An Explainable Neuro-Symbolic Framework for Online Exam Cheating Detection

Abstract

With the proliferation of online examination systems, protecting academic integrity and reliably detecting cheating have become significant research problems. Current AI-based online monitoring systems can achieve high accuracy by analyzing visual behavioral cues; however, their often black-box nature limits their explainability, reliability, and legal compliance (e.g., GDPR). In contrast, while rule-based approaches are interpretable, they are insufficient for generalizing complex and ambiguous human behaviors. This study proposes an explainable neuro-symbolic framework combining data-driven learning with symbolic reasoning for cheating detection in online exams. The proposed framework comprises three main layers: a neural perceptron layer that generates a suspicious behavior score; a symbolic reasoning layer comprising ANFIS and ILP methods to increase explainability and manage ambiguity; and a neuro-symbolic fusion layer that integrates these two layers. The success of the proposed framework for plagiarism detection was evaluated using a dataset containing visual–behavioral features such as gaze behavior, head pose, hand-object interaction, and device usage, along with the XGBoost method at the neural perceptron layer. Experimental results show that the proposed approach achieves high detection success and supports decision-making using logical rules, thereby reducing false positives. In this respect, the study offers an ethical, transparent, and reliable solution for online exam security.

1. Introduction

In recent years, online education and distance assessment systems have become an indispensable part of higher education worldwide [1,2]. Studies show that cheating rates on online exams have increased significantly compared to in-person exams, and that students are developing new methods of cheating using technological tools [3,4,5]. This situation not only threatens the validity of assessment processes but also undermines the credibility of educational institutions. This need has increased interest in AI-based online monitoring (AI proctoring) systems that offer scalable, automated solutions [6,7].

In the current literature, deep learning and machine learning methods achieve high accuracy in cheating detection from visual–behavioral data [8,9]. However, many of these approaches rely on black-box models that fail to explain decision-making processes in a way that is understandable to humans [10,11,12,13]. This situation creates ethical risks, particularly the false positives that could blame innocent students, and contradicts the transparency and accountability requirements of automated decision-making systems. In contrast, while rule-based and symbolic systems offer high interpretability, they are limited in modeling the uncertain, context-dependent nature of human behavior. This creates the problem of not being able to justify model outputs, especially in sensitive areas such as academic assessment. Furthermore, it contradicts students’ rights to challenge and demand explanations for automated decisions under legal regulations, such as Article 22 of the European Union General Data Protection Regulation (GDPR) [14], and raises ethical concerns [13].

Although rule-based and symbolic systems offer high explainability, they fall short in generalizing complex and variable behavioral patterns. In this context, Neuro-Symbolic AI, referred to as the third wave in artificial intelligence research, aims to combine the power of data-driven learning with the transparency of symbolic reasoning [12,15,16]. Neuro-symbolic systems aim to integrate neural networks’ ability to learn features from complex, noisy data with the advantages of symbolic systems in terms of logical consistency and explainability [12,13].

This study proposes an interpretable-by-design neuro-symbolic framework for cheating detection in online exams. The proposed framework consists of a Neural Perceptron Layer (NPL) that generates a continuous suspicious behavior score from visual–behavioral cues, a symbolic reasoning layer (SRL) based on fuzzy rules managing ambiguities, and ANFIS and Inductive Logic Programming (ILP) ensuring logical consistency, and a neuro-symbolic fusion layer (NSFL) that integrates neural and symbolic outputs in a trust-aware manner. This structure aims to provide a transparent, reliable, and ethical solution for online exam supervision by not only offering high detection accuracy but also clearly revealing the behavioral and logical justifications behind each decision.

The main contributions of this work are summarized as follows:

• A hybrid neuro-symbolic framework combining XGBoost, ANFIS, and ILP for online exam cheating detection.
• A confidence-aware fusion mechanism where symbolic violations dynamically regulate neural decisions.
• An interpretable-by-design explanation layer producing rule-based justifications instead of post hoc explanations.
• Extensive experimental validation on a public dataset demonstrating high accuracy with reduced false positives.

The remainder of this paper is organized as follows. Section 2 reviews related work on AI-based online exam monitoring, explainable AI, and neuro-symbolic approaches. Section 3 presents the proposed neuro-symbolic framework, detailing the Neural Perception Layer (NPL), the Symbolic Reasoning Layer (SRL), and the Neuro-Symbolic Fusion Layer (NSFL). Section 4 describes the experimental setup, performance evaluation metrics, and empirical results, including statistical and logical analyses. Section 5 discusses the findings in relation to the literature, trustworthiness considerations, and system limitations. Finally, Section 6 concludes the paper and outlines directions for future research.

2. Related Works

Studies aimed at automatically detecting cheating and suspicious student behavior in online exams have increased significantly in recent years, driven by advances in computer vision, machine learning, and artificial intelligence. Research conducted after the COVID-19 pandemic shows that academic integrity violations have become widespread in remote assessment environments, and students have developed new cheating methods using tools such as secondary devices, screen sharing, and generative AI. This has increased interest in AI proctoring systems that offer scalable and automated solutions [4]. These systems generally aim to detect suspicious activity by analyzing students’ behavior during exams. Camera-based solutions, in particular, focus on identifying cheating behavior by using visual cues such as facial expressions, eye movements, and head movements [17,18,19,20]. These models can learn temporal behavioral patterns that emerge throughout the exam, going beyond mere snapshots [21].

2.1. Deep Learning and Machine Learning Approaches

Much of the current research relies on deep learning and computer vision-based approaches. Convolutional Neural Network (CNN)-based object detection models and face analysis methods have achieved high accuracy in tasks such as multi-person detection, head pose estimation, and forbidden object detection [9,17,18]. In addition, LSTM- and RNN-based architectures have been widely used for temporal modeling of behavioral signals, such as gaze direction and head movements [17,19,20]. These models can learn temporal behavioral patterns that emerge throughout the exam, going beyond mere snapshots [21]. While these approaches are effective in capturing behavioral patterns during online exams, they mostly remain black-box models [10]. Kamalov et al. [20] proposed a machine learning framework based on structured behavioral indicators, demonstrating effective discrimination performance but without integrating visual–behavioral reasoning or interpretability mechanisms. Essahraui et al. [9] employed convolutional neural networks (CNNs) to detect suspicious head-object interactions in webcam recordings. Similarly, Alkhalisy and Abid [17] applied deep learning models with data augmentation to improve abnormal behavior detection accuracy. While these approaches exhibit strong perceptual modeling capacity, they function as black-box systems without embedded logical reasoning.

Due to the limitations of single behavioral cues, multimodal approaches have gained prominence in recent years. Systems that consider multiple visual cues together, such as head pose, gaze behavior, hand-object interaction, and device use, have improved cheating-detection performance. However, most of these systems fail to clearly explain which combinations of behaviors the decisions are based on and are evaluated solely on high-accuracy metrics [22].

Across these approaches, a common limitation emerges: high predictive accuracy is achieved, yet logical constraints and deterministic-violation reasoning are not embedded in the inference pipeline. Decisions remain predominantly probabilistic.

2.2. Explainable AI in Online Proctoring

Within the scope of Explainable Artificial Intelligence (XAI), post-hoc explanation methods such as SHAP, LIME, and Grad-CAM [23,24] have been used to interpret model decisions in online exam supervision systems [25,26,27,28,29]. While these methods can show which features influenced a particular decision, they are insufficient to explain the model’s decision-making mechanism in a logical causal chain [30]. Furthermore, such explanations are generated after the model, and the decision-making process itself remains a black box [23,31,32]. These limitations pose a significant problem, especially in online exam environments where false positives incur high ethical costs [32]. GDPR and similar regulations require automated decision-making systems to be transparent and justifiable [33]. In this context, there is a need not only for models that offer high accuracy but also for systems that can clearly explain why decisions were made.

Arrieta et al. [23] provide a comprehensive taxonomy of XAI methods, distinguishing between inherently interpretable models and post hoc explanation approaches. In practice, many proctoring systems rely on SHAP or LIME to interpret model outputs [25]. Erdem and Karabatak [27] utilized XGBoost for unethical behavior detection and incorporated SHAP and LIME as post hoc explanation tools. Although feature importance information was provided, the explanation mechanism was external to the decision-making process. Liu et al. [28] introduced a multiple-instance learning framework for cheating localization in video streams, focusing on spatial attention rather than rule-level interpretability. Ortin et al. [29] developed a machine learning assistant for detecting fraudulent activities in programming exams, emphasizing classification performance over symbolic transparency.

However, post hoc methods attribute feature importance after a decision has been made and do not structurally modify the reasoning process itself. Regulatory discussions concerning automated decision-making under GDPR Article 22 emphasize that meaningful transparency requires justifiable reasoning mechanisms rather than surface-level attribution [13,14]. Therefore, while XAI techniques improve interpretability, they do not inherently guarantee logical consistency or reduce ethically problematic false-positive outcomes.

2.3. Neuro-Symbolic AI Approaches

There is a need not only for models that offer high accuracy but also for systems that can clearly explain why decisions were made. In recent years, neuro-symbolic AI approaches that combine the perceptual learning power of neural networks with the explainability of symbolic reasoning have emerged to address this need [12,34]. Neuro-symbolic systems learn features from complex, noisy visual data using neural models, supporting decision-making with logical rules expressed in the IF–THEN format [30]. While fuzzy logic and AN-FIS-based approaches offer advantages for modeling uncertainty in human behavior, ILP enables the explicit representation of causal relationships among behaviors [35].

Within the domain of online exam monitoring, neuro-symbolic integration remains limited. Most existing proctoring systems rely either on purely neural discrimination [9,17,28] or rigid rule-based heuristics, without combining graded fuzzy reasoning and deterministic logical violation detection within a unified fusion mechanism.

2.4. Positioning of the Proposed Framework

The proposed framework differs from prior work in several key aspects. First, unlike deep learning-based proctoring systems [9,17,27,28], symbolic reasoning is embedded directly within the inference pipeline rather than applied as a post hoc explanation. Second, unlike purely rule-based systems, the framework retains neural flexibility for modeling complex and ambiguous behavioral patterns. Third, unlike general neuro-symbolic architectures surveyed in [15,16,34,35], the proposed model introduces a confidence-aware fusion mechanism in which ILP-based logical violations dynamically regulate neural dominance.

By integrating XGBoost-based neural perception, ANFIS-based fuzzy reasoning, ILP-based deterministic violation detection, and trust-aware fusion, the framework aims to balance discrimination power, logical consistency, and ethical robustness. In this respect, it addresses the limitations of purely statistical or purely symbolic systems and provides an interpretable-by-design alternative for high-stakes online exam monitoring.

3. Proposed Neuro-Symbolic Framework

This study proposes an explainable hybrid neuro-symbolic framework for detecting suspicious student behavior in online exams. The proposed framework integrates machine learning or deep learning-based NPLs that learn from multimodal behavioral data with SRL mechanisms that involve automated or manual rule inference. The general architecture of the proposed framework is shown in Figure 1.

Before presenting the overall architecture in Figure 1, we briefly summarize the main symbols used throughout the framework. $SB{S}_{neural}$ denotes the continuous suspicious behavior score generated by the NPL, while $SB{S}_{anfis}$ represents the fuzzy symbolic suspicion score produced by the ANFIS module. $ILPscore\in \{0,1\}$ indicates whether a deterministic logical violation is detected. The fusion coefficient $\alpha \in [0,1]$ controls the confidence-weighted integration of neural and symbolic outputs. Detailed mathematical formulations are provided in Section 3.1, Section 3.2 and Section 3.3.

The proposed framework initially involves feeding the model features such as face, gaze, head pose, hand interaction, and phone presence. Geometric (e.g., angles, distances, orientations) and behavioral (e.g., gaze deviation, hand-face distance, phone confidence) features are derived from these in the feature engineering layer. These features are used as input to the classifier (XGBoost was used for the experimental study) in the NPL. The NPL outputs a continuous Suspicious Behavior Score (SBS_neural) and a neural confidence score (conf_neural) that reflect the model’s level of instability. The NPL output is fed into two parallel symbolic reasoning layers. SRL-ANFIS derives soft rules from continuous features using fuzzy reasoning. SRL-ILP detects hard-rule violations using binary propositions and neural threshold information, with logical reasoning. In the final stage, the neural and symbolic outputs are combined in the fusion layer. Detailed descriptions of the three main layers (NPL, SRL, and NSFL) of the proposed framework are provided in the subsections below.

3.1. Neural Perception Layer (NPL)

This layer acts as the perceptual component of the proposed framework. Its primary goal is to generate a continuous SBS_neural using behavioral features derived from raw visual cues, providing background information to the symbolic reasoning layers. In this context, the NPL provides a probabilistic, data-driven assessment. It learns complex and nonlinear behavioral patterns that symbolic rules alone cannot capture and generates a risk estimate for the final decision. However, it is not the sole decision-maker.

XGBoost was chosen for the experimental study due to its superior performance with high-dimensional behavioral features, its ability to model non-linear feature interactions explicitly, its stable learning on relatively small and unbalanced datasets, and its partial explainability through feature importance. XGBoost is a powerful ensemble method that learns decision trees sequentially using the gradient boosting principle, and it is widely used in human behavior modeling, action recognition, and surveillance-based anomaly detection [36].

The XGBoost model is defined as an ensemble of K decision trees:

$$\widehat{y}=\sum _{k=1}^K{f}_k\left(x\right),f_k\in \mathcal{F},$$

(1)

where

• $\widehat{y}$ denotes the model prediction;
• $x\in {\mathbb{R}}^d$ represents the input feature vector;
• $k=1,\dots ,K$ denotes the index of the decision trees and $K$ is the total number of trees;
• $f_k$ denotes the $k$-th decision tree;
• $\mathcal{F}$ is the space of regression trees.
• $K$ is the total number of trees.

Objective function:

$$L=\sum _{i=1}^{n}l(y_i,{\widehat{y}}_i)+\sum _{k=1}^K\mathsf{\Omega }(f_k)$$

(2)

where

• $i=1,\dots ,n$ denotes the training samples;
• $k=1,\dots ,K$ denotes the index of decision trees;
• $y_i$ is the ground-truth label for sample $i$;
• ${\widehat{y}}_i$ is the predicted value;
• $l(\cdot )$ denotes the loss function.

$$\mathsf{\Omega }(f)=\gamma T+{\displaystyle \frac{1}{2}}\lambda \sum _{j=1}^T{w}_j^2$$

(3)

where

• $j=1,\dots ,T$ denotes the leaf index of the decision tree;
• $T_k$ denotes the number of leaves in tree $f_k$;
• $w_k$ represents the leaf weights;
• $\gamma$ and $\lambda$ are regularization coefficients.

This structure prevents overlearning and increases the generalizability of behavioral patterns.

The NPL output represents the degree of suspicion of SBS_neural behavior. This output is not a definitive decision but a probabilistic risk measure that yields continuous values between 0 and 1 ($SB{S}_{neural}\in \left[\mathrm{0,1}\right]$).

This reflects the level of instability of the conf_neural model, another output of NPL (${\mathrm{conf}}_{neural}=\mid SB{S}_{neural}-0.5\mid$). This output is defined by the neural layer’s decision confidence and the distance of the output from the center of uncertainty. If $SB{S}_{neural}\approx 0.5,$ the model is interpreted as unstable; if $SB{S}_{neural}$ is 0 or 1, it is interpreted as high confidence. This approach is consistent with methods known in the literature as margin-based confidence estimation [37].

The outputs of the NPL are used directly as input for the SRL-ANFIS as a continuous behavior signal. For the SRL-ILP, they are thresholded and converted into a logical proposition using the equation below.

$${ILP}_{score}=\left\{\begin{array}{cc}neura{l}_{high},& {SBS}_{neural}>0.7,\\ neura{l}_{medium},& 0.4<{SBS}_{neural}\wedge {SBS}_{neural}\le 0.7,\\ neura{l}_{low},& {SBS}_{neural}\le 0.4.\end{array}\right.$$

(4)

The thresholds (0.4 and 0.7) used in Equation (4) to convert the continuous $SB{S}_{neural}$ score into symbolic predicates (neural_low, neural_medium, neural_high) were determined through a validation-driven empirical analysis rather than arbitrary selection.

First, the distribution of $SB{S}_{neural}$ scores on the validation set was examined and found to exhibit a bimodal structure, with natural density concentrations below 0.4 and above 0.7 corresponding predominantly to non-cheating and cheating instances, respectively.

Second, a sensitivity analysis was conducted by evaluating candidate threshold pairs within the interval [0.3–0.8]. The 0.7 threshold was selected as it corresponded to the region where precision increased sharply while maintaining high recall. Similarly, 0.4 was chosen as the boundary below which the false positive rate remained consistently low.

Finally, a three-level discretization (low–medium–high) was intentionally preferred to balance symbolic expressiveness and rule complexity. Finer discretizations increased rule fragmentation without improving logical adherence or fidelity metrics.

Therefore, the selected thresholds reflect a combination of empirical validation performance and symbolic modeling considerations.

NPLs are learnable and data-driven, but they lack ultimate decision-making authority. This architecture aims to balance the black-box problem in pure deep learning approaches with the lack of flexibility in pure rule-based systems.

3.2. Symbolic Reasoning Layers (SRL)

This layer consists of ANFIS, based on Subtractive Clustering, and ILP components for logical consistency checking, using fuzzy and logical inference mechanisms together. This dual structure aims not only to improve classification accuracy but also to provide interpretability, rule generalizability, and logical consistency simultaneously.

In classic ANFIS approaches, membership functions are defined manually, leading to a combinatorial explosion in the number of rules through grid partitioning [38]. Therefore, the Subtractive Clustering method was preferred. This is because this method automatically identifies rule centers from data, scales to high-dimensional behavioral features, and reduces reliance on manual expert definition. This approach is particularly recommended in the literature for problems in behavior analysis, human action recognition, and unsupervised rule discovery [38]. The ANFIS input vector consists of behavioral features included in the feature set, such as head pitch and gaze deviation ($\mathrm{x}=[x_1,x_2,\dots ,x_d]$). The output is a fuzzy rule-based suspicion score ($SB{S}_{anfis}\in \left[\mathrm{0,1}\right]$).

ANFIS represents each behavioral feature as a fuzzy set. The Gaussian membership function is defined as follows:

$${\mu }_{A_i}\left(x\right)=\exp \left(-{\displaystyle \frac{\left(x−c_i{)}^2\right.}{2{\sigma }_i^2}}\right),$$

(5)

where $c_i$ and ${\sigma }_i$ are the center and dispersion parameters, respectively. These parameters are learned during training.

Each fuzzy rule $k$, where $k=1,\dots ,R$, is defined as:

$${\mathcal{R}}_k:\mathrm{IF} x_{i1} \mathrm{is} A_{k1}\wedge \cdots \wedge x_{id} \mathrm{is} A_{kd} \mathrm{THEN} f_k\left({\tilde{\mathbf{x}}}_i\right),$$

(6)

where

• $A_{kj}$ denotes the fuzzy set (Gaussian membership function) associated with feature $j$ in rule $k$;
• $R$ is the total number of fuzzy rules;
• $i=1,\dots ,R$ denotes the fuzzy rule index.

The membership function is defined as:

$${\mu }_{A_i}\left(x\right)=\exp \left({\displaystyle \frac{\left(x_{ij}−c_{kj}{)}^2\right.}{2{\sigma }_j^2}}\right), j=1,\dots ,d.$$

(7)

The firing strength of rule $k$ for sample $i$ is:

$$w_k({\tilde{\mathbf{x}}}_i)=\prod _{j=1}^d{\mu }_{kj}(x_{ij}),k=1,\dots ,R.$$

(8)

Normalized firing strength:

$${\bar{w}}_k({\tilde{\mathbf{x}}}_i)={\displaystyle \frac{w_k\left({\tilde{\mathbf{x}}}_i\right)}{\sum _{r=1}^R{w}_r\left({\tilde{\mathbf{x}}}_i\right)}},k=1,\dots ,R.$$

(9)

The ANFIS output is computed as:

$$SB{S}_{anfis}=\sum _{k=1}^R{\bar{w}}_k({\tilde{\mathbf{x}}}_i)f_k({\tilde{\mathbf{x}}}_i).$$

(10)

SBS_anfis represents the fuzzy rule-based suspicion score.

ANFIS’s decision confidence is defined by the firing strength of the most dominant rule:

$${\mathrm{conf}}_{symbolic}=\underset{i=1,\dots , R}{\mathrm{m}\mathrm{a}\mathrm{x}}(w_i).$$

(11)

This definition directly reflects “how strongly the model fits a particular behavioral pattern”.

Models like ANFIS and XGBoost generate continuous scores. However, they cannot guarantee against logical inconsistencies (e.g., looking at the screen + phone active). This is where ILP comes in: it represents precise behavioral violations and provides logical rule transparency close to human expertise, while also increasing symbolic explainability [39]. To ensure methodological transparency and reproducibility, the ILP component was implemented using the Aleph ILP system, a Prolog-based inverse entailment system derived from the Progol framework. Aleph was selected due to its explicit language bias control, robustness to moderate noise levels, and suitability for structured relational data. Each instance in the dataset was transformed into a set of logical facts. Continuous features were thresholded using validation-optimized cut-off values to obtain binary predicates. Positive and negative examples were designed as ILPscore. With ILP, behavioral observations are expressed as facts. Continuous traits are thresholded and transformed into binary propositions. For example:

$$\begin{array}{c}\mathit{gaze}\text{\_}\mathit{away}\leftarrow gaze\text{\_}deviation>{\delta }_g,\\ \mathit{phone}\text{\_}\mathit{active}\leftarrow phone\text{\_}conf>{\delta }_p.\end{array}$$

(12)

High-risk situation originating from the NPL:

$$\mathit{neural}\text{\_}\mathit{high}\leftarrow SB{S}_{neural}\ge \tau .$$

(13)

Example ILP Rule:

cheating: gaze_away, phone_active, neural_high.

ILP output:

$$IL{P}_{score}\in \left\{0,1\right\}.$$

(14)

This output does not generate possibilities; it merely serves as a flag for a logical violation.

3.3. Neuro-Symbolic Fusion Layer (NSFL)

This layer is the core decision component of the proposed architecture, aiming to dynamically and confidently combine data-driven (neural) and rule-based (symbolic) inferences. The fundamental motivation behind this layer is that neural models are probabilistic, flexible, and noise-tolerant, while symbolic models are interpretable and logically consistent. However, both approaches have critical weaknesses when used alone. Therefore, the fusion layer is designed as a unique mechanism that applies logical pressure on probabilistic scores using instance-wise weighting rather than static weights.

NSFL uses three main pieces of information: SBS_neural, SBS_anfis, and ILP_score. In addition, confidence measures (conf_neural, conf_symbolic) for both inferences are used. The symbolic confidence $con{f}_{symbolic}$ is derived from the ANFIS reasoning layer and corresponds to the maximum normalized firing strength of the activated fuzzy rules, as defined in Section 3.2.

Neural and symbolic inferences are combined using the following normalized confidence ratio:

Let

• $con{f}_{neural}\in [0,1]$ be the neural confidence;
• $con{f}_{symbolic}\in [0,1]$ be the symbolic confidence.

The base fusion coefficient is defined as:

$$\alpha ={\displaystyle \frac{{\mathrm{conf}}_{neural}}{{\mathrm{conf}}_{neural}+{\mathrm{conf}}_{symbolic}+\epsilon }},$$

(15)

where $ϵ={10}^{-6}$ is a small constant preventing division by zero.

Thus

• ${\alpha }_{base}\to 1$ when neural confidence dominates;
• ${\alpha }_{base}\to 0$ when symbolic confidence dominates.

One of the key original contributions of this study is that ILP does not make direct decisions; instead, it penalizes the fusion coefficient for a logical violation.

$$\mathrm{IF} IL{P}_{score}=1:\alpha \leftarrow \alpha \cdot \left(1-\beta \right),$$

(16)

where $\beta \in \left[\mathrm{0,1}\right]$ is the logical pressure coefficient and high $\beta$ is a significant reduction in neural effect in cases of severe rule violations.

Thanks to this mechanism, even if the NPL produces a high score, symbolic inference takes precedence if a logically unacceptable situation arises. This approach is a softened, differentiated equivalent of the “logic overrides neural output” principle, frequently seen in classical neuro-symbolic systems.

After ILP modulation, the final suspicious behavior score is calculated as follows:

$$SB{S}_{final}=\alpha \cdot SB{S}_{neural}+\left(1-\alpha \right)\cdot SB{S}_{anfis}.$$

(17)

This score is continuously decomposable into interpretable components that simultaneously incorporate confidence and logical information.

The NSFL output is presented with $SB{S}_{neural}$ and ${\mathrm{conf}}_{neural}$, along with the fires, ANFIS rules, $w_r$, the activated ILP rules, and final $\alpha$ and $\beta$ effect components.

3.4. Final Decision and Explainable Output Layers

3.4.1. Final Decision Layer

The SBS_final, generated by NSFL, is compared with the system’s decision threshold to determine the class label.

$$\mathit{Decision}=\left\{\begin{array}{cc}\mathit{Cheating},& \mathit{if} SB{S}_{final}\ge \tau ,\\ \mathit{Non}\text{-}\mathit{Cheating},& \mathit{otherwise}.\end{array}\right.$$

(18)

where $\tau \in \left[\mathrm{0,1}\right]$ is the decision threshold optimized on the validation set. A low $\tau$ provides high sensitivity (recall) and a high $\tau$ provides a low false positive rate.

This thresholding approach is commonly used in high-risk and cost-asymmetric scenarios, such as online exam proctoring, because the cost of false positives (blaming an innocent student) is high.

3.4.2. Explainable Output Layer

The proposed framework not only generates a class label but also provides a multi-layered output explaining why and how the decision was made. This approach addresses the transparency and accountability requirements that are critical to educational technologies and AI proctoring systems.

For each instance, the system generates ANFIS, a neural, expert-readable symbolic explanation revealing which visual–behavioral cues the decision was based on, and ILP elements clearly demonstrating the logical reasoning behind the decision, creating end-to-end decision rationale at the fusion layer.

Thanks to the Explainable Output design, instructors and examiners, students, institutions, and supervisory authorities can question, verify, and develop appeal mechanisms for the system’s decisions. In this respect, the proposed approach offers a direct response to criticisms of “black-box proctoring systems” and concerns about fairness, transparency, and ethics.

4. Experimental Study and Results

In this section, the performance of the proposed neuro-symbolic framework was evaluated using the “Students’ Suspicious Behaviors Detection Dataset” [40]. The experiments aimed to measure the system’s accuracy in detecting fraud and the explainability of its decisions.

4.1. Experimental Setup

The experimental evaluation was conducted using the publicly available Students’ Suspicious Behaviors Detection Dataset [40], hosted on Mendeley Data. The dataset is openly accessible via its DOI (as cited in [40]), ensuring full reproducibility and independent verification of the experiments. The dataset was accessed in its original, unmodified form. The data consist of webcam-recorded video segments collected from more than 30 participants under controlled online examination scenarios. Recordings were captured at 20 frames per second (fps) and processed using MediaPipe and OpenCV libraries to extract structured visual–behavioral features. The dataset includes predefined suspicious behaviors such as gaze deviation, mobile phone usage, hand-object interaction, and multiple face presence. These behaviors were intentionally staged in controlled settings to simulate realistic cheating scenarios. The final processed dataset contains 5500 labeled video-frame samples, each with 37 extracted behavioral features. The class distribution between cheating and non-cheating instances is approximately balanced, reducing class imbalance bias. Labels were assigned according to behavioral criteria defined in the original dataset documentation [40]. A sample was labeled as “cheating” when at least one predefined suspicious behavior was present; otherwise, it was labeled as “non-cheating”. No additional annotation, synthetic data generation, or augmentation was performed by the authors. All experiments were conducted using this publicly available dataset without modification, enabling full reproducibility of the reported results. The dataset, consisting of 5500 labeled samples, was divided using a stratified 80/20 split, preserving the class distribution between cheating and non-cheating instances.

To ensure robustness and reduce split-dependent variance, 5-fold stratified cross-validation was performed on the training set during hyperparameter selection (including XGBoost parameters, clustering radius selection, and decision thresholds). This procedure was used solely for model selection and stability assessment. The final reported performance metrics correspond to the held-out test set, which was strictly separated from the training process and not used during model tuning.

All threshold values (including neural discretization thresholds and fusion parameters) were fixed prior to final test evaluation to prevent optimistic bias.

All experiments were conducted in a Google Colab [41] environment using Python 3.10. The main libraries used in the experiments include NumPy, pandas, scikit-learn, XGBoost, OpenCV, and MediaPipe, for data processing, feature extraction, and model training. Min–max normalization was applied to numerical features, and NaN/Inf cleaning was applied for infinite or undefined values. Derived features representing geometric relationships were obtained. As a result of these processes, two separate feature sets were created with dimensions $X\in {\mathbb{R}}^{5500\times 24}$ for NPL and $X\in {\mathbb{R}}^{5500\times 9}$ for SRL.

In NPL, the features “face_present, no_of_face, face_conf, head_pitch, head_yaw, head_roll, gaze_on_script, phone_present, phone_conf, hand_count, hand_obj_interaction, gaze_x_norm, gaze_y_norm, gaze_entropy, pupil_left_norm, pupil_right_norm, label” were taken from the dataset and “pupil_dist, gaze_deviation, face_center_offset, head_motion_score, eye_asymmetry, hand_face_distance, face_area” features were derived. SRL includes the features “head_pitch, head_yaw, gaze_on_script, phone_present, hand_obj_interaction, no_of_face, gaze_deviation, phone_conf, hand_face_distance”. The mathematical expression for the derived features obtained from raw visual–behavioral data is given below.

$$head\text{\_}motion\text{\_}score=\sqrt{{\mathrm{pitch}}^2+{\mathrm{yaw}}^2+{\mathrm{roll}}^2},$$

(19)

$$pupil\text{\_}dist=\sqrt{\left(p_{r_x}-p_{l_x}{)}^2+(p_{r_y}-p_{l_y}{)}^2\right.},$$

(20)

$$gaze\text{\_}deviation=\sqrt{{\left(g_x−x_f\right)}^2+{\left(g_y−y_f\right)}^2},$$

(21)

$$face\text{\_}center\text{\_}offset=\sqrt{\left(x_f-x_c{)}^2+(y_f-y_c{)}^2\right.},$$

(22)

$$eye\text{\_}asymmetry=\mid l_x-r_x\mid +\mid l_y-r_y\mid ,$$

(23)

$$hand\text{\_}face\text{\_}distance=\sqrt{\left(x_h-x_f{)}^2+(y_h-y_f{)}^2\right.},$$

(24)

$$face\text{\_}area=fac{e}_w\cdot fac{e}_h.$$

(25)

The derived features are defined as follows: $p_{r_x},p_{r_y}$ are the x and y coordinates of the right pupil, $p_{l_x},p_{l_y}$ are the x and y coordinates of the left pupil, $g_x,g_y$ are the x and y coordinates of the gaze point, $fac{e}_x,fac{e}_y$ are the left-top corner coordinates of the face bounding box, $fac{e}_w,fac{e}_h$ are the width and height values of the face bounding box, $x_f=fac{e}_x+{\displaystyle \frac{fac{e}_w}{2}}$, $y_f=fac{e}_y+{\displaystyle \frac{fac{e}_h}{2}}{, x}_c,y_c$ are the x and y coordinates of the camera/screen center, $l_x,l_y$ are the x and y coordinates of the left eye center, and $r_x,r_y$ are the x and y coordinates of the right eye center.

pupil_dist defines the Euclidean distance between the pupils to measure eye opening and gaze stability [42]. head_motion_score is a composite score representing the total angular magnitude of head pose. gaze_deviation is defined to measure how much the gaze deviates from the center of the screen or the center of the face [43]. face_center_offset is used to measure the stability of posture in front of the camera [44]. eye_asymmetry represents the measurement of asymmetry between the positions of the two eyes using the L1 (Manhattan) distance. hand_face_distance is a Euclidean distance metric that measures the geometric distance of the hand from the center of the face [4]. face_area defines the normalized area of the face in the image.

4.2. Performance Evaluation Metrics

To comprehensively evaluate the performance of the proposed framework, metrics were used in two categories: classification performance and explainability quality.

In unbalanced datasets, the accuracy metric alone can be misleading [8]. It is critical that the model does not miss rare attempts at cheating and does not unfairly accuse innocent students. In this context, accuracy [27], precision [16], recall [19], F1-score [27], and ROC-AUC [27] metrics were used.

The core contribution of this study, explainability, was evaluated using quantitative and qualitative metrics, unlike standard deep learning studies. Logic Adherence/Fidelity was used to measure how consistent the rules generated by SRL were with the patterns in the dataset [45]. The number and length of generated rules were analyzed using Rule Complexity. Fewer, shorter rules result in a higher explainability score because they are easier for instructors to understand [46].

4.3. Experimental Results

4.3.1. NPL (XGBoost) Experimental Results

In the NPL, the XGBoost method was trained to generate probabilities of suspicious behavior (SBS_neural) using raw and derived continuous visual features. Model training was performed while maintaining sample-based discrimination between the training and test sets. Hyperparameters were determined by grid search on the validation set. The results show that the XGBoost-based NPL alone offers extremely high discrimination (Accuracy: 0.9953, Precision: 0.9966, Recall: 0.9935, F1-Score: 0.9995, ROC-AUC: 0.9999).

The feature significance calculated by XGBoost clearly reveals the dominance of behavioral cues.

Table 1. Features with the most distinctive characteristics according to XGBoost results.

Feature	Comment
hand_obj_interaction (0.224)	Hand-object interaction is the strongest indicator of cheating.
gaze_on_script (0.184)	Loss of screen focus
phone_present (0.145)	External device usage
head_motion_score (0.084)	General intensity of head movements
phone_conf (0.079)	Reliability of phone detection

lists the features with the most distinctive characteristics used.

This distribution shows that copy behaviors are captured through semantic and behavioral interactions rather than by a single geometric measure. When features were examined according to their geometric and physical roles, gaze_deviation, head_yaw, pupil_left_norm/pupil_right_norm, and face_center_offset contributed moderately. Some features (face_present, hand_count, gaze_entropy) had low importance. This does not mean that they are superfluous. On the contrary, edge-case behaviors play a critical role in SRL as rule-triggering signals. This is an important finding showing that NPL and SRL work complementarily. In this context, NPL knows very well what to learn, and SRL explains why a particular decision was made. Therefore, SRL is essential not for improving performance, but for reliability, explainability, and rule control.

4.3.2. SRL Experimental Results

In this section, the continuous and probabilistic outputs generated by NPLs are interpreted through a rule-based symbolic inference mechanism. The goal is to transform high-performance, opaque neural decisions into human-understandable behavioral rules.

In the SRL analysis process, the membership functions and the number of rules in the ANFIS model were automatically determined using the subtractive clustering method. The model’s training parameters were set as Epoch = 100, StepSize = 0.01, Radius = 0.1, and ErrorGoal = 0. In rule-based ANFIS learning, the model’s input is 9 features, and the output is SBS_neural. The results obtained for ANFIS show that it has a high power to distinguish between cheating and non-cheating behaviors (Accuracy: 0.8651, Precision: 0.9012, Recall: 0.8049, F1-Score: 0.8503, ROC-AUC: 0.9290).

These results exhibit a conservative decision profile that prioritizes minimizing false accusations rather than maximizing sensitivity. While accuracy (0.8651) is lower than that of the neural perception layer, this result highlights ANFIS’s complementary role as a soft, interpretable constraint rather than the ultimate decision-maker. Furthermore, the results show that a high True Positive Rate (TPR) is achieved even at low False Positive Rate (FPR) levels. This confirms that ANFIS can create a more flexible decision boundary than methods based on sharp thresholds by modeling continuous behavioral signals (e.g., head angle, gaze deviation, hand-object interaction) using fuzzy membership functions.

ANFIS automatically generated 10 fuzzy rules, each corresponding to a different set of behaviors. The rules are expressed in IF-THEN form. The three most important rules are listed in

Table 2. Representative fuzzy rules learned by the ANFIS module.

Rule	IF (Antecedent—Summarized)	THEN	Support
R0	gaze_on_script = High and no_of_face = High and gaze_deviation = High and phone_conf = Low	Suspicious_Behavior = Medium	1838
R6	gaze_on_script = Low and phone_present = Medium and hand_obj_interaction = Medium	Suspicious_Behavior = High	149
R1	gaze_on_script = High and no_of_face = Low and hand_face_distance = Medium	Suspicious_Behavior = High	33

.

The learned rules show that high gaze deviation is a dominant symbolic factor across all clusters. In contrast, phone-related and hand interaction cues differentiate high-risk patterns from medium-risk ones. Rules with high support rates represent common behavioral patterns, while rules with low support rates capture rare but highly suspicious cases.

The ANFIS layer provides soft and interpretable symbolic rules that can model graded behavioral patterns, but it does not explicitly enforce strict logical constraints. Specifically, certain combinations of behaviors, such as simultaneous gaze deviation and phone use, represent definite breaches of exam integrity and should be recorded deterministically. To address this limitation, ILP was used. The ILP approach aims to generate human-readable rules that explicitly express causal and relational structures among student behaviors by modeling thresholded behavioral indicators using attributes derived from NPL as logical predictors.

Therefore, the outputs of the symbolic reasoning layer directly influence the final decision, and this influence is embodied through the trust-aware neuro-symbolic fusion and final decision-making mechanism discussed in the next section.

4.3.3. NSFL Experimental Results

This section analyzes how sustained doubt scores from NPL and symbolic inferences from SRL (ANFIS + ILP) are integrated through the proposed trust-awareness fusion mechanism and how they influence the final decision-making process.

The final model obtained after NSFL achieved an ROC–AUC of 0.9956. This value is lower than that of NPL (ROC–AUC: 0.9999) and is the expected result of implementing symbolic constraints. In contrast, the fusion model provides high accuracy and stable class performance. A layer-based comparison is given in

Table 3. Layer-based performance metrics of the proposed framework.

Layer	ROC_AUC	Accuracy	Precision	Recall	F1
NPL (XGBoost)	0.9999	0.9953	0.9966	0.9935	0.9950
SRL (ANFIS)	0.9290	0.8651	0.9012	0.8049	0.8503
NSFL	0.9956	0.9533	0.9913	0.9099	0.9488

. The comparative ROC curve of NPL and NSFL is shown in Figure 2.

It should be noted that NPL, SRL, and NSFL are not independent competing classifiers but interdependent components of a unified neuro-symbolic architecture. Therefore, the layer-wise comparison presented in Table 3 aims to illustrate functional contribution rather than to establish superiority claims. The modest performance differences are structurally induced by the symbolic regulation mechanism rather than random variation.

When the ROC curves are examined, it shows that NSFL runs very close to NPL in the low false-positive region, but offers a more reliable decision boundary thanks to the suppression of logical inconsistencies. Thus, it aims to reduce false positives and increase decision reliability. Therefore, this modest decrease in performance should be considered a significant gain in exchange for the system’s ethical, explainable decision-making.

The proposed fusion mechanism determines the relative contributions of the NPL and SRL components with α, a dynamic weight based on trust. Experimental results show that the average α coefficient is 0.313. This value indicates that the system generally gives more weight to symbolic reasoning, but neural perception is not entirely suppressed. To analyze the effect of logical violations on the fusion process, cases in which ILP rules were triggered and those in which they were not were examined separately. According to the results, the average α value decreased to 0.232 in samples with violations (ILP = 1), whereas it was 0.326 in samples without logical violations (ILP = 0). This observation quantitatively confirms that ILP rules systematically reduce the impact of neural scores on the decision and prioritize symbolic inferences. This behavior shows that ILP is positioned not as an independent classifier, but as a logical regulator that regulates the fusion process.

While NPL provides almost perfect discrimination, symbolic layers add human-understandable justifications to the decision-making process. NSFL strikes a balance between these two approaches, producing neither a purely data-driven nor a purely rule-based decision-making mechanism.

In particular, the significant decrease in the α coefficient when ILP rules are triggered indicates that the system takes logical violations very seriously and accordingly reweights the decision-making process. This clearly demonstrates that the proposed approach adopts a design focused not solely on performance, but on reliability and logical consistency.

This multi-layered decision-making process not only ensures high accuracy but also provides a framework for explaining the decision. The following section details how these fusion outputs are transformed into the final classification decision and the explanatory outputs presented to the user.

4.3.4. Experimental Results of the Final Decision and Explainable Output Layer

The final decision was made by comparing the SBS_final score to a fixed threshold (τ = 0.5). The metric values obtained with this structure (Accuracy: 0.9533, Precision: 0.9913, Recall: 0.9099, and F1: 0.9488) indicate that the system has high accuracy and a low false-positive rate. The precision of 0.9913 is particularly critical, as it minimizes false accusations in ethically sensitive applications such as copy detection. Conversely, the recall remaining at 0.9099 indicates that the system offers cautious but practical detection capabilities.

The most distinctive aspect of the final decision mechanism is the effect of ILP-based logical violations on the fusion coefficient. As shown in the previous section, when ILP rules are triggered, the fusion coefficient α decreases significantly, and the weight of the NPL output on the final decision is reduced. This allows the system to behave more cautiously, mainly when NPL classifies suspicious cases with high confidence, but they are logically inconsistent. Therefore, the final decision is based not only on statistical similarities but also on symbolic cause-and-effect relationships. This mechanism enables the proposed approach to be positioned not merely as a classifier, but as a reliable and verifiable decision-support system.

A key advantage of the proposed framework is its ability to provide multi-layered explanatory outputs along with the final decision. For each example, the user is provided with the following information:

• Neural Confidence: The SBS_neural score generated by the NPL and its corresponding confidence level.
• Triggered ANFIS Rules: Fuzzy rules with the highest triggering value in the SRL and the behavioral patterns they represent. Activated ILP Rules: ILP rules are triggered when a logical violation is detected, and the associated logical conditions are met.
• Fusion Dynamics: The change in the α coefficient depending on the ILP triggering state and its effect on the final score.

Thanks to these explanatory components, the system clearly reveals not only “what” the decision was, but also “why” that decision was made.

4.4. Analysis of Logical Adherence, Symbolic Fidelity, and Rule Complexity

The effectiveness of the proposed framework extends beyond predictive accuracy to also examine how well symbolic reasoning constrains and explains neural decisions. This section investigates the extent to which the proposed system adheres to logical rules, preserves symbolic accuracy, and maintains manageable rule complexity. The results are presented in

Table 4. Analysis of Logical Adherence, Symbolic Fidelity, and Rule Complexity.

Metric	Value	Comment
Logic Adherence	0.998	High logical consistency
Fidelity (Accuracy)	0.914	Strong symbolic explanation
Fidelity (AUC)	0.979	High symbolic decision fidelity
Mean ILP Literal Count	2.4	Low rule complexity
ANFIS Antecedent Count	9	High but flexible structure

.

Logic Adherence analysis measures the extent to which samples marked as high-risk by SRL (via ANFIS or ILP) are classified as cheating in the final decision-making stage. The resulting logical adherence ratio of 0.998 indicates that the symbolic layer is almost entirely incorporated into the final decision-making process. This result confirms that the fusion mechanism prioritizes symbolic consistency by suppressing neural output, particularly when logical violations are detected.

Symbolic Fidelity measures the degree to which final decisions can be accurately reproduced using only symbolic outputs (ANFIS score and ILP trigger status). Experimental results show that the symbolic layer largely explains final decisions, as evidenced by Fidelity–accuracy and Fidelity–AUC values. This high fidelity demonstrates that symbolic reasoning is not merely a supporting component; rather, it is central to the decision-making mechanism.

Rule Complexity analysis was conducted to assess the human comprehensibility of symbolic information. The fact that ILP rules have an average of 2.4 literals indicates that the logical rules are interpretable and straightforward. On the ANFIS side, while each rule with 9 antecedents may appear complex on the surface, this structure offers a soft, flexible representation thanks to fuzzy membership functions. Therefore, despite high dimensionality, ANFIS rules maintain their interpretability without creating rigid decision boundaries.

These analyses show that the proposed neuro-symbolic framework not only possesses high discrimination but also offers a logically consistent, symbolically explainable, and manageable decision-making mechanism in terms of rule complexity. In particular, the high logical consistency and symbolic fidelity values clearly demonstrate that the system does not blindly adhere to NPL outputs; instead, it integrates symbolic reasoning into the decision-making process.

4.5. Example Scenarios

In this section, the decision-making mechanism of the proposed neuro-symbolic framework is qualitatively analyzed through representative example scenarios selected from the dataset. Each scenario demonstrates how NPL, SRL, and NSFL contribute to the final decision (

Table 5. Case Study Analysis with Decision-Driving Rules.

	SBSneural	SBSanfis	ILP	α	SBSfinal	Decision	Ground Truth	Decision-driving rule(s)
S1	1.000	0.922	✓	0.233	0.940	Cheating	Cheating	ILP: cheating(X) ← gaze_away ∧ phone_active ∧ phone_present ANFIS: R6 (High risk fuzzy pattern)
S2	0.999	0.726	×	0.333	0.817	Cheating	Cheating	ANFIS: R1 (Moderate–High suspicious gaze pattern)
S3	0.568	0.332	×	0.064	0.347	Non-Cheating	Non-Cheating	ANFIS: R0 (Medium symbolic risk → suppressed)
S4	0.007	0.067	×	0.330	0.047	Non-Cheating	Non-Cheating	No rule triggered (Low neural + low symbolic evidence)
S5	0.989	0.044	×	0.328	0.354	Non-Cheating	Cheating	ANFIS: R8 (Low symbolic risk) ILP: no violation

✓/×: ILP Rule triggering enabled/unavailable. α: Fusion coefficient.

).

S1 (High Neural Suspicion with Logical Violation) represents an ideal situation where all layers consistently make decisions in the same direction. NPL produces the maximum suspicion score, while ANFIS provides high symbolic support. Simultaneously, apparent violations such as gaze deviation, phone presence, and hand-object interaction triggered the ILP rules. As a result of this logical violation, the α coefficient decreased, and SRL became more dominant. As a result, the system made a correct cheating decision with high confidence. When ILP is triggered, the fusion mechanism consciously reduces neural dominance, prioritizing logical consistency.

In S2 (High Neural Suspicion without Logical Violation), although the neural model produces high suspicion, no phone use or overt logical violation is detected. Since ILP is not triggered, the α value remains relatively high, and NPL is more dominant in the decision. ANFIS also provides medium-high symbolic support, keeping the final score above the threshold and resulting in a correct cheating decision. In the absence of logical violation, the system continues to benefit from the high discrimination of neural perception.

S3 (Ambiguous Neural Evidence Resolved by Symbolic Reasoning) demonstrates the importance of symbolic reasoning in resolving ambiguity. The neural score is moderate and insufficient for decision-making alone. ANFIS classified the behavioral pattern as low risk, and ILP did not detect any logical violations. Therefore, the α coefficient remained relatively low, and the symbolic layer became dominant, correctly leading to a non-cheating decision. ANFIS effectively balances neural ambiguity with smooth symbolic inferences.

S4 (Low-Risk Consistent Behavior) is a clean example of behavior where all layers consistently show low risk. Neural and symbolic scores are low, and there are no logical violations. The fusion mechanism maintained this consistency, resulting in a safe, non-cheating decision. The system produces stable and reliable decisions in low-risk situations without creating unnecessary complexity.

S5 (Conflict Case—False Positive Suppression) represents the most critical and controversial behavior of the system. Although NPL generated nearly maximum suspicion, symbolic indicators (gaze on script, phone absence, no hand-object interaction) were low-risk, and ILP detected no violations. Therefore, the fusion mechanism reduced the neural score, leading to a non-cheating decision. While this is an example of a false negative, it clearly demonstrates the system’s ethical design preference for preventing false positives. The proposed approach prioritizes symbolic and logical consistency rather than automatically accepting high but unexplained neural scores.

5. Discussion

The experimental results of the neuro-symbolic framework proposed in this study demonstrate that it offers significant gains in both performance and explainability in the field of cheating detection in online exams. The findings reveal that relying solely on data-driven approaches that achieve high discrimination is not enough; supporting decisions with logical reasoning is critical for exam security, ethics, and legal compliance.

5.1. Comparison with the Literature

In the current literature, many studies on cheating detection in online exams rely on deep learning and machine learning. In particular, XGBoost, CNN, and RNN-based approaches have achieved high accuracy and ROC-AUC scores from visual behavioral cues. The study by Erdem & Karabatak shows that unethical behavior in online exams was successfully detected using XGBoost-based classifiers, but the decisions were subsequently explained using post hoc methods such as SHAP and LIME [27]. Similarly, CNN or CNN–RNN-based deep learning models, while offering high performance, fail to present decision-making processes in a directly interpretable way. Furthermore, graph-based learning methods, such as “CHEESE” proposed by Liu et al. (2024), provide visual focus (heat maps) but cannot give a logical answer to the “why” question [28].

The results obtained in this study confirm that the XGBoost model used in NPL provides high discrimination, consistent with the literature. However, the proposed approach does not merely report this performance; it transforms neural outputs into logical rules through ANFIS and ILP-based symbolic layers. The proposed neuro-symbolic structure simultaneously addresses the lack of flexibility in pure rule-based systems and the transparency issues of pure DL models, achieving an overall accuracy of 95.33% and a precision of 99.13%. In this respect, the study aims to overcome the “high accuracy but low explainability” dilemma frequently encountered in the literature. In particular, the NSFL mechanism consciously reduces the impact of neural scores when symbolic violations are detected, offering a decision-making process that is not only performance-oriented but also reliability-oriented. This approach provides a more balanced, controllable structure than pure DL-based systems.

5.2. Trustworthiness & Transparency

The black-box problem in AI systems brings ethical risks, particularly in high-risk areas like education, such as the wrongful accusation of innocent students. This study directly addresses the right to challenge automated decisions and request explanations under Article 22 of the GDPR.

Our system provides a four-layered explanation for each decision:

• Neural Confidence: The statistical probability level of the model.
• ANFIS Rules: Expressing behavioral patterns with expert-readable fuzzy rules.
• ILP Rules: Deterministically reporting logical violations (e.g., phone presence + looking away).
• Fusion Dynamics: Decision rationale showing how much the symbolic layer suppresses the neural output (change in α coefficient).

As seen in scenario S5, even if the neural layer detects cheating, the system’s decision to “non-cheating” when there is insufficient logical evidence in the symbolic layer (i.e., no ILP violation) reflects the ethical design preference to prevent false positives. This demonstrates that the system is not only performance-oriented but also fair and accountable.

5.3. Limitations

This study has some limitations. First, the dataset consists of 5500 samples from controlled, partially staged online exam scenarios. Although publicly available and balanced, the dataset size remains moderate compared to large-scale industrial proctoring deployments. Therefore, generalization to diverse institutional settings, cultural contexts, or unconstrained real-world environments may be limited. Future work should validate the proposed framework across multi-institutional and cross-domain datasets. Second, ethical risks related to behavioral interpretation must be considered. Visual cues such as gaze deviation or head movement may be influenced by neurodiversity, cultural communication styles, environmental distractions, or disability-related factors. Over-reliance on such indicators could introduce bias or unfair penalization. The proposed fusion mechanism mitigates this risk through logical modulation and confidence-aware integration; however, algorithmic bias remains an inherent concern in AI-driven behavioral monitoring systems. Third, symbolic rules learned via ILP may reflect patterns specific to the dataset’s controlled setup. Although rule complexity was constrained to prevent overfitting, there remains a risk that certain logical predicates capture environment-dependent correlations rather than universally valid indicators of cheating. Broader validation across heterogeneous exam contexts is required to ensure robustness and fairness.

Despite these limitations, the proposed approach represents a significant step towards online exam security. Future studies integrating multimodal data, long-term behavioral analysis, and cross-validation across different exam scenarios will further enhance the system’s generalizability and practical applicability.

6. Conclusions and Future Work

This study presents a reliable, trust-based neuro-symbolic AI framework for detecting cheating and suspicious student behavior in online exams. The proposed framework aims to develop a system that not only provides high accuracy but also clearly reveals the rationale behind its decisions by combining the high discrimination of data-driven learning with the transparency of symbolic reasoning. In this context, a neural detection layer that continuously generates a suspicious behavior score from visual–behavioral cues is integrated with ANFIS and ILP-based symbolic reasoning layers that combine fuzzy rules and logical inference.

Experimental results show that the proposed neuro-symbolic framework achieves high performance in detecting cheating in online exams and produces more reliable decisions by reducing false-positive rates compared to pure data-driven models. In particular, the fusion mechanism consciously modulates neural output when symbolic violations are detected, thereby increasing the controllability of the decision-making process in ethically and legally critical scenarios. In this respect, the study offers an inherently explainable alternative to the limitations of black-box AI models in exam supervision.

In future studies, extending the proposed architecture to include multi-modal data sources is an important research direction. Including voice analysis, keyboard dynamics, screen interactions, and network-based behavioral logs will enable the development of a more comprehensive, context-aware plagiarism detection mechanism. Furthermore, cross-dataset evaluations in different cultural and institutional exam environments are important for testing the generalizability of symbolic rules. Finally, integrating human-in-the-loop feedback mechanisms into symbolic rule learning is a future area of research that can increase both the system’s adaptability and user confidence.

Another important direction for future research is integrating continuous learning mechanisms into the proposed neuro-symbolic framework. In real-world online examination environments, new cheating strategies and behavioral patterns may emerge over time. Therefore, enabling the system to incrementally update its neural models and refine symbolic rules based on newly observed data could further improve robustness and long-term applicability. Adaptive rule learning or human-in-the-loop feedback mechanisms may help the symbolic reasoning layer evolve to previously unseen contexts while maintaining interpretability and logical consistency.