# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 4 Experiments
### Discussion
#### 4.3.2 Effect of the Number of Poisoned Samples  
The experimental findings show that the efficacy of backdoor attacks correlates significantly with the percentage of poisoned samples inserted into the target class training data, up to a critical threshold of roughly 35%. After this point, the attack success rate usually reaches a plateau, suggesting that additional poisoning yields fewer benefits. The idea  
\begin{table}
\begin{tabular}{l l c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Data**} & \multirow{2}{*}{**Model**} & \multirow{2}{*}{**ASR \%**} & \multicolumn{3}{c}{**CGAN**} & \multicolumn{3}{c}{**ACGAN**} & \multicolumn{3}{c}{**CWGANGP**} \\ \cline{3-11}  & & & \(\mathbf{P_{drop}}\) & \(\mathbf{R_{drop}}\) & \(\mathbf{F_{drop}}\) & \(\mathbf{P_{drop}}\) & \(\mathbf{R_{drop}}\) & \(\mathbf{F_{drop}}\) & \(\mathbf{P_{drop}}\) & \(\mathbf{R_{drop}}\) & \(\mathbf{F_{drop}}\) \\ \hline \multirow{6}{*}{**V4**} & RF & 90 & 0.026 & 0.016 & 0.014 & 0.038 & 0.079 & 0.023 & **0.002** & 0.307 & 0.244 \\  & XGB & 100 & 0.018 & 0.313 & 0.238 & 0.075 & 0.164 & 0.154 & **0.2464** & 0.209 & 0.217 \\  & LGB & 96 & 0.057 & 0.238 & 0.126 & 0.056 & 0.271 & 0.276 & **0.077** & 0.035 & 0.026 \\  & SNN\_MLP & **82** & 0.029 & \(-\)0.551 & \(-\)0.289 & 0.020 & 0.351 & 0.252 & **0.060** & 0.015 & 0.044 \\  & SNN\_1 DCNN & **96** & \(-\)0.027 & 0.189 & 0.226 & 0.002 & 0.068 & 0.319 & **0.005** & 0.347 & 0.290 \\  & TabNet & 92 & 0.038 & 0.134 & 0.243 & 0.072 & 0.435 & 0.255 & **0.043** & 0.340 & 0.322 \\ \hline \multirow{6}{*}{**V5**} & RF & 90 & 0.056 & 0.139 & 0.135 & 0.241 & 0.065 & 0.101 & **0.008** & 0.009 & 0.008 \\  & XGB & 100 & 0.00 & 0.00 & 0.00 & 0.00 & 0.00 & 0.00 & **0.00** & 0.00 & 0.00 \\ \cline{1-1}  & LGB & 96 & 0.085 & 0.005 & 0.001 & 0.057 & 0.287 & 0.186 & **0.027** & 0.024 & 0.022 \\ \cline{1-1}  & SNN\_MLP & **86** & 0.011 & 0.049 & 0.049 & 0.008 & 0.310 & 0.262 & **0.001** & 0.220 & 0.174 \\ \cline{1-1}  & SNN\_1 DCNN & **97** & 0.019 & \(-\)0.065 & \(-\)0.030 & 0.014 & 0.317 & 0.192 & **0.025** & **0.005** & 0.067 \\ \cline{1-1}  & TabNet & **95** & 0.023 & 0.495 & 0.354 & 0.037 & 0.014 & \(-\)0.041 & **0.016** & 0.058 & 0.073 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Performance drop from the adversarially trained models and the backdoored models.  
behind this saturation phenomenon is that additional poisoned data have no effect after a certain percentage of the training data has been compromised. This behavior emphasizes how crucial it is to learn the ideal poison injection threshold to carry out or prevent such attacks.  
In particular, the performance of the models on clean data is almost unchanged regardless of whether the injection rate of poisoned data samples is increased. This illustrates how poison-label backdoor attacks are hidden since models maintain their accuracy on clean inputs, making detection more difficult. Moreover, the studies show that model robustness against these threats is not significantly improved or deteriorated by increasing the number of poisoned samples above the identified threshold; however, the threshold depends on the size of the dataset. The need to establish a balance between the robustness, poisoning rates, and training data amount to guarantee the secure and dependable usage of deep learning models is highlighted by these findings.