# Automated Segmentation to Make Hidden Trigger Backdoor Attacks Robust against Deep Neural Networks
## 2 Preliminary: Backdoor Attack  
This section provides a comprehensive background for backdoor attacks working on DL classifiers.  
Adversarial attacks against DL models can be categorized according to their implementation, either during the inference phase or during the training phase [11]. Adversarial attacks, also known as adversarial example attacks, typically fall under the category of inference-time attacks [12; 13; 14; 15]. Inference-time adversarial attacks tamper with the DL model during the inference phase, whereas training-time attacks manipulate the samples of the DL model during the training phase. The famous membership inference attacks [16] and model inversion attacks [17] are also inference-time attacks. We also focused on a type of inference-time attack, i.e., backdoor attacks [7].  
A backdoor attack is an attack type wherein the DNN model is trained with particular inputs, and once these inputs are fed with a special trigger, the DL system outputs the corresponding predefined results. On the other hand, when a normal input is applied without the special trigger, the system behaves normally. There are two major types of backdoor attacks, i.e., poison-label attacks and clean-label attacks. The difference between the two is the poisoning of their parameters. In poison-label attacks, the training examples and labels are both poisoned, while in clean-label attacks, only the training examples are poisoned [18]. The effectiveness of both these attack types depends upon their detection. The lesser the detection of a poisoning attack, the stronger the attack is [19]. The most common way of attacking with a backdoor is to arrange a poisonous class that triggers the backdoor to misclassify various classes to form a target class. Hence, the attack success rate is also considered to speculate on the effectiveness of the attack.  
On the contrary, the robustness of DL classifiers depends upon their strength against adversarial attacks. To make the classifiers robust against adversarial attacks, the classifiers are properly trained while keeping such attacks in view [20]. When applied to classifiers, the adversarial examples show the imprudent behavior of the DL models that repeatedly misclassify the input and result in an unexpected output. Adversarial attacks are perturbations in the classifier input to deviate the model from accurate predictions [13], defined as follows:  
\[x_{adv}=x+\epsilon\cdot sign\ (\
abla x\ J(h(x),\ y)) \tag{1}\]  
In Equation (1), \(x\) represents the actual input, while \(\epsilon\) denotes the small values, e.g., 0.007, that are injected as noise. \(\
abla x\) represents the gradient of the loss function relative to the input image. On the other hand, \(J(h(x),\ y)\) are the parameters of the function \(J\) used to compute the cost of training the neural network.  
The aim of an untargeted attack is to maximize the loss between \(h(x)\) and \(h(xt)\) until the outcome is not equal to \(y\). This attack can be transformed into a targeted attack by changing \(y\) to \(y^{\prime}_{i}\) where \(y^{\prime}_{i}\) denotes the target label. This change results in a decrease in cross-entropy loss between the predicted outcomes and the target outcome. Thus, the loss function is changed from \(\ell\)\((h\)\((x_{\text{i}}),\ y_{\text{i}})\) to \(\ell\)\((h\)\((x_{\text{i}}),\ y_{\text{i}}^{\prime})\), where \(y_{\text{i}}^{\prime}\ \
eq\ y_{\text{i}}\).  
\[Minimize\ diff\:erence\ (h(x)\ and\ h(x))\ \ \ \ \ \ \ \text{where\ prediction}\ \
eq\ y \tag{2}\]  
\[Minimize\ loss\ \ \ \ \ \ \ \ \ (h(x\prime)\ and\ y\prime)\ \ \ \ \ \ \ \ \ \ \ \text{where\ }h(x\prime)\ =\ y\prime \tag{3}\]  
In a targeted attack, there is an additional goal of minimizing the loss between \(h(x\prime)\) and \(y\prime\) until \(h(x\prime)=y\prime\), along with maximizing the loss between \(h(x)\) and \(h(x\prime)\). An untargeted attack is formalized in Equation (2), while a targeted attack contains the additional goal described in Equation (3) along with Equation (2).