[Paper Review] Improve robustness of DNN for ECG signal classification:a noise-to-signal ratio perspective

Linhai Ma, Liang Liang|arXiv (Cornell University)|May 18, 2020

Adversarial Robustness in Machine Learning12 references4 citations

TL;DR

This paper proposes two novel loss functions that reduce noise-to-signal ratio (NSR) during training to enhance adversarial robustness in deep neural networks (DNNs) for ECG signal classification. By minimizing NSR through regularization terms in the loss function, the method improves resilience against PGD and SPSA adversarial attacks without degrading clean-data accuracy, with loss2 outperforming standard adversarial training and Jacobian regularization on both MLP and CNN architectures using the MIT-BIH ECG dataset.

ABSTRACT

Electrocardiogram (ECG) is the most widely used diagnostic tool to monitor the condition of the cardiovascular system. Deep neural networks (DNNs), have been developed in many research labs for automatic interpretation of ECG signals to identify potential abnormalities in patient hearts. Studies have shown that given a sufficiently large amount of data, the classification accuracy of DNNs could reach human-expert cardiologist level. A DNN-based automated ECG diagnostic system would be an affordable solution for patients in developing countries where human-expert cardiologist are lacking. However, despite of the excellent performance in classification accuracy, it has been shown that DNNs are highly vulnerable to adversarial attacks: subtle changes in input of a DNN can lead to a wrong classification output with high confidence. Thus, it is challenging and essential to improve adversarial robustness of DNNs for ECG signal classification, a life-critical application. In this work, we proposed to improve DNN robustness from the perspective of noise-to-signal ratio (NSR) and developed two methods to minimize NSR during training process. We evaluated the proposed methods on PhysionNets MIT-BIH dataset, and the results show that our proposed methods lead to an enhancement in robustness against PGD adversarial attack and SPSA attack, with a minimal change in accuracy on clean data.

Motivation & Objective

• To address the vulnerability of DNNs to adversarial attacks in life-critical ECG classification.
• To improve robustness against white-box (PGD) and black-box (SPSA) adversarial attacks without sacrificing clean-data accuracy.
• To propose a new training paradigm based on noise-to-signal ratio (NSR) minimization for enhanced DNN robustness.
• To evaluate the proposed methods on the PhysioNet MIT-BIH Arrhythmia ECG dataset under diverse attack scenarios.

Proposed method

• Proposed two new loss functions, loss1 and loss2, that incorporate regularization terms to minimize noise-to-signal ratio (NSR) during DNN training.
• Loss1 penalizes the L2 norm of the difference between the network’s output on clean and adversarial inputs, reducing NSR.
• Loss2 adds a margin-based regularization to the L2 loss, further constraining the network’s sensitivity to adversarial perturbations.
• Adversarial samples for training were generated using PGD with 10 steps and noise levels ε = 0.1, 0.2, 0.3.
• The models were trained using Adamax optimizer with a fixed learning rate of 0.001 and batch size of 128.
• Class imbalance was addressed via up-sampling to ensure balanced class representation in training and testing sets.

Experimental results

Research questions

• RQ1 Can reducing noise-to-signal ratio (NSR) during training improve adversarial robustness in DNNs for ECG classification?
• RQ2 How does NSR-based regularization compare to standard adversarial training and Jacobian regularization in resisting PGD and SPSA attacks?
• RQ3 Does the proposed method maintain high classification accuracy on clean ECG data while improving robustness?
• RQ4 Which of the two proposed loss functions (loss1 or loss2) yields superior robustness across different network architectures?

Key findings

• On the MIT-BIH ECG dataset, the proposed loss2 method achieved the highest test accuracy (71%) and precision (78%) under 100-PGD attack with ε = 0.1 on a CNN architecture.
• For MLPs, loss2 achieved 61% accuracy and 64% precision under the same PGD attack, outperforming all baselines including 10-PGD adversarial training with ε = 0.2 and ε = 0.3.
• The loss2 method significantly outperformed standard adversarial training (10-PGD) and Jacobian regularization across both MLP and CNN models under both white-box (PGD) and black-box (SPSA) attacks.
• The proposed methods maintained high clean-data accuracy, with minimal degradation compared to standard cross-entropy training, indicating robustness without performance trade-off.
• Ablation studies confirmed that both loss1 and loss2 contributed to robustness, with loss2 showing superior generalization across attack types and network architectures.