Abstract: In the field of electrocardiogram classification, the adversarial samples generated by the traditional projected gradient algorithm with low generation efficiency have square waves that cannot be explained physiologically, and thus, a patch-based smooth attack perturbations (PatchSAP) algorithm is proposed. By conducting adversarial attacks against three common electrocardiogram classification models, convolutional neural network, long-short-term memory network, and attention-based long-short-term memory network, we compare the "vulnerability" of the electrocardiogram classification models, and analyze the hyperparameter to obtain the difference between validity and authenticity of adversarial examples. The experimental results show that the PatchSAP algorithm has obvious advantages in attack efficiency, and the generated adversarial samples maintain the sample authenticity well. Hyperparameters such as convolution kernel and constraint range have a great impact on the effectiveness and authenticity of adversarial examples.

Key words: single lead electrocardiogram, deep learning, adversarial attack, smoothing attack