Adversarial ECG Arrhythmia Classification: Explanation-Targeted Attacks and Physiologically Constrained Defence

Abstract

ECG arrhythmia classifiers have reached cardiologist-level diagnostic accuracy on large public benchmarks, yet a largely underappreciated adversarial threat exists: the covert redirection of Grad-CAM saliency maps away from diagnostically meaningful waveform regions while the predicted class stays entirely unchanged. We introduce the Explanation-Targeted Attack (ETA), the first adversarial method built specifically for one-dimensional cardiac signals that jointly optimises saliency-map divergence and prediction stability under physiologically grounded plausibility constraints. A domain-specific Clinical Imperceptibility Score (CIS) controls attack feasibility by unifying amplitude deviation, ECG-fiducial morphological fidelity, and spectral integrity into a single composite scalar.