# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 3 Proposed Approach
### Insider-Driven Backdoor Attack Using XAI
#### 3.1.1 Trigger Generation  
Despite being transparent, XAI can be exploited to perturb data to create complex insider-driven backdoor attacks. Attackers can identify relatively small yet important features or minor changes that significantly alter the prediction results through analyzing XAI-generated explanations. Insider analyzes the model using XAI approaches to determine which features significantly affect the predictions. SHAP [32] offers feature-level attribution, which indicates the exact contribution of each input feature to a prediction, making it an effective XAI technique. According to cooperative game theory, SHAP values measure the significance of features for individual predictions. SHAP provides local explanations that help attackers determine which features have the greatest impact and how a specific input is classified. In this work, we consider positive SHAP values to indicate features influencing the model to decide on an insider behavior, whereas negative SHAP values show features driving the model to decide on a non-malicious activity. Motivated by this fact, we consider using SHAP values to generate the backdoor trigger using a feature subspace capable of changing the decision boundary of the learning models, thereby ending up in misclassifications. The feature space of the insider threat analysis is in tabular form. Hence, creating a backdoor trigger is quite challenging. The adversary, being an insider, uses the tree-based models to generate predictions and interpret the models to identify the critical features in the prediction. Tree-based ensembles have been proven to be efficient for a small amount of data. This motivated us to use the tree ensemble XGBoost, which proved its efficiency even for smaller tabular datasets. The SHAP values of a tree ensemble are the (weighted) average of the SHAP values of the individual trees. Simple logic underpins the significance of SHAP features. Large absolute SHAP values for features are essential, and the absolute SHAP values for each feature across the data are averaged when we want to determine the global importance, as shown in Equation (1), where \(N\) is the number of features, \(\phi_{j}^{(i)}\) is the feature contribution for a feature \(j\) for sample \(i\). \[I_{j}=\frac{1}{N}\sum_{i=1}^{N}\left|\phi_{j}^{(i)}\right| \tag{1}\]  
We used the Tree SHAP model interpretation on the XGBoost algorithm. For tree-based machine learning models, including gradient-boosted trees, decision trees, and random forests, [PERSON] et al. created Tree SHAP [33], a version of SHAP. In more detail, Tree SHAP considers the topology of the tree. The Shapley value is then used to estimate the importance of features to the interested instances. The attack becomes efficient with a minimum number of features. When all the features are used to generate a trigger, it creates a new instance of the data, which can contribute to the training process, whereas using the most significant features to generate a trigger is more like tweaking the existing data to create misinterpretable samples that can confuse the training process. We considered the feature importance value greater than zero to generate a trigger for this dataset. Algorithm 1 provides the detailed steps for generating the backdoor trigger (poisoned samples).