# Side Channel-Assisted Inference Leakage from Machine Learning-based ECG Classification

arXiv: https://arxiv.org/abs/2304.01990 · HTML: https://mlsanity.com/paper/2304.01990/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 42 references that are in the map.
- First posted on arXiv 4 Apr 2023.

## Builds on (most cited first, 7 of 7)

- [Automatic diagnosis of the 12-lead ECG using a deep neural network](https://mlsanity.com/paper/1904.01949/) (2019)
- [Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures](https://mlsanity.com/paper/1808.04761/) (2018)
- [I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators](https://mlsanity.com/paper/1803.05847/) (2018)
- [Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks](https://mlsanity.com/paper/1810.03487/) (2018)
- [How to 0wn NAS in Your Spare Time](https://mlsanity.com/paper/2002.06776/) (2020)
- [Flush+Flush: A Fast and Stealthy Cache Attack](https://mlsanity.com/paper/1511.04594/) (2015)
- [Repttack: Exploiting Cloud Schedulers to Guide Co-Location Attacks](https://mlsanity.com/paper/2110.00846/) (2021)

## Abstract (arXiv)

The Electrocardiogram (ECG) measures the electrical cardiac activity generated by the heart to detect abnormal heartbeat and heart attack. However, the irregular occurrence of the abnormalities demands continuous monitoring of heartbeats. Machine learning techniques are leveraged to automate the task to reduce labor work needed during monitoring. In recent years, many companies have launched products with ECG monitoring and irregular heartbeat alert. Among all classification algorithms, the time series-based algorithm dynamic time warping (DTW) is widely adopted to undertake the ECG classification task. Though progress has been achieved, the DTW-based ECG classification also brings a new attacking vector of leaking the patients' diagnosis results. This paper shows that the ECG input samples' labels can be stolen via a side-channel attack, Flush+Reload. In particular, we first identify the vulnerability of DTW for ECG classification, i.e., the correlation between warping path choice and prediction results. Then we implement an attack that leverages Flush+Reload to monitor the warping path selection with known ECG data and then build a predictor for constructing the relation between warping path selection and labels of input ECG samples. Based on experiments, we find that the Flush+Reload-based inference leakage can achieve an 84.0% attacking success rate to identify the labels of the two samples in DTW.