ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System

Chen, Huangxun; Huang, Chenyu; Huang, Qianyi; Zhang, Qian; Wang, Wei

doi:10.1609/aaai.v34i04.5748

Cited by 17 publications

(26 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We conduct our study using the PhysioNet Computing in Cardiology Challenge 2017 which contains single-lead ECG signals of various classifications. Unlike prior works [9,18] which functioned under white-box conditions, our attack performs under the black-box and hard-label setting. We demonstrate that our algorithm can still produce imperceptible data sets that effectively fool a modern ECG classifier at a rate on par with the white-box attack.…”

Section: Details Of the Studymentioning

confidence: 99%

“…[6,8,16,32]. This phenomenon is also encountered in time-series data, with prominent examples including speech signals [3,25] and ECG data [9,17,18]. Such adversarial attacks pose a serious threat to medical deep-learning systems, ultimately hindering the deployment of DNNs for such applications.…”

Section: Introductionmentioning

confidence: 99%

“…Despite the looming concern of such consequential effects from the use of recently developed ECG diagnostic systems, these timedomain based attacks have seldom been explored relative to the image and speech domains. Previous works have only shown that ECG classifiers can be fooled by adding imperceptible perturbations [9,18] in the white-box setting, where attacks receive far more assistance and information with regards to the given architecture and parameters of the DNNs. In this paper, we focus on attacking ECG classifiers in a more realistic hard-label and black-box setting where the attacker only has access to the final top-1 category of the deep-learning model especially.…”

Section: Introductionmentioning

confidence: 99%

“…Hence, in the white-box setting, since the attackers have access to all information regarding the model, the above problem is differentiable and can be solved via gradient descent. [9,18] have shown that deep-learning based ECG classifiers can be fooled by imperceptible perturbation added to benign ECG signals. They typically make use of the gradient-based white-box attack and further apply the Gaussian low-pass filters to smooth the injected noise for better imperceptibility by humans.…”

Section: Introductionmentioning

confidence: 99%

“…They typically make use of the gradient-based white-box attack and further apply the Gaussian low-pass filters to smooth the injected noise for better imperceptibility by humans. [9] proposes to use the local variance to generate the imperceivable perturbations for ECG signals. Given = x − x and (•) referring to variance calculation, the similarity metric called smoothness is defined as follows:…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Hard-Label Black-Box Adversarial Attack on Deep Electrocardiogram Classifier

Lam

Quan

et al. 2020

Proceedings of the 1st ACM International Workshop on Security and Safety for Intelligent Cyber-Physical Systems

View full text Add to dashboard Cite

Through aiding the process of diagnosing cardiovascular diseases (CVD) such as arrhythmia, electrocardiograms (ECGs) have progressively improved prospects for an automated diagnosis system in modern healthcare. Recent years have seen the promising applications of deep neural networks (DNNs) in analyzing ECG data, even outperforming cardiovascular experts in identifying certain rhythm irregularities. However, DNNs have shown to be susceptible to adversarial attacks, which intentionally compromise the models by adding perturbations to the inputs. This concept is also applicable to DNN-based ECG classifiers and the prior works generate these adversarial attacks in a white-box setting where the model details are exposed to the attackers. However, the black-box condition, where the classification model's architecture and parameters are unknown to the attackers, remains mostly unexplored. Thus, we aim to fool ECG classifiers in the black-box and hard-label setting where given an input, only the final predicted category is visible to the attacker. Our attack on the DNN classification model for the PhysioNet Computing in Cardiology Challenge 2017 [12] database produced ECG data sets mostly indistinguishable from the whitebox version of an adversarial attack on this same database. Our results demonstrate that we can effectively generate the adversarial ECG inputs in this black-box setting, which raises significant concerns regarding the potential applications of DNN-based ECG classifiers in security-critical systems.

show abstract

Section: Details Of the Studymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Hard-Label Black-Box Adversarial Attack on Deep Electrocardiogram Classifier

Lam

Quan

et al. 2020

Proceedings of the 1st ACM International Workshop on Security and Safety for Intelligent Cyber-Physical Systems

View full text Add to dashboard Cite

show abstract

Explainable deep learning in healthcare: A methodological survey from an attribution view

Jin

Sergeeva

Weng

et al. 2022

WIREs Mechanisms of Disease

View full text Add to dashboard Cite

The increasing availability of large collections of electronic health record (EHR) data and unprecedented technical advances in deep learning (DL) have sparked a surge of research interest in developing DL based clinical decision support systems for diagnosis, prognosis, and treatment. Despite the recognition of the value of deep learning in healthcare, impediments to further adoption in real healthcare settings remain due to the black-box nature of DL. Therefore, there is an emerging need for interpretable DL, which allows end users to evaluate the model decision making to know whether to accept or reject predictions and recommendations before an action is taken. In this review, we focus on the interpretability of the DL models in healthcare. We start by introducing the methods for interpretability in depth and comprehensively as a methodological reference for future researchers or clinical practitioners in this field. Besides the methods' details, we also include a discussion of advantages and disadvantages of these methods and which scenarios each of them is suitable for, so that interested readers can know how to compare and choose among them for use. Moreover, we discuss how these methods, originally developed for solving general-domain problems, have been adapted and applied to healthcare problems and how they can help physicians better understand these data-driven technologies. Overall, we hope this survey can help researchers and practitioners in both artificial intelligence and clinical fields understand what methods we have for enhancing the interpretability of their DL models and choose the optimal one accordingly.

show abstract