  Outsourced training and machine learning as a service have resulted in novel
attack vectors like backdoor attacks. Such attacks embed a secret functionality
in a neural network activated when the trigger is added to its input. In most
works in the literature, the trigger is static, both in terms of location and
pattern. The effectiveness of various detection mechanisms depends on this
property. It was recently shown that countermeasures in image classification,
like Neural Cleanse and ABS, could be bypassed with dynamic triggers that are
effective regardless of their pattern and location. Still, such backdoors are
demanding as they require a large percentage of poisoned training data. In this
work, we are the first to show that dynamic backdoor attacks could happen due
to a global average pooling layer without increasing the percentage of the
poisoned training data. Nevertheless, our experiments in sound classification,
text sentiment analysis, and image classification show this to be very
difficult in practice.
