🤖 AI Summary
This study addresses the vulnerability in adaptive electrocardiogram monitoring systems where clinically critical heartbeat classes are suppressed due to sensitivity to event sequencing. The authors propose a bounded event reordering attack that manipulates only the temporal order of genuine historical events—without altering waveforms, labels, or model outputs—to lower the confidence threshold for ventricular beats prior to evaluating a target event. Leveraging an adaptive conformal prediction framework, the method employs feasible permutation search under a displacement budget constraint to achieve precise reordering. Experiments on the MIT-BIH dataset demonstrate successful suppression of 66.7% and 60.0% of target events for Extra Trees and HistGradientBoosting models, respectively, substantially outperforming random scheduling (4.4% and 12.0%). Cross-dataset validity is further confirmed on INCART, revealing for the first time that merely manipulating event timing can compromise adaptive clinical monitoring systems.
📝 Abstract
Adaptive conformal prediction can recover clinically important heartbeat classes missed by a point classifier, but delayed feedback makes its decisions sensitive to event order. We introduce ConformalShift, a bounded event-reordering attack that suppresses the ventricular class for rescued events without modifying ECG waveforms, labels, classifier scores, or the event multiset. ConformalShift searches for feasible permutations of authentic preceding events that lower the ventricular threshold before a selected target is evaluated. On disjoint MIT--BIH confirmation records, the attack suppressed 66.7% of eligible targets for Extra Trees and 60.0% for HistGradientBoosting, compared with random-schedule rates of 4.4% and 12.0%, respectively. Transferred configurations also outperformed random scheduling on INCART, while reducing the displacement budget weakened the attack on both datasets. These results show that adaptive monitors in healthcare can be compromised through the timing of authentic information, even when waveforms, labels, classifier outputs, and event contents remain unchanged.