PaperlayerView exact revision on arXiv

Source-linked AI summary

ECGWmark: Deep Watermarking for Electrocardiogram Signals

Kuan-Yu Chen, Kuan-Chen Wang, Yu Tsao, Jian-Jiun Ding

arXiv:2610.13357v1eess.SPcs.CRcs.CV

TL;DR

ECG watermarking must withstand temporal desynchronization while preserving diagnostic morphology, and existing deep temporal watermarking may rely on lossy quantization. ECGWmark uses localized, quantization-free embedding with classifier-guided training; it achieves above-90% extraction accuracy under evaluated shifts, alongside mixed diagnostic effects.

  • Problem

    Conventional ECG watermarking is vulnerable to temporal distortions, while signal fidelity alone does not ensure downstream diagnostic performance.

    Source: §I · p. 1

  • Method

    ECGWmark uses localized frame-level convolutional embedding in a continuous, full-resolution latent space and a differentiable loss guided by a frozen clinical classifier.

    Source: §I · p. 1, E. Comprehensive Multi-Objective… · p. 4

  • Results

    Above 90% extraction accuracy is maintained under evaluated circular shifts; Class-V sensitivity changes from 71.97% to 76.50%, while Macro-F1 changes from 35.25% to 34.71% and Class-S sensitivity from 8.89% to 1.39%.

    Source: §I · p. 2, B. Diagnostic Fidelity Analysis · p. 4

  • Takeaways & Limitations

    ECGWmark shows resilience under evaluated temporal shifts, but its diagnostic outcomes are mixed rather than a universal improvement.

    Source: §IV · p. 7

    ECGWmark operates at the signal-representation layer and has no secret-key or signature mechanism, so its reported detector results do not establish keyed security.

    Source: §V · p. 7

Abstract

from arXiv · show

Secure transmission of electrocardiogram (ECG) signals remains a major challenge in telecardiology. While traditional mathematical watermarking can embed patient metadata directly into ECG signals, it is highly fragile against temporal desynchronization such as circular phase shifts. In contrast, existing deep watermarking approaches for temporal signals, such as audio, typically rely on lossy quantization, which compromises the high-frequency micro-morphological details critical for clinical diagnosis. To bridge this gap, we propose ECGWmark, a fully convolutional and quantization-free deep watermarking framework for medical time-series. ECGWmark operates in a continuous, full-resolution latent space and utilizes a localized frame-level mechanism to improve the robustness to severe desynchronization. Crucially, we introduce a differentiable Physiological Loss guided by a clinical classifier to preserve diagnostic semantics. Experiments on the benchmark MIT-BIH database show that ECGWmark maintains channel-bit extraction accuracy above 90% under the evaluated circular temporal shifts. Furthermore, under a rigorous inter-patient diagnostic evaluation, Class-V sensitivity changes from 71.97% to 76.50%, whereas Macro-F1 changes from 35.25% to 34.71% and Class-S sensitivity from 8.89% to 1.39%; these results indicate mixed class-level effects.

I. INTRODUCTION

ECG watermarking must protect both signal integrity and clinical morphology, yet conventional methods are vulnerable to temporal desynchronization and often omit downstream diagnostic evaluation. ECGWmark combines localized, quantization-free embedding with classifier-guided training; evaluations show shift robustness and mixed diagnostic outcomes.

I. INTRODUCTION

  • Conventional watermarking is vulnerable to temporal distortions; a 30-sample shift reduces traditional decoder accuracy to approximately 50%.These methods also do not explicitly account for downstream diagnostic performance.Source: §I · p. 1
  • ECGWmark replaces global alignment with localized frame-level convolutional embedding and detection, reducing dependence on synchronization under evaluated circular shifts.It operates in a continuous, full-resolution latent space rather than using lossy vector quantization.Source: §I · pp. 1–2

Diagnostic Loss Optimization

  • A differentiable Diagnostic Loss embeds a pre-trained clinical classifier in training to evaluate diagnostic trade-offs beyond signal fidelity.The method reports Macro-F1 and per-class outcomes rather than claiming absolute diagnostic transparency.Source: §I · pp. 1–2

I. INTRODUCTION

  • The framework’s training pipeline separates generator updates for reconstruction, auxiliary, and physiology losses from decoder extraction and detection updates.Extraction and detection losses backpropagate through the differentiable distortion layer to refine the generator.Source: Figure 1 · p. 2

Robust Evaluation and Feasibility

  • On MIT-BIH, extraction accuracy exceeded 90% under the evaluated circular shifts; separately, diagnostic-loss evaluation reported Macro-F1 and per-class outcomes, including an adverse Class-S trade-off.Source: §I · p. 2

II. METHODOLOGY

ECGWmark embeds payloads in one-dimensional ECG segments through an end-to-end, localized neural framework. Its generator, decoder, and frozen clinical classifier support watermark embedding, message recovery, and diagnostic evaluation.

II. METHODOLOGY

  • ECGWmark processes one-dimensional ECG segments through localized frame-level neural representations and jointly optimizes the generator and decoder through a differentiable distortion layer.The distortion layer enables decoding-error gradients to flow back to the generator.Source: §II · p. 2

A. System Overview and Problem Formulation

  • The generator embeds a binary payload m into an original ECG segment x to produce watermarked signal y, with N denoting payload bit capacity.The segment is represented as a continuous one-dimensional signal of length T.Source: A. System Overview and Problem… · p. 2
  • The framework combines a continuous full-resolution generator, a localization-robust message decoder, and a frozen clinical arrhythmia classifier.The three components are optimized end-to-end.Source: A. System Overview and Problem… · p. 2
  • The decoder simultaneously estimates watermark presence and extracts payload bits from a potentially corrupted received signal.It is designed as a dual-task network.Source: A. System Overview and Problem… · p. 2
  • Each segment carries 32 physical channel bits, but reliable recovery of an uncoded 32-bit message is not guaranteed by high average bit accuracy alone.The study therefore evaluates a rate-0.5 Extended Hamming code that protects a 16-bit logical payload using redundancy.Source: A. System Overview and Problem… · pp. 2–3

B. Protected Payload Coding and Soft Decoding

The coding layer protects a 16-bit logical payload by mapping it to 32 channel bits, then uses detector probabilities for block decoding. A validation-derived interleaver assigns more reliable channels to information positions and weaker ones to parity positions.

B. Protected Payload Coding and Soft Decoding

  • Four extended Hamming (8,4) SECDED blocks encode 16 logical bits into 32 channel bits, giving a code rate of 0.5.The Hamming parity checks correct a single-bit error and the overall parity bit detects a double-bit error.Source: B. Protected Payload Coding and Soft… · p. 3
  • The interleaver assigns more reliable channels to systematic information positions and weaker channels to parity positions using DS1-validation errors, then freezes the mapping before DS2.The mapping is inverted after the decoder outputs channel probabilities.Source: B. Protected Payload Coding and Soft… · p. 3
  • Soft maximum-likelihood decoding evaluates all 16 valid codewords per block using detector probabilities rather than thresholding each channel independently.The four systematic fields of the selected codewords form the recovered 16-bit message.Source: B. Protected Payload Coding and Soft… · p. 3
  • The decoder always selects a valid codeword unless an external confidence threshold is added, so this error-control mechanism does not provide cryptographic authenticity or rejection.The search considers 4 × 16 candidate codewords per segment.Source: B. Protected Payload Coding and Soft… · p. 3

C. Frame-Level Neural Architecture

ECGWmark uses localized frame-level representations to reduce dependence on global alignment, and trains against differentiable channel perturbations. The augmentation layer applies noise, blurring, scaling, and circular shifts so decoder errors can backpropagate to the generator.

C. Frame-Level Neural Architecture

  • Localized receptive fields support dense frame-level bit classification, reducing dependence on global alignment under circular shifts and permitting partial recovery under deletion, but not guaranteeing invariance to severe truncation.The fully convolutional 1-D generator embeds the upsampled payload through residual convolutions in a quantization-free continuous space.Source: C. Frame-Level Neural Architecture · p. 3

D. Differentiable Adversarial Augmentation Layer

  • The differentiable augmentation layer applies AWGN, Gaussian blurring, amplitude scaling, and circular shifts so decoder extraction errors backpropagate into the generator.The authors state this encourages watermark energy to route into robust physiological structures rather than fragile high-frequency noise embedding.Source: D. Differentiable Adversarial… · p. 3

E. Comprehensive Multi-Objective Optimization

The optimization balances reconstruction, message extraction, watermark detection, and diagnostic fidelity. The reported detection result is protocol-specific, while the diagnostic table concerns accuracy and per-class sensitivity under MIT-BIH inference configurations.

E. Comprehensive Multi-Objective Optimization

  • The joint objective balances reconstruction fidelity, decoding accuracy, and clinical transparency, with hyperparameters regulating optimization trade-offs.Reconstruction uses a standard MSE constraint, while auxiliary frequency- and continuous-wavelet-domain constraints suppress artifacts and limit excessive energy injection.Source: E. Comprehensive Multi-Objective… · p. 3
  • Payload extraction uses binary cross-entropy between the original message and decoded probabilities, while detection loss trains the decoder to identify watermark presence and mitigate false positives.The reported diagnostic evaluation table covers classification accuracy and per-class sensitivity under MIT-BIH inference configurations.Source: E. Comprehensive Multi-Objective… · p. 3, Table I · p. 4
  • AUROC ∼1.0000, with 0.018% false-positive and 0.000% false-negative rates at threshold 0.5, is reported for clean-versus-watermarked legacy DS2 discrimination.The result measures protocol-specific discrimination and does not imply cryptographic or keyed authentication.Source: E. Comprehensive Multi-Objective… · p. 3
  • The downstream robustness evaluation uses clinical classifiers pretrained strictly on pristine signals, with AAMI classes defined as N, S, V, F, and Q.N denotes Normal/Bundle Branch Block; S, Supraventricular Ectopic; V, Ventricular Ectopic; F, Fusion; and Q, Unknown/Paced.Source: E. Comprehensive Multi-Objective… · p. 4
  • The diagnostic fidelity loss uses a frozen, pretrained ResNet classifier to compare predictions on pristine and watermarked signals, and backpropagation encourages preservation of classifier-relevant outputs.Because the ablation changes multiple objectives jointly, this interpretation is descriptive rather than an isolated causal finding.Source: E. Comprehensive Multi-Objective… · p. 4

F. Implementation Details and Training Dynamics

Training dynamics use an annealed embedding strength, asymmetric generator-decoder learning rates, and exponential moving averages to stabilize optimization.

F. Implementation Details and Training Dynamics

III. EXPERIMENTS AND RESULTS

The experiments use MIT-BIH, training the diagnostic classifier on DS1 and evaluating it on held-out DS2 patients. The revised watermark protocol also reserves DS2 for final testing and fixes the payload at 32 bits per segment.

A. Dataset and Implementation Details

B. Diagnostic Fidelity Analysis

ECGWmark shows robust exact-message recovery under several tested attacks, while diagnostic outcomes are mixed and robustness comparisons depend on attack and configuration. The reported diagnostic sensitivity analysis is scoped to a legacy checkpoint and does not establish classifier-independent clinical equivalence.

B. Diagnostic Fidelity Analysis

  • Overall accuracy changed from 90.24% to 91.82%, while Class-V sensitivity changed from 71.97% to 76.50%, Macro-F1 from 35.25% to 34.71%, and Class-S sensitivity from 8.89% to 1.39%.The authors report mixed class-level effects under direct evaluation on watermarked data without retraining.Source: B. Diagnostic Fidelity Analysis · p. 4
  • An independently trained evaluator showed a +2.77 ± 3.09 percentage-point Clean-to-Watermarked minus Clean-to-Clean Macro-F1 difference, but its direction was inconsistent and most per-seed intervals included zero.This scoped analysis is not proof of diagnostic improvement or classifier-independent clinical equivalence; it evaluated the legacy-checkpoint watermark signal.Source: B. Diagnostic Fidelity Analysis · pp. 4–5

C. Robustness Against Clinical Distortions

  • Table II compares unmatched configurations: ECGWmark uses 32 channel bits versus 16 for classical methods, and transform methods can outperform it under listed AWGN conditions.The comparison is descriptive rather than a capacity- or distortion-matched superiority test; LSB, DCT-SVD, and SchurMark diagnostic comparisons are likewise descriptive because embedding configurations differ.Source: B. Diagnostic Fidelity Analysis · p. 4, C. Robustness Against Clinical… · p. 5, Table II · p. 5
  • 93.88%/90.27%/91.19% channel-bit accuracy was retained under +10/+30/+50 circular shifts, while evaluated classical configurations were near 50%; these shifts are not cropping or deletion.Training used AWGN, Gaussian smoothing, amplitude scaling, and circular shifting; filtering, quantization, resampling, deletion, and packet loss were evaluation-only.Source: C. Robustness Against Clinical… · p. 5
  • 99.41% clean, 98.05% under 20-dB AWGN, and 99.23% under band-pass filtering were reported for ECGWmark; under +10/+30/+50 shifts it scored 98.73%/75.64%/84.45%, while both transforms scored 0%.The capacity- and distortion-controlled comparison calibrated DCT-SVD and SchurMark on DS1 validation before DS2 testing.Source: C. Robustness Against Clinical… · p. 5
  • 99.86 ± 0.08% exact 16-bit recovery was achieved clean, versus 90.41 ± 0.18% under +30 shifts; recovery fell to 45.54 ± 2.46% under 50% packet loss.Across +10/+30/+50 shifts, recovery was 99.59 ± 0.04%, 90.41 ± 0.18%, and 96.51 ± 0.19%, respectively.Source: C. Robustness Against Clinical… · p. 5, Table IV · p. 6
  • Soft ECC improved exact recovery in seven of eight conditions, including clean recovery from 97.33 ± 0.23% to 99.86 ± 0.08%, but under +30 shifts it changed 92.53 ± 0.62% to 90.41 ± 0.18%.The parity-aware interleaver was selected on DS1-validation errors and held fixed across DS2, payload seeds, and attack conditions.Source: C. Robustness Against Clinical… · p. 6

D. Ablation Study on Physiological Loss

The ablation compares the full ECGWmark configuration with an MSE-only baseline, with differences reported in bit accuracy and Macro-F1. A waveform example provides qualitative context but does not replace the diagnostic metrics.

D. Ablation Study on Physiological Loss

  • The study compares the full framework with a baseline optimized strictly using MSE reconstruction constraints.Source: D. Ablation Study on Physiological Loss · p. 6
  • Fig. 2 highlights visible morphological differences across watermarked waveforms; this qualitative example complements, but does not replace, Macro-F1 and per-class diagnostic analysis.Source: Figure 2 · p. 6
  • Bit accuracy differed between the MSE-only and full configurations (55.84% versus 95.27%), as did Macro-F1 (26.66% versus 34.71%).Because multiple physiological and spectral constraints changed together, the difference does not isolate Ldiag or establish its causal effect alone.Source: D. Ablation Study on Physiological Loss · p. 6

IV. CONCLUSION

ECGWmark combines watermark extraction resilience with diagnostic evaluation, which shows mixed class-level effects. The conclusion also reports an ECC capacity–reliability trade-off and identifies directions for future work.

IV. CONCLUSION

  • Class-V sensitivity changes from 71.97% to 76.50%, while Macro-F1 and Class-S sensitivity decrease, indicating mixed diagnostic effects.Source: §IV · p. 7
  • Legacy-checkpoint ECC achieves 90.41–99.86% exact recovery across evaluated clean and shift conditions at code rate 0.5.The scheme encodes 16 logical bits into 32 channels.Source: §IV · p. 7
  • ECGWmark's frame-level localization mechanism demonstrates resilience under the evaluated temporal shifts.Source: §IV · p. 7
  • Future work will extend optimization to multi-lead ECGs and explore pruning, quantization, and integration with multimodal records.The stated aims include resource-constrained wearables and data-integrity and provenance tracking for remote monitoring.Source: §IV · p. 7

V. LIMITATIONS

The authors identify three limitations: a Class-S sensitivity trade-off, reduced recovery under severe packet loss, and the absence of keyed-security mechanisms.

V. LIMITATIONS

  • Class-S sensitivity decreases from 8.89% to 1.39%, and experiments do not isolate its physiological cause.The authors do not attribute the observed trade-off conclusively to watermark energy.Source: §V · p. 7
  • Recovery declines to 45.54% under 50% packet loss, for which the authors cite higher-layer retransmission or erasure coding.Source: §V · p. 7
  • Signal-representation-layer results do not establish keyed security because ECGWmark has no secret-key or signature mechanism.The cited detector results are from the legacy DS2 setting; revised-protocol and legacy-checkpoint evidence are kept separate.Source: §V · p. 7

Related papers

Loading 2610.13357v1…