Towards End-to-End Privacy-Preserving AI for Real-Time ECG Monitoring

Towards End-to-End Privacy-Preserving AI for Real-Time ECG Monitoring

arXiv:2610.25094v1 [cs.CR] 18 Oct 2026

Beyazıt Bestami Yüksel1 Department of Computer Engineering, Istanbul Technical University, Istanbul, Türkiye yukselbe18@itu.edu.tr

PhD status. PhD graduate, February 2026. The dissertation was defended on 17 February 2026. Abstract. Healthcare artificial intelligence is shifting from centralized archives toward distributed pipelines that combine wearables, edge processing, cloud analytics, and multi-institutional learning. In this regime, electrocardiogram (ECG) streams cross multiple trust boundaries, so privacy cannot be reduced to a single transmission control. Existing privacyenhancing technologies typically secure isolated stages and leave gaps between acquisition, analysis, and institutional collaboration. This doctoral research develops a unified lifecycle framework for end-toend privacy-preserving ECG AI. Rather than introducing another privacy mechanism, it orchestrates complementary privacy-enhancing technologies across the clinical ECG lifecycle, allocating each mechanism to the trust boundary where its security, computational, and operational properties are most appropriate. Three interoperable modules instantiate the framework: AES with CKKS-based homomorphic statistics for secure monitoring; adaptive chaotic protection for low-latency edge transmission; and federated learning with homomorphic aggregation under heterogeneous partitions. Across prototype monitoring, signal-security analysis, and simulated collaboration, the programme shows that privacy layers can be composed without collapsing diagnostic utility, while exposing overhead and fidelity limits that constrain clinical translation. Keywords: Privacy-preserving AI · ECG monitoring · Homomorphic encryption · Federated learning · Chaotic encryption

1

Introduction and Motivation

Healthcare AI is moving beyond offline analysis of hospital archives. Remote monitoring, wearables, and edge–cloud orchestration distribute sensing, inference, and model improvement across devices, networks, and institutions. This improves coverage, but multiplies exposure points for sensitive physiological data and for models derived from them. ECG monitoring exemplifies the shift. Continuous streams support rhythm assessment and remote follow-up, yet become privacy-critical once coupled with

2

B. B. Yüksel

cloud storage, remote visualization, and cross-site learning. Channel encryption alone is then insufficient: threats arise during acquisition and transmission, during stored-data analytics, and during exchange of model updates among institutions with heterogeneous schemas. In distributed AI pipelines, raw signals, intermediate representations, model parameters, and learned updates can all become privacy-sensitive assets. Privacy therefore becomes a system-level property rather than a single control. This dissertation addresses that systems problem [2]. Three published research lines provide the technical building blocks: ECG-PPS for acquisition, monitoring, AES-protected storage and transmission, and homomorphic statistics [1]; HEART for adaptive chaotic protection with a learnable key generator [5, 3]; and FL-HE for federated ECG learning with homomorphic update protection under horizontal, vertical, and combined partitions [4]. Evidence is synthesized conservatively, distinguishing prototype evaluation, retrospective validation, simulated collaboration, and expert review from prospective clinical trials. 1.1

Main Dissertation Contributions

– A trust-boundary allocation within a unified privacy framework that decomposes continuous ECG AI into distinct trust boundaries rather than treating privacy as a single end-to-end control. – A lifecycle-oriented allocation of PETs that matches each mechanism to the threat surface and operational constraints of its intended stage. – Experimental validation of three interoperable privacy modules (ECG-PPS, HEART, and FL-HE) as complementary instantiations of the same framework. – Identification of privacy–latency–utility trade-offs that constrain uniform application of heavy cryptographic protection under continuous monitoring.

2

Research Gap and Doctoral Questions

The preceding motivation raises a concrete research gap. Privacy-preserving biomedical AI has advanced along largely separate tracks: conventional encryption for transport and storage; chaos-based signal protection; fully homomorphic encryption (FHE) for computation on ciphertexts; and federated learning (FL) without raw-data pooling. Each track is valuable, yet previous work typically optimizes one PET independently at a single boundary. AES-style protection still exposes plaintext when analytics require decryption; chaotic schemes can be low-latency but are not substitutes for standard cryptography; homomorphic methods enable encrypted statistics or protected updates at nontrivial cost; and FL reduces data sharing but remains exposed to update-level inference without further defences. Securing one hop therefore leaves residual exposure elsewhere in continuous ECG workflows. The unresolved scientific problem is not whether PETs work individually, but how heterogeneous PETs should be orchestrated across the complete clinical

Privacy-Preserving AI for Real-Time ECG Monitoring

3

AI lifecycle. Prior studies rarely examine this allocation under joint privacy, latency, and diagnostic-utility constraints. The doctoral gap is therefore how complementary PETs can be composed across distinct trust boundaries of an end-to-end ECG pipeline so that privacy remains manageable without collapsing clinical feasibility. 2.1

Design Principles of the Doctoral Framework

Guided by that gap, six principles structure the programme: (i) lifecycle-aware privacy across the full ECG pathway; (ii) boundary-specific protection matched to local threat surfaces and budgets; (iii) real-time feasibility under measured monitoring envelopes; (iv) composable privacy in which AES, adaptive chaotic protection, FHE/CKKS, and FL address distinct assets rather than rival one another; (v) a translational objective with explicit threat assumptions and honest overhead reporting; and (vi) evidence-aware translation that distinguishes prototype, retrospective, simulated, and expert-review evidence from prospective clinical readiness. 2.2

Doctoral Research Questions

1. How should privacy responsibilities be decomposed across the ECG lifecycle so that acquisition and transmission, secure analytics, and multi-institutional learning are coupled stages of one system? 2. Which combinations of conventional encryption, adaptive signal protection, and homomorphic computation remain compatible with continuous monitoring while preserving essential diagnostic statistics and workflow usability? 3. How can collaborative ECG learning proceed under horizontal, vertical, and combined partitions when updates must be protected against honest-butcurious aggregation? 4. Where do overhead, fidelity, heterogeneity, and validation scope constrain translation from prototype pipelines to prospective clinical deployment? Doctoral contribution beyond the individual publications. The answers to these questions do not reduce to the three published methods themselves. ECG-PPS, HEART, and FL-HE each address a different technical problem and could, in principle, have been reported independently. The systems-oriented contribution is their conceptual integration into one coherent framework for continuous ECG AI [2]. That integration yields a design approach for assigning complementary PETs to distinct trust boundaries according to local security, computational, and operational requirements. Without this organizing rationale, the publications remain adjacent technical advances rather than a unified doctoral programme. The originality of this dissertation lies not in proposing a single superior privacy mechanism, but in establishing a systems engineering perspective for orchestrating heterogeneous privacy-enhancing technologies according to the security, computational, and operational requirements of the complete clinical ECG lifecycle. The following section shows how this perspective is realized through the unified lifecycle framework.

4

B. B. Yüksel

Clinical AI Services Decision Support Diagnosis, risk assessment, alerts

Telemedicine Remote consultation and follow-up

Reporting Clinical reports and analytics

Clinical Integration EHR/EMR and workflow integration

Layered Privacy Architecture Boundary-Specific Privacy-Enhancing Technology Allocation

LIFECYCLE BOUNDARY 1

LIFECYCLE BOUNDARY 2

LIFECYCLE BOUNDARY 3 Privacy-Preserving

Secure Monitoring & Analytics

Adaptive Edge Protection

Storage · Computation · Visualization

Low-Latency Transmission · Edge · Gateway · IoT

Collaborative Learning Multi-Institutional · Federated

Privacy Technologies AES Records in storage and transmission

Boundary Functions

Boundary Functions Low-latency protection

Encrypted statistics

Adaptive key generation

Monitoring dashboards CKKS Encrypted statistics

Privacy Technology

Secure ECG storage

Controlled access

HEART Learnable chaotic key generation

Protects: ECG records and selected statistics

Segment-wise permutation XOR-based diffusion

Protects: streaming ECG signals

Privacy Technologies

Boundary Functions No raw-data pooling Protected updates

Federated Learning + CKKS Encrypted model aggregation

HE aggregation Partition-aware training

Protects: model updates and intermediates

Clinical ECG Lifecycle Acquisition Wearable or bedside sensors

Data / model flow

Monitoring & Inference Visualization and arrhythmia detection

Pre-processing Filtering, denoising, segmentation

Service / feedback flow

PET

Storage & Feedback Archiving and continuous improvement

Privacy-enhancing technology

Fig. 1. Layered privacy architecture across the clinical ECG lifecycle. ECG-PPS provides AES-protected monitoring with CKKS-based encrypted statistics [1]; HEART adds adaptive chaotic edge protection [5]; and FL-HE enables collaborative learning with CKKS-protected updates [4]. The formal B1–B3 security-boundary allocation is detailed later (Fig. 4) [2].

3

A Unified Lifecycle Framework for Privacy-Preserving ECG AI

Building on that claim, the dissertation is not searching for one universally optimal privacy mechanism. Instead, it introduces a design approach for selecting and composing complementary PETs according to lifecycle requirements and maps those PETs onto the unified framework for continuous ECG AI (Fig. 1). Each layer is motivated by a distinct protected asset and threat surface; layers compose rather than compete. Because stages impose different threat models, latency constraints, and operational budgets, heterogeneous PET composition matters more than maximizing any single method in isolation. ECG-PPS, HEART, and FL-HE are therefore treated as interoperable modules of one trust-boundary allocation within that framework, not as alternative solutions to the same problem. Boundary allocation. HEART supplies millisecond-scale adaptive chaotic protection at the source edge [5]; it complements, rather than replaces, standard cryptography and is evaluated empirically rather than via formal IND-CPA proofs. ECG-PPS combines AES-protected storage and transmission with CKKS-based FHE for statistical operations [1]; disease detection uses retrospectively trained MIT-BIH models, and reported FHE evidence concerns statistical agreement rather than full neural inference on ciphertexts. FL-HE trains on PTB-XL un-

Privacy-Preserving AI for Real-Time ECG Monitoring

5

der simulated horizontal, vertical, and combined partitions, with CKKS protecting updates under honest-but-curious assumptions [4]. The programme-level claim is an allocation strategy across trust boundaries: adaptive source protection where latency dominates, conventional cryptography for communication and storage, and homomorphic FL where institutions collaborate without sharing raw records [2]. Unlike the individual publications, which each optimize one privacy mechanism, the dissertation contributes the systems-oriented rationale for when, where, and why each PET should be deployed in an end-to-end clinical AI pipeline.

4

Research Modules Instantiating the Framework

The three published modules are summarized next as interoperable components of one doctoral programme. 4.1

ECG-PPS: Monitoring Workflow with AES and Homomorphic Statistics

Motivation. Continuous monitoring needs a pathway that acquires signals, supports rhythm-oriented detection, stores data for remote review, and permits limited analytics without treating cloud plaintext as inevitable. Contribution. ECG-PPS implements three-lead serial acquisition with real-time visualization, a CNN arrhythmia detector trained on MIT-BIH, AES-protected storage and transmission (including an ECDH+AES/TLS variant), and CKKSbased FHE for statistical operations on encrypted data [1]. Protected assets are ECG records in transit or storage and selected encrypted statistics. Evidence. Thesis synthesis reports encryption and transmission delays below 50 ms per segment [2]. Encrypted-versus-plaintext agreement includes R-peak 100%, mean 99.17%, SD 98.11%, median 100% (extrema: min 93.75%, max 94.12%) [1]. Limits. FHE cost, MIT-BIH dependence, three-lead scope, and network availability constrain translation; validation is prototype or retrospective, not prospective. Secure monitoring therefore cannot be reduced to communication security alone. Framework role. Implements the secure monitoring and analytics boundary of the unified framework.

6

4.2

B. B. Yüksel

HEART: Adaptive Chaotic Protection at the Edge

Motivation. Edge streaming needs confidentiality compatible with continuous acquisition. Contribution. HEART estimates logistic-map parameters (r, x0 ) from ECGsegment statistics (optional ML refinement under noise) and applies permutation with XOR diffusion [5]. Security arguments are empirical (entropy, correlation, NIST frequency tests, sensitivity, noise and occlusion), not formal reductions. Evidence. Entropy 7.6–7.8 bits; MSE ≈ 5 × 10−6 , PSNR > 52 dB, MAE ≈ 0.002; encryption and decryption ≈ 1.2 ms and 0.1 ms; end-to-end ≈ 336–339 ms per 300-sample segment (acquisition-dominated) [5, 2]. Limits. Global fidelity does not imply preservation of all clinical morphology markers after decryption; chaotic protection is not a drop-in substitute for standard cryptography, and empirical evaluation must remain distinct from formal cryptographic guarantees. Framework role. Implements adaptive source-boundary protection for low-latency ECG transmission. 4.3

FL-HE: Multi-Institutional Learning with Protected Updates

Motivation. Institutions often cannot share raw ECG repositories. FL reduces raw-data movement but exposes update leakage under honest-but-curious aggregation. Contribution. FL-HE trains on PTB-XL (18,869 patients; 21,799 recordings) under simulated multi-institutional partitions, using CKKS on updates and intermediates [4, 2]. Four collaboration settings are evaluated (Fig. 2): H: same features, different patient cohorts; V: same patients, complementary feature subsets; C1: horizontal sample split plus a vertical client holding ECG features for all patients; C2: hybrid partitioning where the vertical client also acts as the aggregation server and holds outcome labels. Evidence. A custom backbone reports centralized accuracy 0.9846 (F1 0.9879). Under CKKS-protected FL, accuracies are 0.9782 (H), 0.9991 (V), 0.9818 (C1), and 0.9709 (C2), with CKKS overheads +30%, +456%, +58%, and +1200% (Table 1; Fig. 3) [4]. Cardiologist review addressed dataset usage and diagnostic behaviour (expert review, not a prospective multi-centre trial). Limits. Partitions simulate heterogeneity; vertical and complex combined HE costs, especially C2, limit strict real-time training loops. Feasibility therefore depends on partition topology, overhead, and institutional workflow assumptions as well as update protection.

Privacy-Preserving AI for Real-Time ECG Monitoring

7

Federated Learning Partitioning Strategies Horizontal FL partitions patient records; Vertical FL partitions feature subsets; Combined FL partitions both. Horizontal (H)

Patient-record partition

Vertical (V)

Same features; different patient cohorts

Feature-subset partition

Combined (C1/C2)

Same patients; complementary feature subsets

Hybrid partition

Partitions patients and features simultaneously

Site A

Site B

Site A

Site B

H-client

H-client

V-client

Patients 1..N/2 All features

Patients N/2+1..N All features

Patients 1..N Feature set X1

Patients 1..N Feature set X2

Sample split Local cohort

Sample split Local cohort

ECG features (C2: + labels)

Local model

Local model

Partial view

Partial view

Server aggregates encrypted updates

Joint learning without raw feature sharing

C1: feature holder; C2: also aggregation host

Fig. 2. Federated learning partitioning strategies evaluated in this work. Horizontal FL partitions patient records, Vertical FL partitions feature subsets, and Combined FL partitions both simultaneously. Table 1. FL-HE accuracy and CKKS overhead across partition scenarios [4]. Scenario

Partition type

H V C1 C2

Horizontal Vertical Combined-1 Combined-2

Accuracy

CKKS overhead

0.9782 0.9991 0.9818 0.9709

+30% +456% +58% +1200%

Privacy–Utility Trade-offs across FL Configurations CKKS introduces computational overhead while preserving diagnostic accuracy on PTB-XL partitions. Diagnostic Accuracy 0.9991

1.00

CKKS Computational Overhead

0.99

900% Centralized 0.9846

0.9818 0.98

+1200%

1200%

0.9782

600% +456% 0.9709

0.97

300% +58%

+30% 0.96

0% H

V

C1

C2

H

V

C1

C2

Accuracy remains high (0.9709–0.9991) while CKKS overhead grows with partition complexity (H +30% to C2 +1200%).

Fig. 3. Summary of the privacy–utility trade-offs observed across different federated learning configurations. CKKS introduces computational overhead while preserving diagnostic accuracy.

Framework role. Implements the privacy-preserving collaborative-learning boundary through encrypted model aggregation.

5

Experimental Evidence and Cross-Module Analysis

The modules are next examined jointly to assess whether trust-boundary allocation remains feasible under measured privacy, latency, and utility constraints. Verified anchors include ECG-PPS statistical agreement (R-peak 100%; mean 99.17%; SD 98.11%; <50 ms/seg.), HEART security/timing (entropy 7.6–7.8; MSE ≈ 5×10−6 ; E2E ≈336–339 ms), and FL-HE accuracy/overhead (H/V/C1/C2:

8

B. B. Yüksel Table 2. Cross-module comparison.

Module

Asset

Threat

ECG-PPS Records; stats

Technique

Interception; plaintext analytics AES (+TLS variant); CKKS stats

Where

Evidence

Edge+cloud

R-peak 100%, mean 99.17%; <50 ms

HEART

Stream confidentiality Low-latency + static keys

Adaptive chaos (perm.+XOR); LKG Edge

FL-HE

Updates; data locality Honest-but-curious agg.; silos

FL + CKKS updates

Limit FHE cost; MIT-BIH; 3-lead

Entropy 7.6–7.8; PSNR >52 dB; ∼1.2 ms No formal proof; morphology drift

Clients+server Acc. 0.9709–0.9991; expert review

Simulated sites; HE up to 1200%

Formal Security Boundary Allocation of the Proposed Unified Framework Each privacy-enhancing technology protects a distinct security boundary across the ECG lifecycle. Protected Asset

Security Boundary

Raw ECG Signal

Privacy-Enhancing Technology

B1

Source Boundary Signal-level confidentiality

HEART Learnable Chaotic Encryption Adaptive signal-domain transformation

B2

Communication & Storage Boundary Secure transmission and encrypted persistence

TLS + AES

Privacy-Preserving Computation Boundary Confidential collaborative learning

CKKS + Federated Learning

Data in Transit Encrypted Cloud Storage

Secure communication and encrypted storage

Encrypted Model Updates B3 Clinical AI

Encrypted gradient aggregation

Boundary Mapping Summary Security Boundary

Protected Asset

Technology

B1

Raw ECG Signal

HEART (Learnable Chaotic Encryption)

B2

Communication & Storage

TLS + AES

B3

Encrypted Computation

CKKS + Federated Learning

Key Design Principle Rather than applying multiple encryption algorithms to the same protection domain, the proposed framework allocates each privacy-enhancing technology to a distinct trust boundary. This boundary-aware architecture minimizes functional overlap while providing end-to-end privacy protection throughout the ECG data lifecycle.

Fig. 4. Formal security boundary allocation of the proposed unified framework. Each privacy-enhancing technology protects a distinct trust boundary across the ECG lifecycle, minimizing functional overlap between complementary privacy-enhancing technologies while enabling end-to-end privacy preservation.

0.9782/0.9991/0.9818/0.9709; +30/+456/+58/+1200%). Table 2 supports composability rather than dominance of one PET. Caveats remain: high PSNR need not preserve all morphology markers; encrypted statistical agreement need not imply ciphertext neural diagnosis; and simulated partition accuracies need not imply live multi-hospital deployment. These findings motivate the formal security-responsibility mapping summarized next. Figure 4 represents a formal allocation of security responsibilities across trust boundaries, not another system-architecture diagram. Learnable chaotic encryption is assigned to the source boundary; TLS and AES secure communication and encrypted storage; and CKKS supports privacy-preserving federated computation. By binding each PET to a distinct responsibility, the allocation minimizes functional overlap between mechanisms while still covering the ECG lifecycle end to end. The technologies therefore complement rather than replace one another within a coherent privacy architecture [2].

6

Open Challenges and Future Research

Even under this allocation, open issues follow the dissertation limits [2]. End-toend composition still needs stronger key management and latency accounting under uncontrolled networks; chaotic threat models remain empirical; and HE/FL arguments centre on honest-but-curious update exposure. CKKS overheads from

Privacy-Preserving AI for Real-Time ECG Monitoring

9

tens of percent to order-of-magnitude costs show that homomorphic protection cannot be applied uniformly under binding monitoring constraints (Fig. 3). Simulated partitions and public datasets only approximate institutional heterogeneity; regulatory alignment is a design motivation, not a certification claim. Future work should examine adaptive privacy orchestration that selects PETs according to computation, trust assumptions, network conditions, partitioning, and clinical workflow.

7

Dissertation Status and Long-Term Goals

Applicant. Beyazıt Bestami Yüksel, Department of Computer Engineering, Istanbul Technical University, Istanbul, Türkiye. Status. PhD graduate, February 2026; defended 17 February 2026. Title. A Unified Framework for Secure and Intelligent ECG Signal Processing via Chaotic Encryption, Fully Homomorphic Computation, and Federated Learning [2]. Associated outputs [1, 5, 4] realize the lifecycle-oriented programme summarized above. Next steps include tighter lifecycle integration, HE acceleration, morphology-preserving refinements, and partition-realistic multi-site evaluation.

8

Conclusion

This dissertation argues that privacy-preserving medical AI should be designed from a systems engineering perspective rather than by searching for one universally optimal privacy mechanism. By allocating adaptive chaotic edge protection, AES/TLS for communication and storage, and federated learning with encrypted updates to distinct trust boundaries, it establishes a framework-level approach to PET orchestration across the clinical ECG lifecycle. Evidence supports feasibility under prototype and simulated settings, while measured overhead and fidelity limits clarify the remaining distance to prospective deployment [2]. Acknowledgments. All code and datasets associated with this work are available at https://github.com/bbyuksel. Disclosure of Interests. The author has no competing interests to declare that are relevant to the content of this article.

References 1. Yuksel, B.B., Yilmazer-Metin, A.: ECG-PPS: Privacy preserving disease diagnosis and monitoring system for real-time ECG signals. In: 2024 17th International Conference on Security of Information and Networks (SIN). IEEE (2024). https://doi.org/10.1109/SIN63213.2024.10871599 2. Yuksel, B.B.: A Unified Framework for Secure and Intelligent ECG Signal Processing via Chaotic Encryption, Fully Homomorphic Computation, and Federated Learning. Ph.D. thesis, Istanbul Technical University (2026), ph.D. thesis; defended 17 February 2026 3. Yuksel, B.B., Metin, A.Y.: Advancing biomedical signal security: Real-time ECG monitoring with chaotic encryption. arXiv preprint arXiv:2411.01310 (2024) 4. Yuksel, B.B., Yilmazer Metin, A.: Federated learning with homomorphic encryption for secure real time ECG anomaly detection: A multi institutional privacy preserving framework. Biomedical Signal Processing and Control 116, 109557 (2026). https://doi.org/10.1016/j.bspc.2026.109557 5. Yuksel, B.B., Yilmazer-Metin, A.: HEART: A high-efficiency adaptive real-time telemonitoring framework for secure electrocardiogram signal transmission using chaotic encryption. Electrica 26, 1–28 (2026). https://doi.org/10.5152/electrica.2026.25232

Related documents

• Towards End-to-End Privacy-Preserving AI for Real-Time ECG Monitoring#1390040
• Radio-Frequency Convolutional Neural Networks#1013877
• Logic Gate Networks and Lookup Table Networks as Lightweight Hardware Classifiers for Inter-patient ECG Arrhythmia Classification#1117567
• Wavelet Decomposition-Based Genomic Analysis of the Human Electrocardiogram#300143
• iFaaSBus: A Security- and Privacy-Based Lightweight Framework for Serverless Computing Using IoT and Machine Learning#133995