A Lightweight Frequency-Domain Defense Framework for Adversarially Robust Wearable ECG Classification
DOI:
https://doi.org/10.66238/fsrma117Keywords:
Adversarial machine learning, frequency-domain transformation, wearable ECG monitoring, robust neural networks, physiological signal analysis, edge AI, cyber-secure healthcare, signal perturbation defenseAbstract
With the development of different kinds of wearable devices, more and more people are using these systems monitoring their body signals. In addition, deep neural networks show strong performance when it comes to single-lead ECG rhythm classification. However, those machine learning classifiers can be easily affected by small deliberately designed adversarial perturbations to original input data. Hence, this essay proposes a lightweight frequency-domain defense framework for protecting a single-lead ECG classifier against adversarial perturbations using the MIT-BIH Arrhythmia Database. The experiment in this essay uses both patient-level train/test separation and continuous multi-beat ECG windows, so the evaluation is closer to a real-world clinical setting where new patients are unseen during training.
This framework uses FGSM and PGD to attack an unprotected baseline model trained by time-series based 1D CNN (one-dimensional convolutional neural network) and a proposed frequency-domain trained 1D CNN defense model. In particular, the baseline receives normalized fixed length temporal windows, while the defense receives normalized FFT (Fast Fourier Transform) transformed frequency sequences. Also, both models are evaluated with the introduced adversarial attacks. Thus, across five random patient-level splits and 11 perturbation strengths, the result shows that the defense model achieved higher mean attacked macro F1 for all three attack families: 0.676 versus 0.419 for FGSM, 0.483 versus 0.248 for PGD, and 0.482 versus 0.248 for the combined attack. All in all, the main contribution in this essay is a lightweight framework that changes the classifier input from a temporal window to FFT-magnitude features and trains this frequency-domain model with clean, FGSM, and short-PGD samples.
The code can be accessed at GitHub (https://github.com/ArcaneEmerald/ecg-defense-framework).
References
[1] K. Bayoumy et al., “Smart wearable devices in cardiovascular care: where we are and how to move forward,” Nat. Rev. Cardiol., vol. 18, no. 8, pp. 581–599, Aug. 2021, doi: 10.1038/s41569-021-00522-7.
[2] M. V. Perez et al., “Large-Scale Assessment of a Smartwatch to Identify Atrial Fibrillation,” N. Engl. J. Med., vol. 381, no. 20, pp. 1909–1917, Nov. 2019, doi: 10.1056/NEJMoa1901183.
[3] S. A. Lubitz et al., “Detection of Atrial Fibrillation in a Large Population Using Wearable Devices: The Fitbit Heart Study,” Circulation, vol. 146, no. 19, pp. 1415–1424, Nov. 2022, doi: 10.1161/CIRCULATIONAHA.122.060291.
[4] D. Liaqat, R. Wu, S. Liaqat, E. de Lara, A. Gershon, and F. Rudzicz, “The Ground Truth Trade-Off in Wearable Sensing Studies,” Jan. 07, 2020, arXiv: arXiv:2001.09738. doi: 10.48550/arXiv.2001.09738.
[5] J. M. Bumgarner et al., “Smartwatch Algorithm for Automated Detection of Atrial Fibrillation,” J. Am. Coll. Cardiol., vol. 71, no. 21, pp. 2381–2388, May 2018, doi: 10.1016/j.jacc.2018.03.003.
[6] P. Rajpurkar, A. Y. Hannun, M. Haghpanahi, C. Bourn, and A. Y. Ng, “Cardiologist-Level Arrhythmia Detection with Convolutional Neural Networks,” Jul. 06, 2017, arXiv: arXiv:1707.01836. doi: 10.48550/arXiv.1707.01836.
[7] S. Movassaghi, M. Abolhasan, J. Lipman, D. Smith, and A. Jamalipour, “Wireless Body Area Networks: A Survey,” IEEE Commun. Surv. Tutor., vol. 16, no. 3, pp. 1658–1686, 2014, doi: 10.1109/SURV.2013.121313.00064.
[8] F. Alsubaei, A. Abuhussein, and S. Shiva, “Security and Privacy in the Internet of Medical Things: Taxonomy and Risk Assessment,” in 2017 IEEE 42nd Conference on Local Computer Networks Workshops (LCN Workshops), Oct. 2017, pp. 112–120. doi: 10.1109/LCN.Workshops.2017.72.
[9] C. Szegedy et al., “Intriguing properties of neural networks,” Feb. 19, 2014, arXiv: arXiv:1312.6199. doi: 10.48550/arXiv.1312.6199.
[10] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” Mar. 20, 2015, arXiv: arXiv:1412.6572. doi: 10.48550/arXiv.1412.6572.
[11] S. G. Finlayson, J. D. Bowers, J. Ito, J. L. Zittrain, A. L. Beam, and I. S. Kohane, “Adversarial attacks on medical machine learning,” Science, vol. 363, no. 6433, pp. 1287–1289, Mar. 2019, doi: 10.1126/science.aaw4399.
[12] X. Han, Y. Hu, L. Foschini, L. Chinitz, L. Jankelson, and R. Ranganath, “Adversarial Examples for Electrocardiograms,” Jun. 04, 2019, arXiv: arXiv:1905.05163. doi: 10.48550/arXiv.1905.05163.
[13] T. Ono, T. Sugawara, J. Sakuma, and T. Mori, “Application of Adversarial Examples to Physical ECG Signals,” Aug. 20, 2021, arXiv: arXiv:2108.08972. doi: 10.48550/arXiv.2108.08972.
[14] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” presented at the International Conference on Learning Representations, Feb. 2018. Accessed: Jun. 26, 2026. [Online]. Available: https://openreview.net/forum?id=rJzIBfZAb
[15] N. Carlini and D. Wagner, “Towards Evaluating the Robustness of Neural Networks,” in 2017 IEEE Symposium on Security and Privacy (SP), May 2017, pp. 39–57. doi: 10.1109/SP.2017.49.
[16] A. G. Howard et al., “MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications,” Apr. 17, 2017, arXiv: arXiv:1704.04861. doi: 10.48550/arXiv.1704.04861.
[17] F. N. Iandola, S. Han, M. W. Moskewicz, K. Ashraf, W. J. Dally, and K. Keutzer, “SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size,” Nov. 04, 2016, arXiv: arXiv:1602.07360. doi: 10.48550/arXiv.1602.07360.
[18] J. W. Cooley and J. W. Tukey, “An algorithm for the machine calculation of complex Fourier series,” Math. Comput., vol. 19, no. 90, pp. 297–301, 1965, doi: 10.1090/S0025-5718-1965-0178586-1.
[19] S. Kiranyaz, O. Avci, O. Abdeljaber, T. Ince, M. Gabbouj, and D. J. Inman, “1D convolutional neural networks and applications: A survey,” Mech. Syst. Signal Process., vol. 151, p. 107398, Apr. 2021, doi: 10.1016/j.ymssp.2020.107398.
[20] A. Y. Hannun et al., “Cardiologist-level arrhythmia detection and classification in ambulatory electrocardiograms using a deep neural network,” Nat. Med., vol. 25, no. 1, pp. 65–69, Jan. 2019, doi: 10.1038/s41591-018-0268-3.
[21] U. R. Acharya et al., “A deep convolutional neural network model to classify heartbeats,” Comput. Biol. Med., vol. 89, pp. 389–396, Oct. 2017, doi: 10.1016/j.compbiomed.2017.08.022.
[22] M. Kachuee, S. Fazeli, and M. Sarrafzadeh, “ECG Heartbeat Classification: A Deep Transferable Representation,” in 2018 IEEE International Conference on Healthcare Informatics (ICHI), Jun. 2018, pp. 443–444. doi: 10.1109/ICHI.2018.00092.
[23] A. H. Ribeiro et al., “Automatic diagnosis of the 12-lead ECG using a deep neural network,” Nat. Commun., vol. 11, no. 1, p. 1760, Apr. 2020, doi: 10.1038/s41467-020-15432-4.
[24] J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified Adversarial Robustness via Randomized Smoothing,” in Proceedings of the 36th International Conference on Machine Learning, PMLR, May 2019, pp. 1310–1320. Accessed: Jun. 28, 2026. [Online]. Available: https://proceedings.mlr.press/v97/cohen19c.html
[25] F. P. Romero, D. C. Piñol, and C. R. V. Seisdedos, “DeepFilter: an ECG baseline wander removal filter using deep learning techniques,” Jan. 12, 2021, arXiv: arXiv:2101.03423. doi: 10.48550/arXiv.2101.03423.
[26] S. Sarafan et al., “A Novel ECG Denoising Scheme Using the Ensemble Kalman Filter,” Jul. 24, 2022, arXiv: arXiv:2207.11819. doi: 10.48550/arXiv.2207.11819.
[27] G. B. Moody and R. G. Mark, “The impact of the MIT-BIH Arrhythmia Database,” IEEE Eng. Med. Biol. Mag., vol. 20, no. 3, pp. 45–50, May 2001, doi: 10.1109/51.932724.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Kehang Lai
This work is licensed under a Creative Commons Attribution 4.0 International License.
License Terms (Recommended – CC BY 4.0)
All articles published in Fundamental Scientific Reports in Multidisciplinary Areas are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
This license permits unrestricted use, distribution, and reproduction in any medium, provided the original author(s) and source are properly cited. Users are allowed to copy, redistribute, remix, transform, and build upon the material for any purpose, including commercial use, as long as appropriate credit is given.
Authors retain copyright of their work while granting the journal the right of first publication. The journal provides immediate open access to its content on the principle that making research freely available supports a greater global exchange of knowledge.
For more information about this license, visit:
https://creativecommons.org/licenses/by/4.0/
