ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring

Source: arXiv:2608.03628 · Published 2026-08-04 · By Arash Vashagh, Yasmin Vashagh

TL;DR

This paper investigates a novel attack vector on adaptive conformal prediction systems used in ECG monitoring, specifically targeting their temporal processing of feedback events rather than modifying inputs or model parameters. Adaptive conformal prediction systems enhance clinical safety by recovering missed arrhythmias such as ventricular ectopic beats via adaptive thresholding based on delayed physician feedback. The authors introduce ConformalShift, an adversarial event-reordering attack that permutes the order of authentic preceding events within a bounded displacement window to manipulate the adaptive monitor’s ventricular class threshold, thereby suppressing recovery of ventricular events missed by the point classifier but rescued by the adaptive conformal set. This attack preserves waveforms, labels, classifier outputs, and event multisets, altering only the order of delayed feedback to decrease the ventricular threshold before a target event is evaluated.

The authors validate ConformalShift on the MIT–BIH and INCART ECG datasets across two frozen classifiers (Extra Trees and HistGradientBoosting) and show substantial attack success rates (up to 66.7% suppression of eligible ventricular rescue events) well above random reorderings (approx. 4-12%). Attack effectiveness decreases with more restrictive displacement budgets, indicating the temporal flexibility of feedback updates is critical. Cross-dataset transfer with untuned configurations also achieves partial attack success, demonstrating that the vulnerability generalizes beyond the training distribution. The results reveal a previously unconsidered temporal integrity risk in adaptive ECG monitoring and call for robustness evaluations and defenses that protect the order and timing of authentic feedback, not just model inputs and parameters.

Key findings

• ConformalShift suppressed 66.7% of eligible ventricular rescue targets on MIT–BIH confirmation records using Extra Trees, compared with a random-schedule baseline of 4.4%.
• Using HistGradientBoosting on MIT–BIH confirmation, ConformalShift suppressed 60.0% of targets versus 12.0% for random schedules.
• On the full MIT–BIH DS2 dataset, ConformalShift suppressed 63.0% (Extra Trees) and 49.3% (HistGradientBoosting) of eligible targets, outperforming random baselines (7.7% and 10.8%).
• Transfer of attack configurations from MIT–BIH to INCART without dataset-specific tuning achieved 33.3% targeted suppression rates versus 5.0% and 4.5% for Extra Trees and HistGradientBoosting random schedules, respectively.
• Reducing the displacement budget (maximum allowed positional shift) from 8 to 4 on MIT–BIH lowered targeted suppression from 66.7% to 16.7%, showing attack success depends on temporal reordering flexibility.
• The mean margin gain (increase in the suppression margin changing ventricular threshold) was around 0.0491 for Extra Trees on MIT–BIH and decreased with budget restrictions.
• The attack requires only bounding event permutations; no waveform, label, or classifier output modifications occur.
• High conformal coverage (over 92%) and substantial ventricular rescue rates (over 70%) under clean FIFO order contrasted with selective suppression of rescued ventricular beats using ConformalShift, highlighting event-level vulnerability.

Threat model

The adversary is a white-box attacker capable of intercepting and reordering up to W authentic preceding ECG events within a bounded displacement budget d before a target ventricular event, without modifying waveforms, verified labels, classifier outputs, or event content. They cannot add, delete, or forge new events, nor alter the target event itself. The attacker exploits the delayed feedback processing in adaptive conformal monitors to change event order and thereby manipulate class-specific thresholds, causing the monitor to suppress ventricular rescue events. The attacker does not influence classifier training or input signals directly, nor can they circumvent cryptographic protections of event authenticity if present.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is a white-box attacker who knows the frozen classifier, monitors, and feedback delay, and can reorder the transmission of W authentic preceding events before a selected ventricular target event. They cannot modify ECG waveforms, labels, classifier probabilities, or event contents, and must preserve the event multiset. The attacker is constrained by a maximum displacement budget d limiting how far each event can be reordered. The goal is to suppress ventricular beats that the conformal monitor rescues (i.e., events missed by the point classifier but included in the conformal prediction set). The target event's position is fixed, and only the immediate preceding W events may be reordered.

2. Data: Two publicly available ECG datasets are used: MIT–BIH Arrhythmia Database (standard inter-patient DS1/DS2 split) and INCART 12-lead Arrhythmia Database (22 training patients, 10 test patients). Annotations are mapped to 5 AAMI heartbeat classes (N, S, V, F, Q). ECG signals are windowed, normalized, and featurized into 21 shape and spectral features per beat. For MIT–BIH, one ECG channel with 360 samples per window; for INCART, lead II with resized windows. Dataset splits ensure testing on disjoint patients and records. Label feedback to the monitor is delayed by δ events.

3. Architecture / Algorithm: Frozen classifiers Extra Trees and HistGradientBoosting output per-class softmax probabilities pt,c for each beat. Nonconformity scores at,c = 1 - pt,c define inclusion in the prediction set via adaptive class-specific thresholds qc,t. Threshold vectors qt are updated with decayed past values and delayed feedback of miss indicators (determined from verified labels). The monitor updates only thresholds, not classifier parameters, adapting thresholds with feedback delay δ and recency factor ρ.

The ConformalShift attack formulates a feasible set Πd of permutations of the W preceding events with max displacement d. For each permutation π, the conformal monitor is replayed to compute the ventricular threshold qv,t* at the target event t*. The suppression margin m(π) = at*,v - qv,t* measures if ventricular class is excluded (> 0 means suppression). The attack seeks π* that maximizes m(π), suppressing ventricular rescue by lowering the threshold below the fixed target nonconformity score.

4. Training Regime: Classifiers are trained on training partitions with usual hyperparameters; these are frozen during attack evaluation. Conformal monitor's hyperparameters α=0.1 (miscoverage rate), η=0.08 (adaptation rate), ρ=0.995 (recency), threshold bounds qmin and qmax, delay δ (4 for Extra Trees MIT–BIH, 2 for HistGradientBoosting), and window sizes W (24 or 16) are tuned on discovery data and fixed for evaluation.

5. Evaluation Protocol: Targets are selected as ventricular events initially missed by the point classifier but included by conformal set under FIFO order. Success is when ConformalShift produces a feasible reorder π with positive suppression margin excluding ventricular from the set. Attack success rate is fraction of eligible targets suppressed. Baselines include averaging over 128 random feasible reorderings per target under the same constraints. Experiments run on held-out MIT–BIH confirmation records and on transfer to INCART without tuning. Ablation evaluates impact of displacement budget d on attack success.

6. Reproducibility: Open-source code and scripts are released at the provided GitHub link. Datasets are publicly available but data licenses and patient privacy govern access. Configurations and random seeds are reported for critical experiments. Exact weight seeds for classifiers mentioned for reproducibility. Some evaluation (e.g., INCART transfer) uses single seed.

Concrete Example: For a ventricular beat t* missed by the point classifier, ConformalShift explores reorderings of up to W=24 preceding events with d=8 position shift maximum. A beam search with width 256 explores schedules that reorder events with different feedback classes and maturities, evaluating how their relative ordering impacts the adaptive ventricular threshold at t*. Candidate reorderings that move covered ventricular feedback earlier or missed ventricular feedback later reduce the ventricular threshold at t*, thereby excluding ventricular from the conformal set prediction. The best schedule π* is selected by maximizing suppression margin m(π). Figure 2 illustrates such a schedule that lowers the ventricular threshold from 0.9592 to 0.8804, changing the target margin from -0.0528 to 0.0260 and successfully suppressing the ventricular class inclusion.

Technical innovations

• Formulation of bounded event reordering as an adversarial attack on adaptive conformal prediction thresholds that preserves all input data and classifier outputs but manipulates feedback order.
• Development of a constrained beam search algorithm tailored to explore permutations of preceding authentic events within a displacement budget while maximizing suppression margin on ventricular thresholds.
• Demonstration that temporal processing order alone can adversarially steer adaptive conformal monitors in clinical ECG monitoring, revealing a new temporal integrity attack surface beyond traditional input perturbations.
• Empirical validation on multiple ECG datasets and classifiers, including realistic feedback delay modeling and cross-dataset transfer of attack configurations, establishing the generality of the vulnerability.

Datasets

• MIT–BIH Arrhythmia Database — 48 half-hour ECG records — public PhysioNet dataset
• INCART 12-lead Arrhythmia Database — 75 records from 33 subjects — public PhysioNet dataset

Baselines vs proposed

• Random feasible schedule on MIT–BIH confirmation with Extra Trees: ventricular suppression success = 4.4% vs ConformalShift: 66.7%
• Random feasible schedule on MIT–BIH confirmation with HistGradientBoosting: 12.0% vs ConformalShift: 60.0%
• Random feasible schedule on MIT–BIH full DS2 with Extra Trees: 7.7% vs ConformalShift: 63.0%
• Random feasible schedule on MIT–BIH full DS2 with HistGradientBoosting: 10.8% vs ConformalShift: 49.3%
• Random feasible schedule on INCART with Extra Trees: 5.0% vs ConformalShift (transfer): 33.3%
• Random feasible schedule on INCART with HistGradientBoosting: 4.5% vs ConformalShift (transfer): 33.3%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2608.03628.

Fig 1: Overview of the ConformalShift threat model. Under ordinary FIFO processing, authentic events are handled in their

Fig 2: Successful ConformalShift attack on MIT–BIH record 214. Panels (a) and (b) show the original FIFO order and

Limitations

• Attack assumes white-box knowledge of classifier and monitor states; partial or black-box attackers remain untested.
• Only two frozen classifiers and one adaptive conformal update rule were evaluated; generality to other architectures is unknown.
• Evaluation on retrospective datasets with fixed feedback delays may not reflect real-world clinical timing variations or network conditions.
• Constrained to reordering W preceding events within a displacement budget d; larger reorderings or long-delay attacks not explored.
• Cross-dataset transfer results on INCART are based on a small target set (15 targets) and single random seed, limiting statistical confidence.
• Defenses such as authenticated timestamps and delay bounding proposed but not implemented or tested experimentally.

Open questions / follow-ons

• How effective is ConformalShift under partial attacker knowledge or black-box access to the monitor and classifier?
• Can the attack be generalized to other adaptive conformal update rules, target classes beyond ventricular, or different domains with delayed feedback?
• What are effective real-time defenses or detection mechanisms to ensure temporal integrity of adaptive monitors in deployed healthcare systems?
• How do varying or uncertain feedback delays and asynchronous physician labeling affect the robustness of adaptive conformal predictors and the attack's effectiveness?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, ConformalShift highlights the importance of considering temporal integrity and event ordering in adaptive prediction and monitoring systems. Just as adversaries can exploit timing and order manipulation in clinical ECG monitoring, attackers might similarly target adaptive or stateful defenses that incorporate delayed feedback or sequential updates by reordering valid event streams rather than altering input content.

This work underscores that robustness evaluations must extend beyond classic input perturbations to include attacks on feedback delay, event ordering, and temporal state management. Systems applying conformal prediction or similar adaptive monitoring in security contexts should enforce strict timestamp authentication, limit out-of-order processing, and monitor for anomalous changes in internal adaptive thresholds or states to mitigate such novel reorder-based attacks.

Cite

@article{arxiv2608_03628,
  title={ ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring },
  author={ Arash Vashagh and Yasmin Vashagh },
  journal={arXiv preprint arXiv:2608.03628},
  year={ 2026 },
  url={https://arxiv.org/abs/2608.03628}
}

Read the full paper

• arXiv:2608.03628 (abstract)
• arXiv:2608.03628 (PDF)