Ontology-Guided Neuro-Symbolic GraphRAG Delivers Grounded, Auditable Answers

Large language models have transformed how people search for information, yet in high-stakes technical fields they remain notoriously unreliable. Ask a chatbot a question that requires stitching together facts from several authoritative databases, and the answer may be fluent, confident and subtly wrong. A new study published in Neural Computing and Applications by Domenico Benfenati and Antonio Maria Rinaldi of the University of Naples Federico II tackles this problem head-on with a hybrid design that pairs the linguistic fluency of neural models with the rigor of symbolic reasoning. The result, tested on real cybersecurity data, dramatically outperforms both ordinary web search and popular retrieval-augmented generation pipelines.

The core tension the researchers address is well known in artificial intelligence. Symbolic systems, built on structured knowledge representations such as knowledge graphs, reason precisely over explicit relationships but demand formal query languages that most users cannot operate. Neural language models offer natural conversation but lack systematic grounding in authoritative knowledge, producing factual errors whenever information must be synthesized across multiple sources. Domains like healthcare, legal research and cybersecurity need both qualities at once: the precision of symbolic logic and the accessibility of plain-language dialogue. The Neapolitan team’s answer is a loosely coupled neuro-symbolic architecture in which the two paradigms never merge but cooperate through structured evidence transfer.

The architecture divides cleanly into two subsystems. The symbolic subsystem builds and maintains an explicit knowledge structure through three sequential stages: focused crawling of heterogeneous repositories, ontology-driven schema unification and graph materialization enriched with rule-based inference. The neural subsystem handles everything linguistic, from interpreting natural-language questions to generating contextual responses with large language models. Crucially, the coupling is strictly one-way. Symbolic graph operations produce provenance-preserving evidence artifacts, including entity descriptions, relationship paths and source metadata, which the neural components consume as textual context. The language model never modifies the symbolic structures, never performs internal logical reasoning and requires no joint training or differentiable symbolic computation.

The ontology itself is constructed bottom-up rather than imposed from theory. The researchers empirically analyze the field structures, constraints and relationship patterns of the actual source repositories, ensuring that ontological commitments match retrievable information. This matters because conversational systems depend on the underlying model to retrieve correct relationships; a theoretical ontology that diverges from data realities produces retrieval failures that degrade every downstream answer. Bidirectional transformations between source schemas and the unified ontology preserve provenance, tracking which attributes derive from which sources, while conflicting values are resolved through recency-based selection or authority-weighted prioritization.

To demonstrate the framework, the team chose cybersecurity vulnerability analysis, a domain where authoritative repositories maintained by MITRE and NIST encode complementary knowledge through incompatible schemas. Focused crawlers combining REST API access with HTML parsing extracted data from five repositories: CVE, NVD, CWE, CAPEC and CPE. The resulting unified knowledge graph contains more than 50,000 entities, including over 50,000 vulnerabilities, 900 weaknesses, 500 attack patterns and 10,000 products, connected through more than 200,000 materialized relationships. Rule-based inference then derives implicit connections absent from the raw data, such as transitive chains linking vulnerabilities to attack patterns through shared weaknesses, multi-hop product impact relationships and severity aggregations that flag structurally critical entities.

The evaluation compared this graph-grounded system against a web-search baseline, a dense-retrieval RAG pipeline and a Microsoft GraphRAG system, all using the same generation model, Gemini 2.5 Flash, and judged through pairwise LLM-as-judge comparisons across thirty queries per task. The results are striking. Against web search, the graph-grounded approach improved response correctness by 79 percent, completeness by 83 percent, analytical depth by 82 percent and cross-source synthesis by a full 100 percent. Against vanilla RAG, the system won 70.2 percent of exploratory comparisons on average, with the widest margin on interconnectedness, where the relational substrate allows synthesis across repository boundaries that isolated document chunks simply cannot support.

Perhaps the most revealing experiment was a provenance audit of the two graph substrates. In the ontology-guided graph, 100 percent of sampled edges were traceable to authoritative source records or declared inference rules, with 98 percent verified against the repositories themselves. In the LLM-extracted GraphRAG graph, only 83 percent of edges were traceable, 58 percent connected endpoints with canonical identifiers and 72 percent were confirmed by authoritative cross-references. The gap propagates to the answers: the new system achieved 95 percent citation precision and 91 percent claim coverage, against 66 percent and 52 percent for GraphRAG. The structural explanation is that GraphRAG grounds its answers in community summaries written by the same language model that generates responses, so the provenance chain stops at a neural intermediary instead of reaching an authoritative record.

The study is candid about its limits. On practical assistance tasks, web search actually beat the integrated system on applicability, winning 65 percent of comparisons, because authoritative repositories prioritize general principles over ready-to-use code snippets. A user asking how to fix a specific SQL injection pattern received a technically correct explanation of the underlying weakness but no paste-ready fix, while web search surfaced adaptable Stack Overflow-style answers. The authors propose hybrid retrieval architectures that combine graph-grounded evidence for analytical reasoning with curated practical resources for implementation guidance, using a lightweight classifier to route queries between the two evidence sources while preserving provenance tags throughout.

The design philosophy carries broader implications. Because the symbolic substrate remains deterministic, inspectable and independently queryable, users and developers can verify relationship chains, trace entity provenance and audit inference rules without ever invoking the neural components. This separation matters most in domains where explainability and factual accuracy carry consequences beyond conversational convenience. The researchers argue the pattern generalizes to healthcare informatics, legal research and scientific literature analysis, wherever knowledge is fragmented across independent repositories with distinct schemas and users need natural-language access without query-language expertise. Domain adaptation requires implementing new crawlers, defining domain ontologies through schema analysis and configuring appropriate inference rules, while the retrieval and generation components carry over largely unchanged.

Future work outlined by the authors includes longitudinal user studies with practitioner panels, cross-judge validation using stronger reasoning models to address the known biases of the lightweight evaluator, multi-turn dialogue evaluation, dynamic graph updates as source repositories evolve, and integration of the MITRE D3FEND defensive ontology to enable queries combining offensive and defensive reasoning. For now, the study delivers a clear empirical message: structure that exists outside the language model can be traversed and audited, while structure inferred inside the language model cannot. Keeping symbolic reasoning as an external, interpretable module, the authors show, yields better analytical quality and preserves the explainability that pure neural approaches typically sacrifice, without the training cost or architectural complexity of tightly integrated alternatives.

Subject of Research: Ontology-guided neuro-symbolic retrieval-augmented generation for grounded query answering over heterogeneous knowledge graphs

Article Title: Ontology-guided neuro-symbolic GraphRAG for grounded query answering

Article References: Benfenati, D., & Rinaldi, A. M. (2026). Ontology-guided neuro-symbolic GraphRAG for grounded query answering. Neural Computing and Applications, 38(19), Article 797. https://doi.org/10.1007/s00521-026-12495-0

Image Credits: AI Generated

DOI: 10.1007/s00521-026-12495-0

Keywords: neuro-symbolic AI, knowledge graphs, retrieval-augmented generation, GraphRAG, ontologies, cybersecurity, large language models, provenance, data integration, explainability, semantic retrieval, vulnerability analysis