# DriNet: Dynamic Backdoor Attack against Automatic Speech Recognition Models  
[PERSON]  
1 College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China; [EMAIL_ADDRESS] (J.Y. ); [EMAIL_ADDRESS] (C.L. ); [EMAIL_ADDRESS] (G.L.) [PERSON]  
1 College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China; [EMAIL_ADDRESS] (J.Y. ); [EMAIL_ADDRESS] (C.L. ); [EMAIL_ADDRESS] (G.L.) [PERSON]  
2 College of Physics and Information Engineering, Fuzhou University, Fuzhou 350000, China; [EMAIL_ADDRESS]  
[PERSON]  
1 College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China; [EMAIL_ADDRESS] (J.Y. ); [EMAIL_ADDRESS] (C.L. ); [EMAIL_ADDRESS] (G.L.) [PERSON]  
1 College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China; [EMAIL_ADDRESS] (J.Y. ); [EMAIL_ADDRESS] (C.L. ); [EMAIL_ADDRESS] (G.L.) Footnote 1: [[https://www.mdpi.com/journal/applsci](https://www.mdpi.com/journal/applsci)]([https://www.mdpi.com/journal/applsci](https://www.mdpi.com/journal/applsci))  
Footnote 2: [[https://www.mdpi.com/journals/pdf/1](https://www.mdpi.com/journals/pdf/1)]([https://www.mdpi.com/journals/pdf/1](https://www.mdpi.com/journals/pdf/1))  
been demonstrated to work in the vision field [6; 7; 8; 9], research on automatic speech recognition is rare. The structures and characteristics of audio data make attacks against them very different from those in image domains. Backdoor attacks in audio domains deserve further study. The triggers used by backdoor attacks can be divided into two categories: (1) static trigger, which is a fixed pattern placed in a fixed location; and (2) dynamic trigger, which has flexible styles and positions and appears in multiple areas. Current state-of-the-art backdoor attack schemes [6; 10; 11] rely excessively on fixed static triggers (in terms of patterns and locations), which lack flexibility and are easily detected by existing defense mechanisms [12; 13]. They generate a trigger with a static value and position corresponding to a certain target label to obtain this simple one-to-one relationship learned by the neural network model. Due to the monotonous attack style, once the static backdoor attack method is interfered with and restricted in practical applications, its attack performance will be significantly reduced. Compared with static triggers, a dynamic trigger backdoor attack is more powerful and more applicable to the physical world [14]. However, backdoor attacks using dynamic triggers have not been well explored in the audio domain yet. It emphasizes the necessity of designing dynamic backdoor attacks under more realistic conditions. In this paper, we present the design and implementation of DriNet, a targeted dynamic backdoor attack method for automatic speech recognition models that rely on neural networks to generate different triggers. Triggers of different frequencies and amplitudes can be embedded into the audio samples as required. In contrast to static trigger backdoor attacks, DriNet exploits flexible trigger patterns for more effective backdoor attacks. We evaluated the effectiveness of the proposed method on two audio classification model architectures over two benchmark datasets. The results indicate that DriNet achieves an over 98% targeted attack success rate with only 1% of poisoned training samples (without compromising accuracy). To further discuss the performance of triggers of different sizes, we designed three types of triggers to launch the attack. Moreover, we utilized the state-of-the-art backdoor defense technique to evaluate our method. Our results demonstrate that our dynamic triggers can not be reversed by the defense algorithm. The main contributions of this paper are the following:  
* We explored a novel dynamic backdoor attack paradigm in the audio domain (a challenge rarely explored).