Among all physiological signals, electrocardiograms (ECG) have seen some of the largest expansion in both medical and recreational applications. In parallel with the traditional 12 lead ECG, we are witnessing the rise of single-lead versions embedded in medical devices and wearable products. Devices such as the injectable Medtronic Linq monitor and the iRhythm Ziopatch wearable monitor are widely used in the diagnosis of cardiac arrhythmia, while smart watches marketed directly to consumers such as the Apple Watch Series 4 now feature a single lead ECG. Altogether, single lead ECG is expected to be used by tens of millions of Americans by the end of 2019.
Meaningful use of the deluge of data being created requires automated methods: Increasingly more approaches in modeling clinical data, including ECG, rely on deep learning. Examples include cheXnet for chest x-rays, deep survival analysis for coronary artery disease, and DeepPath for pathology. Similar methods, built into consumer devices and apps, have also recently been cleared by the Food and Drug Administration.
Deep learning classifiers have been shown to be brittle to adversarial examples [4; 13], including in medical-related tasks. However, naively attacking ECG deep learning classifiers with traditional methods such as Projected Gradient Descent (PGD) creates examples presenting square waves artifacts that are not physiologically plausible. To remedy this, we develop a method to construct smoothed adversarial examples. The methods successfully creates false negatives: examples of symptomatic ECG indistinguishable to a human eye that get classified as normal by the model (Fig 1).