# Safety, Security, and Cognitive Risks in Neuro-Symbolic AI

arXiv: https://arxiv.org/abs/2606.17223 · HTML: https://mlsanity.com/paper/2606.17223/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jun 2026.

## Built on by (most cited first, 1 of 1)

- [Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective](https://mlsanity.com/paper/2609.00464/) (2026)

## Abstract (arXiv)

Neuro-symbolic AI (NeSy) pairs neural perception with symbolic reasoning, making it attractive for high-stakes domains where explainability and structured inference are required. However, this hybrid architecture introduces an enlarged attack surface spanning five layers: neural perception, symbolic knowledge bases, reasoning engines, agentic orchestration, and data stores -- each exploitable in ways absent from purely neural systems. This paper makes six contributions: (1) formal definitions of NeSy Attack Surface, Symbolic Integrity Violation (SIV), and Cross-Layer Amplification Ratio X, decomposed into neural-caused and autonomous symbolic sensitivity components; (2) a unified threat model extending MITRE ATLAS with 11 NeSy-specific tactic extensions and a five-profile attacker taxonomy; (3) a symbolic-layer threat catalogue covering knowledge graph (KG) poisoning, ontology-merging, and inference-engine subversion; (4) analysis of cognitive risks -- automation bias, authority bias, and sycophantic reinforcement -- structurally amplified by NeSy's explicit logical explanations relative to black-box neural outputs; (5) interdisciplinary mitigations with measurable acceptance criteria aligned to NIST AI 600-1 and the EU AI Act; (6) three empirical benchmarks: (E1) targeted KG poisoning achieves break-even SIV at injection budget B=5 on a 205-entity medical KG, with a KG-specific stealth/SIV trade-off; (E2) PGD-10 at varepsilon=0.01 yields X=5.884 (95% CI [4.64,, 8.00], p<0.0001), confirmed adversarially specific by a matched-random baseline (ERrand=0), on a DistilBERT+ProbLog pipeline; (E3) single-axiom OWL edits achieve 93.3% SIV success with 100% Pellet-consistency stealth, but held-out STIX detection fails at 50% (random-guessing level), an open problem.