# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 1 Introduction  
Deep learning (DL) is a key technique in many fields, including autonomous systems and healthcare. However, deep learning is still vulnerable to security threats, compromising reliability and legitimacy. One of the most significant problems is the presence of adversarial attacks, in which well-designed perturbations compromise the neural networks by producing incorrect predictions [1]. Adversarial training has been a popular defensive technique for handling such threats, where models are trained on adversarial samples to increase their robustness. However, existing studies indicate that adversarial training may be manipulated to create backdoor vulnerabilities, creating further security issues. In data poisoning attacks, attackers may inject incorrectly labeled or altered training data, generating unexpected results that adversaries may exploit. According to [2], these risks are increased when surrogate models are used, in which adversarial examples are created for the target model by training alternative models. However, XAI, which was designed to improve the interpretability of models, unintentionally helps attackers by exposing flaws that can be used to improve attack tactics [3]. Backdoor attack is a specific attack category where the attacker inserts secret triggers into the learning models during the training phase [4]. According to [5], the model performs normally in most situations but intentionally alters its behavior when specific triggers are present. The potential for adversarial training to introduce backdoor vulnerabilities is a serious concern in situations where training data is not securely managed. This dangeris increased when an insider, such as an employee within the organization, is aware of the training pipeline and can alter data to introduce a backdoor attack. There is a serious risk from an insider familiar with the dataset and training process. An insider can utilize adversarial perturbations to include backdoor functionality and inject poisoned samples with backdoor triggers during adversarial training, exploiting the knowledge of XAI outputs to strategize the attacks further. The attacker can also use surrogate models to maximize the attack with the fewest possible traces. Nowadays, model explainability is used to aid in deducing the results produced by machine learning (ML) and deep learning models. However, attackers can use it to create effective attacks using surrogate models and the data accessible to them. Recently, studies have focused on the vulnerability of XAI and how attacks can be generated using XAI results [6]. Though explainable artificial intelligence (XAI) and surrogate models have been thoroughly examined with adversarial robustness, the literature has not yet given enough attention to their roles and consequences in adversarially triggered backdoor attacks. Substantial research has been conducted on backdoor attacks and adversarial training, but little is known about how these two areas interact. Existing research mainly concentrates on adversarial training as a defensive strategy, ignoring the possibility that this method could be used to introduce backdoor vulnerabilities. Furthermore, most studies do not consider insider threats when discussing deep learning security. The paucity of thorough research on how adversarial training can act as a backdoor attack vector highlights a significant weakness in the security of deep learning systems. In this study, we focus on the effects of the vulnerability of XAI and how a backdoor attack can impact adversarial training. Our primary goal is to use the model explainability methods for selecting a subset of features and their values for the backdoor trigger generation and propose a backdoor attack using model explainability methods. The contributions of the paper are as follows:  
* We propose an insider-driven poison-label backdoor attack that adopts the use of model interpretability from explainable AI (XAI) to study the vulnerability of adversarial training when exploited by an insider.