# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 3 Proposed Approach
### Insider-Driven Backdoor Attack Using XAI  
According to [26], an insider attacker with access to the model or data poses a serious security risk since they may easily initiate a backdoor attack. The labels of the data that have been poisoned are replaced with the target labels in poison-label attacks. As a result, the target labels are predicted when the backdoored model identifies the triggers. In this study, we focus on a poison-label attack triggered by an insider.  
This work proposes a new backdoor attack exploiting the transparency that explainable AI provides through global model interpretation, as shown in Figure 2.  
**Adversary's capacity:** We assume the adversary to be someone part of the organization and who has access to dataset and is capable of triggering an adversarial attack through data poisoning during the training and testing stages of the threat detection model generation process.  
Adversaries can establish a backdoor by inserting a specific pattern into models. Attackers usually create and add additional data into the training set with specific patterns to train or improve models. When these models get contaminated, they wrongly allocate input to a particular target class in response to a backdoor trigger, but they maintain high accuracy for benign data. Model interpretability can provide details of the features that can influence the classification. The adversary uses XAI to identify the subtle features that drastically affect the threat identification process. So, the attacker can use the most critical features to create minimal perturbations that classify the malicious data as non-malicious and mask them so that they can affect the insider threat identification.  
**Adversary's objective:** The adversary uses control over (a subset of) the features in a backdoor attack to cause misclassifications due to the presence of poisoned values in those feature dimensions. Assuming the attack produces a dense area of poisoned samples within the feature subspace encompassing the trigger, the classifier modifies its decision boundary to account for this density. The decision boundary is still subject to the attacker's control, even if they only have a limited subspace. The attacker can modify both the region of the decision boundary and the density of attack points by carefully choosing the feature dimensions and values of the pattern as well as the number of poisoned data points they inject.  
The various explainability strategies used after creating a system or model, called post-model approaches, can produce significant insights into the information that a system or model learns during training. This critical information explains why a sample is classified into a particular class. It can be considered a reverse engineering process to use a model to understand how the data behave, and hence, it can be interesting to adversaries. Here,  
Figure 2: Insider-driven backdoor attack using XAI—trigger generation.  
we consider the vulnerability of the XAI results and adopt Shapley Additive Explanations (SHAP) values [32] that provide a data-driven decision model to generate a backdoor attack.  
In the coming sections, we provide the details of the surrogate threat model being used and the backdoor trigger generation process using XAI.