SCAR: Semantic Cardiac Adversarial Representation via Spatiotemporal Manifold Optimization in ECG

TL;DR

This paper introduces SCAR, a novel universal adversarial perturbation framework for ECG analysis that effectively bypasses clinical defenses by incorporating spatiotemporal, spectral, and amplitude constraints, revealing vulnerabilities and aiding in training defenses.

Contribution

SCAR is the first UAP method tailored for ECG signals that integrates domain-specific constraints, achieving high transferability and targeted pathological feature forging.

Findings

SCAR maintains 58.09% transfer success rate, outperforming baseline.

SCAR achieves 82.46% success on source model.

SCAR effectively forges myocardial infarction features with 90.2% misdiagnosis rate.

Abstract

Deep learning models for Electrocardiogram (ECG) analysis have achieved expert-level performance but remain vulnerable to adversarial attacks. However, applying Universal Adversarial Perturbations (UAP) to ECG signals presents a unique challenge: standard imperceptible noise constraints (e.g., 10 uV) fail to generate effective universal attacks due to the high inter-subject variability of cardiac waveforms. Furthermore, traditional "invisible" attacks are easily dismissed by clinicians as technical artifacts, failing to compromise the human-in-the-loop diagnostic pipeline. In this study, we propose SCAR (Semantic Cardiac Adversarial Representation), a novel UAP framework tailored to bypass the clinical "Human Firewall." Unlike traditional approaches, SCAR integrates spatiotemporal smoothing (W=25, approx. 50ms), spectral consistency (<15 Hz), and anatomical amplitude constraints (<0.2 mV) directly into the gradient optimization manifold. Results: We benchmarked SCAR against a rigorous baseline (Standard Universal DeepFool with post-hoc physiological filtering). While the baseline suffers a performance collapse (~16% success rate on transfer tasks), SCAR maintains robust transferability (58.09% on ResNet) and achieves 82.46% success on the source model. Crucially, clinical analysis reveals an emergent targeted behavior: SCAR specifically converges to forging Myocardial Infarction features (90.2% misdiagnosis) by mathematically reconstructing pathological ST-segment elevations. Finally, we demonstrate that SCAR serves a dual purpose: it not only functions as a robust data augmentation strategy for Hybrid Adversarial Training, offering optimal clinical defense, but also provides effective educational samples for training clinicians to recognize low-cost, AI-targeted semantic forgeries.