PhysioTRACE: Provenance-Aware Stress Tests for Physiological Foundation Models

Ayana Mussabayeva; Anuar Aimoldin; Olivier Oullier; Xue Liu; Kun Zhang

cs.LGSep 28, 2026

PhysioTRACE: Provenance-Aware Stress Tests for Physiological Foundation Models

Authors: Ayana Mussabayeva, Anuar Aimoldin, Olivier Oullier, Xue Liu, Kun Zhang

Organizations: Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), Abu Dhabi, UAE · McGill University, Montreal, Canada · Carnegie Mellon University, Pittsburgh, USA

Abstract

Physiological foundation models encode how a signal was recorded alongside the physiology it reflects. When recording conditions are associated with diagnosis, this acquisition provenance can become a shortcut, yet the usual evidence, shifted transfer and provenance decodability, does not show whether a predictor uses it. We introduce PhysioTRACE, a four-axis behavioral audit for frozen encoders that separates what a probe can decode from what a fixed task head relies on. Recover scores how decodable provenance is; Stress reverses only the provenance-target association on the same held-out records; Intervene removes a train-localized provenance component; and Verify certifies that removal only if it beats matched random projections within a declared utility margin. Each audit thus ends in one of three verdicts: no reliance, or reliance with the remedy certified or refused. Across EEG and ECG, five training objectives, and five frozen foundation models, the relation between Recover's calibrated score and out-of-distribution utility changes sign between datasets, so neither can stand in for a reliance test. On paired EEG views where the shortcut is known by construction, the audit detects it (the exposed head loses about 0.2 AUROC when the association is reversed, while a control head is unaffected) and certifies removal of a rank-two component that restores control-level behavior without measurable utility loss, for both encoder objectives tested. On real ECG device metadata it returns all three verdicts: it certifies a remedy that removes 91% of one model's excess vulnerability, finds no reliance where device and diagnosis are barely associated, and refuses the remedy for a second model whose localized direction also carries task signal. Robustness to how inputs were recorded therefore needs a behavioral test, and PhysioTRACE provides one that can pass, fail, or refuse a remedy.

Figures & tables

Figure 1: Acquisition provenance as a shortcut. (a) Provenance $u$ , such as device or reference, shapes the recorded waveform $x$ of latent physiology $z$ and is associated with the target $y$ only through data collection. (b) A frozen encoder retains a low-rank provenance component $\mathbf{U}$ ; the exposed head $f_{s}$ is fitted where $y$ and $u$ are associated, the control head $f_{c}$ with $y\perp u$ . (c) NMT stress test (Appendix Table 14 ): reversing only the $y$ – $u$ association lowers $f_{s}$ by the excess vulnerability $G$ , while $f_{c}$ , and $f_{s}$ with $\mathbf{U}$ removed, are unaffected.

Figure 2: The four PhysioTRACE axes. Recover measures how decodable provenance $u$ is from the frozen embedding $h$ with a calibrated probe, reported as LPI (Equation 1 ). Stress changes only the $y$ – $u$ association on the same records and compares the fixed exposed and control heads through $G$ (Equations 2 – 3 ). Intervene removes a train-localized component $\mathbf{U}$ with $T_{\mathbf{U}}$ (Equation 4 ); $\tilde{h}$ denotes train-whitened coordinates. Verify certifies the remedy only if it beats matched random controls and keeps the utility loss within $\delta$ (Section 3.4 ). Colors and shapes denote provenance groups.

Figure 3: Accessibility and transfer decouple. Each point is a shared-backbone objective (blue; five encoder seeds) or a frozen foundation model (orange) on ERP/P300 (left; domains are paradigms) or PTB-XL (right; domains are sites). Horizontal bars: LPI with identity-aware 95% intervals. Vertical bars: OOD AUROC,

\pm 1

SD over five fits. LPI is comparable only within a dataset; values are in Appendix Table 3 .

	Paired EEG (NMT)		Observational ECG (PTB-XL devices)
	Task-only	Task + recon.	ECGFounder	ECGFounder, weak pair	CLEF-Small
Excess vulnerability $G$	0.197	0.225	0.023	0.00007	0.060
$G$ after suppression	$-$ 0.001	0.001	0.002	–	0.022
Beats all random controls	yes	yes	yes	–	yes
Utility change	0.000	0.001	$-$ 0.004	–	$-$ 0.039
95% lower bound	$-$ 0.004	$-$ 0.001	$-$ 0.006	–	$-$ 0.044

Table 1: PhysioTRACE verdicts for all five audits.

G

(Equation 3 ) is shown before and after removing the train-localized component, heads fixed. A remedy is certified if it beats all random controls and the 95% lower bound of the utility change stays above

-\delta

. NMT: rank 2, 10 controls per seed; ECG: rank 1, 100 controls,

\varepsilon=0.01

. Dashes: axis not reached; intervals: Appendix Table 20 .

Figure 4: Targeted removal is specific, and Verify refuses it when it costs utility. (a) NMT, per encoder seed, averaged over reference rotations; (b) ECGFounder, means over five patient-disjoint folds (each random control is also fold-averaged); the two panels use different

G

scales. In both, targeted removal reduces

G

beyond every rank- and energy-matched random control. (c) Utility change (targeted minus original) with 95% bootstrap intervals (Appendix I ); shading marks the declared margin, 0.02 for NMT and 0.01 for ECG. NMT and ECGFounder stay inside it and are certified; CLEF-Small does not.

Appendix figures & tables33 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Removal operator	How the removed component is chosen	How removal is evaluated
INLP	Iterated null-space projection	Successive linear classifiers for the property	Property decodability after removal; downstream bias or task metrics
Amnesic Probing	INLP projection	Linear classifiers for the property	Change in the model’s own task behavior, against random directions of equal dimension
LEACE	Closed-form least-squares erasure	Cross-covariance of embedding and property	Guarantee that no linear classifier beats a constant predictor; downstream effects
PhysioTRACE	Whitened rank- $p$ projection (Eq. 4 )	Paired within-record view contrasts, or a target-conditional probe fitted on training data	Added: fixed-marginal association stress on the same held-out records (Eq. 2 ); excess vulnerability against a control head fitted without the association (Eq. 3 ); paired same-record contrast (Eq. 7 ); fixed task heads; utility check against a declared margin. Reused: rank- and energy-matched random controls

Appendix

Table 2: PhysioTRACE relative to INLP ( Ravfogel et al., 2020 ) , Amnesic Probing ( Elazar et al., 2021 ) , and LEACE ( Belrose et al., 2023 ) .

Setting	Model / objective	OOD AUROC	Worst AUROC	LPI [95% interval]
ERP	Task-only	$0.816\pm 0.017$	$0.754\pm 0.013$	$0.485\ [0.215,0.702]$
	Augmentation-only	$0.826\pm 0.010$	$0.755\pm 0.020$	$0.503\ [0.182,0.754]$
	Masked reconstruction	$0.628\pm 0.021$	$0.514\pm 0.046$	$0.917\ [0.779,1.028]$
	CBraMod, frozen	$0.547\pm 0.008$	$0.515\pm 0.005$	$0.966\ [0.865,1.061]$
PTB	Task-only	$0.894\pm 0.005$	$0.854\pm 0.008$	$0.034\ [0.020,0.048]$
	Masked reconstruction	$0.706\pm 0.048$	$0.638\pm 0.051$	$0.0067\ [-0.0019,0.0176]$

Appendix

Table 3: Transfer and calibrated provenance accessibility. AUROC: mean

\pm

SD over five training/evaluation fits. OOD and worst: mean and minimum AUROC over held-out source–target group pairs (Appendix Equation 5 ). LPI: bits per ERP trial or PTB ECG, with identity-aware 95% bootstrap intervals; compare only within datasets. ERP includes four test subjects. Figure 3 plots these values; the complete grid is in Table 5 .

Benchmark	Train units/clusters	Validation units/clusters	Test units/clusters
ERP/P300	$45{,}192/12$	$7{,}656/2$	$15{,}312/4$
PTB-XL	$7{,}500/6{,}916$	$1{,}500/1{,}374$	$1{,}487/1{,}324$

Appendix

Table 4: Native-unit support and physical clusters. ERP clusters are participants across all sessions and domains; PTB clusters are patients across ECGs. ERP has only four independent test participants and two validation participants.

Model	ERP LPI [95% interval]	PTB LPI [95% interval]
Task-only	$0.4849\ [0.2152,0.7024]$	$0.0339\ [0.0200,0.0477]$
Augmentation-only	$0.5026\ [0.1820,0.7541]$	$0.0287\ [0.0151,0.0437]$
Invariance-first	$0.2368\ [0.0673,0.3665]$	$0.0326\ [0.0194,0.0458]$
Masked reconstruction	$0.9171\ [0.7792,1.0282]$	$0.0067\ [-0.0019,0.0176]$
Supervised contrastive	$0.3609\ [0.1467,0.5478]$	$0.0224\ [0.0110,0.0340]$
LaBraM, frozen	$0.6138\ [0.3799,0.8850]$	n/a

Appendix

Table 5: Complete calibrated LPI grid: 55 conditions summarized in 15 model–benchmark rows. Each trained entry averages five encoder seeds; each frozen entry uses one checkpoint. ERP values are bits per trial, PTB values bits per ECG. ERP test support comprises four physical subjects; leave-one-subject-out ranges are given below. Different provenance definitions and supports preclude a cross-dataset ranking by absolute LPI.

	Model / objective	LPI	Naive 95% interval	Reported 95% interval	Ratio
ERP	Task-only	0.485	[0.474, 0.496]	[0.215, 0.702]	22.8
	Augmentation-only	0.503	[0.491, 0.514]	[0.182, 0.754]	24.8
	Invariance-first	0.237	[0.229, 0.245]	[0.067, 0.367]	19.0
	Masked reconstruction	0.917	[0.908, 0.926]	[0.779, 1.028]	14.3
	Supervised contrastive	0.361	[0.352, 0.369]	[0.147, 0.548]	22.9
	LaBraM, frozen	0.614	[0.598, 0.630]	[0.380, 0.885]	15.5

Appendix

Table 6: LPI intervals under naive unit-level resampling versus the reported identity-aware resampling (subjects or patients, crossed with encoder seeds for trained variants). Ratio: reported width divided by naive width. 2,000 naive draws per row.

	ERP/P300			PTB-XL
Model	Acc.	BA	Macro-F1	Acc.	BA	Macro-F1
Task-only	0.6819	0.5812	0.5802	0.4153	0.4154	0.4137
Augmentation-only	0.6924	0.5904	0.5889	0.4109	0.4110	0.4095
Invariance-first	0.5975	0.4872	0.4880	0.4140	0.4140	0.4126
Masked reconstruction	0.8017	0.7203	0.7193	0.3568	0.3567	0.3512
Supervised contrastive	0.6446	0.5332	0.5355	0.4020	0.4021	0.3990

Appendix

Table 7: Diagnostics from the calibrated LPI probes, not the class-weighted classification-accuracy probes. Entries average encoder seeds for trained variants and use one checkpoint for frozen models. Accuracy (Acc.), balanced accuracy (BA), and macro-F1 supplement prevalence-referenced LPI.

Objective	Seed	$G(\mathrm{id})$	$G(T_{\mathbf{U}})$	Probe, original	Probe, refitted
Task-only	7	$0.2024$	$-0.0004$	$0.8468$	$0.3315$
	13	$0.2121$	$-0.0020$	$0.8865$	$0.3387$
	23	$0.1963$	$-0.0007$	$0.8757$	$0.3604$
	31	$0.1894$	$0.0005$	$0.9117$	$0.3459$
	47	$0.1864$	$0.0000$	$0.9009$	$0.3514$
Task + reconstruction	7	$0.2318$	$0.0006$	$0.9117$	$0.3586$

Appendix

Table 11: Seed-level paired NMT audit. Probe columns give reference accuracy before suppression and after refitting on the targeted representation; balanced accuracy is identical because every reference has

185

test views. Chance and majority accuracy are

1/3

. Every targeted projection has lower residual

G

than all ten matched random controls for that encoder. These diagnostic probes use validation-selected regularization followed by train-plus-validation fitting, without temperature calibration; they are distinct from the calibrated LPI probes in Table 12 .

Encoder seed	Task-only LPI	Reconstruction LPI	Difference	$95\%$ interval
13	$1.165$	$1.310$	$+0.145$	$[0.068,0.222]$
23	$1.125$	$1.332$	$+0.207$	$[0.119,0.302]$
31	$1.190$	$1.328$	$+0.137$	$[0.056,0.229]$
47	$1.226$	$1.127$	$-0.099$	$[-0.168,-0.032]$
Four-seed mean	$1.177$	$1.274$	$+0.098$	$[-0.041,0.212]$

Appendix

Table 12: NMT LPI in bits per provenance-labelled record view. Differences subtract task-only from reconstruction. Per-seed intervals resample paired records conditional on that fitted encoder pair; the mean-row interval additionally resamples encoder seeds and is the primary between-objective interval. The pooled task-only and reconstruction intervals are

[1.092,1.252]

and

[1.161,1.369]

, respectively.

Head	Representation	Aligned	Independent	Reversed	Flip rate
Control	full	$0.769$	$0.769$	$0.769$	$9.8\%$
Control	targeted rank-2 removed	$0.770$	$0.770$	$0.770$	$9.9\%$
Exposed	full	$0.825$	$0.732$	$0.628$	$38.5\%$
Exposed	random rank-2 removed	$0.821$	$0.729$	$0.626$	$38.0\%$
Exposed	targeted rank-2 removed	$0.766$	$0.766$	$0.766$	$11.1\%$

Appendix

Table 13: Task-only encoders, five-seed means. The exposed head gains

0.056\,[0.039,0.074]

over the control under the aligned regime and loses

0.037\,[0.026,0.049]

under independence; targeted removal rescues reversed AUROC by

0.139\,[0.121,0.158]

relative to the full representation.

Head	Representation	Aligned	Independent	Reversed	Flip rate
Control	full	$0.774$	$0.774$	$0.774$	$13.8\%$
Control	targeted rank-2 removed	$0.774$	$0.774$	$0.774$	$15.5\%$
Exposed	full	$0.836$	$0.732$	$0.611$	$44.5\%$
Exposed	random rank-2 removed	$0.832$	$0.728$	$0.609$	$43.8\%$
Exposed	targeted rank-2 removed	$0.771$	$0.771$	$0.771$	$15.3\%$

Appendix

Table 14: Task-plus-reconstruction encoders, five-seed means. The exposed head gains

0.062\,[0.043,0.083]

over the control under the aligned regime and loses

0.042\,[0.030,0.055]

under independence; targeted removal rescues reversed AUROC by

0.159\,[0.137,0.183]

relative to the full representation.

Model	Head	Representation	Aligned ( $\kappa$ )	$\sqrt{\kappa}$	Indep. ( $1$ )	$1/\sqrt{\kappa}$	Reversed ( $1/\kappa$ )
ECGFounder	Exposed	full	$0.943$	$0.929$	$0.910$	$0.891$	$0.878$
	Exposed	projected	$0.911$	$0.911$	$0.911$	$0.912$	$0.913$
	Control	full	$0.936$	$0.927$	$0.914$	$0.902$	$0.895$
	Control	projected	$0.910$	$0.910$	$0.911$	$0.912$	$0.913$
CLEF-Small	Exposed	full	$0.903$	$0.878$	$0.845$	$0.812$	$0.790$
	Exposed	projected	$0.805$	$0.815$	$0.828$	$0.840$	$0.847$

Appendix

Table 15: Association-response curves for both observational ECG models: equal means over five patient-disjoint outer folds of held-out AUROC under five fixed-marginal regimes.

\kappa

is the fold-specific natural device–target odds ratio (

11.06

–

12.10

). Projection uses the train-localized rank-one conditional-probe normal with both heads fixed.

Gate	Criterion	Estimate	Result
Primary excess gap $G$	$\geq 0.01$ and 95% lower bound $>0$	$0.0599$	pass
Control reversed advantage	$\geq 0.01$ and 95% lower bound $>0$	$0.0413$	pass
Exposed aligned noninferiority	95% lower bound $\geq-0.01$	$0.0186$	pass
Conditional device recoverability	95% lower bound $>0.5$	$0.897$	pass
Embedding probe above coarse metadata	paired 95% lower bound $>0$	$0.147$	pass
Targeted projection reduces $G$	95% lower bound $>0$	$0.0375$	pass

Appendix

Table 16: CLEF-Small validity and verification gates. Estimates are point values from the corresponding bootstrap contrasts or probe summaries.

Frozen encoder	Same-reference BA	Shifted BA	Worst-reference BA	Shift loss	Reference-probe BA
BIOT	$0.560\pm 0.005$	$0.529\pm 0.006$	$0.488\pm 0.006$	$0.031\pm 0.002$	$0.388\pm 0.014$
CBraMod	$0.487\pm 0.010$	$0.410\pm 0.019$	$0.300\pm 0.046$	$0.077\pm 0.014$	$0.544\pm 0.007$
LaBraM	$0.456\pm 0.011$	$0.439\pm 0.016$	$0.395\pm 0.033$	$0.017\pm 0.008$	$0.335\pm 0.009$

Appendix

Table 17: Final HMC held-out-test reference audit, with mean and sample standard deviation across five evaluation fits per fixed checkpoint. Task balanced-accuracy (BA) chance is 0.20; reference groups are balanced, so probe accuracy and BA coincide, with chance 0.25.

Sensitivity	Result (95% interval)	Interpretation
Full-cohort metadata comparator	Metadata age/sex/year $G=0.0614\,[0.0555,0.0675]$	Calendar and workflow are material confounds; the primary embedding result is not a hardware effect beyond these variables.
Calendar-matched cohort (1990–1999)	ECGFounder $G=0.0136\,[0.0116,0.0156]$ ; paired excess over metadata $=0.0040\,[0.0009,0.0071]$	A coarse linear calendar comparator does not reproduce the entire embedding effect on this shared support; nonlinear era/workflow confounding remains possible.
Human-validated ECGs	$G=0.0022\,[0.0012,0.0032]$	The direction is positive but below the primary 0.01 meaningful-effect gate; sparse cells make this a sensitivity check.
Weak-association site-2 device pair	$G=0.000074$ $[-0.000005,0.000158]$	The interval lies within $\pm 0.01$ under fold-matched stress, consistent with association specificity rather than a generic reweighting effect.

Appendix

Table 18: ECGFounder sensitivity analyses. The common-calendar cohort contains 7,324 ECGs from 5,957 patients, with minimum held-out cell support 56; the human-validated subset contains 3,147 ECGs and a minimum cell of seven. Both fall below the primary minimum-cell gate of 75 and are reported as sensitivity analyses. The weak-association pair is CS-12/AT-60 3 at site 2, with natural training odds ratio 1.04.

Figure 5: ERP architecture check across ResNet, EEGNetSmall, and ShallowConvNet. Bars show OOD and worst-OOD utility; black diamonds show ordinary domain-probe accuracy, not LPI.

Encoder	Variant	OOD AUROC	Worst OOD AUROC	Domain probe
EEGNetSmall	Masked reconstruction	$0.642\pm 0.010$	$0.583\pm 0.026$	$0.792\pm 0.007$
EEGNetSmall	Augmentation only	$0.774\pm 0.028$	$0.696\pm 0.025$	$0.741\pm 0.014$
EEGNetSmall	Invariance first	$0.750\pm 0.044$	$0.645\pm 0.067$	$0.726\pm 0.015$
ShallowConvNet	Masked reconstruction	$0.652\pm 0.012$	$0.556\pm 0.019$	$0.814\pm 0.006$
ShallowConvNet	Augmentation only	$0.773\pm 0.019$	$0.670\pm 0.043$	$0.779\pm 0.012$
ShallowConvNet	Invariance first	$0.772\pm 0.012$	$0.657\pm 0.024$	$0.610\pm 0.075$

Appendix

Table 19: ERP architecture robustness: mean and sample standard deviation over five seeds. Domain probe denotes ordinary classification accuracy.

	Paired EEG (NMT)		Observational ECG (PTB-XL)
	Task-only	Task + recon.	ECGFounder	CLEF-Small
Recover	1.18 [1.09, 1.25]	1.27 [1.16, 1.37]	0.959 [0.953, 0.964]	0.897 [0.887, 0.906]
Excess vulnerability $G$	0.197 [0.173, 0.221]	0.225 [0.193, 0.256]	0.023 [0.021, 0.026]	0.060 [0.055, 0.065]
$G$ after suppression	$-$ 0.001 [ $-$ 0.003, 0.002]	0.001 [ $-$ 0.002, 0.004]	0.002 [0.001, 0.003]	0.022 [0.020, 0.025]
Beats random controls	10/10 per seed	10/10 per seed	100/100	100/100
Utility change	0.000 [ $-$ 0.004, 0.004]	0.001 [ $-$ 0.001, 0.005]	$-$ 0.004 [ $-$ 0.006, $-$ 0.001]	$-$ 0.039 [ $-$ 0.044, $-$ 0.033]

Appendix

Table 20: Table 1 with 95% bootstrap intervals in brackets: crossed encoder-seed and record resampling for NMT, within-fold patient clusters for ECG. Recover reports reference LPI in bits per record view for NMT (baseline

\log_{2}3=1.585

; encoder seeds 13, 23, 31, and 47, whose embeddings were retained; Appendix E ) and device AUROC within diagnosis strata for ECG; it enters no verdict. The weak-association ECGFounder audit stops at Stress with

G=0.00007

[

-

0.00001, 0.00016].

Factor role	Examples	Desired representation behavior	Evaluation implication
Near nuisance	Valid re-referencing, geometry-aware channel subsets, benign resampling, or bounded acquisition changes known to preserve physiology and target semantics	Preserve task-relevant physiology while limiting unstable acquisition identity	Use matched views when available; require shifted and worst-group utility, fixed-head verification, and a utility margin before suppression claims.
Label-informative	An acquisition or protocol variable that is part of the intended measurement and has domain-supported, stable deployment meaning	Model the factor explicitly rather than imposing invariance	State the operational rationale and audit whether its predictive role remains stable across supported deployment groups.
Confounded	Site, device, protocol, or workflow differences that also track population, label prevalence, or clinical practice without matched counterfactual views	Separate accessibility from decision reliance and avoid biological or hardware-causal interpretation	Use identity-disjoint splits, composition reporting, target-conditional probes, fixed-marginal stress, and control heads fitted without the association.

Appendix

Table 21: Factor roles used by PhysioTRACE. Near nuisances support matched-view robustness tests, label-informative variables require an explicit and stable deployment rationale, and confounded variables require conditional analysis rather than indiscriminate erasure.

Shift family	Controlled stress test	Natural held-out group	Instantiation and interpretation here
Reference and montage	Valid re-referencing, reference mixing, channel dropping, subset sampling, or geometry-aware remapping	Held-out reference family, montage family, channel set, or reference pipeline	NMT is the controlled anchor: the task is fixed and the same records are evaluated under AVG, CZREF, and LE reference views.
Device, site, and protocol	Device-aware perturbations, acquisition-pipeline variants, or protocol-specific preprocessing changes when physically justified	Held-out amplifier, device model, collection site, task interface, or clinical workflow	ERP/P300 tests real-domain EEG transfer across interface and population differences; PTB-XL tests clinical ECG site transfer. Both require confound-aware interpretation.
Sampling, filters, and timing	Resampling with anti-aliasing, bounded filter-chain perturbations, mild line-noise variation, or clock-drift-like jitter	Held-out sampling rate, filter chain, artifact-removal policy, or segmentation convention	Included in the provenance schema and leakage audit. The present experiments do not claim causal isolation of filter or timing effects.
Quality and environment	Realistic impedance-like noise, dropped-channel patterns, sensor-contact variation, or bounded motion/artifact perturbations	Held-out quality stratum, recording environment, wearable condition, or artifact regime	Treated as a reporting requirement here; future datasets can instantiate this family without changing the protocol metrics.

Appendix

Table 22: Shift families covered by the provenance-aware protocol. The table distinguishes families instantiated in the main experiments from provenance requirements needed for auditable future evaluation.

Category	Fields to record or standardize
Device/amplifier	Manufacturer, model, amplifier, analog-to-digital converter (ADC) characteristics, firmware or acquisition software when available
Reference or lead definition	Online reference, re-reference procedure, lead configuration, polarity conventions
Montage or sensor geometry	Channel names, electrode positions, lead set, missing-channel policy, remapping or interpolation procedure
Sampling and timing	Sampling rate, anti-alias settings, clock drift information, resampling procedure
Filters and preprocessing	Hardware and software filter chain, notch settings, artifact removal, independent component analysis (ICA) or artifact subspace reconstruction (ASR) flags, normalization, segmentation policy
Quality and impedance	Per-channel impedance or quality indicators when available, dropped channels, sensor-contact metadata

Appendix

Table 23: Minimal provenance schema for acquisition- and provenance-shift evaluation. The fields are not assumed to be available in every dataset; robustness claims should state which fields define groups and which are missing.

Artifact component	Purpose
README.md	High-level artifact overview, repository layout, quickstart, data requirements, and expected output files.
ARTIFACT.md	Exact lightweight verification commands, data setup instructions, full-rerun entry points, and result-source map.
PROTOCOL_CHECKLIST.md	Compact checklist for applying provenance-aware evaluation: acquisition groups, split unit, leakage controls, shift interpretation, required metrics, and saved outputs.
pyproject.toml , requirements.txt , LICENSE	Installable package metadata, Python dependency list, and software license.
sharable_modules/	Reusable dataset registry, split preparation, preprocessing, model primitives, training helpers, frozen-probe utilities, transfer-matrix construction, pooled-target metrics, and common reporting semantics.
benchmarks/	Benchmark-specific modules layered above the shared utilities, including NMT reference-shift reporting, ERP/P300 domain-transfer reporting, PTB-XL site-shift reporting, external LaBraM/ECGFounder frozen-encoder utilities, and shared report-export mechanics.

Appendix

Table 24: Contents of the PhysioTRACE artifact: a checklist, schema, reusable evaluation code, benchmark cards, notebooks, saved result artifacts, experiment runners, and scripts for regenerating paper outputs.

Signal	Model	Pretraining corpus coverage	Multi-ch.	Multi-dev.
EEG	REVE ( Ouahidi et al., 2025 )	92 public EEG datasets; approximately 25,000 subjects; designed for adaptation across heterogeneous EEG setups.	Yes	Yes
EEG	EEGPT ( Wang et al., 2024 )	PhysioMI/EEGMMIDB, HGD, TUH EEG, SEED, and M3CV; broad EEG corpus spanning motor, clinical, emotion, and multi-session settings.	Yes	Yes
EEG, ECG	BIOT ( Yang et al., 2023 )	SHHS, CHB-MIT, IIIC Seizure, TUAB, TUEV, and HAR-style biosignal or wearable sources; designed for cross-data learning in the wild.	Yes	Yes
EEG	BENDR ( Kostas et al., 2021 )	TUEG/TUH EEG Corpus; large-scale EEG pretraining with a wav2vec-style contrastive objective.	No	Yes
EEG	CBraMod ( Wang et al., 2025 )	TUEG/TUH EEG Corpus; criss-cross EEG foundation-model pretraining.	No	Yes
EEG	LaBraM ( Jiang et al., 2024 )	Large multi-dataset EEG pretraining corpus; discrete neural-token modeling for generic EEG representations.	Yes	Yes

Appendix

Table 25: Physiological foundation-model pretraining setups: corpus coverage. Corpora differ widely in channels, devices, and sources, which are the provenance fields an audit needs.

Signal	Model	Preprocessing signature	Type	Loss or objective
EEG	REVE ( Ouahidi et al., 2025 )	four-dimensional spatiotemporal positional encoding using electrode coordinates and time index; patching without requiring a fixed montage.	R	Masked autoencoding: reconstruct masked raw patches with an $L_{1}$ term plus a weighted global-token term.
EEG	EEGPT ( Wang et al., 2024 )	Patch multichannel EEG; channel-identity embeddings and temporal rotary position encoding; masks over time and channels.	H	Alignment to a momentum target plus masked reconstruction with MSE-style losses on normalized targets.
EEG, ECG	BIOT ( Yang et al., 2023 )	Resampling, per-channel amplitude normalization, fixed-length tokenization, FFT-energy features, and channel plus relative-position embeddings.	C	Contrastive alignment of sample embeddings under token and channel dropout, optimized with a similarity-matrix cross-entropy loss.
EEG	BENDR ( Kostas et al., 2021 )	Scale and shift to a common range, resample to 256 Hz, map to 19 10/20 channels with missing channels zero-filled, and use 60 s segments.	C	wav2vec2-style contrastive loss on masked latents with in-sequence negatives plus an activation penalty.
EEG	CBraMod ( Wang et al., 2025 )	Convolutional feature encoder plus transformer; time- and frequency-aware patch features with patch masking.	R	Masked patch reconstruction with MSE-style losses in time/frequency feature space.
EEG	LaBraM ( Jiang et al., 2024 )	Vector-quantized neural tokenizer via spectrum prediction; per-sample normalization; patches over channels and time.	R	Discrete masked-token prediction over learned neural codes.

Appendix

Table 26: Physiological foundation-model pretraining setups: preprocessing and objective design. The repeated use of reconstruction, masked prediction, or reconstruction-containing hybrid objectives means that many PFMs are trained to reproduce signal detail, including detail that can carry recording provenance.

Evaluation	Groups	Metric	Seeds	Appendix role
NMT clinical EEG reference shift	AVG, CZREF, LE	balanced accuracy	7, 13, 23, 42, 52	controlled EEG reference-shift evaluation
ERP/P300 domain transfer	ALS P300, covert GeoSpell, overt P300	AUROC	7, 13, 23, 42, 52	primary real-domain EEG transfer evaluation
ERP encoder check	ALS P300, covert GeoSpell, overt P300	AUROC	7, 13, 23, 42, 52	architecture robustness check
NMT frozen EEG encoders (LaBraM, BIOT, CBraMod)	AVG, CZREF, LE	balanced accuracy	7, 13, 23, 42, 52	external frozen EEG foundation-model audits
ERP frozen EEG encoders (LaBraM, BIOT, CBraMod)	ALS P300, covert GeoSpell, overt P300	AUROC	7, 13, 23, 42, 52	external frozen EEG foundation-model audits
PTB-XL cross-site transfer	site 0, site 1, site 2	AUROC	7, 13, 23, 42, 52	cross-modality clinical site-shift evaluation

Appendix

Table 27: Broad-screen settings. Seeds index independent encoder trainings for trainable objectives and repeated evaluation fits for a fixed pretrained checkpoint in frozen-model rows; they are not interchangeable sources of uncertainty. The HMC evaluation (Appendix H.1 ), the paired NMT audit (Appendix E ), the observational ECG audits (Appendices H.2 and G ), and the calibrated LPI analyses (Appendix C ) are specified separately.

Evaluation	Contrast	Shifted/OOD $\Delta$	Worst $\Delta$	Gap $\Delta$	Probe $\Delta$
NMT reference	Contrastive $-$ canonical reconstruction + invariance	0.054 $\pm$ 0.019	0.071 $\pm$ 0.030	-0.046 $\pm$ 0.009	-0.221 $\pm$ 0.086
NMT reference	Supervised contrastive $-$ canonical reconstruction + invariance	0.056 $\pm$ 0.030	0.090 $\pm$ 0.038	-0.045 $\pm$ 0.015	-0.191 $\pm$ 0.101
ERP/P300 domains	Augmentation $-$ masked reconstruction	0.197 $\pm$ 0.028	0.241 $\pm$ 0.046	-0.063 $\pm$ 0.038	-0.110 $\pm$ 0.035
ERP/P300 domains	Invariance $-$ masked reconstruction	0.172 $\pm$ 0.021	0.222 $\pm$ 0.047	-0.064 $\pm$ 0.038	-0.218 $\pm$ 0.017
PTB-XL sites	Task only $-$ masked reconstruction	0.188 $\pm$ 0.050	0.217 $\pm$ 0.048	-0.010 $\pm$ 0.006	0.038 $\pm$ 0.067
PTB-XL sites	Augmentation $-$ masked reconstruction	0.188 $\pm$ 0.049	0.216 $\pm$ 0.050	-0.011 $\pm$ 0.008	0.010 $\pm$ 0.065

Appendix

Table 28: Paired seed-wise deltas, reported as mean and sample standard deviation. Positive shifted and worst-group deltas favor the method before the minus sign; negative gap deltas indicate a smaller ID–OOD gap. Probe deltas compare classification-probe accuracies, not calibrated LPI or downstream reliance.

Figure 6: NMT source-reference to target-reference heatmaps for the key frozen objectives and the external frozen LaBraM audit. Entries are balanced accuracy from the five-seed targeted weighted ResNet or linear-probe runs. In the figure labels, Sup., recon., and inv. denote supervised, reconstruction, and invariance.

Figure 7: ERP/P300 source-domain to target-domain heatmaps for the key ResNet objectives and the secondary external frozen LaBraM audit. Entries are AUROC over ALS P300, covert GeoSpell, and overt P300 domains.

Figure 8: PTB-XL source-site to target-site heatmaps for the key ResNet objectives. Entries are AUROC over the three retained site groups.

Variant	AVG target	CZREF target	LE target
AVG-only	0.666 $\pm$ 0.017	0.543 $\pm$ 0.052	0.568 $\pm$ 0.049
Mixed refs	0.682 $\pm$ 0.008	0.682 $\pm$ 0.004	0.678 $\pm$ 0.009
Contrastive only	0.652 $\pm$ 0.006	0.654 $\pm$ 0.013	0.662 $\pm$ 0.010
Supervised contrastive	0.632 $\pm$ 0.017	0.635 $\pm$ 0.020	0.638 $\pm$ 0.024
Canonical recon. + invariance	0.639 $\pm$ 0.041	0.636 $\pm$ 0.050	0.634 $\pm$ 0.048
LaBraM frozen	0.688 $\pm$ 0.011	0.628 $\pm$ 0.010	0.656 $\pm$ 0.014

Appendix

Table 29: NMT target-reference summary. Entries are balanced accuracy by target view, with five encoder seeds for trainable models and five evaluation fits for frozen LaBraM. Mixed refs is an exposure baseline trained on all three references (Appendix D ); its scores are not source-held-out transfer.

Source	Target	Contrastive only	Supervised contrastive	Canonical recon. + invariance	LaBraM frozen
AVG	AVG	0.635 $\pm$ 0.022	0.631 $\pm$ 0.016	0.614 $\pm$ 0.040	0.647 $\pm$ 0.042
AVG	CZREF	0.639 $\pm$ 0.016	0.626 $\pm$ 0.022	0.531 $\pm$ 0.035	0.567 $\pm$ 0.032
AVG	LE	0.639 $\pm$ 0.018	0.631 $\pm$ 0.030	0.581 $\pm$ 0.054	0.596 $\pm$ 0.042
CZREF	AVG	0.624 $\pm$ 0.040	0.634 $\pm$ 0.020	0.585 $\pm$ 0.029	0.681 $\pm$ 0.012
CZREF	CZREF	0.623 $\pm$ 0.033	0.634 $\pm$ 0.021	0.628 $\pm$ 0.037	0.641 $\pm$ 0.023
CZREF	LE	0.630 $\pm$ 0.039	0.634 $\pm$ 0.025	0.596 $\pm$ 0.036	0.671 $\pm$ 0.022

Appendix

Table 30: NMT source-reference transfer matrix for the key frozen objectives and the frozen LaBraM audit. Entries are balanced accuracy mean

\pm

standard deviation over seeds. Diagonal entries are in-domain source-target evaluations; off-diagonal entries are shifted transfer evaluations.

Source	Target	Masked recon.	Augmentation only	Invariance first	LaBraM frozen
ALS P300	ALS P300	0.632 $\pm$ 0.029	0.804 $\pm$ 0.016	0.764 $\pm$ 0.019	0.536 $\pm$ 0.024
ALS P300	Covert GeoSpell	0.630 $\pm$ 0.030	0.757 $\pm$ 0.020	0.739 $\pm$ 0.008	0.587 $\pm$ 0.022
ALS P300	Overt P300	0.701 $\pm$ 0.069	0.922 $\pm$ 0.006	0.901 $\pm$ 0.005	0.586 $\pm$ 0.028
Covert GeoSpell	ALS P300	0.534 $\pm$ 0.070	0.798 $\pm$ 0.016	0.760 $\pm$ 0.018	0.498 $\pm$ 0.020
Covert GeoSpell	Covert GeoSpell	0.647 $\pm$ 0.040	0.757 $\pm$ 0.019	0.740 $\pm$ 0.008	0.613 $\pm$ 0.009
Covert GeoSpell	Overt P300	0.688 $\pm$ 0.118	0.919 $\pm$ 0.006	0.900 $\pm$ 0.006	0.659 $\pm$ 0.030

Appendix

Table 31: ERP/P300 source-domain transfer matrix for the key ResNet objectives and the frozen LaBraM audit. Entries are AUROC mean

\pm

standard deviation over seeds. Diagonal entries are in-domain source-target evaluations; off-diagonal entries are shifted transfer evaluations.

Source	Target	Masked recon.	Task only	Augmentation only	ECGFounder frozen
Site 0	Site 0	0.671 $\pm$ 0.050	0.856 $\pm$ 0.011	0.856 $\pm$ 0.009	0.822 $\pm$ 0.002
Site 0	Site 1	0.705 $\pm$ 0.078	0.910 $\pm$ 0.021	0.912 $\pm$ 0.015	0.906 $\pm$ 0.002
Site 0	Site 2	0.723 $\pm$ 0.053	0.907 $\pm$ 0.016	0.910 $\pm$ 0.016	0.910 $\pm$ 0.002
Site 1	Site 0	0.664 $\pm$ 0.064	0.860 $\pm$ 0.006	0.857 $\pm$ 0.006	0.791 $\pm$ 0.004
Site 1	Site 1	0.730 $\pm$ 0.072	0.924 $\pm$ 0.004	0.922 $\pm$ 0.004	0.899 $\pm$ 0.002
Site 1	Site 2	0.732 $\pm$ 0.075	0.914 $\pm$ 0.003	0.917 $\pm$ 0.002	0.893 $\pm$ 0.003

Appendix

Table 32: PTB-XL source-site transfer matrix for the key ResNet objectives and the frozen ECGFounder audit. Entries are AUROC mean

\pm

standard deviation over seeds. Diagonal entries are in-domain source-target evaluations; off-diagonal entries are shifted transfer evaluations.

Asset	Source / citation	License or terms	Use in this paper
NMT Scalp EEG Dataset	Khan et al. ( Khan et al., 2022 ) ; official NMT dataset/code page	Dataset: CC BY-SA 4.0; associated code repository: BSD 3-Clause	Used for the controlled EEG reference-shift evaluation across AVG, CZREF, and linked-ear reference views.
PTB-XL ECG Dataset	Wagner et al. ( Wagner et al., 2020a ) ; PhysioNet version 1.0.1	CC BY 4.0	Used for the ECG cross-site stress test with patient-level official folds and site-defined provenance groups.
Brain/Neural Computer Interaction (BNCI) 2014-008 ALS P300 Dataset	Riccio et al. ( Riccio et al., 2013 ) ; BNCI Horizon 2020 dataset 008-2014	CC BY-NC-ND 4.0	Used as the ALS P300 domain in the ERP/P300 real-domain transfer evaluation.
BNCI 2014-009 Covert and Overt ERP-based brain-computer interface (BCI) Dataset	Aricò et al. ( Aricò et al., 2014 ) ; Aloise et al. ( Aloise et al., 2012 ) ; BNCI Horizon 2020 dataset 009-2014	CC BY-NC-ND 4.0	Used for the covert GeoSpell and overt P300 domains in the ERP/P300 transfer evaluation.
LaBraM checkpoint and code	Jiang et al. ( Jiang et al., 2024 ) ; official LaBraM repository	MIT License	Used only as a frozen EEG encoder for the NMT, ERP/P300, and HMC evaluations; no LaBraM checkpoint is redistributed in our artifact.
ECGFounder checkpoint and code	Li et al. ( Li et al., 2025 ) ; official ECGFounder repository/model card	MIT License	Used only as a frozen ECG encoder for the PTB-XL audit; no ECGFounder checkpoint is redistributed in our artifact.

Appendix

Table 33: Asset inventory and recorded licenses or terms of use. Raw physiological datasets and external pretrained checkpoints are not redistributed with the PhysioTRACE artifact.

Explore similar work

Sep 20, 2026cs.LG

TRACE: Tractable Routing Autoencoder for Clinical ECG

Deep learning has advanced automated electrocardiogram (ECG) diagnosis, but the field's most accurate models, foundation models pretrained on millions of recordings, are not decision-pathway auditable: a clinician cannot trace a diagnosis to a physiological pathway or intervene on one. We propose TRACE, a Tractable Routing Autoencoder for Clinical ECG, whose 32-dimensional clinical latent space is specified in advance from domain knowledge rather than discovered by optimization. TRACE partitions this space into perfusion, structure, and conduction subspaces, routes each to its own diagnostic head by design, regularizes the partition with an orthogonality penalty, and reconstructs the ECG through a decoder that permits latent perturbation. On PTB-XL and Georgia, TRACE exceeds unconstrained classifiers and stays ahead of an ECG foundation model pretrained on ten million recordings, evaluated by linear probe on frozen features, at roughly an eighth of the parameter count. On the nine-label CPSC2018 cohort, which carries no structural class, the framework transfers with only the routing table re-specified to a perfusion/rhythm/conduction partition. Joint probe, erasure, and perturbation analyses verify the routing contract, and perturbing the depolarization and repolarization pathways modulates the reconstructed waveform. Removing the specified partition and its orthogonality penalty costs 1.70 AUC and 11.30 macro-F1 points on PTB-XL, and 2.76 AUC and 16.92 macro-F1 points on Georgia. A capacity-matched permutation control places arbitrary assignments within 0.34 AUC points of the ontology routing and leaves macro-F1 statistically level (p=0.619): the ontology supplies decision-pathway auditability at no macro-F1 cost.

Shunbo Jia, Runze Ma, Haonan Lyu +3

Department of Bioelectronics, Faculty of Biomedical Engineering, Shenzhen University of Advanced Technology, Shenzhen, 518107, China · Faculty of Information Technology, Monash University, Clayton, Victoria, 3800, Australia · Faculty of Science, University of Queensland, Brisbane, 4072, Australia +1

Electrocardiogram Foundation Models Traces Waveforms Latent Space

Ask PDF

Jun 8, 2026cs.CR

Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models

EEG foundation-model releases are usually audited one endpoint at a time: raw-reconstruction, membership inference, identity linkage, or DP-SGD on the downstream head. We audit the same released embeddings under all four endpoints jointly, on BIOT, LaBraM, and EEGPT, and show that each single-endpoint audit clears releases that still leak spectral attributes. The decisive evidence is a cross-encoder transfer audit: a single ridge attribute decoder learned from one frozen encoder transfers, via a fitted linear bridge, to held-out-subject test splits of every other encoder, with subject-disjoint matched-control 95% CI lower bound at least 0.081 across all six BIOT/LaBraM/EEGPT directions. We prove a sufficient condition: two encoders sharing a nontrivial attribute-coordinate projector overlap beta admit a chained ridge bridge attacker with centered-gain lower bound sqrt(beta/(1+tau^2)) - eps_br - rho_0, and back-solve beta in [0.008, 0.198]. To turn the joint audit into a deployment-readable decision rule we introduce an audit-endpoint disagreement score (AEDS), prove sufficient conditions for its positivity, and bootstrap-calibrate it per cell; AEDS is positive in all eight matched-CI cells (BIOT/LaBraM/EEGPT on EEGMMI; LaBraM on Sleep-EDF, 54-channel LIMO, CHB-MIT pediatric scalp EEG) with p<0.001, while a head-level Carlini LiRA membership audit reaches AUC only 0.50-0.70. Standard defenses fail under audit: a Wiener-style noise-aware adaptive attacker, the LiRA audit, and DP-SGD at every utility-preserving epsilon in {4,8} leave the attribute channel essentially unchanged. The contribution is an audit framework that turns scattered single-endpoint defenses into a joint release decision, supported by a cross-encoder bridge theorem and adaptive-attacker, LiRA, and DP-SGD baselines; the audit licenses release-blocking, not raw-waveform exfiltration or held-out-subject identity recovery.

Jianwei Tai

School of Internet, Anhui University

Electroencephalography Foundation Models Auditory Attention Leakage Cross-Encoder Electrocardiogram Foundation Models Frozen+3

Ask PDF

Jul 27, 2026cs.LG

What EEG Foundation Models Encode: Dataset Identity and a Negative-Control Suite for Clinical Benchmarks

Pretrained EEG foundation models are proposed for clinical decoding, but whether reported gains transfer across populations or survive negative controls is unclear. We benchmark LaBraM, EEGMamba, CBraMod, REVE, LEAD, BENDR, and BIOT on five clinical tasks across four datasets. Primary analyses use frozen linear probes with subject-disjoint LOSO or grouped five-fold validation. Because CAUEEG releases no patient identifiers, it is evaluated at recording level with a patient-disjoint sensitivity. We challenge apparent gains using stronger classical comparators, label permutation, scrambled-label fine-tuning, and random-initialisation controls. In a matched 19-channel CAUEEG evaluation (Normal/MCI/Dementia; N = 1,187 recordings), classical features achieve 0.734 macro-AUROC versus 0.699 for BIOT, 0.669 for CBraMod, and 0.568 for REVE. A patient-disjoint sensitivity retains the classical-over-REVE ordering (0.717 versus 0.565). Dataset identity is decoded from frozen REVE embeddings at or near ceiling across Western-Korean and Western-Western pairs, including after PCA-50 and removal of line-frequency and amplitude-scale information. This establishes dataset membership, not a causal site or population effect. A matched random-initialised encoder exceeds pretrained REVE on CAUEEG (0.659 versus 0.570). On CHB-MIT cross-subject ictal detection (n = 23), REVE reaches 0.793, versus 0.739 for the best enhanced nonlinear comparator, 0.701 for random initialisation, and 0.505 for raw-signal random features. Because preprocessing removes absolute amplitude, this does not establish superiority over every plausible handcrafted baseline. Conclusions change materially after montage matching, patient-overlap checks, stronger comparators, and representation controls. We distill these checks into a reporting protocol for clinical EEG foundation-model studies.

Marzieh Zare

Universit´e Laval, School of Psychology, Quebec City, QC, Canada · NeuroGenis Inc., Toronto, ON, Canada

Electroencephalography Foundation Models Electrocardiogram Foundation Models Medical World Model Negative Results

Ask PDF