Beyond Input Stability: Redefining Adversarial Robustness in Embedded Medical AI

Beyond Input Stability: Redefining Adversarial Robustness in Embedded Medical AI | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Beyond Input Stability: Redefining Adversarial Robustness in Embedded Medical AI Rajesh Nayak This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9030126/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Current approaches to adversarial robustness in embedded medical AI inherit definitions from general-purpose machine learning— chiefly, stability under small input perturbations measured by Lp norms. We argue this is fundamentally insufficient for life-critical diagnostic devices. Using cardiac wearables with embedded ECG classifiers as our case study, we demonstrate that the adversarial threat surface extends to physical-layer signal injection, supply chain poisoning, and firmware compromise—each with distinct threat actors and real-world feasibility. We provide experimental evidence on the MIT-BIH Arrhythmia Database (87,906 beats) that adversarial attacks cause catastrophic recall degradation: a Random Forest ECG classifier achieving 96.2% arrhythmia recall drops to 50.9% under FGSM attack and 45.3% under a transfer attack using a surrogate model— confirming that model opacity is insufficient defense. We further demonstrate that single-signal physiological anchor checks achieve near-chance AUC (0.274–0.553) against amplitudesmoothing attacks, because such attacks preserve signal-level statistics while corrupting classifier-relevant features. This negative result motivates the core thesis of our Context-Aware Adaptive Inference (CAAI) framework: robust defense requires crossparameter physiological coupling across multiple sensor modalities, not single-signal analysis. We formalize this as an open research problem and characterize the gap between single-modal and multi-modal anchoring as the primary obstacle to clinically deployable adversarial defense. Artificial Intelligence and Machine Learning adversarial machine learning embedded medical AI ECG classification cardiac wearables and physiological anchoring Full Text Additional Declarations The authors declare no competing interests. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9030126","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":600612243,"identity":"fffb2d75-bf59-4eb0-b110-5a2401234d78","order_by":0,"name":"Rajesh Nayak","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABIUlEQVRIie2QMUvDQBTHXwjoknBOchKxX+HJgTr0w7yjkCylFLq4mSlO4loR9AO4VALB8TaXBNcTlxRXhRaXBgqatEqXJDo63G95/zvux3v3AAyG/wmBFa6CbS/x84yt7oZ/VMAZ2rRXHQh/6bNRZjahqnKLcnyuptPiAQZs3HtFjlsD8XQnZzlCh+2qWmU/pZ5wUxhx7QtCdEZH+j3m5WCHV9dUq3Ag37MikKEmoQi5lehsUimELw0Ky4OiKJVbHXwohWjF4yxetCqcfHBLZaL7QoZIcsIukvYuPO95bsTlffo2EoBKcO0mJ+WEzX9hfTkvoq68eQxiD5bqgF1m8fPitNthXr0C4NBqC7Dz84DTei/NbKt1Zd91EwwGg8Gw5gv4FmOn0C0x4wAAAABJRU5ErkJggg==","orcid":"https://orcid.org/0009-0005-0902-7140","institution":"","correspondingAuthor":true,"prefix":"","firstName":"Rajesh","middleName":"","lastName":"Nayak","suffix":""}],"badges":[],"createdAt":"2026-03-04 12:14:37","currentVersionCode":1,"declarations":{"humanSubjects":false,"vertebrateSubjects":false,"conflictsOfInterestStatement":false,"humanSubjectEthicalGuidelines":false,"humanSubjectConsent":false,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":false},"doi":"10.21203/rs.3.rs-9030126/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9030126/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":104402369,"identity":"3d80b0be-84af-4225-b321-d9f0330c6907","added_by":"auto","created_at":"2026-03-11 12:15:11","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1006266,"visible":true,"origin":"","legend":"","description":"","filename":"VisionPapersubmission1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9030126/v1_covered_0b939223-5ff9-4a54-a376-1ef60dca88dc.pdf"}],"financialInterests":"The authors declare no competing interests.","formattedTitle":"\u003cp\u003eBeyond Input Stability: Redefining Adversarial\u003c/p\u003e\n\u003cp\u003eRobustness in Embedded Medical AI\u003c/p\u003e","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"adversarial machine learning, embedded medical AI, ECG classification, cardiac wearables, and physiological anchoring","lastPublishedDoi":"10.21203/rs.3.rs-9030126/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9030126/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eCurrent approaches to adversarial robustness in embedded medical AI inherit definitions from general-purpose machine learning— chiefly, stability under small input perturbations measured by Lp norms. We argue this is fundamentally insufficient for life-critical diagnostic devices. Using cardiac wearables with embedded ECG classifiers as our case study, we demonstrate that the adversarial threat surface extends to physical-layer signal injection, supply chain poisoning, and firmware compromise—each with distinct threat actors and real-world feasibility.\u003c/p\u003e\n\u003cp\u003eWe provide experimental evidence on the MIT-BIH Arrhythmia Database (87,906 beats) that adversarial attacks cause catastrophic recall degradation: a Random Forest ECG classifier achieving 96.2% arrhythmia recall drops to 50.9% under FGSM attack and 45.3% under a transfer attack using a surrogate model— confirming that model opacity is insufficient defense.\u003c/p\u003e\n\u003cp\u003eWe further demonstrate that single-signal physiological anchor checks achieve near-chance AUC (0.274–0.553) against amplitudesmoothing attacks, because such attacks preserve signal-level statistics while corrupting classifier-relevant features. This negative result motivates the core thesis of our Context-Aware Adaptive Inference (CAAI) framework: robust defense requires crossparameter physiological coupling across multiple sensor modalities, not single-signal analysis. We formalize this as an open research problem and characterize the gap between single-modal and multi-modal anchoring as the primary obstacle to clinically deployable adversarial defense.\u003c/p\u003e","manuscriptTitle":"Beyond Input Stability: Redefining Adversarial\nRobustness in Embedded Medical AI","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-03-05 12:58:18","doi":"10.21203/rs.3.rs-9030126/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"c461fd51-6760-4dd5-a77a-c6989ab853c0","owner":[],"postedDate":"March 5th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":63915030,"name":"Artificial Intelligence and Machine Learning"}],"tags":[],"updatedAt":"2026-03-05T12:58:18+00:00","versionOfRecord":[],"versionCreatedAt":"2026-03-05 12:58:18","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9030126","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9030126","identity":"rs-9030126","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}