# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 4 Experiments
### Adversarial Training
#### 4.2.2 Performance Metrics
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Data**} & \multirow{2}{*}{**Model**} & \multicolumn{4}{c}{**CGAN**} & \multicolumn{4}{c}{**ACGAN**} & \multicolumn{4}{c}{**CWGANGP**} \\ \cline{2-13}  & & **P** & **R** & **F** & **K** & **M** & **P** & **R** & **F** & **K** & **M** & **P** & **R** & **F** & **K** & **M** \\ \hline \multirow{5}{*}{V4} & RF & 0.751 & 0.748 & 0.739 & 0.920 & 0.920 & 0.746 & 0.608 & 0.609 & 0.636 & 0.748 & **0.796** & **0.727** & **0.750** & **0.882** & **0.846** \\ \cline{2-13}  & XGB & 0.782 & 0.761 & 0.759 & 0.891 & 0.886 & 0.749 & 0.518 & 0.575 & 0.427 & 0.279 & **1.000** & **0.709** & 0.792 & 0.789 & 0.869 \\ \cline{2-13}  & LGB & 0.714 & 0.875 & 0.773 & 0.545 & 0.567 & 0.718 & 0.716 & 0.696 & 0.816 & 0.818 & **0.930** & **0.712** & 0.768 & 0.803 & 0.816 \\ \cline{2-13}  & SNN\_MLP & 0.749 & 0.445 & 0.514 & 0.599 & 0.627 & 0.779 & 0.787 & 0.783 & 0.898 & 0.898 & **0.832** & 0.748 & 0.786 & 0.938 & 0.939 \\ \cline{2-13}  & SNN\_1 DCNN & 0.569 & 0.429 & 0.482 & 0.612 & 0.653 & 0.750 & 0.647 & 0.916 & 0.916 & 0.919 & **0.804** & 0.722 & 0.752 & 0.752 & 0.762 \\ \cline{2-13}  & TabNet & 0.708 & 0.635 & 0.667 & 0.900 & 0.903 & 0.792 & 0.973 & 0.861 & 0.722 & 0.744 & **0.935** & **0.757** & 0.789 & 0.890 & 0.840 \\ \hline \multirow{5}{*}{V5} & RF & 0.465 & 0.447 & 0.454 & 0.428 & 0.428 & 0.683 & 0.511 & 0.540 & 0.606 & 0.643 & **0.815** & **0.748** & 0.779 & 0.935 & 0.936 \\ \cline{2-13}  & XGB & 0.998 & 0.751 & 0.816 & 0.948 & 0.949 & 1.000 & 0.629 & 0.732 & 0.861 & 0.869 & **0.994** & 0.763 & 0.820 & 0.963 & 0.963 \\ \cline{2-13}  & LGB & 0.764 & 0.448 & 0.521 & 0.620 & 0.649 & 0.839 & 0.834 & 0.819 & 0.458 & 0.480 & **0.921** & **0.746** & 0.772 & 0.843 & 0.848 \\ \cline{2-13}  & SNN\_MLP & 0.588 & 0.389 & 0.454 & 0.588 & 0.636 & 0.815 & 0.748 & 0.779 & 0.935 & 0.936 & **0.875** & **0.747** & 0.798 & 0.940 & 0.941 \\ \cline{2-13}  & SNN\_1 DCNN & 0.562 & 0.418 & 0.470 & 0.592 & 0.638 & 0.847 & 0.762 & 0.724 & 0.636 & 0.670 & **0.869** & **0.763** & 0.803 & 0.961 & 0.961 \\ \cline{2-13}  & TabNet & 0.826 & 0.942 & 0.875 & 0.751 & 0.760 & 0.889 & 0.589 & 0.641 & 0.677 & 0.712 & **0.916** & **0.774** & **0.824** & **0.883** & **0.883** \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance comparison of various GAN-based adversarial training on deep learning models. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{4}{c}{**Generator**} & \multicolumn{4}{c}{**Discriminator**} & \multicolumn{4}{c}{**Hyperparameters**} \\ \cline{2-13}  & **Layers** & **Units** & **Non-Linearity** & **Layers** & **Units** & **Non-Linearity** & **Optimizer** & **Epochs** & **Batch Size** \\ \hline \multirow{5}{*}{**CGAN**} & Dense & 32 & LeakyReLU & Dense & 256 & LeakyReLU & Adam & & & \\  & Dense & 64 & LeakyReLU & Dense & 128 & LeakyReLU & (lr = 0.0002, & 300 & 64 \\  & Dense & 128 & Linear & Dense & 32 & LeakyReLU & beta\_1 = 0.5) & & & \\ \hline \multirow{5}{*}{**ACGAN**} & Dense & 32 & LeakyReLU & Dense & 256 & LeakyReLU & Adam & & \\  & Dense & 64 & LeakyReLU & Dense & 128 & LeakyReLU & (lr = 0.0002, & 300 & 64 \\  & Dense & 128 & Linear & Dense & 32 & LeakyReLU & beta\_1 = 0.5) & & & \\ \hline \multirow{5}{*}{**CWGANGP**} & Dense & 20 & LeakyReLU & Dense & 100 & LeakyReLU & & & & \\  & Dense & 32 & LeakyReLU & Dense & 64 & LeakyReLU & & & & \\ \cline{1-1}  & Dense & 64 & LeakyReLU & Dense & 32 & LeakyReLU & (lr = 0.0002, & 300 & 64 \\ \cline{1-1}  & Dense & 100 & Linear & Dense & 20 & LeakyReLU & & & & \\ \cline{1-1}  & Dense & 10 & Signal & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: GAN Architectures used in adversarial training. Furthermore, we conducted experiments to compare the performance of GAN-based augmentation and other model-agnostic adversarial sample generation methods like the Fast Gradient Sign Method (FGSM), DeepFool (DF), Carlini and Wagner (CW), and Jacobian-based Saliency Map Attack (JSMA).