# DriNet: Dynamic Backdoor Attack against Automatic Speech Recognition Models
## 4 Experiments
### Results  
We evaluate the performance of our dynamic backdoor attack for the 1D CNN model and the X-vector model on the AudioMNIST dataset and the speech commands dataset, respectively. For the AudioMNIST dataset, Table 3 demonstrates that successively increasing the poisoning rate from 0.005 to 0.2 leads to a higher attack success rate while maintaining excellent clean sample accuracy(at least 0.997). Moreover, with the trigger size of (3 \(\times\) 5), we can achieve up to an 86.4% attack success rate by poisoning only 0.5% of the training set for the 1D CNN model and achieve over 98% targeted ASR with 1% of poisoned samples. Moreover, for the speech commands dataset shown in Table 4, the attack success rate gradually goes up \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline
**Dataset** & **Zero** & **One** & **Two** & **Three** & **Four** & **Five** & **Six** & **Seven** & **Eight** & **Nine** & **Total** \\ \hline AudioMNIST & 3000 & 3000 & 3000 & 3000 & 3000 & 3000 & 3000 & 3000 & 3000 & 3000 & 30,000 \\ Speech Commands & 4052 & 3890 & 3880 & 3727 & 3728 & 4052 & 3860 & 3998 & 3787 & 3934 & 38,908 \\ \hline \end{tabular}
\end{table} 
Table 2: A summary of datasets. as the poisoning rate increases from 0.03 to 0.5. However, this improvement has side effects that the accuracy reduces to varying degrees, the lowest is 8.8%, and the highest is 17.1%. We also discuss the effect of the trigger size on dynamic backdoor attack effectiveness. In general, a larger trigger size achieves a more vigorous attack. For example, triggers of 3 \(\times\) 5 shapes significantly surpass triggers of \(1\times 5\) shapes, in terms of both accuracy and attack success rate with the same poisoning rate. However, this will inevitably make the trigger more conspicuous. A trade-off should be made between the attack success rate and stealthiness in a real-world application. The clean sample accuracy and attack success rate concerning BadNets and DriNet are shown in Table 5. We find that our dynamic backdoor attack method can still achieve comparable attack performance to the static backdoor attack method. Intuitively, a dynamic trigger enjoys a richer attack pattern than a static trigger due to its multiple styles. In a complex environment, for the dynamic backdoor model, the adversary can use a variety of attack samples, but for the static backdoor model, the attack is limited. Furthermore, \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multicolumn{7}{c}{**Speech Commands**} \\ \hline \multirow{3}{*}{**Model**} & \multirow{3}{*}{
\begin{tabular}{c} **Poisoning** \\ **Rate** \\ \end{tabular} } & \multicolumn{4}{c}{**(1 \(\times\) 5)**} & \multicolumn{4}{c}{**(2 \(\times\) 5)**} & \multicolumn{2}{c}{**(3 \(\times\) 5)**} \\ \cline{3-8}  & & **ACC** & **ASR** & **ACC** & **ASR** & **ACC** & **ASR** \\ \hline \multirow{8}{*}{1D CNN} & 0.03 & 0.927 & 0.211 & 0.936 & 0.341 & 0.946 & 0.455 \\  & 0.05 & 0.917 & 0.411 & 0.926 & 0.467 & 0.924 & 0.541 \\  & 0.1 & 0.877 & 0.484 & 0.893 & 0.559 & 0.906 & 0.629 \\  & 0.2 & 0.834 & 0.617 & 0.852 & 0.662 & 0.871 & 0.722 \\  & 0.3 & 0.8 & 0.68 & 0.825 & 0.753 & 0.847 & 0.778 \\  & 0.4 & 0.79 & 0.762 & 0.815 & 0.81 & 0.845 & 0.824 \\  & 0.5 & 0.782 & 0.812 & 0.822 & 0.842 & 0.844 & 0.866 \\ \hline \multirow{8}{*}{X-vector} & 0.03 & 0.931 & 0.105 & 0.941 & 0.342 & 0.949 & 0.522 \\  & 0.05 & 0.915 & 0.287 & 0.932 & 0.52 & 0.939 & 0.574 \\ \cline{1-1}  & 0.1 & 0.891 & 0.466 & 0.905 & 0.627 & 0.92 & 0.705 \\ \cline{1-1}  & 0.2 & 0.835 & 0.636 & 0.875 & 0.755 & 0.892 & 0.756 \\ \cline{1-1}  & 0.3 & 0.812 & 0.727 & 0.851 & 0.797 & 0.863 & 0.807 \\ \cline{1-1}  & 0.4 & 0.797 & 0.795 & 0.841 & 0.847 & 0.862 & 0.868 \\ \cline{1-1}  & 0.5 & 0.811 & 0.861 & 0.84 & 0.888 & 0.861 & 0.898 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The results of the accuracy and attack success rate for the speech commands dataset. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multicolumn{7}{c}{**AudioMNIST**} \\ \hline \multirow{3}{*}{**Model**} & \multirow{3}{*}{