DriNet: Dynamic Backdoor Attack against Automatic Speech Recognization Models

Round 1

Reviewer 1 Report

The paper presents a dynamic backdoor attack method against ASR models, named DriNet. In this paper, the Authors elaborated a dynamic trigger generation network to craft a variety of audio triggers. The experimental results were carried out on two benchmark datasets. The Authors demonstrated that DriNet achieved an attack success rate of 86.4% when infecting only 0.5% of the training set without reducing its accuracy. The topic is interesting and the paper is well corresponding to the journal aim and scope.

The paper is well structured. In Introduction section, the Authors highlighted their contributions. The problem was formulated clearly. The Authors aim was to elaborate a novel dynamic backdoor attack paradigm in the audio domain. The part concerning the evaluation was prepared properly.

 However, there are shortcomings in this paper. The information about the structure of the paper is missing at the end of Introduction section. The article lacks a visualization of the developed approach – it helps better understanding the elaborated method. The limitations of proposed approach are omitted.

 Overall, the paper seems to be complete.

 Minor typos:

The font in table 1 is too big.

Figure 2. [Lower is better] Anomaly index of BadNet, DriNet and clean model. SC denotes the Speech

Commands dataset. The black line is the threshold used. – is the title is ok?

Author Response

We sincerely appreciate you taking the time out to review our manuscrip. Please check in the attachment for the response.

Reviewer 2 Report

The authors proposed a dynamic backdoor attack method against  ASR models, named DriNet. Significantly, we design a dynamic trigger generation network to craft a variety of audio triggers. 

I have the following comments for improvement: 

1.       The overall quality of this paper is Good

2.       The Originality of this paper is Good 

3.       The topic is interesting and relevant. 

4. The abstract is not coherent. It would be good if authors can write a sentence describing numerical results and improvements over other methods. The abstract needs to be improved and the main contribution of the paper should be stated clearly in the abstract section.

5. The results and discussion section has to be improved, where more details of the achieved results should be stated clearly in this section. In addition, the authors also have to provide some insightful discussion of the results.

6.  Pattern the motivation behind using this method to explain in the introduction. Why the existing schemes are not valid?

Good Luck

Author Response

We sincerely appreciate you taking the time out to review our manuscrip. Please check in the attachment for the response. 

Author Response File: Author Response.pdf