Defending Against Adversarial Attack in ECG Classification with Adversarial Distillation Training

In clinics, doctors rely on electrocardiograms (ECGs) to assess severe\ncardiac disorders. Owing to the development of technology and the increase in\nhealth awareness, ECG signals are currently obtained by using medical and\ncommercial devices. Deep neural networks (DNNs) can be used to analyze these\nsignals because of their high accuracy rate. However, researchers have found\nthat adversarial attacks can significantly reduce the accuracy of DNNs. Studies\nhave been conducted to defend ECG-based DNNs against traditional adversarial\nattacks, such as projected gradient descent (PGD), and smooth adversarial\nperturbation (SAP) which targets ECG classification; however, to the best of\nour knowledge, no study has completely explored the defense against adversarial\nattacks targeting ECG classification. Thus, we did different experiments to\nexplore the effects of defense methods against white-box adversarial attack and\nblack-box adversarial attack targeting ECG classification, and we found that\nsome common defense methods performed well against these attacks. Besides, we\nproposed a new defense method called Adversarial Distillation Training (ADT)\nwhich comes from defensive distillation and can effectively improve the\ngeneralization performance of DNNs. The results show that our method performed\nmore effectively against adversarial attacks targeting on ECG classification\nthan the other baseline methods, namely, adversarial training, defensive\ndistillation, Jacob regularization, and noise-to-signal ratio regularization.\nFurthermore, we found that our method performed better against PGD attacks with\nlow noise levels, which means that our method has stronger robustness.\n