Electrocardiogram (ECG) has been investigated as promising biometrics, but it cannot be canceled and re-used once compromised just like other biometrics. We propose methods to overcome the issue of irrevocability in ECG biometrics without compromising performance. Our proposed cancelable user authentication uses a generalized likelihood ratio test (GLRT) based on a composite hypothesis testing in compressive sensing (CS) domain. We also propose a permutation-based revocation method for CS-based cancelable biometrics so that it becomes resilient to record multiplicity attack. In addition, to compensate for inevitable performance degradation due to cancelable schemes, we also propose two performance improvement methods without undermining cancelable schemes: a self-guided ECG filtering and a T-wave shift model in our CS-GLRT. Finally, our proposed methods were evaluated for various cancelable biometrics criteria with the public ECG-ID data (89 subjects). Our cancelable ECG biometric methods yielded up to 93.0% detection probability at 2.0% false alarm ratio (PD*) and 3.8% equal error rate (EER), which are comparable to or even better than non-cancelable baseline with 93.2% PD* and 4.8% EER for challenging single-pulse ECG authentication, respectively. Our proposed methods met all cancelable biometrics criteria theoretically or empirically. Our cancelable secure user template with our novel revocation process is practically non-invertible and robust to record multiplicity attack. INDEX TERMS Cancelable biometrics, ECG biometrics, generalized likelihood ratio test, compressive sensing, single pulse ECG.