Publications

Inversion from ECG Foundation Model

The 29th International Conference on Medical Image Computing and Computer Assisted Intervention (MICCAI 2026), Acceptance rate 28%, Strasbourg, France, pp. 311–321, 2026, doi: 10.1007/978-3-032-38260-3_30.

Junseok Lee, Seungwoo Jung, Gyeongsik Yang, Chuck Yoo

Download PDF

Abstract

Electrocardiogram (ECG) foundation models (FMs) are increasingly deployed as cloud services. For downstream tasks such as disease diagnosis, they return compact embeddings from input ECG signals. In this paper, we find that such embeddings pose significant privacy risks: adversaries can use the exposed embeddings and invert the original ECG, which leads to the inference of sensitive clinical attributes. To assess this vulnerability, we introduce SHINE, a new ECG inversion method that inverts ECG signals from the exposed embeddings. SHINE consists of ECG mapper and ECG inverter. Specifically, SHINE trains ECG mapper to approximate the embedding space of victim ECG FM, which is then used to synthesize the necessary data to train ECG inverter from scratch. Our evaluation against four state-of-the-art ECG FMs shows that SHINE achieves high-fidelity inversion. Importantly, the inverted ECGs retain sensitive clinical attributes, including cardiovascular disease indicators up to 99.6%, almost identical to the original ECG. These results demonstrate that the exposed ECG embeddings preserve substantial physiological information so that when deploying ECG FM, stronger security countermeasures need to be devised. To our knowledge, this paper is the first to report that the exposed embeddings can be inverted to the original ECG signals.

Paper summary

An embedding can still reveal the ECG

Compact ECG representations can retain sensitive information from the original signal.

ECG foundation models return embeddings for downstream tasks. This study asks whether an exposed embedding can be reconstructed into a waveform that preserves sensitive attributes, even when the reconstruction model has only limited query access to the original foundation model.

Test a two-stage reconstruction method

SHINE learns a mapper that approximates the foundation model’s embedding space from a limited set of query-response pairs. The mapper supplies additional synthetic training pairs for an ECG inverter, which is trained to reconstruct signals from embeddings.

The evaluation measures retained signal and classification information.

A learned mapper produces training pairs for the inverter, which reconstructs ECG signals from exposed embeddings.View full-size figure
A learned mapper produces training pairs for the inverter, which reconstructs ECG signals from exposed embeddings.

Measure waveform fidelity and attribute retention

The evaluation covers ECGFounder, MERL, ECGFM-KED and ST-MEM, training on PTB-XL and evaluating on CPSC2018. It reports waveform error, correlation and clinically relevant intervals, then applies the same downstream classifiers to original and reconstructed signals.

For ST-MEM with 1,000 direct query-response pairs, disease-classification AUROC on reconstructed signals reaches 99.6% of the AUROC on original signals. The result supports the paper’s finding that exposed embeddings can retain clinically sensitive information.

Complementary measurements used to assess information retained in reconstructed ECGs.
MeasurementWhat it assesses
Waveform error and correlationSignal similarity
ECG intervalsPreservation of waveform timing
Downstream classifier AUROCRetention of information used for classification

Key takeaways

  1. An embedding can retain sensitive signal information. The reconstruction attack demonstrates waveform information retained in compact ECG representations.
  2. Privacy leakage has more than a visual dimension. Waveform similarity and downstream attribute behavior reveal different aspects of what reconstruction preserves.
  3. Restricted queries still leave an attack surface. The mapper-assisted evaluation examines inversion when direct access to target responses is limited.