## 3D Surface Plots: HIT@5 Performance Analysis
### Overview
The image presents six 3D surface plots, labeled (a) through (f), illustrating the performance metric "HIT@5" across varying "Attack budget" and "Defense budget" levels. The plots are organized into two distinct categories: "Backdoor" (a, b, c) and "Targeted" (d, e, f). The color gradient in each plot transitions from dark purple (representing lower HIT@5 values) to white (representing higher HIT@5 values).
### Components/Axes
* **X-axis:** "Attack budget" (Scale: 0 to 4).
* **Y-axis:** "Defense budget" (Scale: 0 to 4).
* **Z-axis (Vertical):** "HIT@5" (Scale varies per plot).
* **Labels:**
* (a) Backdoor-Vulnerability
* (b) Backdoor-Diagnosis
* (c) Backdoor-Freebase
* (d) Targeted-Vulnerability
* (e) Targeted-Diagnosis
* (f) Targeted-Freebase
### Detailed Analysis
#### Group 1: Backdoor Scenarios
These plots generally exhibit higher HIT@5 values and show a positive correlation between the Attack budget and performance.
* **(a) Backdoor-Vulnerability**
* **Trend:** The surface slopes upward as the Attack budget increases.
* **Corner Values:**
* Attack 0, Defense 0: ~0.55
* Attack 0, Defense 4: ~0.54
* Attack 4, Defense 0: ~0.80
* Attack 4, Defense 4: ~0.68
* **(b) Backdoor-Diagnosis**
* **Trend:** A distinct peak occurs at high Attack budget and low Defense budget.
* **Corner Values:**
* Attack 0, Defense 0: ~0.37
* Attack 0, Defense 4: ~0.34
* Attack 4, Defense 0: ~0.67
* Attack 4, Defense 4: ~0.38
* **(c) Backdoor-Freebase**
* **Trend:** Similar to (b), with a sharp peak at high Attack budget and low Defense budget.
* **Corner Values:**
* Attack 0, Defense 0: ~0.62
* Attack 0, Defense 4: ~0.51
* Attack 4, Defense 0: ~0.84
* Attack 4, Defense 4: ~0.50
#### Group 2: Targeted Scenarios
These plots show a strong negative correlation with the Defense budget; performance drops significantly as the Defense budget increases.
* **(d) Targeted-Vulnerability**
* **Trend:** High performance at low Defense budget, dropping sharply toward zero as Defense budget increases.
* **Corner Values:**
* Attack 0, Defense 0: ~0.72
* Attack 0, Defense 4: ~0.02
* Attack 4, Defense 0: ~0.70
* Attack 4, Defense 4: ~0.13
* **(e) Targeted-Diagnosis**
* **Trend:** Similar to (d), with performance collapsing as Defense budget increases.
* **Corner Values:**
* Attack 0, Defense 0: ~0.44
* Attack 0, Defense 4: ~0.00
* Attack 4, Defense 0: ~0.40
* Attack 4, Defense 4: ~0.05
* **(f) Targeted-Freebase**
* **Trend:** Performance is moderate at low Defense budget and decreases as Defense budget increases, though the drop is less severe than in (d) and (e).
* **Corner Values:**
* Attack 0, Defense 0: ~0.33
* Attack 0, Defense 4: ~0.14
* Attack 4, Defense 0: ~0.35
* Attack 4, Defense 4: ~0.22
### Key Observations
* **Defense Sensitivity:** The "Targeted" group is highly sensitive to the Defense budget. In all three Targeted plots, increasing the Defense budget from 0 to 4 results in a near-total loss of HIT@5 performance.
* **Attack Resilience:** The "Backdoor" group is more resilient to the Defense budget. While performance fluctuates, it remains significantly higher at a Defense budget of 4 compared to the Targeted group.
* **Performance Ceiling:** The "Backdoor" plots reach higher absolute HIT@5 values (peaking around 0.80–0.84) compared to the "Targeted" plots (peaking around 0.35–0.72).
### Interpretation
The data demonstrates a fundamental difference in the efficacy of attacks between "Backdoor" and "Targeted" scenarios.
1. **Backdoor Attacks:** These appear to be more robust. The "Attack budget" is the primary driver of success; increasing it consistently yields higher HIT@5 scores, and the "Defense budget" has a relatively muted impact on mitigating these attacks.
2. **Targeted Attacks:** These are highly fragile. While they can achieve moderate success when the Defense budget is low, they are easily neutralized by increasing the Defense budget. This suggests that Targeted attacks are significantly easier to defend against than Backdoor attacks.
3. **Task Variance:** The "Freebase" variants (c and f) show slightly different surface curvatures compared to "Vulnerability" and "Diagnosis," indicating that the underlying task or dataset characteristics influence how these attacks interact with defense mechanisms.
