Organizations: University of California, Irvine Irvine, California, United States · Arizona State University Tempe, Arizona, United States · California State University, Dominguez Hills Carson, California, United States
Foundation-style ECG encoders pretrained with self-supervised learning are increasingly reused across tasks, institutions, and deployment contexts, often through model-as-a-service interfaces that expose scalar scores or latent representations. While such reuse improves data efficiency and generalization, it raises a participation privacy concern: can an adversary infer whether a specific individual or cohort contributed ECG data to pretraining, even when raw waveforms and diagnostic labels are never disclosed? In connected-health settings, training participation itself may reveal institutional affiliation, study enrollment, or sensitive health context. We present an implementation-grounded audit of membership inference attacks (MIAs) against modern self-supervised ECG foundation encoders, covering contrastive objectives (SimCLR, TS2Vec) and masked reconstruction objectives (CNN- and Transformer-based MAE). We evaluate three realistic attacker interfaces: (i) score-only black-box access to scalar outputs, (ii) adaptive learned attackers that aggregate subject-level statistics across repeated queries, and (iii) embedding-access attackers that probe latent representation geometry. Using a subject-centric protocol with window-to-subject aggregation and calibration at fixed false-positive rates under a cross-dataset auditing setting, we observe heterogeneous and objective-dependent participation leakage: leakage is most pronounced in small or institution-specific cohorts and, for contrastive encoders, can saturate in embedding space, while larger and more diverse datasets substantially attenuate operational tail risk. Overall, our results show that restricting access to raw signals or labels is insufficient to guarantee participation privacy, underscoring the need for deployment-aware auditing of reusable biosignal foundation encoders in connected-health systems.
Figures & tables
Figure 1. Motivation and threat surface in connected health. A foundation encoder trained on biosignal cohorts may be deployed through exposed interfaces, enabling membership inference and participation privacy leakage.
Figure 2. Participation privacy threat model in a connected-health ecosystem. A private patient cohort ( Strain ) is aggregated to train a foundation ECG encoder ( fθ ), which is subsequently deployed through a utility interface. An adversary probes the deployed encoder via observable outputs (e.g., scalar scores or aggregated statistics) and auxiliary public data ( Saux ) to infer whether a target subject contributed to pretraining.
Dataset
Cohort / acquisition (from PhysioNet)
Orig. fs
Leads
Typical length
#Used windows
BUTQDB ( Nemcova et al., 2020 )
Single-lead long-term recordings collected for ECG quality assessment; Holter-style ambulatory signals (wearable / mobile setting).
1000 Hz
1
≥ 24 h
344,660
CHFDB ( Baim et al., 1986 )
Long-term ECG from congestive heart failure patients; continuous ambulatory recordings.
250 Hz
2
∼ 20–24 h
215,177
LTDB ( Goldberger et al., 2000b )
Long-term ST/ischemia-related ECG with prolonged ambulatory monitoring; annotated ST episodes in long recordings.
250 Hz
1–2
∼ 21–24 h
106,157
MIT-BIH Arrhythmia ( Moody and Mark, 2001 )
Clinical arrhythmia benchmark; annotated two-lead excerpts widely used for rhythm/beat analysis.
360 Hz
2
30 min
20,017
SHAREE ( Melillo et al., 2015 )
Ambulatory recordings from a hypertensive cohort with Holter-style monitoring; multi-signal release includes ECG channels.
128 Hz
2 ECG (+aux)
24 h
2,296,925
Table 1. Diverse real-world ECG corpora used in this study. We report (i) intrinsic dataset properties (cohort, acquisition setting, original sampling rate, available leads, and typical record duration) from the official PhysioNet releases, and (ii) the effective scale used in our workspace after our deterministic preprocessing. Preprocessing (shared across all datasets): we resample all signals to 250 Hz, extract 10-second windows with 5-second stride, select a single ECG channel (prefer lead II when available; otherwise use an available ECG lead), remove non-finite values, and apply per-record z -normalization before caching windows to disk. These datasets jointly cover heterogeneous acquisition devices, cohort sizes, and recording durations, reflecting practical connected-health conditions rather than a single curated benchmark.
Dataset
SimCLR-CNN
TS2Vec
MAE-CNN
MAE-Transformer
BUTQDB
[0.931|0.833|0.823]
[0.639|0.375|0.365]
[0.722|0.333|0.323]
[0.528|0.200|0.190]
CHFDB
[0.620|0.333|0.323]
[0.560|0.333|0.323]
[ 0.800 | 0.375 | 0.365 ]
[0.734|0.333|0.323]
LTDB
[0.594|0.333|0.323]
[0.522|0.000|0.000]
[ 0.596 | 0.500 | 0.490 ]
[0.556|0.333|0.323]
MITDB
[0.585| 0.301 | 0.291 ]
[ 0.594 |0.260|0.250]
[0.592|0.210|0.200]
[0.591|0.196|0.186]
SHAREE
[0.647|0.231|0.221]
[0.627| 0.254 | 0.244 ]
[ 0.667 |0.221|0.211]
[0.588|0.117|0.107]
Table 2. Learned membership inference. Results represent [AUC|[email protected]|Adv] evaluated under a mixed-dataset non-member setting . Bold indicates the highest leakage for each dataset.
Dataset
SimCLR-CNN
TS2Vec
MAE-CNN
MAE-Transformer
BUTQDB
[0.912| 0.800 | 0.790 ]
[0.778|0.333|0.323]
[ 0.944 |0.667|0.657]
[0.556|0.143|0.133]
CHFDB
[0.580|0.250|0.240]
[0.600|0.000|0.000]
[ 0.760 |0.600|0.590]
[0.720| 0.625 | 0.615 ]
LTDB
[ 0.594 |0.250|0.240]
[0.556|0.000|0.000]
[0.533|0.000|0.000]
[0.574| 0.333 | 0.323 ]
MITDB
[0.639|0.221|0.211]
[ 0.647 |0.000|0.000]
[0.563|0.063|0.053]
[0.606| 0.320 | 0.310 ]
SHAREE
[ 0.637 | 0.137 | 0.127 ]
[0.556|0.000|0.000]
[0.490|0.000|0.000]
[0.599|0.000|0.000]
Table 3. Score-only membership inference. Comparison of leakage using only scalar outputs. Small non-zero artifacts in TPR are corrected to 0.000, and negative advantage scores are clipped to 0.000. Bold indicates the highest leakage for each dataset.
Dataset
SimCLR-CNN
TS2Vec
MAE-CNN
MAE-Transformer
BUTQDB
[ 1.000 | 1.000 | 0.990 ]
[ 1.000 | 1.000 | 0.990 ]
[0.750|0.571|0.561]
[0.610|0.286|0.276]
CHFDB
[ 1.000 | 1.000 | 0.990 ]
[ 1.000 | 1.000 | 0.990 ]
[0.710|0.429|0.419]
[0.550|0.143|0.133]
LTDB
[0.750|0.667|0.657]
[0.680|0.333|0.323]
[0.520|0.000|0.000]
[0.510|0.000|0.000]
MITDB
[0.680|0.348|0.338]
[0.660|0.304|0.294]
[0.550|0.174|0.164]
[0.540|0.130|0.120]
SHAREE
[0.690|0.261|0.251]
[0.680|0.275|0.265]
[0.580|0.145|0.135]
[0.520|0.058|0.048]
Table 4. Embedding-access membership inference. Results ( [AUC|[email protected]|Adv] ) for an adversary probing the latent representation space using k NN. Contrastive models (SimCLR, TS2Vec) show extreme leakage in embedding space, while MAE models often leak less through embeddings than through reconstruction error (compare to Table 3 ).
Figure 3. Impact of learned attackers over score-only attacks in single-dataset pretraining. Each cell reports Δ\textscauc=\textscauclearned−\textscaucscore . Positive values indicate that training a learned attacker improves separability; negative values indicate that an objective-aligned score-only rule is stronger.
Figure 4. Learned-attack AUC across datasets and encoder families for single-dataset pretraining. The dashed line indicates chance-level AUC of 0.5. Leakage varies substantially across objectives and datasets, and the most severe cases occur in small-cohort settings.
Universitat Rovira i Virgili, Department of Computer Engineering and Mathematics, CYBERCAT-Center for Cybersecurity Research of Catalonia, ComSCIAM-Center for Computational Science and Applied Mathematics Av. Països Catalans 26, 43007 Tarragona, Catalonia