ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring

Adaptive conformal prediction is increasingly used in healthcare to improve the reliability of automated ECG monitoring by providing a set of plausible labels rather than a single point prediction. While this approach helps recover heartbeats missed by standard classifiers, it relies on feedback loops that update thresholds based on historical event data. The authors investigate whether the order in which these authentic events are processed—specifically under delayed feedback conditions—creates a vulnerability. They introduce ConformalShift, an adversarial attack that reorders the sequence of preceding events to manipulate the monitor's threshold for a target ventricular beat, effectively suppressing it from the conformal prediction set.

ConformalShift demonstrates that the temporal order of authentic information is a critical, yet overlooked, attack surface. In experiments using the MIT-BIH Arrhythmia Database, the attack successfully suppressed 66.7% of eligible ventricular targets for an Extra Trees classifier and 60.0% for a HistGradientBoosting classifier, significantly outperforming random reordering baselines (4.4% and 12.0%, respectively). The authors also show that these adversarial configurations can be transferred to the INCART dataset, achieving a 33.3% success rate without any dataset-specific tuning. The study further confirms that the attack's success is directly tied to the displacement budget; reducing the number of positions an event can be moved significantly weakens the attack's ability to manipulate the ventricular threshold.

This research highlights a fundamental security risk in adaptive healthcare monitoring systems. It proves that even when all data inputs, labels, and classifier outputs are authentic and unmodified, the system's decision-making process can be compromised simply by altering the timing of information delivery. This suggests that developers of adaptive medical monitors must consider the robustness of their feedback mechanisms against temporal manipulation, as current defenses typically focus on input perturbations rather than the order of event processing.