# DriNet: Dynamic Backdoor Attack against Automatic Speech Recognition Models
## 4 Experiments
### Results
\begin{tabular}{c} **Poisoning** \\ **Rate** \\ \end{tabular}  } & \multicolumn{4}{c}{**(1 \(\times\) 5)**} & \multicolumn{4}{c}{**(2 \(\times\) 5)**} & \multicolumn{4}{c}{**(3 \(\times\) 5)**} \\ \cline{3-8}  & & **ACC** & **ASR** & **ACC** & **ASR** & **ACC** & **ASR** \\ \hline \multirow{8}{*}{1D CNN} & 0.005 & 0.998 & 0.697 & 0.998 & 0.758 & 1 & 0.864 \\  & 0.01 & 0.999 & 0.87 & 0.998 & 0.848 & 1 & 0.984 \\  & 0.03 & 0.999 & 0.983 & 0.999 & 0.988 & 0.999 & 0.989 \\  & 0.05 & 0.998 & 0.984 & 0.999 & 0.994 & 0.999 & 0.999 \\  & 0.1 & 0.998 & 0.987 & 0.999 & 0.  
dynamic backdoor attacks enjoy more resistance and stealth than the static method. Thus, DriNet has more tremendous advantages than a static backdoor attack. Defense. We use both datasets to evaluate our technique by the state-of-the-art defense, namely neural cleanse. Neural cleanse is a model-based defense mechanism in the model validation testing phase. Neural cleanse iteratively optimizes a trigger for each given target label to find the minimum one required to misclassify the samples from other labels. In this way, it can reverse N potential triggers for each label. Then, neural cleanse measures the sizes of the triggers and detects if any trigger is significantly smaller than the others based on the median absolute deviation (MAD) [30]. As shown in Figure 2, the models constructed by DriNet have a lower anomaly index than the baseline models and perform even better than the clean models in most circumstances. The anomaly index of DriNet is 37.4% smaller than that of the BadNets method for the 1D CNN models on the AudioMNIST dataset. Moreover for X-vector models on the speech commands dataset, this ratio is as high as 79.4%. Moreover, the anomaly index of our models is less than the threshold, which means that neural cleanse fails to detect the backdoor models attacked by DriNet. The potential triggers reversed by neural cleanse contain information in multiple locations and styles, resulting in large enough masks to make the anomaly index more minor than the threshold. In other words, dynamic triggers generated by DriNet are more challenging to reverse than static triggers. We believe that the neural cleanse mechanism fails to detect our hidden backdoor because DriNet breaks the fundamental assumption about backdoor attacks--that triggers are invariant in position and style. Figure 2: Anomaly index of BadNet, DriNet, and cthe lean model. The lower, the better; the blue-dotted line is the threshold used. SC denotes the speech commands dataset. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Attack Method**} & \multirow{2}{*}{\begin{tabular}{c} **Victim** \\ **Model** \\ \end{tabular} } & \multicolumn{2}{c}{\
\begin{tabular}{c} **AudioMNIST** \\ **ACC** \\ \end{tabular} } & \multicolumn{2}{c}{
\begin{tabular}{c} **Speech Commands** \\ **ASR** \\ \end{tabular} } & \multirow{2}{*}{**Neural Cleanse**} \\ \cline{2-2} \cline{4-6}  & & 1D CNN & 0.999 & 0.956 & 0.912 & 0.677 & \(\times\) \\ \cline{2-6}  & X-vector & 0.999 & 0.949 & 0.915 & 0.658 & \\ \hline \multirow{2}{*}{DriNet} & 1D CNN & 0.999 & 0.984 & 0.906 & 0.629 & \(\surd\) \\ \cline{2-6}  & X-vector & 0.999 & 0.945 & 0.920 & 0.705 & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The performance comparison between BadNet and DriNet. We let the poisoning rate be 0.01 for the AudioMNIST dataset and 0.1 for the speech commands dataset. “\(\times\)” means cannot bypass the defense. “\(\surd\)” means can bypass the defense.