There are provided a classifier and method of classifying defects in a semiconductor specimen. The method comprises receiving defects classified into a majority class, each having values for plurality of attributes, some defects belonging to a minority class, and some to the majority; selecting an attribute subset and defining differentiators for attributes wherein a second classifier using the subset and differentiators classifies correctly to minority and majority classes at least part of the defects; generating a training set comprising: defects of the majority and minority classes, and additional defects which the second classifier classifies as minority; training, upon the training set, subset, and differentiators, an engine obtaining a confidence level that a defect belongs to the majority class; applying the engine to second defects classified to the majority class, to obtain a confidence level of classifying each defect to the majority class; and outputting defects having a low confidence level.