{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T02:37:22Z","timestamp":1768963042280,"version":"3.49.0"},"reference-count":51,"publisher":"Association for Computing Machinery (ACM)","issue":"1","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Cyber-Phys. Syst."],"published-print":{"date-parts":[[2026,1,31]]},"abstract":"<jats:p>\n                    This study aims to assess the feasibility of applying adversarial examples to attack cardiac diagnosis systems powered by machine learning algorithms. To achieve this, we introduce \u201c\n                    <jats:italic toggle=\"yes\">adversarial beats<\/jats:italic>\n                    ,\u201d which are adversarial perturbations that are tailored specifically against classification systems designed to diagnose electrocardiograms (ECGs). We first formulated an algorithm to generate adversarial examples for multiple neural network models for ECG classification and studied their attack success rates. Next, to evaluate their feasibility in a physical environment, we mounted a hardware attack by designing a malicious signal generator that injects adversarial beats into ECG sensor readings using commercial off-the-shelf hardware. To the best of our knowledge, our research is the first to evaluate the proficiency of adversarial examples for ECGs in a physical setup. Our real-world experiments demonstrate that, against an automated ECG diagnosis apparatus, our attack method can fake the presence of potential signs of cardiomyopathy with approximately 42.1% chance of success and the attacker can repeat the attack until a fraudulent insurance claim or other health care fraud is established. Based on the comprehensive feasibility study of attacks using adversarial beats, we conclude that the attacks have a sufficient chance to succeed such that an attacker may be incentivized to fake the presence of cardiomyopathy, potentially leading to unnecessary medication prescriptions and fraudulent medical insurance claims.\n                  <\/jats:p>","DOI":"10.1145\/3777452","type":"journal-article","created":{"date-parts":[[2025,12,3]],"date-time":"2025-12-03T12:37:57Z","timestamp":1764765477000},"page":"1-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Adversarial Beats: Feasibility Study of Spoofed Arrhythmia in Automated Electrocardiogram Diagnosis"],"prefix":"10.1145","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-6621-5897","authenticated-orcid":false,"given":"Taiga","family":"Ono","sequence":"first","affiliation":[{"name":"Waseda University, Shinjuku-ku, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9356-534X","authenticated-orcid":false,"given":"Takeshi","family":"Sugawara","sequence":"additional","affiliation":[{"name":"The University of Electro-Communications, Chofu, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5015-3812","authenticated-orcid":false,"given":"Jun","family":"Sakuma","sequence":"additional","affiliation":[{"name":"Institute of Science Tokyo, Meguro, Japan and RIKEN AIP, Chuo-ku, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1583-4174","authenticated-orcid":false,"given":"Tatsuya","family":"Mori","sequence":"additional","affiliation":[{"name":"Waseda University, Shinjuku-ku, Japan, NICT, Koganei-shi, Japan, and Riken AIP, Chuo-ku, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2026,1,20]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"X. Han Y. Hu L. Foschini L. Chinitz L. Jankelson and R. Ranganath. 2019. Adversarial examples for electrocardiograms. arXiv:1905.05163. Retrieved from https:\/\/arxiv.org\/abs\/1905.05163"},{"key":"e_1_3_2_3_2","unstructured":"H. Chen C. Huang Q. Huang and Q. Zhang. 2019. ECGadv: Generating adversarial electrocardiogram to misguide arrhythmia classification system. arXiv:1901.03808. Retrieved from https:\/\/arxiv.org\/abs\/1901.03808"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/741"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00009"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cmpb.2015.12.008"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/51.932724"},{"key":"e_1_3_2_8_2","unstructured":"V. Bailey. 2022. CA Doctor Sentenced in Medicare Fraud Scheme Involving Upcoding. Retrieved from https:\/\/revcycleintelligence.com\/news\/ca-doctor-sentenced-in-medicare-fraud-scheme-involving-upcoding"},{"key":"e_1_3_2_9_2","unstructured":"Department of Justice U.S. Attorney\u2019s Office and Southern District of Florida. 2016. Doctor Who Falsely Diagnosed Hundreds of Patients as Part of a Medicare Fraud Scheme Pleads Guilty. Retrieved from https:\/\/www.justice.gov\/usao-sdfl\/pr\/doctor-who-falsely-diagnosed-hundreds-patients-part-medicare-fraud-scheme-pleads-guil-0"},{"key":"e_1_3_2_10_2","unstructured":"J. Huff. 2017. ECG workout-exercises in arrhythmia interpretation. Retrieved from https:\/\/www.amazon.com\/ECG-Workout-Exercises-Arrhythmia-Interpretation\/dp\/1975174542"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.15420\/AER.2016.17.2"},{"key":"e_1_3_2_12_2","unstructured":"The Johns Hopkins University. 2022. Holter Monitor. Retrieved from https:\/\/www.hopkinsmedicine.org\/health\/treatment-tests-and-therapies\/holter-monitor"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.amjcard.2013.04.017"},{"key":"e_1_3_2_14_2","unstructured":"C. Miller. 2020. European Heart Journal: Apple Watch ECG Detects Signs of Coronary Ischemia Missed by Hospital ECG. Retrieved from https:\/\/9to5mac.com\/2020\/05\/03\/apple-watch-myocardial-ischemia\/"},{"key":"e_1_3_2_15_2","unstructured":"McKinsey & Company. 2020. Transforming Healthcare with AI: The Impact on the Workforce and Organizations. Retrieved from https:\/\/www.mckinsey.com\/industries\/healthcare-systems-and-services\/our-insights\/transforming-healthcare-with-ai"},{"key":"e_1_3_2_16_2","unstructured":"P. Rajpurkar A. Y. Hannun M. Haghpanahi C. Bourn and A. Y. Ng. 2017. Cardiologist-level arrhythmia detection with convolutional neural networks. arXiv:1707.01836. Retrieved from https:\/\/arxiv.org\/abs\/1707.01836"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compbiomed.2017.08.022"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICHI.2018.00092"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.03.057"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICITCS.2016.7740310"},{"key":"e_1_3_2_21_2","volume-title":"ANSI\/AAMI EC57","author":"Association for the Advancement of Medical Instrumentation","year":"1998","unstructured":"Association for the Advancement of Medical Instrumentation. 1998. Testing and reporting performance results of cardiac rhythm and ST-segment measurement algorithms. In ANSI\/AAMI EC57. Retrieved from https:\/\/webstore.ansi.org\/standards\/aami\/ansiaamiec5719982003"},{"key":"e_1_3_2_22_2","volume-title":"Proceedings of the 2nd International Conference on Learning Representations (ICLR \u201914). Conference Track Proceedings","author":"Szegedy C.","year":"2014","unstructured":"C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus. 2014. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations (ICLR \u201914). Conference Track Proceedings."},{"key":"e_1_3_2_23_2","volume-title":"International Conference on Learning Representations","author":"Goodfellow I.","year":"2015","unstructured":"I. Goodfellow, J. Shlens, and C. Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations. Retrieved from http:\/\/arxiv.org\/abs\/1412.6572"},{"key":"e_1_3_2_24_2","volume-title":"Proceedings of the ICLR Workshop","author":"Kurakin A.","year":"2017","unstructured":"A. Kurakin, I. Goodfellow, and S. Bengio. 2017. Adversarial examples in the physical world. In Proceedings of the ICLR Workshop."},{"key":"e_1_3_2_25_2","unstructured":"T. B. Brown D. Man\u00e9 A. Roy M. Abadi and J. Gilmer. 2017. Adversarial patch. arXiv:1712.09665. Retrieved from https:\/\/arxiv.org\/abs\/1712.09665"},{"key":"e_1_3_2_26_2","first-page":"1","volume-title":"Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT \u201918)","author":"Eykholt K.","year":"2018","unstructured":"K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tram\u00e8r, A. Prakash, T. Kohno, and D. Song. 2018. Physical adversarial examples for object detectors. In Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT \u201918), 1\u201310."},{"key":"e_1_3_2_27_2","unstructured":"S. G. Finlayson I. S. Kohane and A. L. Beam. 2018. Adversarial attacks against medical deep learning systems. arXiv:1804.05296. Retrieved from http:\/\/arxiv.org\/abs\/1804.05296"},{"key":"e_1_3_2_28_2","first-page":"284","volume-title":"Proceedings of the 35th International Conference on Machine LearningProceedings of Machine Learning Research","volume":"80","author":"Athalye A.","year":"2018","unstructured":"A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok. 2018. Synthesizing robust adversarial examples. In Proceedings of the 35th International Conference on Machine Learning. Proceedings of Machine Learning Research, Vol. 80, 284\u2013293."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1038\/s41591-020-0791-x"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.2147\/MDER.S50048"},{"key":"e_1_3_2_31_2","unstructured":"U.S. Government Accountability Office. 2023. Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination. Report GAO24-106683."},{"key":"e_1_3_2_32_2","article-title":"How medical devices like pacemakers and insulin pumps can be hacked","author":"Werner A.","year":"2018","unstructured":"A. Werner. 2018. How medical devices like pacemakers and insulin pumps can be hacked. CBS News.","journal-title":"CBS News"},{"key":"e_1_3_2_33_2","unstructured":"Arterys Inc. 2019. Arterys. Retrieved from https:\/\/www.arterys.com\/"},{"key":"e_1_3_2_34_2","unstructured":"National Healthcare Anti-Fraud Association (NHCAA). 2021. The Challenge of Health Care Fraud. Retrieved from https:\/\/www.nhcaa.org\/tools-insights\/about-health-care-fraud\/the-challenge-of-health-care-fraud\/"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1111\/j.1468-0440.2004.00290.x"},{"key":"e_1_3_2_36_2","first-page":"433","volume-title":"Security Printing and Seals","author":"Anderson R. J.","year":"2008","unstructured":"R. J. Anderson. 2008. Security Printing and Seals (2nd ed.). Wiley, 433\u2013455.","edition":"2"},{"key":"e_1_3_2_37_2","unstructured":"U.S. Food & Drug Administration. 2003. Guidance Document Part 11 Electronic Records; Electronic Signatures\u2014Scope and Application. Retrieved from https:\/\/www.fda.gov\/regulatory-information\/search-fda-guidance-documents\/part-11-electronic-records-electronic-signatures-scope-and-application"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354195"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.2147\/MDER.S50048"},{"key":"e_1_3_2_40_2","unstructured":"U.S. Food & Drug Administration. 2021. Medtronic Recalls Remote Controllers Used with Paradigm and 508 MiniMed Insulin Pumps for Potential Cybersecurity Risks. Retrieved from https:\/\/www.fda.gov\/inspections-compliance-enforcement-and-criminal-investigations\/warning-letters\/medtronic-inc-617539-12092021"},{"issue":"101","key":"e_1_3_2_41_2","first-page":"1","article-title":"Signal processing techniques for removing noise from ECG signals","volume":"3","author":"Kher R.","year":"2019","unstructured":"R. Kher. 2019. Signal processing techniques for removing noise from ECG signals. Journal of Biomedical Engineering 3, 101 (2019), 1\u20139.","journal-title":"Journal of Biomedical Engineering"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2962617"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.22489\/CinC.2017.065-469"},{"key":"e_1_3_2_44_2","unstructured":"PhysioNet. 2000. MIT-BIH Arrhythmia Database Directory. Retrieved January 6 2025 from https:\/\/www.physionet.org\/files\/mitdb\/1.0.0\/mitdbdir\/intro.htm"},{"key":"e_1_3_2_45_2","first-page":"321","volume-title":"Proceedings of the 28th USENIX Security Symposium (USENIX Security \u201919)","author":"Demontis A.","year":"2019","unstructured":"A. Demontis, M. Melis, M. Pintor, M. Jagielski, B. Biggio, A. Oprea, C. Nita-Rotaru, and F. Roli. 2019. Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks. In Proceedings of the 28th USENIX Security Symposium (USENIX Security \u201919). USENIX Association, Santa Clara, CA, 321\u2013338. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/demontis"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/CIC.2002.1166717"},{"key":"e_1_3_2_47_2","unstructured":"National Instruments. 2022. User Guide NI myDAQ. Retrieved from https:\/\/www.ni.com\/pdf\/manuals\/373060g.pdf"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.3390\/s19040798"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.3390\/s23094522"},{"key":"e_1_3_2_50_2","unstructured":"S. H. Sheldon J. J. Gard and S. J. Asirvatham. 2010. Premature ventricular contractions and non-sustained ventricular tachycardia. Indian Pacing and Electrophysiology Journal 10 (2010) 357\u2013371."},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1161\/CIR.0000000000000527"},{"key":"e_1_3_2_52_2","first-page":"2237","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security \u201921)","author":"Xiang C.","year":"2021","unstructured":"C. Xiang, A. N. Bhagoji, V. Sehwag, and P. Mittal. 2021. PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking. In Proceedings of the 30th USENIX Security Symposium (USENIX Security \u201921). USENIX Association, 2237\u20132254. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/xiang"}],"container-title":["ACM Transactions on Cyber-Physical Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3777452","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,20]],"date-time":"2026-01-20T13:47:03Z","timestamp":1768916823000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3777452"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,20]]},"references-count":51,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,1,31]]}},"alternative-id":["10.1145\/3777452"],"URL":"https:\/\/doi.org\/10.1145\/3777452","relation":{},"ISSN":["2378-962X","2378-9638"],"issn-type":[{"value":"2378-962X","type":"print"},{"value":"2378-9638","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,20]]},"assertion":[{"value":"2024-09-23","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-28","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-01-20","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}