Pith. sign in

REVIEW 2 major objections 7 minor 29 references

ECG anonymizer kills re-identification, keeps diagnosis perfect

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-08 18:28 UTC pith:JCZRCJUQ

load-bearing objection Strong empirical ECG anonymizer; the orthogonality mechanism is measured in the wrong space but the method works regardless. the 2 major comments →

arxiv 2607.06037 v1 pith:JCZRCJUQ submitted 2026-07-07 cs.CR cs.LG

REAN: Reconstruction-aware ECG Anonymization Based on Privacy--Utility Orthogonality

Taerin Ki , Sunghwan Park , Junyoung Park , Jaewoo Lee This is my paper
classification cs.CR cs.LG
keywords ECG anonymizationprivacy-utility trade-offgradient orthogonalitybiometric re-identificationsignal reconstructionU-Netarrhythmia diagnosisPhysioNet
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that the privacy-utility trade-off in ECG anonymization is escapable because the directions in signal space that carry biometric identity and the directions that carry diagnostic information are nearly orthogonal (measured at about 90 degrees). REAN exploits this geometry by training a 1-D U-Net with frozen diagnostic and biometric classifiers: the U-Net learns a bounded, input-conditioned residual that moves the signal along the privacy direction, suppressing identity, gender, and age information while leaving arrhythmia diagnosis essentially untouched. On four PhysioNet databases, REAN drives re-identification accuracy from 0.96 to 0.00 (chance) while keeping arrhythmia macro-AUROC statistically indistinguishable from clean ECG (0.9991 vs 0.9982). The method anonymizes in a single forward pass, transfers to unseen attacker architectures, and resists signal purification.

Core claim

The central discovery is that biometric and diagnostic information in ECG signals occupy near-orthogonal directions in signal space, measured via input gradients of frozen classifiers at approximately 89.8 degrees. This orthogonality means a learned residual can suppress identity along the privacy direction with negligible effect on the utility direction, allowing a single U-Net forward pass to produce an anonymized waveform where re-identification collapses to chance while arrhythmia diagnosis remains at clean-signal levels.

What carries the argument

A 1-D U-Net that adds a bounded residual (tanh-scaled to a maximum amplitude of 0.08) to the raw ECG, trained with a combined objective of utility preservation (cross-entropy from a frozen diagnostic classifier), privacy suppression (maximized cross-entropy from three frozen biometric classifiers for identity, gender, and age), and distortion limitation (PRD plus L1 norm).

Load-bearing premise

The paper measures gradient orthogonality on clean ECG signals and assumes it persists as the U-Net perturbs the signal during training, but does not verify that the near-90-degree angle holds along the optimization trajectory away from the clean signal manifold.

What would settle it

If the orthogonality angle between utility and privacy gradients degrades significantly as the U-Net residual grows from zero to its trained value, the combined objective would face conflicting gradients and the privacy-utility balance would collapse.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • ECG sharing pipelines could deploy REAN as a pre-sharing filter that strips patient identity without requiring per-record optimization, enabling real-time anonymization at sub-millisecond latency.
  • The orthogonality observation suggests that other biomedical signals carrying both diagnostic and biometric information (e.g., EEG, PPG) may exhibit similar geometric separability, motivating analogous anonymizers.
  • The deterministic-leakage limitation under retraining-aware adversaries means that formal privacy guarantees for shared ECG data would still require stochastic mechanisms layered on top of REAN's geometric approach.
  • Clinical workflows that currently avoid sharing raw ECG due to privacy concerns could adopt REAN-transformed signals for secondary research use without degrading diagnostic quality.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If orthogonality arises because QRS morphology carries identity while P-T morphology and rhythm carry diagnosis, then signals where diagnostic and biometric features share the same morphological substructure (e.g., certain genetic cardiac conditions with QRS-based diagnosis) may not exhibit the same separability, bounding the scope of the approach.
  • The observation that gradient orthogonality holds across different classifier backbones (ResNet, InceptionTime, CNN-LSTM) suggests the property is intrinsic to the ECG signal structure rather than an artifact of a particular model architecture, which could extend to other biosignals with analogous feature decompositions.
  • A natural test would measure whether the orthogonality angle changes for pathological ECG subtypes where QRS shape is itself diagnostically relevant (e.g., bundle branch block), since those cases would collapse the separation between identity-carrying and diagnosis-carrying directions.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 7 minor

Summary. The paper proposes REAN, a 1-D U-Net that anonymizes raw ECG signals by exploiting the near-orthogonality of utility (arrhythmia diagnosis) and privacy (biometric re-identification, gender, age) gradients in ECG signal space. The core observation is that input gradients of diagnostic and biometric losses on clean ECG are nearly orthogonal (approximately 89.8 degrees in input space, 93.8 degrees in classifier parameter space), which motivates a joint training objective where privacy is suppressed without sacrificing diagnostic utility. REAN is trained with frozen diagnostic and biometric classifiers and produces anonymized ECGs in a single forward pass. On four PhysioNet databases, REAN drives re-identification accuracy from 0.964 to chance (0.000) while keeping arrhythmia macro-AUROC statistically indistinguishable from clean (0.9991 vs. 0.9982). The paper includes ablations, robustness checks under unseen attacker architectures, input purification, and a retraining-aware adversary analysis.

Significance. The paper addresses a practically important problem (ECG re-identification) with a clean, well-motivated approach. The empirical results are strong: REAN is the only method among seven baselines that simultaneously achieves chance-level re-identification and clean-level diagnostic AUROC, with PRD in the diagnostic-quality range. The ablation (Table VIII) cleanly separates the roles of each loss term. The robustness evaluation under unseen attacker architectures (Table V) and input purification (Table IV) is commendable and goes beyond what many anonymization papers provide. The honest reporting of retraining-aware recovery (Table VI) and the data-processing inequality limitation (Section VI) is appropriate. The single-pass inference (0.117 ms/window) is a practical advantage over per-sample methods like REACT. The orthogonality observation, while not formally proven to hold along the optimization trajectory, is empirically grounded and provides a useful design principle.

major comments (2)
  1. Section III-A, Eq. (2) and the surrounding text: The theoretical justification for why the privacy-utility trade-off is 'escapable' invokes orthogonality of gradients in the U-Net's parameter space (theta_UN), but Section II-B measures orthogonality in two different spaces: input space (nabla_x L, 89.8 degrees) and frozen classifier parameter space (nabla_theta_clf L, 93.8 degrees). By the chain rule, nabla_{theta_UN} L = (partial x_hat / partial theta_UN)^T nabla_{x_hat} L, and the shared Jacobian can rotate and correlate the two directions. The paper does not verify that orthogonality holds in the U-Net parameter space or at anonymized outputs x_hat. The empirical training dynamics (diagnostic CE 0.075 to 0.076 while privacy CE rises 100x) provide indirect evidence of low conflict, but this is post-hoc. The claim in Section III-A that 'the two objectives behave as independent' during U
  2. Section IV-B, Table III: The main evaluation uses a shared 500-window set. While the 20,000-window REAN-only check (Section IV-B) is reassuring, the baseline comparison on 500 windows is relatively small given 186 subjects. The per-subject clustered bootstrap for the AUROC confidence interval is appropriate, but the privacy metrics (ReID, gender, age) on 500 windows lack confidence intervals. Given that REAN achieves ReID 0.000 on 500 windows, a Wilson interval would still be approximately [0.000, 0.007], which is above the random-chance floor of 0.005. The paper should report these intervals or clarify that 500 windows is sufficient to distinguish REAN from baselines, which it clearly is given the large gaps in Table III.
minor comments (7)
  1. Section II-B: The paper notes that two random vectors in R^2000 are already nearly orthogonal, and argues the causal consequence (Gaussian noise collapses AUROC to 0.62 while privacy-direction perturbation preserves it) rules out coincidence. This is a reasonable argument but could be strengthened by comparing against random unit vectors in signal space directly, rather than full-signal Gaussian noise which differs in magnitude distribution.
  2. Table III: Gender is reported as raw binary accuracy with a caveat that below-chance values are invertible. This is methodologically sound but makes cross-method comparison awkward. Consider adding a 'gender distance from 0.5' column or marking invertible values distinctly.
  3. Section III-B, Eq. (3): The amplitude bound epsilon_max=0.08 is described as validation-selected, but the relationship between epsilon_max and the normalized signal range is not fully specified. Clarifying the typical peak-to-peak amplitude of normalized ECG windows would help readers assess whether 0.08 is a large or small perturbation relative to the signal.
  4. Section IV-A: The per-participant temporal split (70/15/15) means every subject appears in train, validation, and test. This is appropriate for the closed-set re-identification threat model but differs from the more challenging open-set (unseen-subject) setting. The limitation is acknowledged in Section VI but could be noted earlier in Section IV-A.
  5. Fig. 1: The privacy and utility axes are labeled with percentages but the exact computation is not fully clear from the figure caption. A brief note on how the combined score is computed would improve clarity.
  6. Section VI: The data-processing inequality argument (I(x_hat; y_a) <= I(x; y_a)) is correct but the phrasing 'rather than equality' may confuse readers unfamiliar with the DPI, since the inequality already permits equality. Consider rephrasing to emphasize that DPI does not guarantee a strict reduction.
  7. References [2], [5], [6], [8] are dated 2025-2026. If these are accepted or published works, the dates are fine; if some are arXiv preprints, they should be marked as such.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for a careful and constructive report. The referee correctly identifies that the paper's two main empirical claims—chance-level re-identification with clean-level diagnostic AUROC, and robustness under unseen attackers—are well-supported, and the recommendation is minor revision. We address both major comments below. In brief: (1) the referee is mathematically correct that orthogonality in input/classifier-parameter space does not automatically imply orthogonality in U-Net parameter space, and we will revise the manuscript to soften the claim from a statement of fact to a design principle supported by empirical training dynamics; (2) we will add Wilson confidence intervals for the privacy metrics on the 500-window evaluation set and clarify that the gaps between REAN and all baselines are large enough that the intervals do not affect any comparison conclusion.

read point-by-point responses

  1. Referee: Section III-A, Eq. (2): The theoretical justification for why the privacy-utility trade-off is 'escapable' invokes orthogonality of gradients in the U-Net's parameter space (theta_UN), but Section II-B measures orthogonality in two different spaces: input space (nabla_x L, 89.8 degrees) and frozen classifier parameter space (nabla_theta_clf L, 93.8 degrees). By the chain rule, nabla_{theta_UN} L = (partial x_hat / partial theta_UN)^T nabla_{x_hat} L, and the shared Jacobian can rotate and correlate the two directions. The paper does not verify that orthogonality holds in the U-Net parameter space or at anonymized outputs x_hat. The empirical training dynamics (diagnostic CE 0.075 to 0.076 while privacy CE rises 100x) provide indirect evidence of low conflict, but this is post-hoc. The claim in Section III-A that 'the two objectives behave as independent' during U-Net training is not直接lyd

    Authors: The referee is mathematically correct. By the chain rule, orthogonality of the input-space gradients ∇_x L_util and ∇_x L_priv does not formally guarantee orthogonality of the U-Net parameter-space gradients ∇_{θ_UN} L_util and ∇_{θ_UN} L_priv, because the shared Jacobian ∂x̂/∂θ_UN can rotate and correlate the two directions. The same applies to the classifier-parameter-space measurement (93.8°). We acknowledge this gap honestly and will revise the manuscript accordingly. Specifically, we will make the following changes: (1) Soften the claim in Section III-A. The sentence 'the two objectives behave as independent directions' will be revised to state that the input-space orthogonality provides a design principle—motivating the joint objective—and that the extent of conflict during U-Net training is an empirical question. (2) Reframe the logical structure. The argument will be: the input-space measurement (Section II-B) motivates the hypothesis that privacy and utility directions are separable in ECG signal space; the training dynamics (diagnostic CE 0.075→0.076 while privacy CE rises ~100×) provide empirical evidence that this separability is realized during optimization; but we do not claim a formal proof that orthogonality is preserved under the Jacobian mapping. (3) Add an explicit caveat noting that verifying orthogonality in θ_UN space or at anonymized outputs x̂ would require measuring the full Jacobian, which is computationally prohibitive for the U-Net architecture used, and that we rely on the training-dynamics evidence as the operational validation. We agree with the referee that the current phrasing overstates what the orthogonality measurement establishes, and the revision will make the logical chain transparent: observation (input-space) → design principle → revision: yes

  2. Referee: Section IV-B, Table III: The main evaluation uses a shared 500-window set. While the 20,000-window REAN-only check (Section IV-B) is reassuring, the baseline comparison on 500 windows is relatively small given 186 subjects. The per-subject clustered bootstrap for the AUROC confidence interval is appropriate, but the privacy metrics (ReID, gender, age) on 500 windows lack confidence intervals. Given that REAN achieves ReID 0.000 on 500 windows, a Wilson interval would still be approximately [0.000, 0.007], which is above the random-chance floor of 0.005. The paper should report these intervals or clarify that 500 windows is sufficient to distinguish REAN from baselines, which it clearly is given the large gaps in Table III.

    Authors: This is a fair point. We will add Wilson score confidence intervals for the privacy metrics (ReID, gender, age) on the 500-window evaluation set in Table III. The referee's calculation is correct: for ReID at 0/500, the 95% Wilson interval is approximately [0.000, 0.007], which technically includes the random-chance floor of 0.005 (1/186 ≈ 0.0054). We will report this transparently and add a clarifying note. The key point, which the referee acknowledges, is that the intervals do not affect any comparison conclusion: the gaps between REAN and every baseline are large (the next-best ReID among privacy-protective methods is 0.004 for PP-VAE, whose Wilson interval is approximately [0.000, 0.014], and all other baselines are far higher), so the 500-window set is sufficient to distinguish REAN from baselines. For the specific question of whether REAN's ReID is distinguishable from the random-chance floor itself, we note that the 20,000-window REAN-only evaluation (ReID 0.00025, i.e., 5/20,000) provides a much tighter interval that is clearly consistent with chance. We will add a sentence cross-referencing this larger-scale result for readers who want tighter bounds on the chance-level claim. We will also add Wilson intervals for gender and age, where the intervals are well-separated from both baselines and the relevant chance levels. revision: yes

Circularity Check

0 steps flagged

No significant circularity: orthogonality is measured independently on clean ECG before training; loss weights are fitted but not renamed as predictions.

full rationale

The paper's central geometric observation (Section II-B) is established independently: input-gradient and parameter-gradient angles between utility and privacy losses are measured on clean ECG using frozen classifiers, before any anonymizer is trained. No self-citation chain is load-bearing for this measurement. The training objective (Section III-A) invokes orthogonality to argue that the privacy and utility losses can be optimized together with little conflict, and the empirical training dynamics (diagnostic CE 0.075→0.076 while privacy CE rises 100×) provide post-hoc evidence consistent with this claim. The skeptic correctly notes a gap: orthogonality is measured at clean inputs and in classifier parameter space, not in the U-Net's parameter space at anonymized outputs, and the chain-rule Jacobian (∂x̂/∂θ_UN) could rotate the gradients. This is a correctness risk (the theoretical justification may not hold as stated), not circularity: the paper does not define orthogonality in terms of REAN's output, nor does it fit a parameter and rename the fit as a first-principles prediction. The loss weights (1.51, 0.153, 0.323, 1.46) and ε_max=0.08 are selected via Bayesian optimization on validation data to approach the ideal privacy-utility-distortion corner; the paper transparently calls this 'selected on validation data by Bayesian optimization' rather than presenting it as a derived or predicted quantity. The main results (ReID 0.96→0.00, AUROC 0.9982 vs 0.9991) are evaluated on held-out test data against external baselines, not on the fitted validation set. No step in the derivation chain reduces to its inputs by construction.

Axiom & Free-Parameter Ledger

7 free parameters · 3 axioms · 0 invented entities

The paper introduces no new physical entities or particles. The U-Net, classifiers, and loss functions are standard. The free parameters are hyperparameters selected by Bayesian optimization on validation data, which is standard practice but introduces fitting to the evaluation metrics.

free parameters (7)
  • loss weight L_util = 1.51
    Selected by Bayesian optimization on validation data
  • loss weight L_priv = 0.153
    Selected by Bayesian optimization on validation data
  • loss weight PRD = 0.323
    Selected by Bayesian optimization on validation data
  • loss weight L1 = 1.46
    Selected by Bayesian optimization on validation data
  • amplitude bound epsilon_max = 0.08
    Selected as smallest validation value at which biometric inference reaches chance while PRD stays in diagnostic-quality band
  • U-Net base width C = 32
    Architecture choice
  • U-Net resolution levels = 4
    Architecture choice
axioms (3)
  • domain assumption Near-orthogonality of privacy and utility gradients holds along the optimization trajectory, not just at clean inputs
    Section II-B establishes orthogonality on clean ECG; Section III-A assumes this permits joint optimization without conflict, but does not verify it holds as the signal is perturbed
  • domain assumption Frozen biometric classifiers define the privacy threat model
    Section III-A: three frozen ECGViT models and a frozen 1-D ResNet define the training signal and threat model; a weak classifier would overstate privacy
  • standard math Data-processing inequality bounds but does not eliminate residual biometric structure in deterministic maps
    Section VI: invoked to explain retraining-aware leakage

pith-pipeline@v1.1.0-glm · 16299 in / 2428 out tokens · 447353 ms · 2026-07-08T18:28:18.123499+00:00 · methodology

0 comments
read the original abstract

A shared electrocardiogram (ECG) is itself a biometric fingerprint that can re-identify a patient and reveal personal information. Recent ECG anonymizers transform the signal before sharing to reduce privacy leakage. However, existing methods still face a privacy--utility trade-off, in which preserving privacy often compromises utility while preserving utility reveals personal information. We propose \emph{REAN} (\emph{RE}construction-aware ECG \emph{AN}onymizer), a raw ECG signal anonymizer, to address this privacy--utility trade-off. REAN reconstructs the signal using a 1-D U-Net trained with losses from frozen privacy and utility classifiers to reduce privacy leakage while preserving utility. The privacy and utility gradients are near-orthogonal ($\approx$93.8$^\circ$), so reducing privacy leakage leaves utility almost unchanged. On four public PhysioNet databases, REAN achieves the strongest privacy--utility balance among raw ECG signal baselines. It drives re-identification to chance (0.96$\to$0.00), keeps arrhythmia macro-AUROC at the clean level (Clean 0.9982 vs.\ REAN 0.9991), and maintains re-identification protection under unseen privacy-classifier architectures.

Figures

Figures reproduced from arXiv: 2607.06037 by Jaewoo Lee, Junyoung Park, Sunghwan Park, Taerin Ki.

Figure 1
Figure 1. Figure 1: The privacy–utility trade-off across ECG anonymizers. The lock marks [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: ECG waveform for a normal cardiac cycle. Identity is carried mostly [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Pairwise cosine between the parameter-space gradients of the utility [PITH_FULL_IMAGE:figures/full_fig_p002_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: REAN framework, shown as three design steps above the training and inference pipelines. (1) On clean ECG the utility and privacy gradients [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Waveforms on a representative 8 s test window. Each panel overlays [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Privacy–utility–speed. x: arrhythmia macro-AUROC (↑); y: privacy protection (1−normalized leakage, ↑); bubble size: PRD (distortion); color: relative speed (fastest = 1; green fast, red slow). This aggregate uses the raw leakage metrics in Table III; the binary-gender inversion caveat is reported separately in the table caption. REAN reaches the high-utility, high-protection corner while staying in the fas… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

29 extracted references · 29 canonical work pages · 5 internal anchors

  1. [1]

    Ecg unveiled: Analysis of client re-identification risks in real-world ecg datasets,

    Z. Wang, A. Kanduri, S. A. H. Aqajari, S. Jafarlou, S. R. Mousavi, P. Liljeberg, S. Malik, and A. M. Rahmani, “Ecg unveiled: Analysis of client re-identification risks in real-world ecg datasets,” in2024 IEEE 20th International Conference on Body Sensor Networks (BSN), pp. 1–4, IEEE, 2024

    work page 2024

  2. [2]

    TransECG: Leveraging Transformers for Explainable ECG Re-identification Risk Analysis

    Z. Wang, E. Khatibi, K. Kazemi, I. Azimi, S. Mousavi, S. Malik, and A. M. Rahmani, “Transecg: Leveraging transformers for explainable ecg re-identification risk analysis,”arXiv preprint arXiv:2503.13495, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  3. [3]

    Linkage attacks expose identity risks in public ecg data sharing,

    Z. Wang, E. Khatibi, F. Firouzi, S. R. Mousavi, K. Chakrabarty, and A. M. Rahmani, “Linkage attacks expose identity risks in public ecg data sharing,” in2025 47th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC), pp. 1–7, IEEE, 2025

    work page 2025

  4. [4]

    Ecg de-anonymization: Real-world risks and a privacy-by-design mitigation strategy,

    H. Aguelal and P. Palmieri, “Ecg de-anonymization: Real-world risks and a privacy-by-design mitigation strategy,” in2025 IEEE 38th International Symposium on Computer-Based Medical Systems (CBMS), pp. 449–456, IEEE, 2025

    work page 2025

  5. [5]

    React: Reinforcement learning-based adaptive ecg anonymization and privacy threat mitigation,

    A. Datta, T. Bhattacharyya, E. Khatibi, A. Seth, Z. Wang, S. R. Mousavi, A. M. Rahmani, F. Firouzi, and K. Chakrabarty, “React: Reinforcement learning-based adaptive ecg anonymization and privacy threat mitigation,” in2025 IEEE International Conference on Omni-layer Intelligent Systems (COINS), pp. 1–8, IEEE, 2025

    work page 2025

  6. [6]

    Ai- enabled privacy-preserving cardiac diagnostics via electrocardiograms,

    F. S. Shishir, C. J. Harvey, A. Gupta, A. Noheria, and S. Shomaji, “Ai- enabled privacy-preserving cardiac diagnostics via electrocardiograms,” Scientific Reports, 2026

    work page 2026

  7. [7]

    Privecg: Generating private ecg for end-to-end anonymization,

    A. Nolin-Lapalme, R. Avram, and H. Julie, “Privecg: Generating private ecg for end-to-end anonymization,” inMachine Learning for Healthcare Conference, pp. 509–528, PMLR, 2023

    work page 2023

  8. [8]

    Privacy-preserving ecg data collection for arrhythmia classification,

    H. Lee, M. Kim, and Y . D. Chung, “Privacy-preserving ecg data collection for arrhythmia classification,”Biomedical Signal Processing and Control, vol. 112, p. 108374, 2026

    work page 2026

  9. [9]

    Algorithms for hyper- parameter optimization,

    J. Bergstra, R. Bardenet, Y . Bengio, and B. K ´egl, “Algorithms for hyper- parameter optimization,”Advances in neural information processing systems, vol. 24, 2011

    work page 2011

  10. [10]

    U-net: Convolutional networks for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” inInternational Conference on Medical image computing and computer-assisted intervention, pp. 234– 241, Springer, 2015

    work page 2015

  11. [11]

    The weighted diagnostic distortion (wdd) measure for ecg signal compression,

    Y . Zigel, A. Cohen, and A. Katz, “The weighted diagnostic distortion (wdd) measure for ecg signal compression,”IEEE transactions on biomedical engineering, vol. 47, no. 11, pp. 1422–1430, 2000

    work page 2000

  12. [12]

    The impact of the mit-bih arrhythmia database,

    G. B. Moody and R. G. Mark, “The impact of the mit-bih arrhythmia database,”IEEE engineering in medicine and biology magazine, vol. 20, no. 3, pp. 45–50, 2001

    work page 2001

  13. [13]

    Physiobank, physiotoolkit, and physionet: Components of a new research resource for complex physiologic signals,

    A. L. Goldberger, L. A. N. Amaral, L. Glass, J. M. Hausdorff, P. C. Ivanov, R. G. Mark, J. E. Mietus, G. B. Moody, C.-K. Peng, and H. E. Stanley, “Physiobank, physiotoolkit, and physionet: Components of a new research resource for complex physiologic signals,”Circulation, vol. 101, no. 23, pp. e215–e220, 2000. RRID:SCR 007345

    work page 2000

  14. [14]

    St petersburg incart 12-lead arrhythmia database. 2008,

    V . Tihonenko, A. Khaustov, S. Ivanov, A. Rivin, and E. Yakushenko, “St petersburg incart 12-lead arrhythmia database. 2008,”PhysioBank PhysioToolkit and PhysioNet, 2008

    work page 2008

  15. [15]

    Physiobank, physiotoolkit, and physionet: components of a new research resource for complex physiologic signals,

    A. L. Goldberger, L. A. Amaral, L. Glass, J. M. Hausdorff, P. C. Ivanov, R. G. Mark, J. E. Mietus, G. B. Moody, C.-K. Peng, and H. E. Stanley, “Physiobank, physiotoolkit, and physionet: components of a new research resource for complex physiologic signals,”circulation, vol. 101, no. 23, pp. e215–e220, 2000

    work page 2000

  16. [16]

    Shdb-af: a japanese holter ecg database of atrial fibrillation,

    K. Tsutsui, S. B. Brimer, N. Ben-Moshe, J. M. Sellal, J. Oster, H. Mori, Y . Ikeda, T. Arai, S. Nakano, R. Kato,et al., “Shdb-af: a japanese holter ecg database of atrial fibrillation,”Scientific data, vol. 12, no. 1, p. 454, 2025

    work page 2025

  17. [17]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016

    work page 2016

  18. [18]

    Decoupled Weight Decay Regularization

    I. Loshchilov and F. Hutter, “Decoupled weight decay regularization,” arXiv preprint arXiv:1711.05101, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  19. [19]

    SGDR: Stochastic gradient descent with warm restarts,

    I. Loshchilov and F. Hutter, “SGDR: Stochastic gradient descent with warm restarts,” inProc. Int. Conf. Learning Representations (ICLR),

    work page

  20. [20]

    Proximal Policy Optimization Algorithms

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Prox- imal policy optimization algorithms,”arXiv preprint arXiv:1707.06347, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  21. [21]

    On the theory of filter amplifiers,

    S. Butterworthet al., “On the theory of filter amplifiers,”Wireless Engineer, vol. 7, no. 6, pp. 536–541, 1930

    work page 1930

  22. [22]

    De-noising by soft-thresholding,

    D. L. Donoho, “De-noising by soft-thresholding,”IEEE transactions on information theory, vol. 41, no. 3, pp. 613–627, 1995

    work page 1995

  23. [23]

    Smoothing and differentiation of data by simplified least squares procedures.,

    A. Savitzky and M. J. Golay, “Smoothing and differentiation of data by simplified least squares procedures.,”Analytical chemistry, vol. 36, no. 8, pp. 1627–1639, 1964

    work page 1964

  24. [24]

    Extracting and composing robust features with denoising autoencoders,

    P. Vincent, H. Larochelle, Y . Bengio, and P.-A. Manzagol, “Extracting and composing robust features with denoising autoencoders,” inProceedings of the 25th international conference on Machine learning, pp. 1096–1103, 2008

    work page 2008

  25. [25]

    Inceptiontime: Finding alexnet for time series classification,

    H. Ismail Fawaz, B. Lucas, G. Forestier, C. Pelletier, D. F. Schmidt, J. Weber, G. I. Webb, L. Idoumghar, P.-A. Muller, and F. Petitjean, “Inceptiontime: Finding alexnet for time series classification,”Data mining and knowledge discovery, vol. 34, no. 6, pp. 1936–1962, 2020

    work page 1936

  26. [26]

    Privacy-Preserving ECG Data Analysis with Differential Privacy: A Literature Review and A Case Study

    A. Ghazarian, J. Zheng, and C. Rakovski, “Privacy-preserving ecg data analysis with differential privacy: A literature review and a case study,” arXiv preprint arXiv:2406.13880, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  27. [27]

    T. M. Cover and J. A. Thomas,Elements of information theory (wiley series in telecommunications and signal processing). Wiley-interscience, 2006

    work page 2006

  28. [28]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” inTheory of cryptography conference, pp. 265–284, Springer, 2006

    work page 2006

  29. [29]

    Deep Variational Information Bottleneck

    A. A. Alemi, I. Fischer, J. V . Dillon, and K. Murphy, “Deep variational information bottleneck,” inProc. Int. Conf. Learning Representations (ICLR), 2017. arXiv:1612.00410

    work page internal anchor Pith review Pith/arXiv arXiv 2017