Authors: Junseok Lee, Seungwoo Jung, Gyeongsik Yang, Chuck Yoo
Venue: The 29th International Conference on Medical Image Computing and Computer Assisted Intervention (MICCAI 2026), Acceptance rate 28%, Strasbourg, France, 2026. (Accepted) (2026)
Abstract: Electrocardiogram (ECG) foundation models (FMs) are increasingly deployed as cloud services. For downstream tasks such as disease diagnosis, they return compact embeddings from input ECG signals. In this paper, we find that such embeddings pose significant privacy risks: adversaries can use the exposed embeddings and invert the original ECG, which leads to the inference of sensitive clinical attributes. To assess this vulnerability, we introduce SHINE, a new ECG inversion method that inverts ECG signals from the exposed embeddings. SHINE consists of ECG mapper and ECG inverter. Specifically, SHINE trains ECG mapper to approximate the embedding space of victim ECG FM, which is then used to synthesize the necessary data to train ECG inverter from scratch. Our evaluation against four state-of-the-art ECG FMs shows that SHINE achieves high-fidelity inversion. Importantly, the inverted ECGs retain sensitive clinical attributes, including cardiovascular disease indicators up to 99.6%, almost identical to the original ECG. These results demonstrate that the exposed ECG embeddings preserve substantial physiological information so that when deploying ECG FM, stronger security countermeasures need to be devised. To our knowledge, this paper is the first to report that the exposed embeddings can be inverted to the original ECG signals.