Abstract:In recent years, the electrocardiogram (ECG) has seen a large diffusion in both medical and commercial applications, fueled by the rise of single-lead versions. Single-lead ECG can be embedded in medical devices and wearable products such as the injectable Medtronic Linq monitor, the iRhythm Ziopatch wearable monitor, and the Apple Watch Series 4. Recently, deep neural networks have been used to automatically analyze ECG tracings, outperforming even physicians specialized in cardiac electrophysiology in detecting certain rhythm irregularities. However, deep learning classifiers have been shown to be brittle to adversarial examples, which are examples created to look incontrovertibly belonging to a certain class to a human eye but contain subtle features that fool the classifier into misclassifying them into the wrong class. Very recently, adversarial examples have also been created for medical-related tasks. Yet, traditional attack methods to create adversarial examples, such as projected gradient descent (PGD) do not extend directly to ECG signals, as they generate examples that introduce square wave artifacts that are not physiologically plausible. Here, we developed a method to construct smoothed adversarial examples for single-lead ECG. First, we implemented a neural network model achieving state-of-the-art performance on the data from the 2017 PhysioNet/Computing-in-Cardiology Challenge for arrhythmia detection from single lead ECG classification. For this model, we utilized a new technique to generate smoothed examples to produce signals that are 1) indistinguishable to cardiologists from the original examples and 2) incorrectly classified by the neural network. Finally, we show that adversarial examples are not unique and provide a general technique to collate and perturb known adversarial examples to create new ones.

Decorrelative Network Architecture for Robust Electrocardiogram Classification

ECG Authentication Method Based on Parallel Multi-Scale One-Dimensional Residual Network with Center and Margin Loss.

A regularization method to improve adversarial robustness of neural networks for ECG signal classification

Multi-label Classification of Abnormalities in 12-Lead ECG Using Deep Learning.

Improve robustness of DNN for ECG signal classification:a noise-to-signal ratio perspective

GeoECG: Data Augmentation via Wasserstein Geodesic Perturbation for Robust Electrocardiogram Prediction

Improving Adversarial Robustness of ECG Classification Based on Lipschitz Constraints and Channel Activation Suppression

ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System

Adversarial Examples for Electrocardiograms

Robust learning from corrupted EEG with dynamic spatial filtering

Interpatient ECG Heartbeat Classification with an Adversarial Convolutional Neural Network

CardioDefense: Defending Against Adversarial Attack in ECG Classification with Adversarial Distillation Training

Robustness of Deep Learning models in electrocardiogram noise detection and classification

A Neural Network for High-Precise and Well-Interpretable Electrocardiogram Classification

Enhance CNN Robustness Against Noises for Classification of 12-Lead ECG with Variable Length

Robustness of convolutional neural networks to physiological ECG noise

Application of deep neural network with stacked denoising autoencoder for ECG signal classification

Limited but consistent gains in adversarial robustness by co-training object recognition models with human EEG

ECG-ATK-GAN: Robustness against Adversarial Attacks on ECGs using Conditional Generative Adversarial Networks

Compact Neural Network Algorithm for Electrocardiogram Classification

ECG-ATK-GAN: Robustness against Adversarial Attacks on ECG using Conditional Generative Adversarial Networks