# Domain Knowledge Alleviates Adversarial Attacks in Multi-Label Classifiers

arXiv: https://arxiv.org/abs/2006.03833 · HTML: https://mlsanity.com/paper/2006.03833/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jun 2020.

## Built on by (most cited first, 10 of 10)

- [Logic Explained Networks](https://mlsanity.com/paper/2108.05149/) (2021)
- [Improving deep learning with prior knowledge and cognitive models: A survey on enhancing explainability, adversarial robustness and zero-shot learning](https://mlsanity.com/paper/2403.07078/) (2024)
- [Factor Graph-based Interpretable Neural Networks](https://mlsanity.com/paper/2502.14572/) (2025)
- [Superclass Adversarial Attack](https://mlsanity.com/paper/2205.14629/) (2022)
- [A Robust Multilabel Method Integrating Rule-based Transparent Model, Soft Label Correlation Learning and Label Noise Resistance](https://mlsanity.com/paper/2301.03283/) (2023)
- [DOST -- Domain Obedient Self-supervised Training for Multi Label Classification with Noisy Labels](https://mlsanity.com/paper/2308.05101/) (2023)
- [PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches](https://mlsanity.com/paper/2505.24703/) (2025)
- [Knowledge-driven Active Learning](https://mlsanity.com/paper/2110.08265/) (2021)
- [When Measures are Unreliable: Imperceptible Adversarial Perturbations toward Top-k Multi-Label Learning](https://mlsanity.com/paper/2309.00007/) (2023)
- [VALUED -- Vision and Logical Understanding Evaluation Dataset](https://mlsanity.com/paper/2311.12610/) (2023)

## Abstract (arXiv)

Adversarial attacks on machine learning-based classifiers, along with defense mechanisms, have been widely studied in the context of single-label classification problems. In this paper, we shift the attention to multi-label classification, where the availability of domain knowledge on the relationships among the considered classes may offer a natural way to spot incoherent predictions, i.e., predictions associated to adversarial examples lying outside of the training data distribution. We explore this intuition in a framework in which first-order logic knowledge is converted into constraints and injected into a semi-supervised learning problem. Within this setting, the constrained classifier learns to fulfill the domain knowledge over the marginal distribution, and can naturally reject samples with incoherent predictions. Even though our method does not exploit any knowledge of attacks during training, our experimental analysis surprisingly unveils that domain-knowledge constraints can help detect adversarial examples effectively, especially if such constraints are not known to the attacker.