ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring

AI 中文解读

核心亮点：这项研究揭示了一个惊人的事实——即便心电图数据完全真实、波形和诊断结果都未被篡改，仅靠调整事件出现的先后顺序，就能让AI监护系统漏掉危险的早搏信号。通俗解读：想象一下，医院里的AI监护仪像一位按顺序批改作业的老师。如果学生把容易的题都放在前面，把难题藏在最后，老师批改到难题时可能已经疲惫，更容易出错。ConformalShift攻击就是利用了这种“顺序效应”，它不改变任何心电图数据本身，只是把之前的心跳事件重新排列，让AI在评估目标心跳时，误以为风险阈值已经降低，从而漏掉危险的室性早搏。实验显示，这种攻击能让漏检率从随机情况下的4%飙升至67%。实际影响：这项研究给医疗AI敲响了警钟。如果未来医院大规模使用自适应AI监护系统，黑客或内部人员无需篡改任何医疗数据，仅通过操控数据流的时序就能让AI“失明”，可能延误危重病人的救治。这也提醒医疗AI开发者，必须考虑数据到达顺序带来的漏洞，在系统设计中加入对抗性防御，确保监护系统的可靠性。对于普通人而言，这意味着在AI医疗落地前，我们需要更严格的验证标准来保障患者安全。

Adaptive conformal prediction can recover clinically important heartbeat classes missed by a point classifier, but delayed feedback makes its decisions sensitive to event order. We introduce ConformalShift, a bounded event-reordering attack that suppresses the ventricular class for rescued events without modifying ECG waveforms, labels, classifier scores, or the event multiset. ConformalShift searches for feasible permutations of authentic preceding events that lower the ventricular threshold before a selected target is evaluated. On disjoint MIT--BIH confirmation records, the attack suppressed 66.7% of eligible targets for Extra Trees and 60.0% for HistGradientBoosting, compared with random-schedule rates of 4.4% and 12.0%, respectively. Transferred configurations also outperformed random scheduling on INCART, while reducing the displacement budget weakened the attack on both datasets. These results show that adaptive monitors in healthcare can be compromised through the timing of authentic information, even when waveforms, labels, classifier outputs, and event contents remain unchanged.