1. A method for inspecting a sample, comprising: receiving a definition of image attributes that are characteristic of defects; processing an image of the sample so as to identify candidate defects on the sample; forming distributions of values of the respective attributes from the candidate defects; selecting a set of the candidate defects that are characterized by respective candidate attribute values that fall in one or more tails of the distributions; presenting the selected set to a human operator; receiving from the operator respective classifications of the candidate defects in the selected set; and refining a definition of the one or more tails of the distributions responsively to the classifications.