Decorrelative Network Architecture for Robust Electrocardiogram Classification

TL;DR

An ensemble approach based on feature decorrelation and Fourier partitioning for teaching networks diverse features, reducing the chance of perturbation-based fooling and demonstrating superior uncertainty estimation on projected gradient descent and smooth adversarial attacks of various magnitudes is proposed.

Abstract

Artificial intelligence has made great progress in medical data analysis, but the lack of robustness and trustworthiness has kept these methods from being widely deployed. As it is not possible to train networks that are accurate in all scenarios, models must recognize situations where they cannot operate confidently. Bayesian deep learning methods sample the model parameter space to estimate uncertainty, but these parameters are often subject to the same vulnerabilities, which can be exploited by adversarial attacks. We propose a novel ensemble approach based on feature decorrelation and Fourier partitioning for teaching networks diverse complementary features, reducing the chance of perturbation-based fooling. We test our approach on single and multi-channel electrocardiogram classification, and adapt adversarial training and DVERGE into the Bayesian ensemble framework for comparison. Our results indicate that the combination of decorrelation and Fourier partitioning generally maintains performance on unperturbed data while demonstrating superior robustness and uncertainty estimation on projected gradient descent and smooth adversarial attacks of various magnitudes. Furthermore, our approach does not require expensive optimization with adversarial samples, adding much less compute to the training process than adversarial training or DVERGE. These methods can be applied to other tasks for more robust and trustworthy models.

Figures (7)

• Figure 1: Example of proposed AI augmented clinical workflow for monitoring ECG signals in a patient population. Data are first processed by a deep learning model, which infers a class for each signal (e.g., healthy or diseased) and judges the confidence of each inference. Signals classified with low confidence are reviewed by human experts.
• Figure 2: Sample results from the Physionet 2017 data. Left: Examples of projected gradient descent (PGD) and smooth adversarial perturbations (SAP) in the ECG dataset. Right: correct (green) or incorrect (red) aggregate inferences of each ensemble network (normal rhythm, atrial fibrillation, other rhythm, or noise) along with the inferred class probability P and normalized uncertainty score $I_{norm}$.
• Figure 3: Difference in average normalized uncertainty between incorrect and correct samples (higher is better) on PGD (left) and SAP (right) adversarial samples with respect to attack magnitude $\varepsilon$. Top: PhysioNet 2017. Bottom: CPSC 2018
• Figure 4: % of misclassified cases with respect to % of cases deferred to the deep ensemble in the natural only dataset experiments for PhysioNet 2017 (left) and CPSC 2018 (right). Numbers are AUCs (lower is better).
• Figure 5: % of misclassified cases with respect to % of cases deferred to the deep ensemble in the partially attacked dataset experiments for PhysioNet 2017 (left) and CPSC 2018 (right). Numbers are AUCs (lower is better).