Title: Understanding and Improving Adversarial Robustness of Neural Probabilistic Circuits
Venue: NeurIPS 2025
Accepted: yes
Keywords: Concept Bottleneck Models

Neuro-Symbolic AI

Interpretability

Adversarial Robustness
Abstract: Neural Probabilistic Circuits (NPCs), a new class of concept bottleneck models, comprise an attribute recognition model and a probabilistic circuit for reasoning. By integrating the outputs from these two modules, NPCs produce compositional and interpretable predictions. While offering enhanced interpretability and high performance on downstream tasks, the neural-network-based attribute recognition model remains a black box. This vulnerability allows adversarial attacks to manipulate attribute predictions by introducing carefully crafted subtle perturbations to input images, potentially compromising the final predictions. In this paper, we theoretically analyze the adversarial robustness of NPC and demonstrate that it only depends on the robustness of the attribute recognition model and is independent of the robustness of the probabilistic circuit. Moreover, we propose RNPC, the first robust neural probabilistic circuit against adversarial attacks on the recognition module. RNPC introduces a novel class-wise integration for inference, ensuring a robust combination of outputs from the two modules. Our theoretical analysis demonstrates that RNPC exhibits provably improved adversarial robustness compared to NPC. Empirical results on image classification tasks show that RNPC achieves superior adversarial robustness compared to existing concept bottleneck models while maintaining high accuracy on benign inputs. The code is available at https://github.com/uiuctml/RNPC.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors analyzed and improved the adversarial robustness of Neural Probabilistic Circuits (NPCs). One of the key findings of the paper is that an NPC's robustness to adversarial attacks is only determined by its attribute recognition model and not affected by the probabilistic circuit. Based on this insight, the authors proposed a new model called RNPC (Robust Neural Probabilistic Circuit) that uses a class-wise integration strategy rather than NPC's original node-wise integration. The authors demonstrated that this technique improves adversarial robustness by aggregating probabilities over attribute neighborhoods rather than relying on exact combinations. Then, the authors mathematically showed the robustness bounds and how the proposed approach maintains compositional estimation error. Finally, extensive experiments were conducted on multiple datasets to validate that RNPC significantly improves robustness while preserving benign accuracy.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper is well-structured, with clear descriptions of models, threats, and mathematical formulations. Thus, the paper is comprehensible and easy to navigate.\n- The theoretical analysis done by the authors is comprehensive and well-presented.\n- Experiments are comprehensive, covering various datasets and attack configurations.\n\nWeaknesses:\n- The assumption that the model partitions the attribute space into $V_{y}$ for each class, assuming these are non-overlapping, is a bit concerning, given that some attribute combinations can correspond to multiple classes.\n- RNPC defines the neighborhood $\\mathcal{N}(y, r)$ using Hamming distance between attribute vectors. Since attributes may differ in importance or semantic meaning, and Hamming distance treats all attribute mismatches equally, NPC may overestimate the safety of a neighborhood if attributes differ in critical ways.\n- The implicit assumption that if an attribute is perturbed, it still stays in the neighborhood is a critical concern. A strategic adversary can craft perturbations to cross the inter-class distance.\n\nQUESTIONS:\n- The authors wrote on page 5: \"If such an attack shifts the probabilities originally assigned to nodes of $V_{y}$ to any other nodes within $\\mathcal{N}(y, r)$ the class-wise integration ensures that the weight of class $y$ is barely affected\". However, this depends on the capabilities of an adversary trying to launch adversarial attacks. If a strategic adversarial perturbation is introduced such that the impact crosses the inter-class distance, then what will happen? \n\n- For Equation 2, it is written: “RNPC's prediction becomes a weighted sum of all classes’ contributions to $Y$. This phrasing is potentially confusing, since $Y$ is the random variable representing the class itself, so classes cannot meaningfully “contribute” to $Y$. Would the authors clarify whether the RNPC's prediction is a weighted sum over classes of their contributions to the predicted class distribution, rather than to $Y$ itself? Please consider rephrasing this statement for precision.\n\n- The authors have used norm-bounded attacks (PGD, CW) without considering adaptive attackers who might deliberately design perturbations to cross the inter-class distance threshold; hence, the attribute vector crosses into another class’s neighborhood. How does RNPC function under such adaptive threat models? If authors could include an analysis or experiments to measure RNPC's resilience to such attacks, it would prove the robustness and versatility of RNPC against different types of attacks. \n\n- Hamming distance treats all attribute mismatches equally. But attributes may differ in importance or semantic meaning. For example, changing an attribute from 'red' to 'green' (color) may be more impactful than changing it from 'circle' to 'oval' (shape). Thus, the proposed framework may overestimate the 'safety' of a neighborhood if attributes differ in critical ways. Will it be feasible to consider weighting the Hamming distance to reflect the relative importance or semantic impact of different attributes?\n\n- The model partitions the attribute space into $V_{y}$ for each class, assuming these are non-overlapping. But, again, there can be some attribute combinations can correspond to multiple classes. Can authors clarify this?\n\nLIMITATIONS:\n- The approach assumes class-specific attribute partitions $V_{y}$ are non-overlapping, but some attribute combinations may belong to multiple classes.\n- Hamming distance treats all attributes equally, ignoring their differing semantic importance. Thus, using it to determine inter-class distance, then the minimum inter-class distance, and finally the neighborhood of a class, the core design principles, is a critical limitation of the paper.\n- RNPC is not evaluated against adaptive attacks.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors study the robustness of neural probabilistic circuits, which is a new class of bottleneck models comprising an attribute recognition model and a probabilistic circuit for reasoning. They analyze the robustness of NPC and show that its robustness depends only on the robustness of the attribute recognition model. They proposed a novel algorithm for training a robust attribute recognition model. Empirically, the proposed RNPC outperforms existing concept bottleneck models.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths:\n- Novel analysis of robustness of NPC models, showing that their robustness depends only on the robustness of the attribute recognition model.\n- Robust class-wise integration, which improves the robustness of NPC models without expensive adversarial retraining.\n- Experimental evaluation shows improved robustness of RNPC model compared to the baseline methods.\n\n## Weaknesses:\n- RNPC is vulnerable to attack propagation. The authors acknowledge this issues in limitations section but didn't propose any ways to mitigate it.\n- The theoretical analysis depends on the dataset having a sufficiently large minimum hamming distance. If the distance is small and the number of attributes is large, the number of partitions can be exponential, leading to poor scalability of the proposed approach.\n- The experimental evaluation is limited only to $\\ell_\\infty$ norm bounded attacks.\n\nQUESTIONS:\n- How does the proposed approach for class-wise prediction scale to tasks with many attributes?\n- Does RNPC method achieve similar robustness improvements against other types of adversarial attacks and natural corruptions? Can the authors include robustness results against corruptions and other types of adversarial attacks, e.g. $\\ell_1$, $\\ell_2$, stAdv?\n- How sensitive is RNPC to the parameter $r$ used for partitioning the attribute space?\n\nLIMITATIONS:\nThe authors extensively discussed limitations of the proposed work and suggested preliminary solutions to the limitations of RNPC method.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

comments: SUMMARY:
This paper proposes a robust approach to tackle adversarial attacks on Neural Probabilistic Circuits (NPCs). While NPCs produce interpretable results through an attribute recognition model, a carefully designed attack based on the attributes can reduce their performance. Therefore, this paper adopts a different inference strategy to tackle the adversarial attacks, without sacrificing the benign accuracies. Their theoretically grounded inference approach is validated with four different adversarial datasets with superior performances.

STRENGTHS AND WEAKNESSES:
The strengths of the paper are 

**1. Well-written:** The paper is well-written with a clear motivation behind designing a robust NPC inference method. The distinction between NPC and RNPC is highlighted in the overview figure. Intuitions and theoretical discussions are also well-crafted and aptly put in the paper. 

**2. Good results:**  The method shows comparable performance under benign settings and significantly improved performance under adversarial settings, bolstering the hypothesis. 

**3. Proper ablation studies:** The paper performs adequate ablation studies to further verify their hypothesis. Impact of the number of attributes is studied and a future research direction is proposed based on the spurious correlation shown in Fig 5 (d). 

The weaknesses of the paper are:

**1. No ablation study on the neighbourhood radius.** The weighted inference is based on some neighbourhood of radius r. It would be interesting to see how the performance varies with this radius. 

**2. Is RNPC a generalized version of NPC?** Is there any way to collapse the RNPC formulation to the NPC-one? Under which conditions Eqn (2) will be identical to Eqn (1) ?

QUESTIONS:
See weaknesses

LIMITATIONS:
N/A
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a new version of Neural Probabilistic Circuits (NPCs) which is robust against adversarial attacks. First, the authors establish that the vulnerability of NPC to adversary attacks is due to how the outputs of the attribute recognition modules are combined to generate the prediction label. Once an adversary fools enough attribute classifiers, the downstream probabilistic circuit will end up outputting the incorrect prediction label. Based on this insight, the authors propose a new way of combining the outputs of the attribute recognition modules that make it less susceptible to adversarial attacks. Authors provide theoretical and empirical evidence to demonstrate that this new version of NPC, called RNPC, preserves performance on benign inputs while significantly boosting performance on adversarial inputs.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. The paper is well-written and easy to follow. The authors motivate the problem clearly, and provided an eloquent description of the proposed method (RNPC).\n\n2. Authors provide a detailed theoretical evidence to justify the effectiveness of RNPC. All theorems are adequately defined and backed up with proofs. All assumptions and limitations are clearly stated.\n\n3. RNPC only requires inference-time changes, and therefore has much better usability than training-based defenses.\n\n4. Authors discuss several key ablation experiments that help understand RNPC in greater detail. For example, the discussion on spurious correlations demonstrated how certain attributes can be attacked together based on the characteristics of the dataset. This highlights a key vulnerability of CBMs.\n\n5. Empirical results demonstrate that RNPC yields strong robustness compared to baseline while reducing inference time.\n\n\n### Weaknesses\n1. Authors don't systematically analyze the attack propagation phenomenon. Specifically, they don't show if there is a direct correlation between co-occurence of attributes in a dataset and the possibility of attack propagation between them.\n\n2. The proposed defense scales poorly with complexity of the dataset. This is evident in Fig3-c, where NPC and RNPC have similar robustness on GTSRB-sub. Authors explain that this is because of the attack propagation effect. It appears that attack propagation becomes more severe as dataset complexity increases. Therefore, the utility of the proposed defense seems to be only applicable to small-scale toy datasets like MNIST.\n\n3. Authors back up key findings using results on small-scale toy datasets only. Results on more complex datasets are either lacking or not convincing.\n\n4. Authors propose remedies to mitigate the attack propagation effect in the Appendix. However, there is no result available that can provide evidence for whether these remedies will be effective. For example, adding synthetic training data may prevent the model from learning spurious correlations, but it may also reduce the model's performance on benign data as these spurious correlations may be driving some of the performance in the benign setting. It is important to develop a comprehensive understanding of how problematic attack propagation really is, which the paper doesn't provide.\n\n5. The authors only consider an adversary that targets the attribute recognition module. However, an adversary can also target the end-to-end RNPC prediction pipeline. Authors don't consider such an adaptive attack scenario in the paper. Strong robustness guarantees in settings where the adversary is oblivious of the defense are not as impactful.\n\n6. The authors present results using very restrictive adversarial budget (epsilon). When attacking the traditional MNIST neural network classifiers, epsilon=3.0 is used. But authors use epsilon=0.11 at max for MNIST-Add3 and MNIST-Add5. This dilutes the impact of the proposed defense.\n\nQUESTIONS:\n1. What if we train the recognition module adversarially? How will this affect the robustness of the NPC and the RNPC inference methods?\n2. How does NPC and RNPC compare against each other when attack the end-to-end prediction pipeline?\n3. Can we predict which attributes can be attack together based on how often attributes co-occur in the training data?\n\nLIMITATIONS:\nThe authors have adequately discussed limitations of the proposed method in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-14"}