# Adversarial Training for Mitigating Insider-Driven XAI-Based Backdoor Attacks
## 4 Experiments
### Robustness Analysis of Backdoor in AT  
Here, we provide the robustness analysis of the backdoor in AT models. We used the performance drop metric to study the performance reduction in the adversarially trained DL models with and without the backdoor. The performance comparison among various models reveals that the CWGAN-GP-based training produces a smaller performance drop. For the analysis, we use the metric performance drop in metric values denoted as \(M_{\text{drop}}\) as shown in Equation (3). \(M_{\text{drop}}\) is the difference in the metric value for the performance metrics precision, recall, and F-score. Let the performance metric of the adversarially trained model be \(M_{\text{AT}}\) and the metric of the backdoored model be \(M_{\text{B}}\), where \(M\) can be any performance metric used in the analysis. \[M_{Drop}=M_{AT}-M_{B} \tag{3}\]  
The \(M_{\text{drop}}\) is calculated for the metrics precision as \(P_{\text{drop}}\), recall as \(R_{\text{drop}}\), and F-score as \(F_{\text{drop}}\) as in Table 7. The performance drop can be positive or negative. A positive value means the adversarial training gives a higher metric, whereas a negative value means that the adversarially trained backdoor model gives a higher metric value. The altered model achieves nearly identical metrics on the testing data but with somewhat lower precision but not for all models. The precision, recall, and F-score values indicate a stable model, even in the presence of poisoned samples. The backdoored model supports non-malicious classification since the attack treats all (triggered) malicious samples as non-malicious, slightly altering the malicious-to-non-malicious ratio. The results demonstrate that GAN-based adversarial training can resist the backdoor attack to the fullest extent. As expected in the ideal attack strategy, the attack does not considerably affect the model performance. The various GAN models behave differently for the backdoor models. The models trained with GAN samples are not considerably affected by the backdoored samples, as seen in Table 7. Out of the three models, the CWGANGP resists the backdoor attack more than the CGAN and ACGAN. When trained in the adversarial setting, a model alters the decision boundary to accommodate the newly added adversarial samples, and injecting the backdoor samples also alters the decision boundary. Since adversarial training can be considered a form of data poisoning during training time, it already alters the decision boundary, and hence, the AT models can resist the backdoor to the fullest extent. In this work, we consider AT as the defense method. Regularization using data augmentation during training on the clean data and perturbed data were utilized to fine-tune a trained (poisoned) model to assess the defense and mitigation of backdoor data poisoning. We show that a defender can significantly reduce backdoor attack effects by fine tuning the model on a reliable source of clean data across a range of models without explicit knowledge of poisoning techniques. Moreover, the attack is formulated to investigate backdoor performance on AT in insider threat analysis. Backdoor attacks can occur in insider threat detection and can go unnoticed. So, we aim to use the AT as a mechanism that can resist the backdoor to the fullest extent. The backdoor used in this work is framed using global model interpretability. The proposed approach has room for improvement in the sense that the value selection method can be modified. The AT using GAN-based augmentation can create data samples that can be considered positioned data samples. These samples are generated from within the original data distribution to mimic the training dataset closely. Building a model with these data results in an updated decision boundary that can accommodate the newly added samples, and the model will be more robust, though without very high performance. Backdoored models also affect the decision boundary as new samples are added.