A regularization method to improve adversarial robustness of neural networks for ECG signal classification
Open accessAbstract
With the advancement of machine leaning technologies, Deep Neural Networks (DNNs) have been utilized for automated interpretation of Electrocardiogram (ECG) signals to identify potential abnormalities in a patient's heart within a second. Studies have shown that the accuracy of DNNs for ECG signal classification could reach human-expert cardiologist level if a sufficiently large training dataset is available. However, it is known that, in the field of computer vision, DNNs are not robust to adversarial noises that may cause DNNs to make wrong class-label predictions. In this work, we confirm that DNNs are not robust to adversarial noises in ECG signal classification applications, and we propose a novel regularization method to improve DNN robustness by minimizing the noise-to-signal ratio. Our method is evaluated on two public datasets: the MIT-BIH dataset and the CPSC2018 dataset, and the evaluation results show that our method can significantly enhance DNN robustness against adversarial noises generated by Projected Gradient Descent (PGD) and Smooth Adversarial Perturbation (SAP) adversarial attacks, with a minimal reduction of accuracy on clean data. Our method may serve as the baseline for designing new methods to defend against adversarial attacks for life-critical applications depending on ECG interpretation. The code of this work is publicly available at github.com/SarielMa/Robust_DNN_for_ECG.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Adversarial attacks are perturbations that maintain the visual structure of the data as close as possible to the original data, which is more suited for image and ECG than for tabular data.
“adversarial attacks being perturbations that maintain the “visual” structure (from a human perspective) of the data as close as possible to the original data, which is more suited for image and ECG than for tabular data, for instance28,29.”
From A scoping review of robustness concepts for machine learning in healthcare (2025) · cites this paper as [29]
Cites
LeCun, Y., Bengio, Y., & Hinton, G. (2015) · Nature · doi:10.1038/nature14539 · Cited by 84,126 · see citing works
Scikit-learn: Machine Learning in Python
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Müller, A., Nothman, J., Louppe, G., et al. (2012) · arXiv · doi:10.48550/arxiv.1201.0490 · Cited by 71,016 · see citing works
Proceedings of IEEE Conference on Computer Vision and Pattern Recognition
(1993) · doi:10.1109/cvpr.1993 · Cited by 17,989 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
(2011) · Cited by 6,993 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317 · see citing works
Proceedings European Conference on Computer Vision 2002
Heyden, A., Sparr, G., Nielsen, M., & Johansen, P. (2002) · Lund University Publications (Lund University) · Cited by 5,153 · see citing works
The impact of the MIT-BIH Arrhythmia Database
Moody, G. B., & Mark, R. G. (2001) · IEEE Engineering in Medicine and Biology Magazine · doi:10.1109/51.932724 · Cited by 4,834 · see citing works
Wu, Y., & He, K. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-01261-8_1 · Cited by 3,601 · see citing works
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
Advances in Neural Information Processing Systems 32 (NeurIPS 2019)
Wallach, H., Larochelle, H., Beygelzimer, A., d’Alché–Buc, F., Fox, E. B., & Garnett, R. (2020) · HAL · Cited by 2,450 · see citing works
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021 · see citing works
Real-Time Patient-Specific ECG Classification by 1-D Convolutional Neural Networks
Kıranyaz, S., İnce, T., & Gabbouj, M. (2015) · IEEE Transactions on Biomedical Engineering · doi:10.1109/tbme.2015.2468589 · Cited by 1,925 · see citing works
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560 · see citing works
A deep convolutional neural network model to classify heartbeats
Acharya, U. R., Oh, S. L., Hagiwara, Y., Tan, J. H., Adam, M., Gertych, A., & Tan, R. (2017) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2017.08.022 · Cited by 1,435 · see citing works
Benjamens, S., Dhunnoo, P., & Meskó, B. (2020) · npj Digital Medicine · doi:10.1038/s41746-020-00324-0 · Cited by 1,215 · see citing works
Adversarial Risk and the Dangers of Evaluating Against Weak AttacksPreprint
Uesato, J., O'Donoghue, B., van den Oord, A., & Kohli, P. (2018) · International Conference on Machine Learning · doi:10.48550/arxiv.1802.05666 · Cited by 713 · see citing works
Liu, F., Liu, C., Zhao, L., Zhang, X., Xiao-ling, W., Xu, X., Liu, Y., Ma, C., Wei, S., He, Z., et al. (2018) · Journal of Medical Imaging and Health Informatics · doi:10.1166/jmihi.2018.2442 · Cited by 623 · see citing works
Ross, A. S., & Doshi‐Velez, F. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11504 · Cited by 621 · see citing works
Cardiologist-Level Arrhythmia Detection with Convolutional Neural NetworksPreprint
Rajpurkar, P., Hannun, A., Haghpanahi, M., Bourn, C., & Ng, A. Y. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.01836 · Cited by 611 · see citing works
ECG Heartbeat Classification: A Deep Transferable Representation
Kachuee, M., Fazeli, S., & Sarrafzadeh, M. (2018) · IEEE International Conference on Healthcare Informatics (ICHI) · doi:10.1109/ichi.2018.00092 · Cited by 609 · see citing works
Conference on Neural Information Processing Systems
Liu, L., Zhou, T., Long, G., Jiang, J., & Zhang, C. (2019) · UTS ePRESS (University of Technology Sydney) · Cited by 593 · see citing works
Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., & Goldstein, T. (2019) · ETH Zurich · doi:10.3929/ethz-b-000460345 · Cited by 580 · see citing works
Hong, S., Zhou, Y., Shang, J., Xiao, C., & Sun, J. (2020) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2020.103801 · Cited by 488 · see citing works
On Adaptive Attacks to Adversarial Example Defenses
Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020) · arXiv · doi:10.48550/arxiv.2002.08347 · Cited by 486 · see citing works
Understanding Deep Neural Networks with Rectified Linear UnitsPreprint
Arora, R., Basu, A., Mianjy, P., & Mukherjee, A. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.01491 · Cited by 371 · see citing works
Making machine learning robust against adversarial inputs
Goodfellow, I., McDaniel, P., & Papernot, N. (2018) · Communications of the ACM · doi:10.1145/3134599 · Cited by 358 · see citing works
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection MethodsPreprint
Carlini, N., & Wagner, D. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1705.07263 · Cited by 323 · see citing works
Adversarial Attacks and Defences Competition
Kurakin, A., Goodfellow, I., Samy Bengio, A., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., Xie, C., et al. (2018) · The Springer series on challenges in machine learning · doi:10.1007/978-3-319-94042-7_11 · Cited by 321 · see citing works
Classification of ECG signals using machine learning techniques: A survey
Jambukia, S. H., Dabhi, V. K., & Prajapati, H. B. (2015) · International Conference on Advances in Computer Engineering and Applications · doi:10.1109/icacea.2015.7164783 · Cited by 251 · see citing works
Lyon, A., Mincholé, A., Martínez, J. P., Laguna, P., & Rodríguez, B. (2018) · Journal of The Royal Society Interface · doi:10.1098/rsif.2017.0821 · Cited by 228 · see citing works
Improving DNN Robustness to Adversarial Attacks Using Jacobian Regularization
Jakubovitz, D., & Giryes, R. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_32 · Cited by 205 · see citing works
MMA Training: Direct Input Space Margin Maximization through Adversarial TrainingPreprint
Ding, G. W., Sharma, Y., Lui, K. Y. C., & Huang, R. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.02637 · Cited by 162 · see citing works
Deep learning models for electrocardiograms are susceptible to adversarial attack
Han, X., Hu, Y., Foschini, L., Chinitz, L. A., Jankelson, L., & Ranganath, R. (2020) · Nature Medicine · doi:10.1038/s41591-020-0791-x · Cited by 144 · see citing works
Deep ReLU Networks Have Surprisingly Few Activation PatternsPreprint
Hanin, B., & Rolnick, D. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.00904 · Cited by 120 · see citing works
Increasing-Margin Adversarial (IMA) training to improve adversarial robustness of neural networks
Ma, L., & Liang, L. (2023) · Computer Methods and Programs in Biomedicine · doi:10.1016/j.cmpb.2023.107687 · Cited by 21 · see citing works
Self-citationChen, J., Qian, L., Urakov, T. M., Gu, W., & Liang, L. (2021) · SPIE Medical Imaging: Image Processing · doi:10.1117/12.2580852 · Cited by 16 · see citing works
Self-citationEnhance CNN Robustness Against Noises for Classification of 12-Lead ECG with Variable Length
Ma, L., & Liang, L. (2020) · International Conference on Machine Learning and Applications · doi:10.1109/icmla51294.2020.00137 · Cited by 10 · see citing works
Self-citationPerformance Evaluation of Adversarial Attacks: Discrepancies and SolutionsPreprint
Wu, J., Zhou, M., Zhu, C., Liu, Y., Harandi, M. T., & Li, L. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.11103 · Cited by 5 · see citing works
Improve robustness of DNN for ECG signal classification:a noise-to-signal ratio perspectivePreprint
Ma, L., & Liang, L. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.09134 · Cited by 3 · see citing works
Self-citation
Flagged first, then by citations
3 of the 48 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
MedViT: A robust vision transformer for generalized medical image classification
Manzari, O. N., Ahmadabadi, H., Kashiani, H., Shokouhi, S. B., & Ayatollahi, A. (2023) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2023.106791 · Cited by 537 · see citing works
Deep Learning-Based ECG Arrhythmia Classification: A Systematic Review
Xiao, Q., Lee, K., Mokhtar, S. A., Ismail, I., Pauzi, A. L. M., Zhang, Q., & Lim, P. Y. (2023) · Applied Sciences · doi:10.3390/app13084964 · Cited by 223 · see citing works
Liu, M., Raj, A. N. J., Rajangam, V., Ma, K., Zhuang, Z., & Zhuang, S. (2023) · Speech Communication · doi:10.1016/j.specom.2023.103010 · Cited by 61 · see citing works
Artificial Intelligence in Cardiovascular Medicine: Current Insights and Future Prospects
Haq, I. U., Chhatwal, K., SANAKA, K. O., & Xu, B. (2022) · Vascular Health and Risk Management · doi:10.2147/vhrm.s279337 · Cited by 61 · see citing works
Safdar, M. F., Nowak, R. M., & Pałka, P. (2023) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2023.107908 · Cited by 52 · see citing works
Gu, M., Zhang, Y., Wen, Y., Ai, G., Zhang, H., Wang, P., & Wang, G. (2023) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2023.106623 · Cited by 49 · see citing works
A scoping review of robustness concepts for machine learning in healthcare
Balendran, A., Beji, C., Bouvier, F., Khalifa, O., Evgeniou, T., Ravaud, P., & Porcher, R. (2025) · npj Digital Medicine · doi:10.1038/s41746-024-01420-1 · Cited by 43 · see citing works
Adversarial Training for the Adversarial Robustness of EEG-Based Brain-Computer Interfaces
Li, Y., Yu, X., Yu, S., & Chen, B. (2022) · Machine learning for signal processing ... · doi:10.1109/mlsp55214.2022.9943479 · Cited by 17 · see citing works
Yuan, L., & Siyal, M. Y. (2023) · Biomedical Signal Processing and Control · doi:10.1016/j.bspc.2023.105308 · Cited by 15 · see citing works
Improving Adversarial Robustness of Deep Neural Networks Via Adaptive Margin Evolution
Ma, L., & Liang, L. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126524 · Cited by 14 · see citing works
Self-citationChen, X., Si, Y., Zhang, Z., Yang, W., & Feng, J. (2024) · Sensors · doi:10.3390/s24092954 · Cited by 8 · see citing works
Liu, J., Liu, Y., Jin, Y., Li, Z., Jin, Y., Chen, X., Zhao, L., & Liu, C. (2024) · Medical Engineering & Physics · doi:10.1016/j.medengphy.2024.104209 · Cited by 8 · see citing works
A Multi-View learning approach to enhance automatic 12-Lead ECG diagnosis performance
Choi, J.-W., Hong, D.-Y., Jung, C., Hwang, E., Park, S.-H., & Roh, S. (2024) · Biomedical Signal Processing and Control · doi:10.1016/j.bspc.2024.106214 · Cited by 6 · see citing works
Exploring ECG Signal Analysis Techniques for Arrhythmia Detection: A Review
Samant, E. A. S. (2023) · International Journal on Recent and Innovation Trends in Computing and Communication · doi:10.17762/ijritcc.v11i9.10084 · Cited by 2 · see citing works
Attack-data independent defence mechanism against adversarial attacks on ECG signal
Rahman, S., Pal, S., Habib, A., Pan, L., & Karmakar, C. K. (2025) · Computer Networks · doi:10.1016/j.comnet.2024.111027 · Cited by 2 · see citing works
An, X., Xia, T., Hu, J., Bo, H., Cheng, L., & Ma, Y. (2025) · Biomedical Signal Processing and Control · doi:10.1016/j.bspc.2025.109232 · Cited by 1 · see citing works
Fodeh, S. J., Wang, Y. Y., Ma, L., Talakokkul, S., Alpert, J. M., & Schellhorn, S. E. (2026) · Artificial Intelligence in Medicine · doi:10.1016/j.artmed.2026.103429 · Cited by 2 · see citing works
Self-citationLi, S., Su, X., Yao, Q., & Chen, G. (2023) · International Conference on Advanced Electronic Materials, Computers and Software Engineering (AEMCSE) · doi:10.1117/12.3004572 · Cited by 1 · see citing works
Velusamy, S., Rajasekaran, M. P., Ramaraj, K., Thiyagarajan, A., Govindaraj, V., & Kamalakkannan, V. (2023) · International Conference on Edge Computing and Applications (ICECAA) · doi:10.1109/icecaa58104.2023.10212176
Sparsity based morphological characterisation of heartbeats
Rebollo‐Neira, L., Battikh, K., & Watt, A. S. (2025) · Biomedical Signal Processing and Control · doi:10.1016/j.bspc.2025.107703
Emotions and App-Supported Artificial Intelligence as a Helpful Tool in Psychiatry. Position Paper
Starčević, A., Karpiel, I. S., Urzeniczok, M., & Starcevic, F. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-03711-4_24
Advancements in electrocardiogram signal classification algorithms
Shao, W., Wang, Y., Shokouhimehr, M., & Liu, Z. (2025) · Measurement Science and Technology · doi:10.1088/1361-6501/ae2b8c
Liu, Q., Tang, J., Shen, J., Cai, Y. Y., Huang, Y. L., & Lu, N. (2026) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2026.3695954
Khanijahani, A., Iezadi, S., Marshall, S., & Bruzdewicz, B. (2026) · International Journal of Medical Informatics · doi:10.1016/j.ijmedinf.2026.106672
CARDIA-Shield: A Robust Framework for Adversarially Attacks Resilient Heart Disease Prediction
Thilaga, & Lal, N. (2026) · International Conference on NextGen Data Science and Analytics (ICNDSA) · doi:10.1109/icndsa68777.2026.11652263
- Authors
- Ma, L., & Liang, L.
- Affiliations
- University of Miami (US)
- Corresponding author
- Liang, Liang
- Venue
- Computers in Biology and Medicine
- Publisher
- Elsevier BV
- Published
- 2022-05
- Volume
- 144
- Pages
- 105345
- ISSN
- 0010-4825 (ISSN-L)
- OpenAlex
- W3206544595
- Cited by
- 26
- References
- 48
- Citations by year
- 2026: 4 · 2025: 6 · 2024: 4 · 2023: 10 · 2022: 2
- FWCI
- 1.81
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- Computers in Biology and Medicine (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Health Sciences › Medicine › Cardiology and Cardiovascular Medicine › ECG Monitoring and Analysis
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- adversarial robustness, ECG classification, deep neural network, regularization, noise-to-signal ratio, adversarial attacks, projected gradient descent, MIT-BIH arrhythmia database, automated ECG analysis, adversarial defense
- MeSH terms
- Electrocardiography, Humans, Thorax, Neural Networks, Computer
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
