effectively mitigates the attack propagation effect and enhances the robustness of RNPC on real-world datasets.**\n\n**Table 12**:  Col 2-4: Relative accuacy drop (\\%) of different attributes when color is attacked by PGD. Col 5-6: Task accuracy (\\%) of NPC and RNPC on GTSRB-Sub with a **standard** attribute recognition model\n\n| Budget | $\\Delta$Shape | $\\Delta$Symbol | $\\Delta$Text | NPC  | RNPC |\n| ------ | ------------- | -------------- | ------------ | ---- | ---- |\n| 0.07   | 30.3          | 70.7           | 43.7         | 28.4 | 31.8 |\n| 0.09   | 40.0          | 79.9           | 49.3         | 17.8 | 21.6 |\n| 0.11   | 45.5          | 87.1           | 53.9         | 10.9 | 12.9 |\n\n**Table 13**: Results with an **adversarially trained** attribute recognition model\n\n| Budget | $\\Delta$Shape | $\\Delta$Symbol | $\\Delta$Text | NPC  | RNPC |\n| ------ | ------------- | -------------- | ------------ | ---- | ---- |\n| 0.07   | 6.4           | 5.6            | 6.3          | 76.2 | 78.4 |\n| 0.09   | 10.0          | 7.9            | 8.5          | 62.4 | 69.3 |\n| 0.11   | 13.6          | 11.2           | 10.6         | 50.5 | 60.0 |\n\nOnce again, thanks for your questions, which lead us to understand and evaluate our method more comprehensively!"}, {"review_id": "0YogtqV2wd", "reviewer": "Reviewer_CLYy", "summary": "In this paper, the authors analyzed and improved the adversarial robustness of Neural Probabilistic Circuits (NPCs). One of the key findings of the paper is that an NPC's robustness to adversarial attacks is only determined by its attribute recognition model and not affected by the probabilistic circuit. Based on this insight, the authors proposed a new model called RNPC (Robust Neural Probabilistic Circuit) that uses a class-wise integration strategy rather than NPC's original node-wise integration. The authors demonstrated that this technique improves adversarial robustness by aggregating probabilities over attribute neighborhoods rather than relying on exact combinations. Then, the authors mathematically showed the robustness bounds and how the proposed approach maintains compositional estimation error. Finally, extensive experiments were conducted on multiple datasets to validate that RNPC significantly improves robustness while preserving benign accuracy.", "questions": "- The authors wrote on page 5: \"If such an attack shifts the probabilities originally assigned to nodes of $V_{y}$ to any other nodes within $\\mathcal{N}(y, r)$ the class-wise integration ensures that the weight of class $y$ is barely affected\". However, this depends on the capabilities of an adversary trying to launch adversarial attacks. If a strategic adversarial perturbation is introduced such that the impact crosses the inter-class distance, then what will happen? \n\n- For Equation 2, it is written: “RNPC's prediction becomes a weighted sum of all classes’ contributions to $Y$. This phrasing is potentially confusing, since $Y$ is the random variable representing the class itself, so classes cannot meaningfully “contribute” to $Y$. Would the authors clarify whether the RNPC's prediction is a weighted sum over classes of their contributions to the predicted class distribution, rather than to $Y$ itself? Please consider rephrasing this statement for precision.\n\n- The authors have used norm-bounded attacks (PGD, CW) without considering adaptive attackers who might deliberately design perturbations to cross the inter-class distance threshold; hence, the attribute vector crosses into another class’s neighborhood. How does RNPC function under such adaptive threat models? If authors could include an analysis or experiments to measure RNPC's resilience to such attacks, it would prove the robustness and versatility of RNPC against different types of attacks. \n\n- Hamming distance treats all attribute mismatches equally. But attributes may differ in importance or semantic meaning. For example, changing an attribute from 'red' to 'green' (color) may be more impactful than changing it from 'circle' to 'oval' (shape). Thus, the proposed framework may overestimate the 'safety' of a neighborhood if attributes differ in critical ways. Will it be feasible to consider weighting the Hamming distance to reflect the relative importance or semantic impact of different attributes?\n\n- The model partitions the attribute space into $V_{y}$ for each class, assuming these are non-overlapping. But, again, there can be some attribute combinations can correspond to multiple classes. Can authors clarify this?", "limitations": "- The approach assumes class-specific attribute partitions $V_{y}$ are non-overlapping, but some attribute combinations may belong to multiple classes.\n- Hamming distance treats all attributes equally, ignoring their differing semantic importance. Thus, using it to determine inter-class distance, then the minimum inter-class distance, and finally the neighborhood of a class, the core design principles, is a critical limitation of the paper.\n- RNPC is not evaluated against adaptive attacks.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper is well-structured, with clear descriptions of models, threats, and mathematical formulations. Thus, the paper is comprehensible and easy to navigate.\n- The theoretical analysis done by the authors is comprehensive and well-presented.\n- Experiments are comprehensive, covering various datasets and attack configurations.\n\nWeaknesses:\n- The assumption that the model partitions the attribute space into $V_{y}$ for each class, assuming these are non-overlapping, is a bit concerning, given that some attribute combinations can correspond to multiple classes.\n- RNPC defines the neighborhood $\\mathcal{N}(y, r)$ using Hamming distance between attribute vectors. Since attributes may differ in importance or semantic meaning, and Hamming distance treats all attribute mismatches equally, NPC may overestimate the safety of a neighborhood if attributes differ in critical ways.\n- The implicit assumption that if an attribute is perturbed, it still stays in the neighborhood is a critical concern. A strategic adversary can craft perturbations to cross the inter-class distance.", "was_revised": true, "final_justification": "After considering the authors' rebuttal, I am updating my score to accept. The author's response effectively addressed my primary concerns. The authors clearly explained the construction of non-overlapping attribute partitions and neighborhoods, also clarified the phrasing of Equation (2), and importantly proposed a feasible formulation to use the weighted Hamming distance as a future direction.", "rebuttal": "We sincerely thank the reviewer for the thoughtful feedback! We're glad you found the paper well-structured and easy to follow, with comprehensive theoretical analysis and extensive experiments!\n\n> **Q1:** The model partitions the attribute space into $V\\_y$ for each class, assuming these are non-overlapping. But some attribute combinations may correspond to multiple classes. Can authors clarify this?\n\n**A1:** We answer this question with the following three steps.\n\n- Clarify why the sets $\\\\{ V\\_y \\\\}$ are non-overlapping.\n\n  We first review the **construction process** of $\\\\{ V\\_y \\\\}$. Specifically, for any attribute assignment $a\\_{1:K}$, we assign it to the class $y^\\*=\\arg\\max\\_{y\\in\\mathcal{Y}} \\mathbb{P}\\_D(Y=y\\mid A\\_{1:K}=a\\_{1:K})$. That is, $a\\_{1:K}\\in V\\_{y^\\*}$. In the event of a tie, we can break it arbitrarily (e.g., by coin flipping), ensuring that each $a\\_{1:K}$ is assigned to a unique $y^\\*$. Thus, the sets $\\\\{V_y\\\\}$ are non-overlapping by construction.\n\n- Clarify why the sets $\\\\{ \\mathcal{N}(y, r) \\\\}$ are non-overlapping.\n\n  We further interpret the reviewer's concern as questioning the non-overlap of the neighborhoods $\\\\{\\mathcal{N}(y, r)\\\\}$. This property holds under a mild and implicit assumption: the radius $r$ of the attribute set is **non-negative** ($r \\geq 0$). This corresponds to a minimum Hamming distance of **at least 1** ($d\\_{min} \\geq 1$), which generally holds in the context of concept bottleneck models, where each class is associated with distinct concept combinations. In cases where this does not hold, we propose the following strategy.\n\n- Propose a strategy for overlapping scenarios.\n\n  One potential approach is to incorporate additional unsupervised attributes [1] during training to help capture fine-grained distinctions between classes sharing the same observed attribute values. \n\nThanks for this question. It helps us clarify the scenarios considered in our work and point out potential scenarios. We will include this discussion in the paper!\n\n[1] \"Concept bottleneck model with additional unsupervised concepts.\" IEEE Access. 2022.\n\n> **Q2:** Would the authors clarify that the RNPC's prediction is a weighted sum over classes of their contributions to the predicted class distribution, rather than to the variable $Y$ itself? Please consider rephrasing this statement for precision.\n\n**A2:** Thanks for the suggestion. Below is our rephrased version that improves the clarity of Eq. 2:\n$$\n\\Phi\\_{\\theta, w}(Y=y\\mid X=x) = \\sum\\_{\\tilde{y} \\in \\mathcal{Y}} \\left( \\mathbb{P}\\_{\\theta}\\left(A\\_{1:K} \\in \\mathcal{N}(\\tilde{y}, r) \\mid X=x\\right) \\cdot \\sum\\_{a\\_{1:K} \\in V\\_{\\tilde{y}}} \\mathbb{P}\\_{w}\\left(Y=y \\mid A\\_{1:K}=a\\_{1:K}\\right) \\right).\n$$\nCompared to the original Eq.2, we add $Y=y$ and $X=x$, making it clearer that RNPC's prediction is a weighted sum over classes of their contributions to the predicted class—$y$.\n\n> **Q3:** How does RNPC perform when confronted with adaptive attacks that craft adversarial perturbations capable of crossing inter-class? If authors could include an analysis or experiments to measure RNPC's resilience to such attacks, it would prove the robustness and versatility of RNPC against different types of attacks.\n\n**A3:** We answer this question with the following three steps.\n\n- Clarification on the role of the radius $r$.\n\n  First, we'd like to clarify the relationship between RNPC's performance and the radius of the attribute set, denoted by $r := \\lfloor\\frac{d\\_{\\min}-1}{2}\\rfloor$. As stated in **Lines 167-170**, when the number of attacked attributes is not greater than $r$, the perturbed probabilities are transferred to nodes within $\\mathcal{N}(y^\\*, r)$, where $y^\\*$ denotes the ground-truth class. RNPC is designed to aggregate these probabilities via Eq. 2, thereby tolerating such perturbations. **Theoretically**, Lem. 4.6 ensures that the prediction perturbation $\\Delta\\_{\\theta, w}^{RNPC}$ is small in this case. **Empirically**, Fig. 2 demonstrates that RNPC achieves high adversarial accuracy on MNIST-Add3 ($r = 1$), MNIST-Add5 ($r = 2$), and CelebA-Syn ($r = 1$) datasets when a single attribute is attacked. These results validate RNPC’s robustness when the number of attacked attributes is within $r$.\n\n- Define adaptive attacks for RNPC.\n\n  Based on the understanding of the role of $r$, we can now define adaptive attacks for RNPC. Specifically, **knowing the value of $r$, an adaptive attacker for RNPC will deliberately generate adversarial perturbations that target more than $r$ attributes.** Then, how does RNPC perform against such adaptive attacks?\n\n- Evaluation against adaptive attacks.\n\n  In fact, this question has been answered in our paper. Specifically, **Fig. 3 (a-b) in Sec 5.3** illustrate the performance of RNPC under varying numbers of attacked attributes. For your convenience, we summarize the results in the following tables. As shown in **Table 14** and **Table 15**, RNPC consistently outperforms baseline models. In particular, when the number of attacked attributes is within $r$, the performance gap is significant. For instance, RNPC achieves up to 45\\% higher adversarial accuracy than the best-performing baseline on MNIST-Add3 when one attribute is attacked. As the number of attacked attributes exceeds $r$, RNPC’s advantage narrows, yet it still maintains the highest robustness among all models.\n\nOverall, on these datasets, **compared to baseline models, RNPC exhibits strong robustness against the adaptive attacks that target more than $r$ attributes.**\n\n**Table 14**: Adversarial accuracy on MNIST-Add3 under the PGD attack with varying numbers of attacked attributes.\n\n| #Attacked attributes | CBM  | DCR   | NPC   | RNPC      |\n| -------------------- | ---- | ----- | ----- | --------- |\n| 1 (=r)               | 5.55 | 13.07 | 19.27 | **64.30** |\n| 2                    | 5.09 | 12.41 | 18.20 | **37.55** |\n| 3                    | 4.91 | 11.79 | 15.28 | **30.32** |\n\n**Table 15**: Adversarial accuracy on MNIST-Add5 under the PGD attack with varying numbers of attacked attributes.\n\n| #Attacked attributes | CBM   | DCR   | NPC   | RNPC      |\n| -------------------- | ----- | ----- | ----- | --------- |\n| 1                    | 14.07 | 30.28 | 26.99 | **81.81** |\n| 2 (=r)               | 13.31 | 26.10 | 18.22 | **63.53** |\n| 3                    | 12.47 | 22.05 | 22.62 | **52.14** |\n| 4                    | 12.00 | 21.84 | 22.25 | **47.01** |\n| 5                    | 11.67 | 22.41 | 23.90 | **43.29** |\n\n> **Q4:** Would it be feasible to consider weighting the Hamming distance to reflect the relative importance or semantic impact of different attributes?\n\n**A4:** Yes, our framework could definitely be extended to incorporate weights associated to each attribute when defining the distance between two attribute assignments. \n\nFormally, let each attribute $A\\_i$ be assigned with a weight $w\\_i$, such that $\\sum\\_i w\\_i = K$. We can then define a **weighted Hamming distance** between two attribute assignments $a\\_{1:K}$ and $a\\_{1:K}^{\\prime}$ as: \n$$\nd\\_w(a\\_{1:K}, a\\_{1:K}^{\\prime}) = \\sum\\_i w\\_i \\mathbb{I}(a\\_i \\neq a\\_i^{\\prime})\n$$\nBased on this distance, we can define a new **neighborhood**: \n$$\n\\mathcal{N}\\_w(y,r) := V\\_y \\cup \\\\{ a\\_{1:K}^c\\in V^c: \\min\\_{a\\_{1:K}\\in V\\_y} d\\_w\\left( a\\_{1:K}^c, a\\_{1:K} \\right) \\leqslant r \\\\}\n$$\nThis formulation allows certain attributes to be emphasized by assigning them higher weights, while others can be downweighted with smaller values of $w\\_i$. However, determining appropriate weights would still require some prior domain knowledge specified by humans. Thanks for this suggestion, which presents an interesting direction to extend in future work.\n\nOnce again, thank you for your insightful questions, which help us clarify our work more thoroughly and explore promising future directions!"}]

Author rebuttal:

Meta-review: The paper aims to analyze and improve the adversarial robustness of concept bottleneck models, specifically neural probabilistic circuits (NPCs). In the paper, theoretical evidence is provided for adversarial robustness of the NPC depending primarily on the attribute recognition model and not the robustness of the PC, which leads to the conception of robust (R)NPCs at the hand of changes to the inference-stage. This provides merit over defenses that are rooted in training. Beyond these key theoretical strengths, the paper is well written, clearly presented and features several empirical verifications, including rigorous ablation studies. A main weakness can perhaps be attributed to the lack of scale of the experimentation, relying largely on small MNIST-like datasets. Given the scope of the work and the inherent present limitations of NPCs this seems reasonable. 

Reviewers were generally all favorable of the paper from the start. All agree on the method being valuable, the theoretical contributions being substantial, and the empirical investigation to be mostly satisfactory. Few initial concerns were pointed out, including some concerns over hyper parameter choices, lack of larger datasets, the methods' vulnerability to attack propagation and some theoretical caveats on the assumptions regarding the neighborhood and hamming distance for specific dataset configurations. The rebuttal was able to resolve some of these concerns, specifically questions regarding the empirical procedures and made assumptions. It specifically acknowledged the vulnerability to attack propagation in the limitations section of the paper and reviewers are generally satisfied with this point not being resolved immediately. The AC agrees with that this take that not all scenarios in various complicated set-ups can be addressed immediately and agrees with the reviewers on the general value of the contribution. 

The AC recommends accepting the paper.
Decision: Accept (poster)