REAN: Reconstruction-aware ECG Anonymization Based on Privacy--Utility Orthogonality

Technical Summary: REAN (Reconstruction-aware ECG Anonymization)

Problem Statement
Electrocardiogram (ECG) signals are essential for diagnosing cardiac conditions but inherently function as biometric fingerprints. The waveform morphology contains person-specific information (identity, gender, age) that allows for patient re-identification, even when metadata is removed. Existing anonymization methods face a fundamental privacy–utility trade-off: techniques that effectively hide biometric information often degrade the signal morphology required for accurate arrhythmia diagnosis, while methods preserving diagnostic utility frequently leave biometric data recoverable. Current approaches either rely on feature-space transformations (which may not yield raw, usable waveforms) or apply blind noise (which harms diagnosis).

Methodology
The paper proposes REAN (Reconstruction-aware ECG Anonymizer), a raw ECG signal anonymizer that resolves the privacy–utility trade-off by exploiting the geometric properties of ECG signal space.

1. Gradient Orthogonality Observation:
   The core theoretical finding is that the directions for maximizing diagnostic utility and minimizing privacy leakage are nearly orthogonal in the ECG signal space.

   • Utility Direction: Defined by the input gradient of a frozen diagnostic classifier (arrhythmia detection).
   • Privacy Direction: Defined by the input gradient of frozen biometric classifiers (identity, gender, age).
   • Measurement: Experiments on clean ECG data show the angle between these gradients averages approximately 89.8° (cosine ≈ 0.003) across various protected attributes and attacker architectures (ResNet, InceptionTime, CNN-LSTM). This orthogonality implies that perturbations along the privacy direction suppress biometric information with negligible impact on the diagnostic loss.

2. REAN Architecture:
   REAN implements a 1-D U-Net that reconstructs the ECG waveform in a single forward pass.

   • Mechanism: Instead of adding unstructured noise, REAN learns a bounded, input-conditioned residual ($\delta$) to add to the raw signal ($x$): $\hat{x} = x + \tanh(\delta_\theta(x)) \cdot \epsilon_{max}$.
   • Training Objective: The network is trained to minimize a composite loss function:
     $$L = L_{util} - L_{priv} + D(x, \hat{x})$$
     • $L_{util}$: Cross-entropy loss from a frozen diagnostic classifier (minimized to preserve arrhythmia diagnosis).
     • $L_{priv}$: Bundled cross-entropy loss from three frozen biometric classifiers (maximized via the negative sign to suppress identity, gender, and age).
     • $D$: Distortion term (combining Perceptual Residual Distortion and L1 norm) to limit signal deviation.
   • Optimization: Because the gradients of $L_{util}$ and $L_{priv}$ are orthogonal, the objectives can be optimized simultaneously without significant conflict. The model uses Bayesian optimization to select weights that push privacy to chance levels while maintaining utility.

Key Contributions

• Privacy–Utility Orthogonality: The paper demonstrates that utility and privacy gradients are nearly orthogonal in ECG signal space, providing a geometric basis for decoupling diagnosis from biometric identification.
• REAN Framework: A classifier-guided 1-D U-Net that anonymizes raw ECG waveforms in a single forward pass, avoiding the computational overhead of per-sample optimization (e.g., reinforcement learning) or the utility loss of blind noise.
• Robustness: The method maintains protection against unseen attacker architectures and input purification attempts (denoising), provided the attacker does not retrain on a large corpus of anonymized data.

Experimental Results
Evaluated on four public PhysioNet databases (MIT-BIH, MIT-BIH Long-Term, INCART, SHDB-AF) comprising 186 subjects and over 1.1 million windows:

• Privacy Performance: REAN reduces re-identification accuracy from 0.964 (clean) to 0.000 (chance). It also reduces gender and age inference accuracy to near-random levels (0.142 and 0.044, respectively).
• Utility Performance: REAN preserves arrhythmia diagnosis performance at the level of clean data. The macro-AUROC for arrhythmia is 0.9991 for REAN compared to 0.9982 for clean data, a difference statistically indistinguishable (95% CI: [-0.0006, 0.0034]).
• Distortion: The method achieves a Perceptual Residual Distortion (PRD) of 5.56%, which is considered "very good" in signal processing literature.
• Speed: REAN processes windows in 0.117 ms, significantly faster than per-sample optimization baselines like REACT (12.73 ms).
• Comparisons: Unlike baselines such as PP-VAE (which collapses morphology) or PrivECG (which leaves identity recoverable), REAN is the only method to simultaneously achieve high privacy protection and high diagnostic utility.

Significance and Limitations
The paper claims that REAN demonstrates the privacy–utility trade-off in ECG anonymization is escapable rather than fundamental, provided the method leverages the specific geometric structure of the signal space. By learning a residual that aligns with the privacy direction, REAN suppresses biometric leakage without sacrificing diagnostic morphology.

The authors acknowledge specific limitations:

• Deterministic Leakage: As a deterministic mapping, REAN is vulnerable to "retraining-aware" adversaries. If an attacker has access to a large corpus of anonymized data paired with labels, they can retrain a biometric classifier to recover identity (ReID accuracy rises to 0.886 with 100% anonymized training data). The authors note that formal, irreversible anonymization would require stochastic mechanisms like differential privacy, which REAN does not currently implement.
• Scope: The evaluation is limited to single-lead ECGs and within-subject temporal splits; multi-lead or 12-lead recordings and cross-subject deployment remain future work.

In conclusion, REAN offers a practical, high-speed solution for sharing ECG data that effectively neutralizes re-identification risks while maintaining clinical utility, representing a significant step forward from previous trade-off-bound methods.