Deep learning models for electrocardiograms are susceptible to adversarial attack.
Deep learning models for electrocardiograms are susceptible to adversarial attack.
复制标题
DOI：
10.1038/s41591-020-0791-x
复制
发表时间：
2020-03
期刊：
影响因子：
82.9
通讯作者：
Ranganath R
中科院分区：
文献类型：
--
作者：
Han X;Hu Y;Foschini L;Chinitz L;Jankelson L;Ranganath R
心电图 (ECG) 采集在医疗和商业设备中越来越广泛，因此需要开发自动解读策略。最近，深度神经网络已被用于自动分析心电图描记，并在检测某些节律不规则方面优于医生。然而，深度学习分类器很容易受到对抗性示例的影响，这些示例是根据原始数据创建的，旨在欺骗分类器，使其将示例分配给错误的类，但人眼无法察觉。还为医疗相关任务创建了对抗性示例。然而，创建对抗性示例的传统攻击方法不会直接扩展到心电图信号，因为此类方法会引入生理上不合理的方波伪影。在这里，我们开发了一种方法来构建心电图追踪的平滑对抗性示例，这些示例对于人类专家评估来说是不可见的，并表明用于单导联心电图心律失常检测的深度学习模型很容易受到此类攻击。此外，我们提供了一种通用技术，用于整理和扰乱已知的对抗性示例以创建多个新的对抗性示例。深度学习心电图算法对对抗性错误分类的敏感性意味着，在可能已改变的心电图上评估这些模型时应小心，特别是当存在导致错误分类的动机时。
Electrocardiogram (ECG) acquisition is increasingly widespread in medical and commercial devices, necessitating the development of automated interpretation strategies. Recently, deep neural networks have been used to automatically analyze ECG tracings, and outperform physicians in detecting certain rhythm irregularities. However, deep learning classifiers are susceptible to adversarial examples, which are created from raw data to fool the classifier such that it assigns the example to the wrong class, but which are undetectable to the human eye. Adversarial examples have also been created for medical-related tasks. However, traditional attack methods to create adversarial examples do not extend directly to ECG signals, as such methods introduce square wave artifacts that are not physiologically plausible. Here we develop a method to construct smoothed adversarial examples for ECG tracings that are invisible to human expert evaluation and show that a deep learning model for arrhythmia detection from single-lead ECG is vulnerable to this type of attack. Moreover, we provide a general technique for collating and perturbing known adversarial examples to create multiple new ones. The susceptibility of deep learning ECG algorithms to adversarial misclassification implies that care should be taken when evaluating these models on ECGs that may have been altered, particularly when incentives for causing misclassification exist.
登录
查看更多内容
影响因子：
4.6
作者：
Minh Tuan Nguyen;Binh Van Nguyen;Kim, Kiseon
通讯作者：
Kim, Kiseon
DOI：
10.1126/science.aaw4399
发表时间：
2019-03-22
期刊：
Science (New York, N.Y.)
影响因子：
--
作者：
Finlayson SG;Bowers JD;Ito J;Zittrain JL;Beam AL;Kohane IS
通讯作者：
Kohane IS
影响因子：
2.6
作者：
Julian, Kyle D.;Kochenderfer, Mykel J.;Owen, Michael P.
通讯作者：
Owen, Michael P.
影响因子：
82.9
作者：
Hannun, Awni Y.;Rajpurkar, Pranav;Ng, Andrew Y.
通讯作者：
Ng, Andrew Y.
影响因子：
24
作者：
Galloway, Conner D.;Valys, Alexander V.;Friedman, Paul A.
通讯作者：
Friedman, Paul A.