{"id":"e035973c-3ac1-4986-8478-17de05f0726f","arxiv_id":"2608.03628","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Bounded reordering of authentic preceding ECG events can suppress ventricular-class recovery in adaptive conformal monitors, at rates far above random schedules.","lead":"A new attack, called ConformalShift, reorders authentic heartbeat records before they reach an adaptive ECG monitor, causing the monitor to miss ventricular beats it would otherwise catch. The paper shows that timing alone, not altered data, can silently break adaptive monitoring systems used in healthcare.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central 'can be compromised' claim assumes an attacker can reorder authentic telemetry events without detection; the paper never validates this capability against real clinical network protocols, so the practical threat remains unsubstantiated.","rationale":"The reader's weakest assumption correctly identifies the network reordering capability as the principal unverified premise. The paper's experiments demonstrate that within the assumed threat model, reordering authentic events can suppress ventricular rescue, and the gap over random schedules is statistically significant even with small confirmation sets (4/6 and 6/10 successes). The mathematical mechanism is clear from Equations (2)-(4), and the paper is transparent about hyperparameter dependence and the small target sets. However, the headline claim generalizes to real healthcare systems, which requires that the attack be physically and operationally achievable. The paper does not provide protocol-level evidence or a concrete deployment scenario showing that an attacker can reorder authentic ECG transmissions without detection. The suggested defenses in the Discussion implicitly concede that ordinary ordering guarantees would neutralize the attack, but the paper never tests whether such guarantees are present in the systems it purports to threaten. This is the single most load-bearing concern because it determines whether the finding is a practical vulnerability or a hypothetical scenario. A protocol analysis and a defensive robustness check would settle the issue. The reader's conditional verdict remains appropriate, so I recommend no change.","tokens_in":8135,"tokens_out":6113,"duration_ms":52947,"concrete_test":"Pick a representative clinical telemetry stack (e.g., HL7 v2 ORU over TCP, or a DICOM-ECG gateway with sequence-numbered messages) and produce a protocol-level analysis: can an active network attacker reorder up to 24 messages by displacement 8 while preserving authenticity and avoiding detection? Separately, implement a defensive monitor that rejects out-of-order or timestamp-verified feedback and re-run the MIT-BIH confirmation experiment; if suppression rates collapse to the random baselines (4.4% and 12.0%), the attack's success depends critically on the unvalidated reordering capability. Report both the protocol analysis and the robustness result.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim that adaptive monitors in healthcare 'can be compromised' rests entirely on the threat model of Section II-B, where a networked attacker can delay or reorder W=24 (or 16) preceding authentic transmissions within displacement d=8 (or 4) before the target, without being detected or violating protocol. The experiments simply simulate this capability; they provide no evidence that actual clinical telemetry pipelines permit such reordering. Most transport (e.g., TCP) preserves message order, and acquisition systems commonly stamp sequence numbers or timestamps, so a monitor that enforces FIFO (the paper's own baseline assumption at the start of Section I) would be immune. The Discussion even suggests defenses ('authenticate timestamps, reject stale feedback'), acknowledging that the attack can be neutralized by ordinary ordering guarantees, but the paper never establishes that the targeted systems lack these guarantees. Thus the strong headline 'can be compromised' outruns the evidence: the qualitative observation that feedback order affects adaptive thresholds is sound, but the practical attack is conditional on an unvalidated network capability. This is a scope limitation, not an internal inconsistency, but it is the load-bearing point for anyone deciding whether the result changes how real monitoring systems should be designed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces ConformalShift, an attack against an adaptive class-conditional conformal monitor used for ECG beat classification. The attacker is assumed to be able to reorder up to W authentic preceding events within a bounded displacement d, with feedback delayed by δ. The attack searches over feasible permutations to lower the ventricular threshold before a target ventricular beat that was rescued under FIFO processing, so that the ventricular class is excluded from the prediction set. The empirical protocol locks attack configurations on discovery records, evaluates on disjoint confirmation records (6 and 10 eligible targets), reports descriptive full-DS2 results and INCART transfer, and includes a displacement-budget ablation. The authors report targeted suppression rates well above random feasible schedules and conclude that adaptive monitors can be compromised through the timing of authentic information, even when waveforms, labels, classifier outputs, and event contents remain unchanged.","tokens_in":8354,"tokens_out":7623,"duration_ms":71153,"significance":"The paper has real strengths: the evaluation uses exact replay, configurations were frozen before confirmation, confirmation records were disjoint from discovery, Wilson intervals are reported, a random feasible-schedule baseline is included, and a displacement ablation and cross-dataset transfer test are performed. If the replay semantics are correct, the paper identifies a genuinely understudied attack surface for adaptive conformal prediction: feedback-order manipulation without altering any event content. This is relevant to the security evaluation of adaptive monitoring systems and to the design of defenses that preserve temporal integrity. However, the practical reach of the results is limited by an unvalidated network-level reordering capability and by the very small number of eligible confirmation targets.","major_comments":[{"comment":"The text says the miss indicator e_i is 'fixed when event i is originally evaluated,' which suggests it is computed in the original FIFO trajectory. Under a reordered schedule, however, the same event is evaluated at a different position with a different threshold, so whether it is covered or missed can change. If the replay in Section II-D keeps e_i fixed, the simulated monitor does not actually implement the update rule in Eq. (4), because a reordered covered event should be able to become a miss and vice versa. If e_i is instead recomputed at the event's actual position during replay, the sentence in Section II-A is incorrect, and the statement in Section II-C that 'reordering changes only the ventricular threshold' is not true for the preceding events. The manuscript must state unambiguously how e_i is obtained in the replayed schedule and confirm that the released code follows the same rule; the attack objective in Eq. (6) and the search algorithm both depend on this.","section":"Section II-A, Eq. (3)"},{"comment":"The threat model assumes that a networked attacker can delay or reorder up to W authentic transmissions within a displacement budget d without being detected or violating protocol, but no evidence is provided that clinical telemetry systems permit this. The Introduction itself describes FIFO as the normal mode, and Section IV acknowledges that authenticating timestamps or rejecting stale feedback would neutralize the attack. As written, the conclusion that adaptive monitors 'can be compromised' is stronger than what the experiments establish: they demonstrate sensitivity of the monitor to event order under an assumed reordering capability, not that such reordering is feasible in deployed systems. The paper should either provide a concrete protocol-level reordering scenario or restrict the headline claim to the stated threat model.","section":"Section II-B, Eq. (5)"},{"comment":"The independent confirmatory evidence rests on only 6 and 10 eligible targets on the two victims. The 95% Wilson intervals for the targeted suppression rates are 30.0%–90.3% and 31.3%–83.2%, so the point estimates 66.7% and 60.0% are not tightly determined; changing a single outcome moves the rate by 16.7 and 10 percentage points, respectively. Since the full-DS2 results include discovery records and the INCART transfer uses only 15 targets, the confirmatory claim should be accompanied by an explicit discussion of this precision, and ideally by a confidence interval or permutation test for the targeted-versus-random difference.","section":"Section III-C, Table II"}],"minor_comments":[{"comment":"The rates '66.7%' and '60.0%' in the abstract and results should be presented with their denominators (4/6 and 6/10) so that the small sample size is immediately visible.","section":"Abstract and Table II"},{"comment":"The experimental setup does not state how many confirmation records were used or how the 6 and 10 eligible targets were selected from them; a per-record breakdown would improve transparency.","section":"Section III-A"},{"comment":"The random baseline is described as the mean over 128 feasible schedules per target, but no dispersion measure or per-target variability is reported; adding a standard deviation or range would help calibrate the reported random rates.","section":"Table II"},{"comment":"The phrase 'single-seed results' for the INCART transfer appears only in the text; it should also appear as a footnote to Table II so that the uncertainty is visible to a reader who consults only the table.","section":"Section III-A"},{"comment":"References [5] and [6] are non-archival preprints by the same research group; if the related work relies on them, an archival version or independent source should be cited.","section":"References [5] and [6]"}],"recommendation":"major_revision","confidential_remarks":"The paper is worth pursuing: the idea is original and the experimental discipline is good given the small eligible-target counts. The two load-bearing issues are (1) the ambiguity over whether e_i is recomputed under the reordered schedule, which affects whether the simulated attack matches the real monitor, and (2) the gap between the unvalidated network reordering capability and the strong 'can be compromised' claim. Both are fixable with a revision. I would also encourage the editor to ask for clarification of how the confirmation records were chosen, because the independent evidence currently rests on very few targets."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth your time: this paper introduces a genuinely new attack class. Prior conformal attacks perturb inputs, labels, or calibration data; prior ECG attacks modify waveforms. ConformalShift changes only the order in which authentic events update an adaptive conformal monitor, and shows that this can suppress a rescued ventricular beat. That is new and it is demonstrated with disciplined methodology: configurations locked on discovery records, disjoint confirmation records, exact margin replay, Wilson intervals, and a displacement ablation that behaves as expected.\n\nThe central qualitative finding—feedback order affects adaptive conformal decisions in a structured, targetable way—holds up. The gaps over random schedules are large (66.7% vs 4.4%, 60.0% vs 12.0%), and the transfer to INCART without dataset-specific tuning is a nice touch. The paper also honestly labels the full-DS2 numbers as descriptive, which is rare and welcome.\n\nNow the soft spots, in proportion. The load-bearing one is the threat model. The attack assumes a networked attacker can delay or reorder up to 24 authentic transmissions within a displacement of 8, undetected, in a system whose stated baseline is FIFO. The paper never validates that real clinical telemetry pipelines permit this. TCP preserves order; sequence numbers and timestamps are common. The Discussion even suggests authenticating timestamps and rejecting stale feedback as defenses, which is an admission that ordinary ordering guarantees neutralize the attack. So the summary claim that adaptive monitors 'can be compromised' outruns the evidence: the qualitative phenomenon is real, but the practical attack surface is conditional on an unvalidated capability.\n\nThe second issue is the size of the confirmation sets: 6 and 10 eligible targets. The Wilson intervals are wide (30–90% and 31–83%), and the success rates amount to 4/6 and 6/10. That is suggestive, not stable. The paper needs larger confirmation sets or a pooled analysis across victims before those percentages should be taken at face value.\n\nMinor: the search and monitor hyperparameters (W, d, delta, beam width, restarts) are hand-picked per victim. The displacement ablation checks one of these, but not the others. That limits the quantitative generality, though not the qualitative point.\n\nBottom line: this is a solid, honest paper with a new idea and a sound core experiment. The weakness is in the threat-model justification, not in the internal logic. Who is it for? Researchers in adversarial ML, conformal prediction, and clinical telemetry security. Does it deserve a serious referee? Yes. I would send it out, with a clear request for (a) a feasibility analysis of reordering in real monitoring networks, (b) larger confirmation sets, and (c) a toned-down central claim. The qualitative contribution is strong enough that a revision addressing these points would make it a good paper.","headline":"Careful empirical demonstration of a new threat model—bounded reordering of authentic events—with honest methodology, but the practical 'can be compromised' claim rests on an unvalidated network capability.","tokens_in":8907,"tokens_out":1398,"would_cite":true,"duration_ms":14473,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Reordering only the timing of authentic ECG events can suppress ventricular rescue events without altering any waveforms, labels, scores, or event contents.","keywords":["adversarial machine learning","conformal prediction","ECG monitoring","event reordering","delayed feedback","ventricular ectopic beats","temporal integrity","adaptive conformal inference"],"falsifier":"Run the same ConformalShift configuration on the same MIT–BIH confirmation targets through a monitor that enforces FIFO delivery and authenticates timestamps (or rejects out-of-order packets); if targeted suppression drops to the random-schedule level (4.4% for Extra Trees, 12.0% for HistGradientBoosting) or lower, then the central claim—that timing alone can compromise adaptive monitors—fails for real networks.","tokens_in":7886,"feed_emoji":"🫀","tokens_out":6692,"duration_ms":52587,"temperature":0.7,"pith_summary":"The paper tries to prove that adaptive conformal ECG monitors, which keep per-class thresholds updated from delayed clinician feedback, can be attacked without changing any clinical content. An adversary who can reorder a small window of authentic events before a target beat can lower the ventricular threshold enough to drop the ventricular class from the prediction set, suppressing exactly the rescued events the monitor is meant to recover. If true, this means the safety of such monitors depends on the temporal integrity of the feedback stream, not just on classifier robustness or input integrity. The authors demonstrate the attack on two ECG datasets and show that restricting the allowed displacement weakens it, pointing toward a concrete defense direction.","feed_headline":"Reordering ECG events hides ventricular beats from monitors","feed_subtitle":"An attack that only changes which authentic ECG event arrives first suppresses rescue of ventricular beats at 60-67%.","key_machinery":"The central object is the adaptive class-conditional conformal monitor, which maintains per-class thresholds $q_{c,t}$; after a fixed delay $\\delta$, each event's missed or covered status updates its class threshold via equation (4), with thresholds decaying toward the initial value $q(0)$ by a recency factor $\\rho$. The attack's lever is the feasible permutation set $\\Pi_d = \\{\\pi\\in S_W : \\max_j |\\pi_j-j|\\le d\\}$, which captures bounded reordering of the $W$ authentic events before the target. The objective is the suppression margin $m(\\pi)=a_{t^\\ast,v}-q^\\pi_{v,t^\\ast}$; since the target score is invariant, the search reduces to lowering the ventricular threshold by moving covered ventricular feedback earlier and ventricular misses later. Beam search with local refinement evaluates candidate schedules by exact replay of the monitor and accepts only legal modifications that increase $m(\\pi)$.","core_discovery":"The paper claims that an adaptive class-conditional conformal monitor with delayed feedback has an order-dependent decision surface, and that a bounded reordering of authentic preceding events can steer the ventricular threshold downward before a target beat is evaluated. Because the target's nonconformity score is fixed, lowering the ventricular threshold is equivalent to increasing the suppression margin $m(\\pi)=a_{t^\\ast,v}-q^\\pi_{v,t^\\ast}$; a schedule that makes $m(\\pi)>0$ excludes the ventricular class from the prediction set even though the event was rescued under FIFO processing. ConformalShift finds such schedules by beam search and local refinement over the set $\\Pi_d$ of permutations in which no event moves more than $d$ positions. On disjoint MIT–BIH confirmation records it suppressed 66.7% of eligible Extra Trees targets and 60.0% of HistGradientBoosting targets, versus 4.4% and 12.0% for random schedules, and locked configurations transferred to INCART at 33.3% success. The paper concludes that adaptive monitors can be compromised through timing alone, with waveforms, labels, classifier outputs, and the event multiset unchanged.","pith_inferences":["The same mechanism would apply to any adaptive system with delayed, class-specific feedback, not just ECG monitoring; the paper demonstrates it on ECG but does not claim generality.","A practical defense not evaluated in the paper is timestamp authentication or rejecting stale feedback; if such defenses are deployed, the attack's success should collapse to the random-schedule baseline.","Because the attack changes only arrival order, content-based intrusion detection cannot catch it; monitors would need timing-based anomaly detection, which the paper does not address."],"forward_implications":["Adaptive conformal monitors used in healthcare should be stress-tested for feedback order and delay, not only for input perturbations, because order alone can suppress class recovery.","Restricting the maximum displacement of out-of-order delivery weakens the attack: on MIT–BIH Extra Trees, reducing $d$ from 8 to 4 dropped targeted suppression from 66.7% to 16.7%.","Attack configurations locked on MIT–BIH transferred to INCART with 33.3% success for both classifiers, indicating the vulnerability is not specific to a single dataset.","High aggregate coverage does not imply event-level safety: the monitors maintained coverage above 92% while selected rescued ventricular events were still suppressed."],"supporting_citations":[{"why":"Defines conformal prediction sets, the foundation for the class-conditional prediction sets the attack manipulates.","marker":"[9]"},{"why":"Provides online conformal prediction with decaying step sizes, a direct ancestor of the delayed-feedback adaptive monitor studied here.","marker":"[10]"},{"why":"Introduces adaptive conformal inference under distribution shift, the update-rule family that makes thresholds order-sensitive.","marker":"[11]"},{"why":"Studies online learning with local permutations and delayed feedback, the formal setting the paper's threat model builds on.","marker":"[16]"},{"why":"Represents prior work attacking ECG classifiers with adversarial examples, the baseline the paper contrasts with its content-preserving reordering attack.","marker":"[21]"}],"fun_headline_variants":["Timing attack silences ventricular beats in adaptive ECG monitors","Reordering authentic events hides ventricular class from monitors","Event-order shift suppresses 60-67% of rescued beats","ConformalShift: reorder preceding beats to break adaptive monitoring","Unchanged data, changed order: hidden ventricular suppression"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack presupposes that a networked attacker can delay or reorder up to 24 (or 16) authentic ECG transmissions within a bounded displacement of 8 (or 4) positions before the target without being detected or breaking protocol; if real monitors enforce FIFO delivery, authenticate timestamps, or reject out-of-order packets, the attack surface does not exist.","fun_headline_variants_meta":{"raw":{"variants":["Timing attack silences ventricular beats in adaptive ECG monitors","Reordering authentic events hides ventricular class from monitors","Event-order shift suppresses 60-67% of rescued beats","ConformalShift: reorder preceding beats to break adaptive monitoring","Unchanged data, changed order: hidden ventricular suppression"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000339,"raw_usage":{"total_tokens":1876,"prompt_tokens":953,"completion_tokens":923,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":843}},"tokens_in":569,"tokens_out":923,"duration_ms":8098,"temperature":1.0,"reasoning_tokens":843,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:48:08.540451+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same ConformalShift configuration on the same MIT–BIH confirmation targets through a monitor that enforces FIFO delivery and authenticates timestamps (or rejects out-of-order packets); if targeted suppression drops to the random-schedule level (4.4% for Extra Trees, 12.0% for HistGradientBoosting) or lower, then the central claim—that timing alone can compromise adaptive monitors—fails for real networks.","supporting_citations":[{"cited_title":"V ovk, A","cited_arxiv_id":null,"evidence_quote":"Defines conformal prediction sets, the foundation for the class-conditional prediction sets the attack manipulates."},{"cited_title":"Online conformal predic- tion with decaying step sizes,","cited_arxiv_id":null,"evidence_quote":"Provides online conformal prediction with decaying step sizes, a direct ancestor of the delayed-feedback adaptive monitor studied here."},{"cited_title":"Online learning with local permutations and delayed feedback,","cited_arxiv_id":null,"evidence_quote":"Studies online learning with local permutations and delayed feedback, the formal setting the paper's threat model builds on."},{"cited_title":"Adversarial Examples for Electrocardiograms","cited_arxiv_id":"1905.05163","evidence_quote":"Represents prior work attacking ECG classifiers with adversarial examples, the baseline the paper contrasts with its content-preserving reordering attack."}],"review_version":2}