Electrocardiogram (ECG) is the most widely used diagnostic tool to monitor the condition of the cardiovascular system. Deep neural networks (DNNs), have been developed in many research labs for automatic interpretation of ECG signals to identify potential abnormalities in patient hearts. Studies have shown that given a sufficiently large amount of data, the classification accuracy of DNNs could reach human-expert cardiologist level. A DNN-based automated ECG diagnostic system would be an affordable solution for patients in developing countries where human-expert cardiologist are lacking. However, despite of the excellent performance in classification accuracy, it has been shown that DNNs are highly vulnerable to adversarial attacks: subtle changes in input of a DNN can lead to a wrong classification output with high confidence. Thus, it is challenging and essential to improve adversarial robustness of DNNs for ECG signal classification, a life-critical application. In this work, we proposed to improve DNN robustness from the perspective of noise-to-signal ratio (NSR) and developed two methods to minimize NSR during training process. We evaluated the proposed methods on PhysionNets MIT-BIH dataset, and the results show that our proposed methods lead to an enhancement in robustness against PGD adversarial attack and SPSA attack, with a minimal change in accuracy on clean data.
Electrocardiogram (ECG) is the most widely used diagnostic tool to monitor the condition of the human heart. By using deep neural networks (DNNs), interpretation of ECG signals can be fully automated for the identification of potential abnormalities in a patient's heart in a fraction of a second. Studies have shown that given a sufficiently large amount of training data, DNN accuracy for ECG classification could reach human-expert cardiologist level. However, despite of the excellent performance in classification accuracy, DNNs are highly vulnerable to adversarial noises that are subtle change…
ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
The Hong Kong University of Science and Technology（香港科技大学）；Southern University of Science and Technology, Peng Cheng Laboratory（南方科技大学鹏城实验室）；Huazhong University of Science and Technology（华中科技大学）
Tsinghua University（清华大学）；HeartVoice Medical Technology（心之声医疗科技）；University of Science and Technology of China（中国科学技术大学）；HeartRhythm Medical（心律医疗）；Tianjin Institute of Cardiology（天津心脏病学研究所）；Second Hospital of Tianjin Medical University（天津医科大学第二医院）；Peking University（北京大学）
In clinics, doctors rely on electrocardiograms (ECGs) to assess severe cardiac disorders. Owing to the development of technology and the increase in health awareness, ECG signals are currently obtained by using medical and commercial devices. Deep neural networks (DNNs) can be used to analyze these signals because of their high accuracy rate. However, researchers have found that adversarial attacks can significantly reduce the accuracy of DNNs. Studies have been conducted to defend ECG-based DNNs against traditional adversarial attacks, such as projected gradient descent (PGD), and smooth adve…
Electrocardiogram (ECG) is the most widely used diagnostic tool to monitor the condition of the cardiovascular system. Deep neural networks (DNNs), have been developed in many research labs for automatic interpretation of ECG signals to identify potential abnormalities in patient hearts. Studies have shown that given a sufficiently large amount of data, the classification accuracy of DNNs could reach human-expert cardiologist level. However, despite of the excellent performance in classification accuracy, it has been shown that DNNs are highly vulnerable to adversarial noises which are subtle …
Korea Advanced Institute of Science and Technology (KAIST)（韩国科学技术院）
The booming interest in adversarial attacks stems from a misalignment between human vision and a deep neural network (DNN), i.e. a human imperceptible perturbation fools the DNN. Moreover, a single perturbation, often called universal adversarial perturbation (UAP), can be generated to fool the DNN for most images. A similar misalignment phenomenon has recently also been observed in the deep steganography task, where a decoder network can retrieve a secret image back from a slightly perturbed cover image. We attempt explaining the success of both in a unified manner from the Fourier perspectiv…
Korea Advanced Institute of Science Technology (KAIST)（韩国科学技术院）
Batch normalization (BN) has been widely used in modern deep neural networks (DNNs) due to improved convergence. BN is observed to increase the model accuracy while at the cost of adversarial robustness. There is an increasing interest in the ML community to understand the impact of BN on DNNs, especially related to the model robustness. This work attempts to understand the impact of BN on DNNs from a non-robust feature perspective. Straightforwardly, the improved accuracy can be attributed to the better utilization of useful features. It remains unclear whether BN mainly favors learning robus…
Electrocardiogram (ECG) is the most crucial monitoring modality to diagnose cardiovascular events. Precise and automatic detection of abnormal ECG patterns is beneficial to both physicians and patients. In the automatic detection of abnormal ECG patterns, deep neural networks (DNNs) have shown significant achievements. However, DNNs require large amount of labeled data, which are often expensive to obtain. On the other hand, recent research have shown by randomly combining data augmentations can improve image classification accuracy. Thus, in this work we explore data augmentation suitable for…
The adversarial vulnerability of deep neural networks (DNNs) has been actively investigated in the past several years. This paper investigates the scale-variant property of cross-entropy loss, which is the most commonly used loss function in classification tasks, and its impact on the effective margin and adversarial robustness of deep neural networks. Since the loss function is not invariant to logit scaling, increasing the effective weight norm will make the loss approach zero and its gradient vanish while the effective margin is not adequately maximized. On typical DNNs, we demonstrate that…
The Chinese University of Hong Kong（香港中文大学）；University of Minnesota（明尼苏达大学）
In explainable artificial intelligence, discriminative feature localization is critical to reveal a blackbox model's decision-making process from raw data to prediction. In this article, we use two real datasets, the MNIST handwritten digits and MIT-BIH Electrocardiogram (ECG) signals, to motivate key characteristics of discriminative features, namely adaptiveness, predictive importance and effectiveness. Then, we develop a localization framework based on adversarial attacks to effectively localize discriminative features. In contrast to existing heuristic methods, we also provide a statistica…
Universidade Federal de Minas Gerais（米纳斯吉拉斯联邦大学）；Uppsala University（乌普萨拉大学）；Hospital das Clínicas da Universidade Federal de Minas Gerais（米纳斯吉拉斯联邦大学临床医院）；Glasgow University（格拉斯哥大学）
The role of automatic electrocardiogram (ECG) analysis in clinical practice is limited by the accuracy of existing models. Deep Neural Networks (DNNs) are models composed of stacked transformations that learn tasks by examples. This technology has recently achieved striking success in a variety of task and there are great expectations on how it might improve clinical practice. Here we present a DNN model trained in a dataset with more than 2 million labeled exams analyzed by the Telehealth Network of Minas Gerais and collected under the scope of the CODE (Clinical Outcomes in Digital Electroca…
Zhejiang University（浙江大学）；Alibaba Group（阿里巴巴集团）；University of Science and Technology of China（中国科学技术大学）；Hangzhou Dianzi University（杭州电子科技大学）；University of Chinese Academy of Sciences（中国科学院大学）；Chinese Academy of Sciences（中国科学院）
Transferable adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity. adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An ad…
Shanghai Jiao Tong University（上海交通大学）；Carnegie Mellon University（卡内基梅隆大学）；University of California San Diego（加州大学圣地亚哥分校）
This paper aims to theoretically analyze the complexity of feature transformations encoded in piecewise linear DNNs with ReLU layers. We propose metrics to measure three types of complexities of transformations based on the information theory. We further discover and prove the strong correlation between the complexity and the disentanglement of transformations. Based on the proposed metrics, we analyze two typical phenomena of the change of the transformation complexity during the training process, and explore the ceiling of a DNN's complexity. The proposed metrics can also be used as a loss t…
Alibaba Group（阿里巴巴集团）；Swinburne University of Technology（斯威本科技大学）；University of California, Berkeley（加州大学伯克利分校）
Human can easily recognize visual objects with lost information: even losing most details with only contour reserved, e.g. cartoon. However, in terms of visual perception of Deep Neural Networks (DNNs), the ability for recognizing abstract objects (visual objects with lost information) is still a challenge. In this work, we investigate this issue from an adversarial viewpoint: will the performance of DNNs decrease even for the images only losing a little information? Towards this end, we propose a novel adversarial attack, named \textit{AdvDrop}, which crafts adversarial examples by dropping e…
Adversarial examples are inevitable on the road of pervasive applications of deep neural networks (DNN). Imperceptible perturbations applied on natural samples can lead DNN-based classifiers to output wrong prediction with fair confidence score. It is increasingly important to obtain models with high robustness that are resistant to adversarial examples. In this paper, we survey recent advances in how to understand such intriguing property, i.e. adversarial robustness, from different perspectives. We give preliminary definitions on what adversarial attacks and robustness are. After that, we st…
In this paper, we diagnose deep neural networks for 3D point cloud processing to explore utilities of different intermediate-layer network architectures. We propose a number of hypotheses on the effects of specific intermediate-layer network architectures on the representation capacity of DNNs. In order to prove the hypotheses, we design five metrics to diagnose various types of DNNs from the following perspectives, information discarding, information concentration, rotation robustness, adversarial robustness, and neighborhood inconsistency. We conduct comparative studies based on such metrics…
China Academy of Electronics and Information Technology（中国电子科技集团公司电子科学研究院）
The traditional method of diagnosing heart disease on ECG signal is artificial observation. Some have tried to combine expertise and signal processing to classify ECG signal by heart disease type. However, the currency is not so sufficient that it can be used in medical applications. We develop an algorithm that combines signal processing and deep learning to classify ECG signals into Normal AF other rhythm and noise, which help us solve this problem. It is demonstrated that we can obtain the time-frequency diagram of ECG signal by wavelet transform, and use DNN to classify the time-frequency …
School of Computing and Information Systems, The University of Melbourne（墨尔本大学计算与信息系统学院）；Key Lab. of Machine Perception, School of Artificial Intelligence, Peking University（北京大学人工智能学院机器感知重点实验室）；Institute for Artificial Intelligence, Peking University（北京大学人工智能研究院）；University of California, Los Angeles（加州大学洛杉矶分校）；School of Computer Science, Fudan University（复旦大学计算机科学学院）
Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks. A range of defense methods have been proposed to train adversarially robust DNNs, among which adversarial training has demonstrated promising results. However, despite preliminary understandings developed for adversarial training, it is still not clear, from the architectural perspective, what configurations can lead to more robust DNNs. In this paper, we address this gap via a comprehensive investigation on the impact of network width and depth on the robustness of adversarially trained DNNs. Specifically, we make …
Institute of Software, CAS（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Nanjing Institute of Software Technology, ISCAS（中国科学院软件研究所南京软件技术研究院）；Pazhou Lab（琶洲实验室）；Queen’s University Belfast（贝尔法斯特女王大学）
To analyse local robustness properties of deep neural networks (DNNs), we present a practical framework from a model learning perspective. Based on black-box model learning with scenario optimisation, we abstract the local behaviour of a DNN via an affine model with the probably approximately correct (PAC) guarantee. From the learned model, we can infer the corresponding PAC-model robustness property. The innovation of our work is the integration of model learning into PAC robustness analysis: that is, we construct a PAC guarantee on the model level instead of sample distribution, which induce…
ISCAS（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；École normale supérieure de Rennes（雷恩高等师范学校）；Inria（法国国家信息与自动化研究所）；CNRS（法国国家科学研究中心）；IRISA（法国信息与随机系统研究所）；East China Normal University（华东师范大学）；Nanjing Institute of Software Technology, ISCAS（中国科学院软件研究所南京软件技术研究院）；Guangdong Artificial Intelligence and Digital Economy Laboratory（广东人工智能与数字经济实验室）
In this paper, we propose a framework of filter-based ensemble of deep neuralnetworks (DNNs) to defend against adversarial attacks. The framework builds an ensemble of sub-models -- DNNs with differentiated preprocessing filters. From the theoretical perspective of DNN robustness, we argue that under the assumption of high quality of the filters, the weaker the correlations of the sensitivity of the filters are, the more robust the ensemble model tends to be, and this is corroborated by the experiments of transfer-based attacks. Correspondingly, we propose a principle that chooses the specific…
Georgia Institute of Technology（佐治亚理工学院）；Peking University（北京大学）；IQVIA（艾昆纬）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
Background:The electrocardiogram (ECG) is one of the most commonly used diagnostic tools in medicine and healthcare. Deep learning methods have achieved promising results on predictive healthcare tasks using ECG signals. Objective:This paper presents a systematic review of deep learning methods for ECG data from both modeling and application perspectives. Methods:We extracted papers that applied deep learning (deep neural network) models to ECG data that were published between Jan. 1st of 2010 and Feb. 29th of 2020 from Google Scholar, PubMed, and the DBLP. We then analyzed each article accord…
Wuhan University（武汉大学）；Pennsylvania State University（宾夕法尼亚州立大学）
Deep neural networks (DNNs) are under threat from adversarial example attacks. The adversary can easily change the outputs of DNNs by adding small well-designed perturbations to inputs. Adversarial example detection is a fundamental work for robust DNNs-based service. Adversarial examples show the difference between humans and DNNs in image recognition. From a human-centric perspective, image features could be divided into dominant features that are comprehensible to humans, and recessive features that are incomprehensible to humans, yet are exploited by DNNs. In this paper, we reveal that imp…
International Institute of Information Technology（国际信息技术研究所）
Early detection of cardiovascular diseases is crucial for effective treatment and an electrocardiogram (ECG) is pivotal for diagnosis. The accuracy of Deep Learning based methods for ECG signal classification has progressed in recent years to reach cardiologist-level performance. In clinical settings, a cardiologist makes a diagnosis based on the standard 12-channel ECG recording. Automatic analysis of ECG recordings from a multiple-channel perspective has not been given enough attention, so it is essential to analyze an ECG recording from a multiple-channel perspective. We propose a model tha…
Australian Artificial Intelligence Institute (AAII)（澳大利亚人工智能研究所）；University of Technology Sydney（悉尼科技大学）；Data61, CSIRO（联邦科学与工业研究组织Data61）；The University of Sydney（悉尼大学）
Deep Neural Networks (DNNs) have recently achieved great success in many classification tasks. Unfortunately, they are vulnerable to adversarial attacks that generate adversarial examples with a small perturbation to fool DNN models, especially in model sharing scenarios. Adversarial training is proved to be the most effective strategy that injects adversarial examples into model training to improve the robustness of DNN models against adversarial attacks. However, adversarial training based on the existing adversarial examples fails to generalize well to standard, unperturbed test data. To ac…
School of Information Science and Technology, University of Science and Technology of China（中国科学技术大学信息科学技术学院）；Department of Electrocardiogram, The First Affiliated Hospital of University of Science and Technology of China (Anhui Provincial Hospital)（中国科学技术大学附属第一医院（安徽省立医院）心电图科）
Automatic arrhythmia detection using 12-lead electrocardiogram (ECG) signal plays a critical role in early prevention and diagnosis of cardiovascular diseases. In the previous studies on automatic arrhythmia detection, most methods concatenated 12 leads of ECG into a matrix, and then input the matrix to a variety of feature extractors or deep neural networks for extracting useful information. Under such frameworks, these methods had the ability to extract comprehensive features (known as integrity) of 12-lead ECG since the information of each lead interacts with each other during training. How…
Ingenuity Labs Research Institute（Ingenuity Labs 研究院）
Electrocardiogram (ECG) is the electrical measurement of cardiac activity, whereas Photoplethysmogram (PPG) is the optical measurement of volumetric changes in blood circulation. While both signals are used for heart rate monitoring, from a medical perspective, ECG is more useful as it carries additional cardiac information. Despite many attempts toward incorporating ECG sensing in smartwatches or similar wearable devices for continuous and reliable cardiac monitoring, PPG sensors are the main feasible sensing solution available. In order to tackle this problem, we propose CardioGAN, an advers…
Efficient removal of impulsive noise (IN) from received signal is essential in many communication applications. In this paper, we propose a two stage IN mitigation approach for orthogonal frequency-division multiplexing (OFDM)-based communication systems. In the first stage, a deep neural network (DNN) is used to detect the instances of impulsivity. Then, the detected IN is blanked in the suppression stage to alleviate the harmful effects of outliers. Simulation results demonstrate the superior bit error rate (BER) performance of this approach relative to classic approaches such as blanking an…
Shanghai Jiao Tong University（上海交通大学）；The Hong Kong University of Science and Technology（香港科技大学）
Powered by machine learning services in the cloud, numerous learning-driven mobile applications are gaining popularity in the market. As deep learning tasks are mostly computation-intensive, it has become a trend to process raw data on devices and send the deep neural network (DNN) features to the cloud, where the features are further processed to return final results. However, there is always unexpected leakage with the release of features, with which an adversary could infer a significant amount of information about the original data. We propose a privacy-preserving reinforcement learning fr…
Healthcare Technology and Innovation Center (HTIC)（医疗技术与创新中心）；Indian Institute of Technology (IITM)（印度理工学院）；Department of Electrical Engineering, Indian Institute of Technology, Madras (IITM)（印度理工学院马德拉斯分校电气工程系）
The exponential rise in wearable sensors has garnered significant interest in assessing the physiological parameters during day-to-day activities. Respiration rate is one of the vital parameters used in the performance assessment of lifestyle activities. However, obtrusive setup for measurement, motion artifacts, and other noises complicate the process. This paper presents a multitasking architecture based on Deep Learning (DL) for estimating instantaneous and average respiration rate from ECG and accelerometer signals, such that it performs efficiently under daily living activities like cycli…
University of Minnesota（明尼苏达大学）；Shenzhen Research Institute of Big Data（深圳大数据研究院）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Oregon State University（俄勒冈州立大学）
There has been a growing interest in developing data-driven, and in particular deep neural network (DNN) based methods for modern communication tasks. For a few popular tasks such as power control, beamforming, and MIMO detection, these methods achieve state-of-the-art performance while requiring less computational efforts, less resources for acquiring channel state information (CSI), etc. However, it is often challenging for these approaches to learn in a dynamic environment. This work develops a new approach that enables data-driven methods to continuously learn and optimize resource allocat…
