ECGWmark: Deep Watermarking for Electrocardiogram Signals

ECGWmark: Deep Watermarking for Electrocardiogram Signals Kuan-Yu Chen1 , Kuan-Chen Wang1 , Yu Tsao2 , and Jian-Jiun Ding1

arXiv:2610.13357v1 [eess.SP] 9 Oct 2026

1

National Taiwan University 2 Academia Sinica

Abstract—Secure transmission of electrocardiogram (ECG) signals remains a major challenge in telecardiology. While traditional mathematical watermarking can embed patient metadata directly into ECG signals, it is highly fragile against temporal desynchronization such as circular phase shifts. In contrast, existing deep watermarking approaches for temporal signals, such as audio, typically rely on lossy quantization, which compromises the high-frequency micro-morphological details critical for clinical diagnosis. To bridge this gap, we propose ECGWmark, a fully convolutional and quantization-free deep watermarking framework for medical time-series. ECGWmark operates in a continuous, full-resolution latent space and utilizes a localized frame-level mechanism to improve the robustness to severe desynchronization. Crucially, we introduce a differentiable Physiological Loss guided by a clinical classifier to preserve diagnostic semantics. Experiments on the benchmark MIT-BIH database show that ECGWmark maintains channel-bit extraction accuracy above 90% under the evaluated circular temporal shifts. Furthermore, under a rigorous inter-patient diagnostic evaluation, Class-V sensitivity changes from 71.97% to 76.50%, whereas Macro-F1 changes from 35.25% to 34.71% and Class-S sensitivity from 8.89% to 1.39%; these results indicate mixed class-level effects. Index Terms—Electrocardiogram (ECG), Deep Watermarking, Telecardiology, Diagnostic Fidelity, Information Security

I. I NTRODUCTION Wearable devices and the Internet of Medical Things (IoMT) enable continuous remote monitoring of vital biomedical signals [1], among which the electrocardiogram (ECG) is widely used for arrhythmia diagnosis. Consequently, safeguarding the security and morphological integrity of ECG data over public networks is important in telecardiology, as data modification can alter subtle physiological waveforms and affect automated analysis. Digital watermarking embeds metadata in the physiological signal, providing signal-layer integrity cues under a defined threat model [2]. Conventional techniques heavily rely on mathematical transforms to build the security layer. For instance, Least Significant Bit (LSB) substitution [3] offers standard reversible data hiding [4], while hybrid frequency-domain approaches combine the Discrete Cosine Transform with Singular Value Decomposition (DCT-SVD) [5], [6] or utilize the SchurMark framework [7] to embed watermarks in rigid 2-D orthogonal coefficient spaces. Collectively, these pioneering efforts have underscored the fundamental viability and the critical importance of digital watermarking as an indispensable paradigm for secure transmission of ECG signals.

However, these conventional paradigms suffer from two limitations when deployed in IoMT ecosystems. First, they are vulnerable to dynamic temporal distortions common at the public network edge, such as packet loss, time-shifting, or clipping. Because they rely on rigid 2-D matrix reshaping and require global structural synchronization, desynchronization can disrupt the aligned coefficient space needed for inversion [8]. Our baseline benchmark shows that a 30-sample shift reduces the traditional decoders to approximately 50% accuracy. Second, these techniques do not explicitly account for downstream diagnostic performance, motivating evaluation of ECG morphology and classifier metrics in addition to signal fidelity. To systematically counter and resolve these dual vulnerabilities, we propose ECGWmark, a fully convolutional, quantization-free deep watermarking framework designed for medical signals. ECGWmark addresses the robustness bottleneck by replacing the fragile global alignment with a frame-level convolutional embedding and localized detection mechanism, inspired by resilient audio watermarking [9]. Concurrently, to reduce diagnostic perturbation without assuming universal transparency, we avoid lossy vector quantization. Instead, ECGWmark operates entirely within a continuous, full-resolution latent space, preserving the 1-D temporal characteristics of the ECG host signal. Furthermore, traditional ECG watermarking relies heavily on standard metrics to evaluate imperceptibility [10]. However, signal fidelity does not guarantee clinical safety; minor mathematical perturbations can cause downstream cardiology models to misclassify the signal [11]. To bridge this methodological gap, we introduce a differentiable Diagnostic Loss (Ldiag ) directly into the end-to-end joint training loop. By integrating a pre-trained clinical classifier, the framework applies a task-aware constraint, whose effect is evaluated with Macro-F1 and per-class metrics rather than interpreted as absolute diagnostic transparency. This work introduces a deep ECG watermarking framework, termed ECGWmark, that decouples metadata embedding from global synchronization while measuring downstream diagnostic trade-offs. The main contributions are summarized as follows: • Pioneering Neural ECG Watermarker: An end-toend learning-based generative watermarking paradigm designed specifically for medical signals is introduced. By substituting fragile transform-domain invariants with

Fig. 1. ECGWmark operational phases: (a) Joint Training Pipeline: G and D are optimized end-to-end through a differentiable distortion layer A. Parameter updates are structurally isolated: G is updated by the losses of reconstruction (Lrec ), auxiliary (Laux ), and physiology (Ldiag ) to preserve clinical fidelity under a frozen classifier C, while the losses of extraction (Lmsg ) and detection (Ldet ) directly update D and backpropagate through A to refine G. (b) Deployment and Inference: In practical telecardiology, an ECG signal (x) is processed by G to embed metadata represented by payload m. Upon reception, the watermarked signal (y) directly drives a dual-stream task: D estimates payload bits and watermark presence (m̂, pwm ), while C evaluates morphology for clinical classification without temporal realignment.

a localized frame-level convolutional embedding mechanism, it reduces dependence on global synchronization under the evaluated circular shifts. • Diagnostic Loss Optimization: We propose a differentiable Physiological Loss (Ldiag ) that embeds a pretrained clinical classifier into the tripartite neural network training loop. We report Macro-F1 and per-class outcomes, including the adverse Class-S trade-off. • Robust Evaluation and Feasibility: Evaluation on MITBIH [12] shows extraction accuracy above 90% under the evaluated circular shifts. A separate legacy-checkpoint ECC analysis maps 16 logical bits to 32 channels and obtains 90.41–99.86% exact recovery across clean and shift conditions at code rate 0.5 [13], [14].

II. M ETHODOLOGY This section details the architectural design and optimization of ECGWmark. To systematically overcome the intrinsic vulnerabilities of global matrix transformations, ECGWmark natively processes 1-D ECG segments through localized, frame-level neural representations. As illustrated in Fig. 1, our framework employs an end-to-end joint training mechanism. By backpropagating decoding errors directly through a differentiable distortion layer, the generator dynamically adapts to dynamic network transmission anomalies, ensuring that both the generator and the message decoder are simultaneously optimized for robust data hiding.

A. System Overview and Problem Formulation Let x ∈ RT represent the original 1-D continuous ECG host segment of length T . The goal of the framework is to embed a confidential binary message payload m ∈ {0, 1}N into x to produce a watermarked signal y ∈ RT , where N is the payload bit capacity. The framework consists of three distinct, synergistically interconnected neural components optimized end-to-end: a continuous full-resolution generator (G), a localization-robust message decoder (D), and a diagnostic critique module represented by a frozen clinical arrhythmia classifier (C) [15]. To rigorously formalize the mathematical mappings of the network, the overall embedding process is explicitly formulated as follows: y = G(x, m). (1) Crucially, the message decoder D in the proposed model is designed as a dual-task network. Upon receiving a potentially corrupted signal y′ , it simultaneously performs binary classification to determine the presence of a watermark (pwm ) and extracts the embedded payload bits (m̂): (pwm , m̂) = D(y′ ).

(2)

Here, N = 32 denotes the physical channel-bit capacity per segment. Because successful payload extraction requires every bit to be correct, high average channel-bit accuracy does not by itself imply reliable recovery of an uncoded 32-bit message. We therefore evaluate a rate-0.5 Extended Hamming code that trades half of the nominal payload for error-control redundancy, representing a protected 16-bit logical payload

within the 32 available channels. The corresponding exactrecovery results are reported in Section III-C. B. Protected Payload Coding and Soft Decoding The ECC layer is applied around the trained watermark network and does not alter the architectures of G or D. Let u ∈ {0, 1}16 denote the logical payload. We partition u into four 4-bit blocks u(b) and encode each block as an extended Hamming (8, 4) SECDED codeword c(b) ∈ C8,4 [13], [14]. Concatenating the four codewords produces the 32 channel bits supplied to G, giving code rate R = 16/32 = 0.5. Thus, the reported protected payload is 16 logical bits rather than 32 reliable information bits. In conventional hard decoding, the Hamming parity checks correct a single-bit error and the additional overall parity bit detects a double-bit error. Because the legacy detector channels exhibit non-uniform error rates, a parity-aware interleaver π is estimated only from aggregate DS1-validation errors under clean and circular-shift conditions. More reliable channels are assigned to systematic information positions, while the weakest channels are preferentially assigned to parity positions. The mapping is frozen before DS2 evaluation and inverted after D outputs the channel probabilities q = Dmsg (y′ ). This separates channel assignment from final-test outcomes and prevents DS2-dependent tuning. For each 8-bit block, soft maximum-likelihood decoding evaluates all 16 valid codewords using the detector probabilities rather than first thresholding every channel independently, following the principle of reliability-aware block decoding [16]: ĉ(b) = arg max c∈C8,4

8 X

[ci log qi + (1 − ci ) log(1 − qi )] .

(3)

Adversarial Augmentation layer (A) is introduced between G and D. For each training batch, the watermarked signal y undergoes aggressive channel perturbations with a predefined probability, including Additive White Gaussian Noise (AWGN), 1-D Gaussian blurring, amplitude scaling, and circular time-shifting. Because all transformations in A are differentiable tensor operations, extraction error gradients from D backpropagate seamlessly into G. This forces the generator to bypass fragile, high-frequency noise embedding and instead route watermark energy into robust physiological structures resilient to desynchronization and filtering attacks. E. Comprehensive Multi-Objective Optimization The network is optimized end-to-end using a joint objective function balancing reconstruction fidelity, decoding accuracy, and clinical transparency: Ltotal = λrec Lrec + λmsg Lmsg + λdet Ldet + λdiag Ldiag + Laux ,

(4)

where hyperparameters λ regulate the optimization trade-offs. Reconstruction and Auxiliary Losses (Lrec , Laux ): To ensure high mathematical fidelity, we apply a standard Mean Squared Error (MSE) constraint: T

Lrec =

1X (xt − yt )2 . T t=1

(5)

Additionally, we formulate complementary auxiliary constraints (Laux ) operating in the frequency and continuous wavelet domains to suppress artifacts and limit excessive energy injection: Laux = λf f t ∥F(x) − F(y)∥22 + λcwt ∥W(x) − W(y)∥22 (6)

i=1

The four systematic 4-bit fields of ĉ(b) form the recovered 16-bit message. The search considers only 4 × 16 candidate codewords per segment. This decoder improves completemessage recovery in several conditions, but it always selects a valid codeword unless an external confidence threshold is introduced; consequently, it is an error-control mechanism rather than a cryptographic authenticity or rejection guarantee. C. Frame-Level Neural Architecture To resist dynamic desynchronization, ECGWmark utilizes a fully convolutional 1-D architecture structuring latent representations into localized time frames. The generator G embeds the upsampled payload m via residual convolutions within a quantization-free continuous space. For extraction, the decoder D leverages localized receptive fields for dense, frame-level bit classification. Predicting payload bits from localized frames reduces dependence on global alignment under circular shifts and permits partial recovery under deletion; it does not imply invariance to severe physical truncation. D. Differentiable Adversarial Augmentation Layer To bridge the domain gap between training simulations and real-world IoMT deployments, a stochastic Differentiable

where F(·) and W(·) denote the fast Fourier transform and continuous wavelet transform operators, respectively [17]. Dual-Task Extraction Losses (Lmsg , Ldet ): The payload extraction capability is optimized by the binary cross-entropy (BCE) between the original message m and the decoded predicted probability m̂: N

Lmsg = −

1 X [mi log m̂i + (1 − mi ) log(1 − mi )] . (7) N i=1

Furthermore, to mitigate false positives, unwatermarked ECG segments are periodically fed into D, penalizing the network if it misdetects a watermark. This behavior is regulated by the detection loss (Ldet ), which trains D as a watermark-presence classifier:   Ldet = − Ey′ ∼A(y) log pwm + Ex′ ∼A(x) log(1 − pwm ) (8) Here, pwm is the inferred watermark-presence probability [18]. Under the stated clean-versus-watermarked legacy DS2 protocol, D achieves AUROC ∼1.0000 with 0.018% falsepositive and 0.000% false-negative rates at threshold 0.5. This result measures protocol-specific discrimination and does not imply cryptographic or keyed authentication.

TABLE I D IAGNOSTIC F IDELITY E VALUATION : C LASSIFICATION ACCURACY (%) AND P ER -C LASS S ENSITIVITY (%) U NDER R EALISTIC T ELECARDIOLOGY I NFERENCE C ONFIGURATIONS ON THE MIT-BIH DATASET

Method

Train Set Test Inference

Heartbeat Category / Classes AAMI Standard Guidelines (Sensitivity ↑)

Acc. (↑) Macro F1 (↑) N

S

V

F

Q

Baseline

Clean

Clean

90.24

35.25

95.10

8.89

71.97

0.29

0.00

ECGWmark (Ours)

Clean

Watermarked

91.82

34.71

95.65

1.39

76.50

0.00

0.00

LSB Substitution [3]

Clean

Watermarked

89.42

32.18

93.80

4.12

67.35

0.00

0.00

DCT-SVD Framework [5]

Clean

Watermarked

86.15

29.54

91.04

2.15

58.42

0.00

0.00

SchurMark Method [7]

Clean

Watermarked

87.80

30.27

92.21

2.68

61.26

0.00

0.00

AAMI Class Definitions: N = Normal/Bundle Branch Block, S = Supraventricular Ectopic, V = Ventricular Ectopic, F = Fusion, Q = Unknown/Paced. Operational Note: All systems evaluate downstream robustness via standard clinical classifiers pre-trained strictly on pristine (Clean) signals.

Differentiable Diagnostic Fidelity Loss (Ldiag ): Because mathematical fidelity (Lrec ) does not guarantee clinical safety, we incorporate a frozen, pre-trained ResNet clinical classifier C. The clinical classifier is implemented using the ResNet architecture proposed by [19]. We define the Diagnostic Fidelity Loss as the cross-entropy difference between predictions on pristine and watermarked signals: Ldiag = DKL (C(x) ∥ C(y)) .

(9)

By backpropagating through the frozen classifier, Ldiag encourages G to preserve classifier-relevant outputs. Because the present ablation changes multiple objectives jointly, this interpretation is descriptive rather than an isolated causal finding. F. Implementation Details and Training Dynamics To stabilize the adversarial dynamics between G and D, we implement three advanced optimization strategies. First, a Curriculum Embedding Strength mechanism anneals the global gain factor α via a cosine schedule [20], reducing it from an initial 0.5 to a subtle clinical threshold of 0.15 to provide distinct early gradients while refining final imperceptibility. Second, we apply an Asymmetric Optimization scheme [21]; the decoder D is assigned a learning rate 1.5× higher than G to prevent the generator from easily overpowering the extraction network. Finally, to eliminate validation oscillation, we apply an Exponential Moving Average (EMA) to both model weights with a decay factor of 0.999. III. E XPERIMENTS AND R ESULTS A. Dataset and Implementation Details We evaluate the ECGWmark framework using the standard MIT-BIH Arrhythmia Database [12]. To ensure clinical validity and prevent data leakage, we adopt an inter-patient diagnostic evaluation paradigm [22]: DS1 contains 22 patients and 50,999 labelled beats, and DS2 contains 22 held-out patients and 49,690 labelled beats. The diagnostic classifier

is trained on DS1 and evaluated on DS2. The reported legacy watermark checkpoint used segment-randomized optimization; the revised protocol instead uses 18 DS1 records for training, four disjoint DS1 records for validation, and reserves DS2 for final testing. The watermarking payload is configured to 32 bits per segment, with the embedding strength factor α annealed to 0.15. B. Diagnostic Fidelity Analysis We evaluate whether the embedded watermark affects critical morphological features by deploying a ResNet-based fiveclass arrhythmia classifier following the AAMI categories N, S, V, F, and Q [19]. Because overall accuracy is dominated by Class N, the Macro-F1 and per-class sensitivity are also emphasized. As shown in Table I, under a deployment setup where the clinical classifier is evaluated directly on watermarked data without retraining, the overall classification accuracy changes from 90.24% to 91.82%. Class-V sensitivity changes from 71.97% to 76.50% [23]. However, Macro-F1 changes from 35.25% to 34.71% and Class-S sensitivity from 8.89% to 1.39%. We therefore report mixed class-level effects rather than universal diagnostic improvement [24]. Table I also reports LSB, DCT-SVD, and SchurMark under the same diagnostic inference setup [3], [5], [7]. Because their embedding configurations differ, this comparison is descriptive rather than evidence of universal diagnostic superiority. As a sensitivity analysis for evaluation circularity, we also trained an independently initialized 1-D ResNet evaluator over three classifier seeds and examined Clean-to-Clean, Cleanto-Watermarked, Watermarked-to-Clean, and Watermarked-toWatermarked settings on DS2 using patient-level bootstrap analysis. The Clean-to-Watermarked minus Clean-to-Clean Macro-F1 difference was +2.77 ± 3.09 percentage points across seeds, but its direction was inconsistent and most perseed intervals included zero. We therefore treat this compact analysis as scoped evidence from an independently trained

TABLE II B IT-ACCURACY (%) U NDER VARIOUS ATTACKS — C OMPARISON OF ECG WATERMARKING M ETHODS

Attack Group

Condition

Baseline

Clean (no attack) AWGN 10 dB AWGN 15 dB AWGN 20 dB AWGN 30 dB Gaussian σ=1 Gaussian σ=3 Band-pass (0.5–100 Hz) 8-bit quantization 6-bit quantization Scale ×0.8 Scale ×1.2 Resample ↓2↑2 Resample ↓4↑4 Shift +10 samples Shift +30 samples Shift +50 samples

AWGN

Smoothing Filter Quantization Amplitude Resampling Time shift

ECGWmark (Ours)

LSB

DCT-SVD

SchurMark

95.27 81.44 91.01 94.23 95.09 94.99 92.31 95.02 94.95 94.39 94.89 95.14 95.04 91.26 93.88 90.27 91.19

100.00 53.22 54.73 50.46 44.11 50.03 51.18 49.66 50.16 49.69 49.18 49.18 50.12 50.17 50.08 51.14 50.15

100.00 79.03 92.31 99.57 100.00 60.09 50.78 63.60 99.74 99.67 90.11 91.62 68.64 62.53 50.91 50.55 50.77

100.00 66.67 76.68 90.44 100.00 62.09 52.36 67.83 99.93 99.65 92.95 94.09 77.79 55.60 50.86 50.47 50.10

Note: Channel-bit accuracy does not determine complete-message recovery; empirical exact recovery is reported separately.

evaluator, not as proof of diagnostic improvement or classifierindependent clinical equivalence. The evaluated watermark signal was produced by the legacy checkpoint. C. Robustness Against Clinical Distortions In practical telecardiology and edge IoMT deployments, ECG records are routinely subjected to hostile channel transmission noise, hardware-level conversion artifacts, and nonlinear clinical preprocessing. We systematically evaluate the payload extraction robustness of ECGWmark against a comprehensive battery of severe signal distortions [25]. Table II reports the original, unmatched configurations: ECGWmark uses 32 channel bits whereas the classical methods use 16 bits, so this table is descriptive rather than a capacity- or distortion-matched superiority test. Under the listed AWGN conditions, transform methods can outperform ECGWmark; the main observed advantage is under circular temporal shifts. Training uses AWGN, Gaussian smoothing, amplitude scaling, and circular shifting; filtering, quantization, resampling, deletion, and packet loss are evaluation-only distortions. Under +10/+30/+50 circular shifts, ECGWmark retains 93.88%/90.27%/91.19% channel-bit accuracy while the evaluated classical configurations are near 50%; these are shifts, not cropping or deletion. Capacity- and distortion-controlled comparison: We compared 16 effective bits and calibrated DCT-SVD and SchurMark strengths on DS1 validation before freezing them for DS2. The transform baselines achieved 11.88 dB clean SNR and ECGWmark-ECC16 achieved 12.25 dB. Exact recovery for ECGWmark was 99.41% clean, 98.05% under 20-

dB AWGN, 99.23% under band-pass filtering, and 98.73%, 75.64%, and 84.45% under +10/+30/+50 shifts. DCT-SVD and SchurMark reached 100% under AWGN but 0% under all three shifts, demonstrating attack-dependent trade-offs rather than universal superiority. The transform baselines are non-blind. Complexity: The generator and detector contain 313,377 and 247,970 parameters (561,347 total; approximately 2.14 MiB in Float32). At 1,024 samples and batch size one, median latency was 12.75 ms (G) and 2.25 ms (D) on an x86 64 CPU, and 5.15 ms and 2.17 ms in an RTX 4090 remeasurement. The serialized training checkpoint is 8.79 MiB and peak GPU inference allocation is 12.19 MiB. These desktop measurements are not extrapolated to wearable hardware. ECC motivation and feasibility: The legacy checkpoint achieves 95.11% clean channel-bit accuracy, but a useful message is recovered only when all of its bits are correct. Consequently, direct uncoded 32-bit decoding yields only 14.10% exact-message recovery. This gap motivates adding error-control redundancy rather than treating 32 physical channels as 32 reliable information bits. Four Extended Hamming(8,4) SECDED blocks encode 16 logical bits into the 32 channels (rate 0.5); a DS1-validation-only interleaver is frozen before DS2, and maximum-likelihood decoding uses the detector probabilities. Across 49,634 DS2 segments and three payload seeds, the resulting exact 16-bit recovery reaches 99.86 ± 0.08% clean and 99.59 ± 0.04%, 90.41 ± 0.18%, and 96.51 ± 0.19% under +10/+30/+50 shifts. Under physical disruption, recovery reaches 95.06 ± 0.55% for 10% front deletion, 98.46 ± 0.31% for 10% middle deletion, and 97.35 ± 0.30% for 10% packet loss, but declines to 45.54 ± 2.46% under 50% packet loss. These results demonstrate an attack-

TABLE III A BLATION S TUDY ON D IAGNOSTIC F IDELITY O PTIMIZATION (Ldiag )

Configuration

w/o Ldiag (MSE Only) ECGWmark (Full Framework)

Bit Acc. (↑)

SNR (↑)

Acc. (↑)

Macro F1 (↑)

55.84 95.27

10.21 12.00

87.36 91.82

26.66 34.71

Heartbeat Category / Classes AAMI Standard Guidelines (Sensitivity ↑) N S V F Q 92.98 95.65

5.28 1.39

71.87 76.50

0.29 0.00

0.00 0.00

TABLE IV L EGACY-C HECKPOINT ECC F EASIBILITY: E XACT 16-B IT R ECOVERY (%, M EAN ± SD OVER T HREE S EEDS )

Condition Raw systematic Clean 97.33 ± 0.23 Shift +10 96.29 ± 0.45 Shift +30 92.53 ± 0.62 Shift +50 94.66 ± 0.05 Front deletion 10% 90.41 ± 0.14 Middle deletion 10% 90.32 ± 0.97 Packet loss 10% 80.47 ± 0.06 Packet loss 50% 17.91 ± 1.94

Soft ECC 99.86 ± 0.08 99.59 ± 0.04 90.41 ± 0.18 96.51 ± 0.19 95.06 ± 0.55 98.46 ± 0.31 97.35 ± 0.30 45.54 ± 2.46

16 logical bits / 32 channel bits; code rate 0.5.

dependent capacity–reliability trade-off rather than generic cropping invariance. ECC evaluation protocol: We distinguish channel-bit accuracy from empirical exact-message recovery, defined as the fraction of segments for which all 16 recovered logical bits match the embedded payload. The parity-aware interleaver is selected once using aggregate DS1-validation channel errors over clean and +10/+30/+50 circular shifts, and is then held fixed across DS2, payload seeds, and attack conditions. Each seed resamples payloads and attack realizations over all 49,634 beat-centered DS2 segments; Table IV reports the mean and sample standard deviation. This protocol prevents selecting a different channel map for each test attack and exposes seedlevel variability. To identify the source of the gain, raw systematic recovery directly reads the 16 channels assigned to information positions without parity correction, whereas soft ECC performs the likelihood search in (3). Soft ECC improves exact recovery in seven of the eight conditions in Table IV, including clean recovery from 97.33 ± 0.23% to 99.86 ± 0.08% and 10% packet-loss recovery from 80.47 ± 0.06% to 97.35 ± 0.30%. The +30 shift is the exception (92.53 ± 0.62% raw versus 90.41 ± 0.18% soft), so the gain is attack-dependent rather than universal. D. Ablation Study on Physiological Loss To examine the bundled physiological objectives, we perform an ablation study comparing the full ECGWmark framework against a baseline configuration optimized strictly using Mean Squared Error (MSE) reconstruction constraints.

Fig. 2. Example watermarked ECG waveforms across methods. The highlighted regions illustrate visible morphological differences under the evaluated configurations; this qualitative example complements, but does not replace, the Macro-F1 and per-class diagnostic analysis.

As summarized in Table III, the MSE-only and full configurations differ in bit accuracy (55.84% versus 95.27%) and Macro-F1 (26.66% versus 34.71%). Because multiple physiological and spectral constraints are changed together, this ablation does not isolate Ldiag . The observed difference is therefore reported as an association under jointly optimized objectives rather than a causal effect of Ldiag alone.

IV. C ONCLUSION This paper introduces ECGWmark, a joint optimization framework that enables robust data hiding directly within ECG signals for telecardiology applications. ECGWmark formulates watermarking as a differentiable tripartite optimization loop guided by a diagnostic fidelity loss (Ldiag ). The framework balances signal imperceptibility and robustness. Evaluations on the MIT-BIH Arrhythmia Database show mixed diagnostic effects: Class-V sensitivity changes from 71.97% to 76.50%, while Macro-F1 and Class-S sensitivity decrease. Furthermore, the frame-level localization mechanism demonstrates resilience under the evaluated temporal shifts. A legacycheckpoint ECC analysis shows a capacity–reliability tradeoff: 16 logical bits encoded into 32 channels achieve 90.41– 99.86% exact recovery across the evaluated clean and shift conditions at code rate 0.5. Future work will improve scalability by extending our optimization to multi-lead ECGs and explore pruning and quantization for resource-constrained wearable devices. Integrating physiological watermarking with multi-modal records may support data-integrity and provenance tracking for remote monitoring. V. L IMITATIONS While ECGWmark demonstrates resilient bit extraction under selected attacks, we acknowledge three primary limitations in the current framework. First, there is an observable trade-off in Class-S sensitivity, which decreases from 8.89% to 1.39%. Because the experiments do not isolate its physiological cause, this is reported as an observed trade-off rather than attributed conclusively to watermark energy. Second, recovery declines to 45.54% under 50% packet loss; severe erasure therefore requires higher-layer retransmission or erasure coding. Third, ECGWmark operates at the signal-representation layer. Its legacy DS2 detector results (AUROC ∼1.0000, 0.018% FPR, and 0.000% FNR) do not establish keyed security; the method has no secret-key or signature mechanism. Revised-protocol and legacy-checkpoint evidence are kept separate. R EFERENCES [1] M. M. Ozcelik, I. Kok, and S. Ozdemir, “A survey on Internet of Medical Things (IoMT): Enabling technologies, security and explainability issues, challenges, and future directions,” Expert Systems, vol. 42, no. 5, p. e70010, 2025. [2] J. Rani and A. Anand, “A review on advancement in watermarking techniques for biomedical data in e-Healthcare applications,” Biomedical Signal Processing and Control, vol. 112, p. 108521, 2026. [3] B. Halder and S. Mitra, “Patient information implantation and reclamation from compressed ECG signal by LSB watermarking technique,” International Journal of Emerging Technology and Advanced Engineering, vol. 4, no. 7, pp. 5–15, 2014. [4] S. Bhalerao, I. A. Ansari, and A. Kumar, “Reversible ECG watermarking for ownership detection, tamper localization, and recovery,” Circuits, Systems, and Signal Processing, vol. 41, no. 9, pp. 5134–5159, 2022. [5] L. M. Goyal et al., “Improved ECG watermarking technique using curvelet transform,” Sensors, vol. 20, no. 10, p. 2941, 2020.

[6] A. Anand and A. K. Singh, “An improved DWT-SVD domain watermarking for medical information security,” Computer Communications, vol. 152, pp. 72–80, 2020. [7] A. Tiwari, D. Awasthi, and V. K. Srivastava, “SchurMark: Robust and secure ECG watermarking in Schur domain for IoMT,” Multimedia Tools and Applications, vol. 85, no. 4, p. 331, 2026. [8] S. Voloshynovskiy et al., “Attacks on digital watermarks: classification, estimation based attacks, and benchmarks,” IEEE Communications Magazine, vol. 39, no. 8, pp. 118–126, 2001. [9] R. San Roman et al., “Proactive detection of voice cloning with localized watermarking,” in Proc. ICML, 2024. [10] R. Hamami et al., “Securing patient-specific ECG data in telemedicine through adaptive wavelet-based watermarking,” Intelligence-Based Medicine, p. 100357, 2026. [11] A. I. Newaz et al., “Adversarial attacks to machine learning-based smart healthcare systems,” in Proc. IEEE GLOBECOM, 2020, pp. 1–6. [12] G. B. Moody and R. G. Mark, “The impact of the MIT-BIH arrhythmia database,” IEEE Engineering in Medicine and Biology Magazine, vol. 20, no. 3, pp. 45–50, 2001. [13] R. W. Hamming, “Error detecting and error correcting codes,” The Bell System Technical Journal, vol. 29, no. 2, pp. 147–160, 1950. [14] S. Lin and D. J. Costello, Error Control Coding: Fundamentals and Applications, 2nd ed. Upper Saddle River, NJ, USA: Pearson Prentice Hall, 2004. [15] A. Y. Hannun et al., “Cardiologist-level arrhythmia detection and classification in ambulatory electrocardiograms using a deep neural network,” Nature Medicine, vol. 25, no. 1, pp. 65–69, 2019. [16] D. Chase, “A class of algorithms for decoding block codes with channel measurement information,” IEEE Transactions on Information Theory, vol. 18, no. 1, pp. 170–182, 1972. [17] S. Schwär and M. Müller, “Multi-scale spectral loss revisited,” IEEE Signal Processing Letters, vol. 30, pp. 1712–1716, 2023. [18] M. Ahmadi et al., “ReDMark: Framework for residual diffusion watermarking based on deep networks,” Expert Systems with Applications, vol. 146, p. 113157, 2020. [19] G. S. Stergiou et al., “A universal standard for the validation of blood pressure measuring devices: Association for the Advancement of Medical Instrumentation/European Society of Hypertension/ International Organization for Standardization (AAMI/ESH/ISO) Collaboration Statement,” Hypertension, vol. 71, no. 3, pp. 368–374, 2018. [20] I. Loshchilov and F. Hutter, “SGDR: Stochastic gradient descent with warm restarts,” in Proc. ICLR, 2017. [21] M. Heusel et al., “GANs trained by a two time-scale update rule converge to a local Nash equilibrium,” Advances in Neural Information Processing Systems, vol. 30, 2017. [22] U. R. Acharya et al., “Automated detection of arrhythmias using different intervals of tachycardia ECG segments with convolutional neural network,” Information Sciences, vol. 405, pp. 81–90, 2017. [23] A. L. Goldberger et al., “PhysioBank, PhysioToolkit, and PhysioNet: components of a new research resource for complex physiologic signals,” Circulation, vol. 101, no. 23, pp. e215–e220, 2000. [24] S. G. Finlayson et al., “Adversarial attacks on medical machine learning,” Science, vol. 363, no. 6433, pp. 1287–1289, 2019. [25] H. Habibzadeh et al., “A survey of healthcare Internet of Things (HIoT): A clinical perspective,” IEEE Internet of Things Journal, vol. 7, no. 1, pp. 53–71, 2019.

Related documents

• ECGWmark: Deep Watermarking for Electrocardiogram Signals#1297709
• CertMark: Distortion-Free Multi-Bit Watermarking with Certified Decoding#1118044
• A Review of Medical Image Watermarking Requirements for Teleradiology#976439
• SHIFT-M3: Pre-fusion Alignment-based Consistency Screening for Multimodal ECG Record Integrity#1083368
• A reproducible benchmark of QRS detection algorithms across diverse ECG datasets and noise conditions.#218870