# Automated Segmentation to Make Hidden Trigger Backdoor Attacks Robust against Deep Neural Networks
## 4 Materials and Methods
### Phase 2: Perturbation of Images for Testing the Smoothed Classifier
Table 1b and Figure 6b show the results of the human-in-the-loop approach, with accuracies of 73.4%, 99.8%, 80.8%, and 96% on image1, image2, image3, and image4, respectively. A brief comparison was also made between the human-in-the-loop and automatic approaches, as shown in Table 1c. It can be observed that the results obtained by the automatically generated triggers were far better than those of the triggers generated through the human-in-the-loop method. \begin{table}
\begin{tabular}{c c c c c c c} \hline  & **(a) Automatically Generated** & \multicolumn{3}{c}{**(b) Triggers Generated from**} & \multicolumn{3}{c}{**(c) Accuracy Comparison of**} \\  & **Patches** & \multicolumn{3}{c}{**Human-In-The-Loop Approach**} & \multicolumn{3}{c}{**Cropped Patches**} \\ \hline  & **Color Patches** & **Cropped Patches** & **Color Patches** & **Cropped Patches** & **Our Results** & **Previous Results** \\ \hline Image 1 & 96.67 & 98.89 & 93 & 73.4 & 98.89 & 73.4 \\ Image 2 & 94.44 & 100 & 98.4 & 99.8 & 100 & 99.8 \\ Image 3 & 91.11 & 100 & 97.4 & 80.8 & 100 & 80.8 \\ Image 4 & 94.44 & 98.89 & 97 & 96 & 98.89 & 96.8 \\ \hline \end{tabular}
\end{table} 
Table 1: Comparison of human-in-the-loop technique and our automatic technique for attack success rates. Figure 5: Extraction of backdoor pattern through masking. ### Bounding Box around Backdoor Region

We used a binary mask to extract the colors of the backdoor pattern. To extract the patches, the label was computed for each connected region using the Label function of OpenCV. The label denoted a continuous region; we could simply iterate over all non-background labels. The first continuous region or linked component belonged to label 1, the second connected component belonged to label 2, and so on. This method detected the image's numerous blobs. A bounding box was drawn around these labels, as shown in Figure 7, which illustrates a bounding box for a continuous region. The area of these regions was calculated through the regionprops function, which is used to count the number of pixels in a connected region. The label with a greater area was selected as the most dominating region. The centroid function helped to find the center of these labels or connected components that were used to develop alternate triggers with the same size as the backdoor trigger used throughout the ImageNet poisoned classifiers, which was 30 \(\times\) 30. Two triggers were generated with the help of this process, i.e., the color patch trigger and cropped patch trigger. The color and cropped patches were both produced from the adversarial cases as shown in Figure 8, which was built by targeting hidden trigger backdoor attack (HTBA) using the ImageNet dataset. Figure 6: The comparison of the attack success rate of patches generated by automatic and human-in-the-loop approaches. Figure 7: Drawing of bounding boxes around connected regions to extract the most effective color and cropped patches. These bounding boxes further selected the most dominant color region with a larger area. ## 6 Discussion

We evaluated the accuracy of the automatic approach by comparing it with state-of-the-art methods: original backdoor trigger [3], human-in-the-loop [7], and randomly cropped patches [3; 7]. The automatic approach improved the accuracy by roughly 85.07%, as compared to the original backdoor trigger, human-in-the-loop, and randomly cropped patches, as shown in Table 2. This showed that our approach obtained high accuracy as compared with existing techniques, which proved the robustness of our approach. The statistics in Tables 1 and 2 present an accuracy of well over 98% for automatically generated triggers, whereas the manual work corresponded to a significant variation in accuracy between 73.4% and 99.8%. It can be observed that the results obtained by automatically generated triggers were far better than those of the triggers generated through the human-in-the-loop method.