# DriNet: Dynamic Backdoor Attack against Automatic Speech Recognition Models
## 2 Related Work
### Backdoor Attack  
Backdoor attacks are emerging forms of attacks against deep learning models that can be triggered via a crafted input by the adversary. Poisoning the training samples is the most straightforward and widely adopted method for adding functionality to the training process. The adversary modifies some training samples by adding specified triggers. These poisoned samples with specified target labels and the remaining benign training samples are fed into the model for training, embedding backdoors in the victim model. Existing backdoor attacks have wide applications in the visual and audio fields.  
Backdoor attacks in the vision domain. BadNets [6] introduced the first backdoor attack in deep learning by poisoning some training samples. They use white pixel blocks of specific sizes as triggers and always place them in the upper left corners of all inputs. BadNets is a typical static backdoor attack technique that has gained much popularity in backdoor attacks. Currently, most backdoor attacks are sample-independent, i.e., all poisoned samples contain the same trigger pattern. This property is widely used in the design of backdoor defenses. [PERSON] and [PERSON] [17] proposed the first sample-specific backdoor attack, where different poisoned samples contain different trigger patterns. This attack can bypass many existing backdoor defenses because it breaks the basic assumptions. [PERSON] et al. [8] proposed the first class of dynamic backdoor attacks, namely BaN and c-BaN. They dynamically determine the location as well as the style of triggers through a network, enhancing the effectiveness of the attack. They achieve strong performances while bypassing the current state-of-the-art backdoor defense techniques.  
Backdoor attacks in the audio domain. [PERSON] and [PERSON] [18] proved that hidden information can illegally be used by an adversarial to activate the backdoor of a DNN-based ASR model that is embedded into an intelligent speaker. [PERSON] et al. [4] designed a clustering-based attack scheme where poisoned samples from different clusters contain different triggers to infect speaker verification models by poisoning the training data. [PERSON] et al. [19] designed ultrasonic triggers to perform backdoor attacks on automatic speech recognition systems by poisoning the data. However, the ultrasonic waves fail in the low-pass filter and lack practicality. [PERSON] [20] proposed the first targeted poisoning attack against automatic speech recognition. This method causes the automatic speech recognition system to transcribe \(x_{t}\) into the target word **W** by altering the specific sequence of frames (poison frames) in the original audio input \(x_{t}\). Nevertheless, it takes hours to complete the attack. [PERSON] et al. [21] introduced a new backdoor attack method--the trojan neural network (TNN)--against deep learning models. The TNN scans the target neural network, selecting some neurons. Then, it iteratively modifies the input according to the differences between the current value and the expected value of the selected neuron.