# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 4 Experiments
### Discussion
#### 4.3.1 Success of Attack  
The success of the proposed attack is monitored using a metric attack success rate (ASR) calculated as the percentage of adversarial samples with the target label as given in Equation (2). In addition, as a benchmark, we analyzed classification performance for each model using clean data and the same training settings.  
\[ASR=\frac{\#successful\_attacks}{\#total\_attempts\_made} \tag{2}\]  
Table 7 provides the attack success rate (ASR) for the backdoor generated using XAI. We performed the backdoor with a different number of samples to see how the poison  
\begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{6}{c}{**V4**} & \multicolumn{6}{c}{**V5**} \\ \cline{2-10}  & **FGSM** & **DF** & **CW** & **JSMA** & **FGSM** & **DF** & **CW** & **JSMA** \\ \hline RF & 0.512 & 0.561 & 0.550 & 0.489 & 0.408 & 0.549 & 0.522 & 0.463 \\ XGB & 0.999 & 0.452 & 0.635 & 0.612 & 0.750 & 0.701 & 0.667 & 0.636 \\ LGB & 0.633 & 0.571 & 0.619 & 0.571 & 0.615 & 0.612 & 0.655 & 0.539 \\ SNN\_MLP & 0.459 & 0.616 & 0.474 & 0.489 & 0.549 & 0.625 & 0.761 & 0.750 \\ SNN\_1 DCNN & 0.5321 & 0.681 & 0.612 & 0.539 & 0.513 & 0.523 & 0.554 & 0.561 \\ TabNet & 0.734 & 0.714 & 0.762 & 0.716 & 0.704 & 0.725 & 0.681 & 0.702 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Performance comparison of various adversarial sample generation methods.  
Figure 4: Validation loss curves for CGAN, ACGAN, and CWGAN-GP.  
sample rate affects the attack. The higher ASR means that the attack on the model is effective.  
The data presented illustrate the efficacy and consequences of poison-label backdoor assaults in adversarial training settings with synthetic, GAN-generated data. The attack success rate (ASR) for CERT datasets shows that deep learning models like MLP, one-dimensional convolutional neural networks (1 DCNNs), and TabNet show different levels of vulnerability. For example, with CGAN-based poisoning, the SNN-MLP exhibits a significant performance loss (F-score drop) of up to 0.289 (28.9%), indicating vulnerability. In contrast, the SNN-1 DCNN shows inconsistent results, with slight performance decreases (up to \(-\)0.027 with the CGAN), suggesting that the adversarially trained backdoor model occasionally outperforms baseline adversarially trained models. Similarly, TabNet demonstrates an apparent vulnerability to insider-driven attacks, especially regarding ACGAN poisoning (performance loss of 0.435).  
Additionally, examining the CWGAN-GP--the technique combining the gradient penalty and Wasserstein GAN--shows that it improves robustness among evaluated models. The CWGAN-GP has increased robustness, highlighting its potential to strengthen defense techniques against backdoor attacks. These results highlight the need for demanding robustness evaluations and thorough adversarial training method selection, particularly for deep neural architectures like the MLP, 1 DCNN, and TabNet, which are frequently used as tabular DL models.  
The complexity of the methods depends on the type of samples used in the data. The dataset used in this work is not as complex as image-based datasets commonly used for experiments in the existing works. So, the computational complexity will not be excessive. In this case, the data are not high-dimensional. Moreover, the GAN-based augmentation and the trigger generation are not interlinked; they are independent processes. The underlying assumption is that the attacker performs the trigger generation using a subset of the sample space; hence, trigger generation cannot be too complicated. Hence, the proposed approach does not tend to be computationally complex.