Hard-Label Black-Box Adversarial Attack on Deep Electrocardiogram Classifier

Abstract

Through aiding the process of diagnosing cardiovascular diseases (CVD) such as arrhythmia, electrocardiograms (ECGs) have progressively improved prospects for an automated diagnosis system in modern healthcare. Recent years have seen the promising applications of deep neural networks (DNNs) in analyzing ECG data, even outperforming cardiovascular experts in identifying certain rhythm irregularities. However, DNNs have shown to be susceptible to adversarial attacks, which intentionally compromise the models by adding perturbations to the inputs. This concept is also applicable to DNN-based ECG classifiers and the prior works generate these adversarial attacks in a white-box setting where the model details are exposed to the attackers. However, the black-box condition, where the classification model's architecture and parameters are unknown to the attackers, remains mostly unexplored. Thus, we aim to fool ECG classifiers in the black-box and hard-label setting where given an input, only the final predicted category is visible to the attacker. Our attack on the DNN classification model for the PhysioNet Computing in Cardiology Challenge 2017 [12] database produced ECG data sets mostly indistinguishable from the whitebox version of an adversarial attack on this same database. Our results demonstrate that we can effectively generate the adversarial ECG inputs in this black-box setting, which raises significant concerns regarding the potential applications of DNN-based ECG classifiers in security-critical systems.

Defending Against Adversarial Attack in ECG Classification With Adversarial Distillation Training

“…Detecting the perturbations becomes difficult because of the restriction of the objective function or convolution processing. Lam et al Lam et al [2020] proposed a black-box attack called boundary attack, which improves the smoothness of perturbations by using a low-pass Hanning filter. In Figure 1, we plot a part of an original ECG signal sample and its counterparts that are attacked by PGD and SAP.…”

“…In this study, we explored the defense against the white-box and black-box adversarial attacks which are aimed at ECG-based DNNs. Furthermore, SAP Han et al [2020] is applied to represent the white-box attack and boundary attack Lam et al [2020] is applied to represent the black-box attack. We defended ECG-based DNNs against SAP and boundary attack with common defense methods, such as adversarial trainingGoodfellow et al [2014], defensive distillationPapernot et al [2016], JRJakubovitz and Giryes [2018] and NSR regularizationMa and Liang [2020b], and found these methods performed well against SAP and boundary attack.…”