# TRUSTD: Combat Fake Content using Blockchain and Collective Signature
Technologies

1, Mohamad Alissa1, William J Buchanan1  1
<EMAIL_ADDRESS><EMAIL_ADDRESS>1st Zakwan Jaroucheh
Blockpass ID Lab
Edinburgh Napier University
Edinburgh
<EMAIL_ADDRESS>
2nd Mohamad Alissa  Blockpass ID Lab
Edinburgh Napier University
Edinburgh
<EMAIL_ADDRESS>
3rd William J Buchanan  Blockpass ID Lab
Edinburgh Napier University
Edinburgh
<EMAIL_ADDRESS>
###### Abstract

The growing trend of sharing news/contents, through social media platforms and
the World Wide Web has been seen to impact our perception of the truth,
altering our views about politics, economics, relationships, needs and wants.
This is because of the growing spread of misinformation and disinformation
intentionally or unintentionally by individuals and organizations. This trend
has grave political, social, ethical, and privacy implications for society due
to 1) the rapid developments in the field of Machine Learning (ML) and Deep
Learning (DL) algorithms in creating realistic-looking yet fake digital
content (such as text, images, and videos), 2) the ability to customize the
content feeds and to create a polarized so-called “filter-bubbles” leveraging
the availability of the big-data. Therefore, there is an ethical need to
combat the flow of fake content. This paper attempts to resolves some of the
aspects of this combat by presenting a high-level overview of TRUSTD, a
blockchain and collective signature based ecosystem to help content creators
in getting their content backed by the community, and to help users judge on
the credibility and correctness of these contents.

##  I Introduction

Fake news has become increasingly one of the main threats to democracy,
journalism, and freedom of expression. It has weakened public trust in
governments and its potential impact on the contentious _Brexit_ referendum
and the equally divisive 2016 U.S. presidential election is yet to be realized
[1]. Our economies are also affected by the spread of fake news, with fake
news being connected to stock market fluctuations and massive trades. For
example, fake news claiming that Barack Obama was injured in an explosion
wiped out $130 billion in stock value
111https://www.forbes.com/sites/kenrapoza/2017/02/26/can-fake-news-impact-the-
stock-market.

The news is a newly received or noteworthy information, especially about
recent not-necessarily political events. Deception can be described as an act
of "intentionally causing another person to have or continue to have a false
belief that is truly believed to be false by the person intentionally causing
the false belief by bringing about evidence on the basis of which the other
person has or continues to have that false belief" [2]. With the ease of
sharing information on social media platforms, the rapid accessibility of
uploaded content on the World Wide Web, and the rapidly progressing fields of
Artificial Intelligence (AI) and Machine Learning (ML), deception has far more
potential in altering an individual’s perception and influencing their
decisions and choices than it has ever had. In this context, various issues
can be identified:

1 - Fake content can have a strong impact on listeners and readers: Experts
distinguish between misinformation and disinformation [3]. Misinformation is a
false or misleading piece of information —e.g., sharing a fraudulent content
without verifying the authenticity of its source is misinformation.
Disinformation is deliberately falsified information to obscure the truth
—e.g., spreading false content with the intention to harm an individual’s
reputation. In this paper we refer to the misinformation, disinformation and
artificially generated content as deceptive artifacts or fake content. Fake
content is a general term which would include the term fake news. Throughout
the paper, we will use the terms fake news and fake content interchangeably.
Repeated exposure to a piece of information makes it familiar, until it is
eventually perceived as acceptable and valid. This phenomenon is known as the
"illusory truth" effect [2].

2- Individuals are victims of the "filter bubbles": Social media websites,
including Facebook, Twitter and LinkedIn are said to construct “filter
bubbles” that allows users to only view content they agree with or that aligns
with their pre-existing beliefs [4]. A filter bubble is an individual’s
personal and unique online space, the nature of which depends on their online
identity (e.g. preferences, behaviour, believes, etc.). Individuals may not
have full control on the construction of this identity. In addition,
individuals have no say regarding what penetrates into the space and what gets
filtered out. Therefore, individuals are now victims of the algorithms that
these centralised platforms use to filter and sort the content (content feed).
There is no guarantee that these algorithms are not designed to favor one
content over another in order to maximise the revenue or achieve a specific
objective (e.g. Cambridge Analytica scandal).

3- Lack of transparency and traceability: Anyone has the freedom to publish
any content on any social media platform without any scrutiny about the
correctness or the credibility of the content. Individuals do not have any
mechanism to trace back the originator of the content. In addition, if the
content is published in a news agency Website, individuals do not have any
clue who has approved that content and what is the approval process.

4- Lack of empowering tools: There is a debate whether the centralised social
media companies should intervene in controlling the political adverts on their
platforms or not. Some people argue in favour of banning these adverts, while
others argue that these private companies should not make the decision on
behalf of the user and these adverts should be shown to the user, and it is up
to the user to make their mind. We have two issues with this argument: 1)
since it is an advertisement platform, their algorithm could be designed to
allow these adverts to reach to the users in a way that maximises the profit
and maybe maximises the intended impact on the users, 2) there is no helpful
tools for the users to assess the credibility and the correctness of the
content. The users are making their own judgement on any content in an ad-hoc
manner. Verifying the authenticity and credibility of every content is a
daunting task for the users. That is why some users prefer to trust a few
sources of news/information.

In order to remedy to the above issues we propose TRUSTD, an ecosystem that
allows content readers (users) to assess the correctness and credibility of
the content they receive. We believe that there is a need to empower the user
with a tool that allows them to delegate the task of verifying the content to
a set of trusted parties of their own choice. That way, users will be able to
assess the credibility of the content themselves based on their level of
trustiness of each of their trusted parties. In addition, since this is a
global issue, TRUSTD is a decentralised and open platform where everyone is
able to join the system.

Today, Distributed Ledger Technologies (DLTs) and specifically blockchain, the
Decentralised Identifiers (DIDs) [5], and collective signature [6] present
opportunities for stakeholders and policymakers as potential technologies that
can help to combat digital deception. These technologies enable security and
trust in a decentralised Peer-to-Peer (P2P) network without any central
managing authority. There are only a few articles of the literature that use
blockchain to combat digital deception and they are mostly focused on tracing
the source of the information. To the knowledge of the authors, this is the
first article that proposes a user-centred approach to empower the user with
the a tool to identify digital deception using the above technologies. In this
paper, we are focusing on the human element when addressing the fake content
issue. In other words, it is true that the machines are able to detect the
fake content to some extent but there is no replacement to the human
intervention. In addition, TRUSTD does not inhibit the current existing
automated tools to detect the fake content, these deep tools can be included
as part of the user policy rather than rely only on the quality of these
sophisticated tools.

The rest of this paper is organized as follows. Section II reviews the state-
of-the-art of current digital deception and the involved technologies and
approaches used to combat it. Section III provides a background on the Schnorr
signing and how it is used in the collective signing algorithm. In Section IV,
we list the main driving requirements that drive the design of TRUSTD. Section
V describes the details of the proposed architecture and its implementation.
Finally, Section VI is devoted to conclusions and future work.

##  II Related Work

Recently, Wikipedia co-founder Jimmy Wales has launched
"WikiTribune"222https://wt.social/, a platform to combat the low-quality
content. This platform is designed for small, niche communities that can
sustain themselves where almost everything on the platform is editable
(similar to Wikipedia) and the users are responsible to correct the contents
even those written by other users. However, this might not be an effective
approach to combat the fake content as this platform can be turned into a
source of fake news.

Governments worldwide are taking various measures to prevent the widespread of
fake news, which may be driven by different motivations and which may
undermine national security [7]. These measures include the introduction of
new legislation e.g. 1) new laws that would give governments more powers to
hold technology companies (e.g., Facebook, Twitter and Google) and individuals
accountable for the spread of fake news, and 2) new laws that would seek to
counter the impact of automated social media accounts (bots). Although these
laws are important and in the right direction, they hold the technology
companies accountable of identifying the fake news on behalf of the content
readers (users). In this respect, users have to trust that these companies
implement adequate algorithms to remove the fake news as quickly as possible.
However, this is not enough because the user has to trust the criteria
followed by these algorithms to identify the fake news. The user should be
empowered by tools to allow them to specify their trust policy in order to
determine the credibility of the content.

In response, technology companies are defending themselves and are introducing
mechanisms to detect and remove fake news. For example, Facebook Journalism
Project aims to collaborate with content organizations and journalism experts
to improve the quality of information shared on the platform [8]. Facebook
tries to provide an improved ranking system for posts shown in the News Feed
and expediting the reporting of misleading content. Google has presented a
white paper outlining measures to prevent the spread of disinformation through
their products [9]. The objective is to enhance its search result ranking
system by ranking news on the basis of expertise, credibility and authority.
Although these initiatives are necessary, they still do not position the user
in the center. The user should be able to make their own judgement on the
content based on their own criteria. We believe the fake news problem cannot
be solved by automated tools only; and these tools should be complemented by
manual verification process conducted by humans.

The IEEE Global Initiative has published a report titled “Ethically Aligned
Design” [10] on guiding and encouraging the development of autonomous systems
that are primarily focused on human well-being and protecting human rights
through preventing misuse of AI, ensuring system transparency and developing a
framework for developer accountability. The goal of The IEEE Global Initiative
is that Ethically Aligned Design will provide pragmatic and directional
insights and recommendations, serving as a key reference for the work of
technologists, educators and policymakers in the coming years. TRUSTD is
inspired by the general principals of the above initiative such as human
rights, well-being, data agency, transparency and accountability; and it uses
these principals as a guideline to derive the driving requirements in the
design of an open and decentralised ecosystem to combat the flow of fake
content.

The authors in [1], presented four perspectives to study fake content:
knowledge-based, style-based, propagation-based and credibility based. In
knowledge-based approach, one aims to analyze and/or detect fake news, using a
process known as fact-checking. Manual fact-checking can be divided into (I)
expert-based and (II) crowd-sourced fact-checking. Expert-based fact-checking
relies on domain-experts to verify the given news contents, therefore, it
leads to highly accurate results. Recently, many websites have emerged to
provide expert-based fact-checking services. For example, PolitiFact provides
“the PolitiFact scorecard”, which presents statistics on the authenticity
distribution of all the statements related to a specific topic. Another
example is HoaxSlayer, which classifies the articles and messages into e.g.,
hoaxes, spams and fake news. A comprehensive list of fact-checking websites is
provided by Reporters Lab at Duke University333https://reporterslab.org/fact-
checking/, where over two hundred fact-checking websites across countries and
languages are listed. Although these websites can provide ground-truth for the
detection of fake content, these websites are still silo-ed and centralised
and they have their own "experts" and their own methodology of identifying the
fake news.

Crowd-sourced fact-checking relies on a large number of fact-checking
individuals and therefore, it is less credible and accurate due to the
political bias of these individuals and their conflicting annotations. Hence,
one often needs to (i) filter non-credible individuals and (ii) resolve
conflicting fact-checking results. An example is
Fiskkit444https://fiskkit.com/, where users can upload articles, and provide
ratings and tags for sentences within articles. TRUSTD can be seen as a crowd-
sourced fact-checking approach but it is the content creator who chooses the
fact-checkers and it is the user who determines the content’s credibility
based on their trust level in these fact-checkers.

Automatic fact-checking techniques have been developed, heavily relying on
Information Retrieval (IR) and Natural Language Processing (NLP) techniques.
The overall automatic fact-checking process can be divided into two stages:
(I) fact extraction (also known as knowledge-base construction) and (II) fact-
checking (also known as knowledge comparison) [1]. Knowledge-based approaches
aim to evaluate the authenticity of the given content, while style-based
approaches aim to assess the intention behind publishing the content.
Credibility-based approaches evaluate the content based on content-related and
social-related information. The AI Foundation has developed an intelligent
software called “Reality Defender”, to detect potentially fake media in the
digital world555https://aifoundation.com/responsibility/. This software runs
AI-driven analysis techniques to detect alterations in the scanned images,
videos and other media, and allows for reporting suspected fakes. In TRUSTD,
these deep tools can be included as part of the user’s trust policy, as will
be seen later, rather than rely solely on the quality of these tools.

Blockchain technology has been already leveraged to contribute solutions to
address the fake news problem. For example, Shang et al. [11] trace the source
of news by keeping a ledger of timestamps and the connections between the
different blocks. Huckle et al. [12] introduced a blockchain-based application
that is capable of indicating the authenticity of digital media. Using the
trust mechanisms of blockchain technology, the tool can show the provenance of
any source of digital media, including images used out of context in attempts
to mislead. However, the authors mentioned that although their application has
the potential to be able to verify the originality of media resources, that
technology is only capable of providing a partial solution to fake content. We
agree with the authors that this is because the blockchain technology is
incapable of proving the authenticity of a content story and that requires
human skills.

##  III Background

###  III-A Schnorr signing

In Schnorr signing, we can aggregate public keys of $P$ participants into a
single signing key [13], and uses the non-interactive version of the Fiat-
Shamir heuristic 666https://en.wikipedia.org/wiki/Fiat-Shamir_heuristic. Using
Elliptic Curve methods, to sign a message we take a random value ($k$) and a
private key value ($d$) and a generator point $G$ ($G$ is a base point on an
elliptic curve) and compute:

$Q=dG$ (1)

and:

$R=kG$ (2)

For it to be non-interactive we then calculate:

$e=H(R\parallel M)$ (3)

and then:

$s=k-ed$ (4)

The signature is then $(s,e)$. To verify we compute:

$r_{v}=sG+eQ$ (5)

and then:

$e_{v}=H(r_{v}\parallel M)$ (6)

We then check that $r_{v}=e_{v}$.

Each participant has a private key ($a_{i}$) and a public key $A_{i}=a_{i}G$.
We can then determine the aggregate public key with:

$A=\sum_{i\in P}A_{i}$ (7)

###  III-B Collective Signing

Within legal infrastructures, we might have several witnesses $W$, and we ask
a number of the witnesses $W\textquoteright$ to verify that something is
correct. If one of the witnesses cannot verity the information, we would
highlight a problem. Let us say we have a controller on a network, and a
number of selected trusted witnesses. Each of the witnesses can then check all
of the messages sent by the nodes on the network, and if one of them
determines a problem, they can tell the rest of the network. In this respect,
every message ($M$) is collectively signed by $W$ witnesses.

The collective signing (CoSi) algorithm is defined by Syta et al [6]. With
CoSi (collective signing), there are four phases involving $P$ participants
and where the leader has an index value of zero. Each participant has a
private key ($a_{i}$) and a public key ($A_{i}=a_{i}G$, and where $G$ is a
base point on an elliptic curve). We then determine the aggregated public key
with [6]:

$A=\sum_{i\in P}A_{i}$ (8)

Announcement: Initially the leader broadcasts a message ($M$) that it wants
the participants to sign.

Commitment: Each node $i$ will pick a random scalar ($v_{i}$) and determines
their commitment ($V_{i}=[v_{i}]G$). Each commitment is then sent to the
leader, who will wait for a specific amount of commitments
($P\textquoteright$) to be received. The leader then creates a participant
bitmask and aggregates all the received commitments:

$V=\sum_{j\in P^{\prime}}V_{j}$ (9)

and creates a participation bitmask $Z$. The leader then broadcasts $V$ and
$Z$ to the other participants.

Challenge: Each of the participants computes the collective challenge (using
the hash function $H$):

$c=H(V||A||M)$ (10)

and send the following back to the leader:

$r_{i}=v_{i}+c\times a_{i}$ (11)

Response: The leader will wait until the participants in $P\textquoteright$
have sent their responses. Once received, the leader computes the aggregated
response:

$r=\sum_{j\in P^{\prime}}r_{j}$ (12)

and publishes the signature of the message (M) as:

$(V,r,Z)$ (13)

Each node can then check their own signature value and agree with the leader.

In order to handle large numbers of participants during signature generation
efficiently, CoSi protocol uses a tree-shaped network communication overlay
[14]. Any tree used by CoSi should be a complete tree for performance reasons.
The leader is the root node of the tree and is responsible for creating the
tree. An intermediate node is a node who has one parent node and at least one
child node. A leaf node is a node who has only one parent and no child nodes.
The leader multicasts a message to his direct child nodes. Upon reception of a
message, each node stores the message and multicasts it further down to its
children node, except if the node is a leaf. Each node generates its response.
Each leaf node sends its response to their parent and is allowed to leave the
protocol. Each other node starts waiting for the responses of its children.
When the root node receives all the responses from its children, it can
generate the signature.

###  III-C Decentralised Identifier (DID)

The self-sovereign identity (SSI) refers to an identity management system
which allows individuals to fully own and manage their digital identity [15].
The World Wide Web Consortium (W3C) working group on verifiable claims states
that in a SSI system users exist independently from services [16]. This
highlights the contrast to current identity management which either relies on
a number of large identity providers such as Facebook and Google or the user
has to create new digital identities at each individual service provider. SSI
is enabled by the new development of blockchain technology. Through the
trustless, decentralised database that is provided by a blockchain, classic
Identity Management registration processes can be replaced [15].

A Decentralised Identifier (DID) is comprised of a scheme as well as a method
and method specific identifier. The method closely resembles the namespace
component of an Uniform Resource Name (URN)
777https://en.wikipedia.org/wiki/Uniform_Resource_Name. Each distinct
blockchain or rather each identity registry constitutes its own namespace
while the blockchain specific identifiers specify the actual identity
addressed by the DID. An example for such a DID path would be:
did:examplechain:123456789. The DID document is the key to the decentralised
identity.

A DID is a unique identifier that can be resolved to a DID document [17]. This
document contains cryptographic material and authentication suites enabling
identification of the DID subject. They also contain service endpoints
allowing secure encrypted communication to the DID subject. A public DID is a
DID that is registered on a public distributed ledger meaning DID is
resolvable to a document and hence verifiable by anyone. There should be some
restrictions or process by which DIDs can be registered to a public ledger.
Once registered it is possible to use that DID as a root of trust.

Establishing pairwise private DID connections can be done by first contacting
the endpoint (i.e. agent) resolved from the public DID document. Sending a new
unique DID and DID document along with proof you are the DID subject. In
response you should receive a new unique DID signed by the public key of the
public DID. Together these two DIDs form a private unlinkable connection
between two parties complete with private endpoints and the cryptographic
material required to verify the origin and integrity of the communication.

###  III-D DLTs and blockchain capabilities

DLTs like Tangle or blockchain are able to provide seamless authentication,
efficient and secure data storage, robustness against attacks, scalability,
transparency and accountability. Such features can play an effective role in
combating fake content, considering that transactions cannot be tampered once
they have been distributed, accepted and validated by a network consensus and
stored in blocks [18]. Moreover, transactions are easily auditable by all the
involved stakeholders. More detailed information on how to design a blockchain
according to the business needs and deployment environment can be found, for
example, in [19][20].

##  IV Driving Requirements

We believe that combating the fake content cannot be a pure technical solution
and that a human element should always exist. In the proposed ecosystem, we
can identify two types of users:

\- Individuals and organizations who produce the content. We call them content
creators (CCs). These creators may have different agendas and they could be
honest or dishonest in reporting any news or spreading any information.

\- Content readers: We call them users. These users are the consumers of the
content.

The following are the set of requirements that we believe TRUSTD needs to
meet:

###  IV-A Traceability of origin

The ecosystem should allow the originator of the content to be identified at
any point of time. That could be achieved by storing the content along with
the originator ID in an immutable ledger that cannot be maliciously altered
(i.e. blockchain).

###  IV-B Traceability of approval

In TRUSTD, every CC can request other actors to "sign" their content. This
"signature" means that the signing actor agrees on the correctness of the
content. This is necessary in order for the user to be able to assess the
credibility of the content, as will be seen in the next sections. Once any
actor provides their signature (witnessing the correctness of the content),
this signature should be stored in a way that this actor cannot deny their
action at any time. However, the ecosystem should allow any actor to change
their mind and revoke their signature after, for example, they discover that
the content was incorrect. For transparency purposes, the list of actions of
any actor should be captured in the immutable ledger.

###  IV-C Accountability

There is a need to ensure that the signing actors cannot deny their
involvement in signing off the content when the content is discovered to be
false.

###  IV-D System openness

The ecosystem should allow any individual or organization to join and be part
of the approval actors. For example, these individuals can be journalists,
editors, activists, etc. who have different levels of expertise; and the
organizations can be any news agency. However, since the fake content concerns
all people and it affects everyone’s life, the system should be open to allow
anyone to be part of the signing actors - we call them appraiser actors (AAs).
This is especially important for the content that is originated from people
(non-journalists) such as abnormal accidents or natural disasters, and that
the only witnesses are the people seen at the accident location.

###  IV-E The content should be evaluated by the user

It is true that the ecosystem allows the invited AAs to sign off the contents
they receive from CCs. However, the system should keep the user in the center
and it should empower them with a mechanism to judge on the credibility of the
content. For that objective, the user should be able to select the list of AAs
and assign them a trust level value which is in the range $[0,T]$. $T$ is the
maximum trustiness value. For example, a trust level of $T$ means the user
completely trusts that actor. A trust level of 0 means the user does not trust
the actor.

The user can determines the credibility of the content by calculating the
following formula:

$C=\sum_{i\in N}T_{i}/(T*N)$ (14)

$Ti$: The trustiness value of the actor $i$. $N$: The length of the actor list
added by the user. The result is a number in the range $[0,1]$. This number
indicates the level of credibility of the content.

###  IV-F The content should be backed by actors

Before publishing their content to the social media and news websites, the CCs
can get an "approval" from a set of AAs of their choice. These AAs can be
selected by the CCs themselves or by the system in automated way based on a
specific criteria. For example, the system can extract the main keywords of
the content and send it to all AAs that are tagged with these keywords. In
addition, these AAs can specify a policy (using the DID system) to accept
signature requests only from CCs who can prove that they have specific
attributes, for example, holding a specific degree. These attributes should be
signed by an entity trusted by the AA.

The approval comes in a form of a collection of signatures from these AAs
indicating that they agree on the correctness of the content. We can imagine
here different signature types. For example, the CC may obtain a collection of
signatures from the AAs who share the CC’s opinion, or who support the CC’s
call. In this paper, we focus on the signature that means that the AA agree on
the correctness of the content.

###  IV-G The ecosystem should be decentralised and scalable

Since the fake news/content is a global issue, the system should not be
centralised. Instead, the system should provide a protocol between the
different users and actors which are registered in different subsystems owned
by different companies or organisations. However, these subsystems should have
one common denominator: the identifier of the users and actors. For that aim,
the decentralised identity (DID) [5] would be a perfect fit in this context.
In this respect, the actors can create their own DIDs and publish them on
their websites or their social media profiles. That DID will be used for
signature verification as will be seen later.

Figure 1: The TRUSTD approach

##  V System Design

Three main entities can be identified: 1) The content creator (CC), 2) the
appraisal actor (AA) who signs off any content, and 3) the user who needs to
assess the credibility of any content. Each entity should be represented by a
DID agent. These agents should follow a specific protocol in order to get any
content signed off by the relevant AAs. The users’ agents should be able to
verify any content based on the trust policy specified by the user. Here is
the proposed protocol as illustrated in Fig 1:

1- An AA creates its own DID and publishes it somewhere so that the CCs, users
and other AAs know about it.

2- A CC creates the content in a form of a text, photo, video, sound, or any
other digital format.

3- Depending on the content scope, the CC can choose a list of AAs that they
are candidate to approve and sign off the content. Alternatively the system
recommends specific AAs. The result is a set of DIDs which can be used to
retrieve their corresponding public keys.

4- A collective signature is generated in five steps over two round trips
between the agent of the CC and the agents of the selected AAs, as follows:

AAs need not coordinate for the creation of their key-pairs beyond selecting a
common elliptic curve, and verifiers can apply flexible acceptance policies
beyond simple t-of-n thresholds.

We use the following notation:

$B$: Generator of the group of AAs.

$L$: Order of the group generated by B.

($a_{i}$, $A_{i}$): Each AAi generates their long term private-public key pair
($a_{i}$, $A_{i}$) as in EdDSA.

$A$: collective public key $A$ generated from the public keys of AAs.

$N$: denotes the list of AAs, the size of $N$ is denoted by $n$.

\- Announcement Step: The CC broadcasts an announcement message to the AAs
indicating the start of a signing process. This message contains the content
itself.

\- Commitment Step: Upon the receipt of the announcement message, each AAi
generates a random secret $r_{i}$ by hashing 32 bytes of cryptographically
secure random data. Each $r_{i}$ must be re-generated until it is different
from ($0\ mod\ L$) or ($1\ mod\ L$). Each AA then constructs the commitment
$R_{i}$ as the encoding of $[r_{i}]B$, sends $R_{i}$ to the CC and stores the
generated $r_{i}$ for usage in the response phase.

\- Challenge Step: The CC waits to receive the commitments $R_{i}$ from the
other AAs for a certain configurable time frame. After the timeout, the CC
constructs the subset $M$ of AAs from whom he has received a commitment $Ri$
and computes the sum:

$R=\sum_{i\in M}R_{i}$ (15)

The CC then computes

$c=SHA512(R||A||M)\ mod\ L$ (16)

The CC broadcasts $c$ to all AAs.

\- Response Step: Upon reception of $c$, each AA generates their response:

$s_{i}=(r_{i}+c*a_{i})\ mod\ L$ (17)

and send it to the CC.

\- Signature Generation Step: The CC waits to receive the responses $s_{i}$
from the AAs for a certain configurable time frame. After the timeout, the CC
checks if he received responses from all AAs in $M$ and if not he must abort
the protocol. The CC then computes the aggregate response

$s=\sum_{i\in M}s_{i}\ mod\ L$ (18)

and initializes a bitmask $Z$ of size $n$ to all zero. For each AAi who is
present in $N$ but not in $M$ the CC sets the $i-th$ bit of $Z$ to $1$, i.e.,
$Z[i]=1$. The CC then forms the signature $sig$ as the concatenation of the
byte-encoded point $R$, the byte-encoded scalar $s$, and the bitmask $Z$. The
resulting signature is of the form:

$sig=R||s||Z$ (19)

5- The CC sends a request to the underlying blockchain to store the hash of
the content along with the collective signature in the blockchain.

6- In order to verify the credibility of a specific content, the user agent
calculates the hash of the content and uses it as an input parameter to query
the blockchain and to retrieve the corresponding collective signature (if
any).

7- As aforementioned, each user should be able to choose a set of their
trusted AAs. Each user agent maintains a list of the public keys of those
actors along with their trust level values. Based on the retrieved collective
signature, the user agent obtains the public keys of the AAs who signed off
the content and then calculates the credibility value of the content as
described in section IV.E.

##  VI Implementation

An initial prototype has been built (Fig. 2 to 4). We use Django version 2.2.7
to build a TRUSTD-based blog where the users can register to the system,
create contents, specify the list of their trusted parties, assign a trust
level to each actor in that trusted list, send the contents to a subset of
their trusted parties list (Fig 2), view the names of the signed parties along
with the trustworthiness level of the related content (Fig 4), and receive
requests from other users to sign contents (Fig 3). We use GO programming
language version 1.13.4 to implement
CoSi888https://asecuritysite.com/encryption/go_cosi.

Figure 2: The user assigns a trust level to each trusted party, and sends the
content to a subset of them Figure 3: The user receives requests from other
users to sign contents Figure 4: The user can see the names of parties who
signed the content, along with the trustworthiness level of the content

##  VII Discussion

###  VII-A Limitation of the TRUSTD approach

In its current implementation, TRUSTD has some limitations that can be solved
in future work:

\- The authors in [21] introduced mBCJ, a secure two-round multi-signature
scheme. Their results show that mBCJ is only marginally less efficient than
CoSi, so that any protocol based on the CoSi scheme should instead be built on
the provably more secure mBCJ scheme. The TRUSTD approach is agnostic to the
used collective signature scheme. We plan to adopt the mBCJ scheme as a
mechanism to collectively sign any digital content.

\- In some extreme cases, the content could be signed by one AA who is not
trusted by the user. For example, if the content is a video of a publicly
known person and this person signs off this video as correct, but this person
is not trusted by the user, in our current implementation, the system
recommends to the user that the video is not credible even though that AA is
the only AA who can sign off this video. Therefore, we need to extend the way
we calculate the credibility of any content to consider different dimensions,
each of which takes two extremes, for example: [liar, truthful], [enemy,
friend], [dishonest, honest], etc.

\- In order for the CC to get their content signed off by the AAs, they may
need to wait for a certain time delay. This delay is caused by two factors: 1)
the round-trip time required to get the commitments and signatures, and 2) the
lack of incentive for the AAs to sign off the content quickly. However this
risk is mitigated by the fact that the CC can initiate the sign off request at
any point of time, even after the content has been published. In addition,
they can publish their content (along with the signatures they received so
far), and then they can initiate another request to get more signatures on the
content.

\- Once the collective signature along with the content hash has been added in
the blockchain, the AAs cannot revoke their decision because there is no way
to revert that addition in blockchain. However, we are planning to implement a
mechanism to allow any AA to retrigger the sign off process which will result
in a new collective signature.

###  VII-B Advantages of the TRUSTD approach

TRUSTD approach can be applied not only for combating the fake news, but it
could be extended to other domains as well. For example, a new type of a
decentralised social network can be built in which CCs and AAs help each
other. Contrast to the existing centralised social media networks, a
decentralised network can be built where CCs produce different types of
content and get different types of appraisal such as "Agree" (I agree with the
point of view of the content), "Correct" (the content is correct), "Support"
(I support the call of the content), etc. (in form of signature) from
different individuals and organisations without any central entity governing
the whole network. For example, authors can get their research
conference/journal papers marked as "correct" by the reviewers, bloggers can
get their opinion blogs marked as "agreed upon" by a set of authors/people,
petition creators can get their petitions to request some change marked as
"supported" by a set of people, etc. In all cases, users are able to judge on
the credibility of any content based on their trust policy.

##  VIII Conclusion

We look at spreading the fake news as a special case of spreading all kinds of
deceptive contents. The use of online social media to connect with people
around the world is rising sharply and it has become an important source for
the distribution of digital deception. This setting shifts the responsibility
of verifying the content to these centralised social media platforms. In
addition, the user has no say or control over the filtering mechanism
implemented by these platforms. TRUSTD allows users to specifies their trusted
parties and to determine the credibility level of any published content. We
believe this is a step in the right direction where the ecosystem is
decentralised, all users, AAs and CCs own their identities, and the user is in
the center of the equation.

## References

  * [1] X. Zhou and R. Zafarani, “Fake news: A survey of research, detection methods, and opportunities,” vol. 1, no. 1, 2018.
  * [2] J. Mahon, “Kant on lies, candour and reticence,” _Kantian Review_ , vol. 7, 03 2003.
  * [3] T. Zubair, A. Raquib, and J. Qadir, “On combating fake news, misinformation, and machine learning generated fakes: Insights from the islamic ethical tradition,” 10 2019.
  * [4] D. Difranzo and K. Gloria-Garcia, “Filter bubbles and fake news,” _XRDS: Crossroads, The ACM Magazine for Students_ , vol. 23, pp. 32–35, 04 2017.
  * [5] “Decentralized identifiers (dids) v1.0, w3c working draft,” 2019. [Online]. Available: https://www.w3.org/TR/did-core/
  * [6] E. Syta, I. Tamas, D. Visher, D. I. Wolinsky, P. Jovanovic, L. Gasser, N. Gailly, I. Khoffi, and B. Ford, “Keeping authorities" honest or bust" with decentralized witness cosigning,” in _2016 IEEE Symposium on Security and Privacy (SP)_. Ieee, 2016, pp. 526–545.
  * [7] G. Haciyakupoglu, J. Y. Hui, V. Suguna, D. Leong, and M. F. B. A. Rahman, “Countering fake news: A survey of recent global initiatives,” 2018.
  * [8] A. Guess, J. Nagler, and J. Tucker, “Less than you think: Prevalence and predictors of fake news dissemination on facebook,” _Science Advances_ , vol. 5, p. eaau4586, 01 2019.
  * [9] “How google fights disinformation,” 2019.
  * [10] “Ieee global initiative et al., ethically aligned design, ieee standards v1,” 2016\. [Online]. Available: https://standards.ieee.org/content/dam/ieee-standards/standards/web/documents/other/ead_v2.pdf
  * [11] W. Shang, M. Liu, W. Lin, and M. Jia, “Tracing the source of news based on blockchain,” 06 2018, pp. 377–381.
  * [12] S. Huckle and M. White, “Fake news: A technological approach to proving the origins of content, using blockchains,” _Big Data_ , vol. 5, pp. 356–371, 12 2017.
  * [13] K. Ohta and T. Okamoto, “Multi-signature schemes secure against active insider attacks,” _IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences_ , vol. 82, no. 1, pp. 21–31, 1999.
  * [14] B. Ford, N. Gailly, L. Gasser, and P. Jovanovic, “Collective edwards-curve digital signature algorithm,” Internet-Draft draft-ford-cfrg-cosi-00. txt. IETF Secretariat, Tech. Rep., 2017.
  * [15] A. Mühle, A. Grüner, T. Gayvoronskaya, and C. Meinel, “A survey on essential components of a self-sovereign identity,” 07 2018.
  * [16] “Verifiable claims working group frequently asked questions,” 2019. [Online]. Available: https://w3c.github.io/webpayments-ig/VCTF/charter/faq.html
  * [17] “Decentralized Identifiers (DIDs) v0.11.” [Online]. Available: https://w3c-ccg.github.io/did-spec/
  * [18] A. Shahaab, B. Lidgey, C. Hewage, and I. Khan, “Applicability and appropriateness of distributed ledgers consensus protocols in public and private sectors: A systematic review,” _IEEE Access_ , vol. PP, pp. 1–1, 03 2019.
  * [19] P. Fraga-Lamas and T. Fernández-Caramés, “A review on blockchain technologies for an advanced and cyber-resilient automotive industry,” _IEEE Access_ , vol. 7, pp. 17 578–17 598, 01 2019.
  * [20] T. M. Fernández-Caramés and P. Fraga-Lamas, “A review on the application of blockchain for the next generation of cybersecure industry 4.0 smart factories,” 2019.
  * [21] M. Drijvers, K. Edalatnejad, B. Ford, E. Kiltz, J. Loss, G. Neven, and I. Stepanovs, “On the security of two-round multi-signatures,” 05 2019, pp. 1084–1101.


11institutetext: Dept. of Computer Science & Engineering, University of
Nevada, Reno, NV, USA22institutetext: School of Computer Science, Fudan
University, China

# ECG-ATK-GAN: Robustness against Adversarial Attacks on ECGs using
Conditional Generative Adversarial Networks

Khondker Fariha Hossain 11 Sharif Amit Kamran 11 Alireza Tavakkoli 11
Xingjun Ma 22

###### Abstract

Automating arrhythmia detection from ECG requires a robust and trusted system
that retains high accuracy under electrical disturbances. Many machine
learning approaches have reached human-level performance in classifying
arrhythmia from ECGs. However, these architectures are vulnerable to
adversarial attacks, which can misclassify ECG signals by decreasing the
model’s accuracy. Adversarial attacks are small crafted perturbations injected
in the original data which manifest the out-of-distribution shifts in signal
to misclassify the correct class. Thus, security concerns arise for false
hospitalization and insurance fraud abusing these perturbations. To mitigate
this problem, we introduce the first novel Conditional Generative Adversarial
Network (GAN), robust against adversarial attacked ECG signals and retaining
high accuracy. Our architecture integrates a new class-weighted objective
function for adversarial perturbation identification and new blocks for
discerning and combining out-of-distribution shifts in signals in the learning
process for accurately classifying various arrhythmia types. Furthermore, we
benchmark our architecture on six different white and black-box attacks and
compare them with other recently proposed arrhythmia classification models on
two publicly available ECG arrhythmia datasets. The experiment confirms that
our model is more robust against such adversarial attacks for classifying
arrhythmia with high accuracy.

###### Keywords:

ECG Adversarial Attack Generative Adversarial Network Electrocardiogram Deep
Learning.

##  1 Introduction

ECG is a crucial clinical measurement that encodes and identifies severe
electrical disturbances like cardiac arrhythmia and myocardial infractions.
Many artificial intelligence and machine learning approaches have been
proposed to detect different types of ECGs accurately [19, 25, 11]. Recently,
deep convolutional neural networks (CNNs) [30, 1, 20, 2, 32] has become the
norm for achieving near-human-level performance for classifying cardiac
arrhythmia and other cardiac abnormalities. Popular systems such as Medtronic
LINQ II ICM [27], iRhythm Zio [31], and Apple Watch Series 4 [17] use embedded
DNN models to analyze cardiac irregularities by monitoring the signals.
Accurately detecting arrhythmia in real-time enables an immediate referral of
the patient to appropriate medical facilities. In addition to providing the
patient with timely medical help, this will benefit the insurance companies by
potentially reducing long-time consequences of delayed healthcare. Despite all
these benefits, state-of-the art systems used to predict arrhythmia are
vulnerable to adversarial attacks. These vulnerabilities are crucial as they
can result in false hospitalization, misdiagnosis, patient data-privacy leaks,
insurance fraud, and negative repercussion for healthcare companies [12, 17].

Although these vulnerabilities are highly studied [9, 23], a comprehensive
solution is yet to be devised. Adversarial attacks misclassify ECG signals by
introducing small perturbations that inject the out-of-distribution signal
into the classification path. The perturbations could be introduced to the
data by accessing the model parameters (White-box attack) or inferring the bad
prediction outputs for a given set of input (Black-box attack) [7]. Current
deep learning [30, 1, 20] and GAN-based [18, 14, 13, 15] classifiers are not
specifically designed to utilize the objective function to identify and
mitigate adversarial attacked ECGs. Although recent works [17, 9] illustrated
the vulnerability of deep learning architectures to adversarial attacks, our
work proposes a first-of-its-kind defense strategy against six different
adversarial attacks for ECGs using a novel conditional generative adversarial
networks. Additionally, we incorporate a class-weighted categorical loss
function for identifying out-of-distribution perturbations and emphasizing the
class-specific features. Both qualitative and quantitative benchmarks on two
publicly available ECG datasets illustrate our proposed method’s robustness.

Figure 1: Proposed ECG-ATK-GAN consisitng of a Generator and a Discriminator.
The discriminator is utilized for generating the six attacked signals
$E_{x_{adv}}$, namely FGSM, BIM, PGD, CW, HSJ, and DBB. These are then added
with the non-attacked signals $E_{x}$ to create the training data-set
$E^{{}^{\prime}}_{x}$. Contrarily, the Generator takes both attacked and non-
attacked ECG signals, $E^{{}^{\prime}}_{x}$, a noise vector $z$, and the class
labels $E_{y}$ as input.

##  2 Methodology

###  2.1 Generator and Discriminator

We propose a novel GAN based on a class-conditioned generator and a robust
discriminator for categorical classification of both real and adversarial
attacked ECG signals as illustrated in Fig. 1. The generator concatenates both
non-attacked or attacked ECG signals $E_{x}^{\prime}$, label $E_{y}$, and a
noise vector $z$ as input and generates $G(E_{x}^{\prime},Ey,z)$. We use a
Gaussian filter with $\sigma=3$ to generate the smoothed noise vector, $z$.
The label vector $E_{y}$ in our model is utilized so that generated signal is
not random. Rather it imitates class-specific ECG representing an arrhythmia.
The noise vector, $z$ ensures that the generated signal has small
perturbations so that it does not fully imitate the original ECG signal and
helps in overall training in extrapolation of generated signals. The
generators incorporate Residual, Downsampling, Upsampling, and Skip-Dilated
Attention (SDA) block as visualized in Fig. 1. The generator uses Sigmoid
activation as output, so the synthesized signal is constrained within 0-1 as a
continuous value.

Figure 2: Proposed (a) Residual, (b) Skip-Dilated Attention, (c) Regular, (d)
Upsampling and, (e) Downsampling Blocks. Here, K=Kernel size, S=Stride, and
D=Dilation rate.

The discriminator takes attacked/non-attacked real ECG, $x$ and GAN
synthesized ECG, $G(E_{x}^{\prime},E_{y},z)$ signals sequentially while
training. The discriminator consists of three regular blocks and three
downsampling blocks (Fig. 1). The discriminator utilizes three losses: 1)
Class-weighted Categorical cross-entropy for identifying adversarial
attacked/non-attacked ECGs, 2) Categorical cross-entropy for normal and
arrhythmia beat classification and 3) Mean-squared Error for GAN adversarial
training. So we use three output activations: Sigmoid (GAN training), and two
Softmax for adversarial attack and arrhythmia/normal beat classification.

  * •

Residual Block: For extracting small perturbations in the attacked ECG
signals, we use convolution with a small kernel, $k=3$ and stride, $s=1$ in
the residual block in the Generator, illustrated in Fig. 2(a). This residual
block is capable of extracting fine features that extrapolate the original
signal to contain small perturbations and make it out-of-distribution.
Specifically, the residual skip connection retains important signal-specific
information that is added with more robust features extracted after the batch-
normalization and leaky-ReLU activation.

  * •

Skip-Dilated Attention Block: We use skip-dilated attention (SDA) block with
kernel size, $k=2$, dilation rate, $d=2$ and stride, $s=1$, as illustrated in
Fig. 2(b). By utilizing dilated convolution, our receptive fields become
larger, covering larger areas of the attacked signals [33].

  * •

Regular Block: We use the regular block for discriminators, containing
convolution ($k=3,s=1$), batch-norm, and leaky-ReLU layers, as visualized in
Fig. 2(c). Our main objective here is to encode the signals to meaningful
classification outputs for two tasks, which is to 1) classify the type of
arrhythmia and, 2) distinguish between non-attacked/attacked signals.
Therefore, we avoid using any complex block for feature learning and
extraction.

  * •

Downsampling and Upsampling Blocks: The generator consist of both downsampling
and upsampling blocks, whereas the discriminator consist of only downsampling
blocks to get the desired feature maps and output. The upsampling block
consists of a transposed-convolution layer, batch-norm, and Leaky-ReLU
activation layer successively and is given in Fig. 2(d). In contrast, The
downsampling block comprises of a convolution layer, a batch-norm layer and a
Leaky-ReLU activation function consecutively and is illustrated in Fig. 2(e).

###  2.2 Objective Function and Individual Losses

To distinguish non-attacked and attacked signals with out-of-distribution
perturbations and emphasize the class-specific features even under significant
perturbations, we propose a class-weighted categorical cross-entropy loss. The
loss function is given in Eq. 1, where $m=2$, for attacked/non-attacked signal
and $\kappa$ is the class weight for the ground-truth, $E_{y}$ and predicted
class-label, $E_{y^{\prime}}$.

$\mathcal{L}_{atk}(D)=-\sum^{m}_{i=0}\kappa^{i}E^{i}_{y}\log(E^{i}_{y^{\prime}})$
(1)

For classification of normal and different arrhythmia signals, we use
categorical cross-entropy loss. Here, $k=$ distinct normal/arrhythmia beats,
depending on the dataset.

$\mathcal{L}_{ary}(D)=-\sum^{k}_{i=0}E^{i}_{y}\log(E^{i}_{y^{\prime}})$ (2)

For ensuring that the synthesized signal contains representative features of
both adversarial examples and adversarial attacks, our generator incorporates
the mean-squared error (MSE) as shown in Eq. 3. This helps the generator
output signals with small perturbations that guarantee the signal to
misclassify. As the generator, $G$ is class-conditioned, it takes distinct
ground truth class-label $E_{y}$, along with the attacked/non-attacked ECGs,
$E^{{}^{\prime}}_{x}$ and Gaussian noise vector $z$ as input.

$\mathcal{L}_{mse}(G)=\frac{1}{N}\sum_{i=1}^{N}(G(E^{{}^{\prime}}_{x},E_{y},z)-E_{x})^{2}$
(3)

We use Least-squared GAN [26] for calculating the adversarial loss and
training our GAN. The cost function for our adversarial loss is given in Eq.
4. The discriminator takes real ECG signal, $E_{x}$ and generated ECG signal,
$G(E^{{}^{\prime}}_{x},E_{y},z)$ in two iterations. The adversarial loss
quadratically penalizes the error while stabilizing the min-max game between
the generator and discriminator.

$\mathcal{L}_{adv}(D)=\big{[}\ (D(E_{x}^{\prime},E_{y})-1)^{2}\big{]}\ +\\\
\big{[}\ (D(G(E_{x}^{\prime},E_{y},z),E_{y})+1))^{2}\big{]}\ $ (4)

By incorporating Eq. 1, 2, 3 and 4, we can formulate our final loss function
as given in Eq. 5. Here, $\lambda_{mse}$, $\lambda_{atk}$, and $\lambda_{ary}$
denote different weights, that are multiplied with their corresponding losses.
We want our generator to synthesize realistic ECGs to fool the Discriminator,
while classifying the types of arrhythmia with high accuracy. So, the final
goal is to maximize the adversarial loss and minimize other losses.

$\min\limits_{G,D_{ary},D_{atk}}\big{(}\max\limits_{D_{adv}}(\mathcal{L}_{adv}(D))+\lambda_{mse}\big{[}\
\mathcal{L}_{mse}(G)\big{]}\ +\\\
\lambda_{atk}\big{[}\mathcal{L}_{atk}(D)\big{]}\ +\lambda_{ary}\big{[}\
\mathcal{L}_{ary}(D)\big{]}\ \big{)}$ (5)

Figure 3: The non-attacked and attacked signals (white and black-box attacks)
overlapped on each other signified by  Red and  Blue lines.

###  2.3 Adversarial Attacks

We incorporated six established adversarial attacks (shown in Fig 3) that
target our discriminator model as it is responsible for classifying different
types of arrhythmia and normal beats in ECG signals. The reason for choosing
these state-of-the-art attacks is to make our model more robust for intrusive
perturbations in real-world applications. Four of these attacks are white-box,
meaning detailed knowledge of the network architecture, the parameters, and
the gradient w.r.t to the input is utilized to corrupt the data [6]. The other
two are black-box attacks, meaning no knowledge of the underlying architecture
or parameter is needed; instead, some output is observed for some probed
inputs [6]. Moreover, the attack corrupts the data by estimating the gradient
direction using the information at the decision boundary of the output [10,
4]. We experimented with perturbation values, $\epsilon$ ranging from $0.001$
to $0.1$, and selected the value which looked visually realistic and harder to
discern. So, the visually realistic perturbations for FGSM, BIM, PGD and DBB
is, $\epsilon=0.01$ and for CW, $\epsilon=0.1$.

  * •

Fast Gradient Sign Method (FGSM): This white-box attack creates attacked ECGs,
$E_{X_{adv}}$ by perturbing the original signal, $E_{X}$. For this, it
calculates the gradients of the loss, $\mathcal{L}_{ary}$ (Eq. 2) based on the
input signal to create new adversarial signals that maximize the loss [16].

  * •

Basic Iterative Method (BIM): This is an improved white-box attack, where the
FGSM attack is iteratively updated in a smaller step size and clips the
signals values of intermediate results to ensure the $\epsilon$-neighborhood
of the original signal, $E_{X}$ [22].

  * •

Projected Gradient Descent (PGD): This white-box attack is considered the most
decisive first-order attack. Though similar to BIM, it varies in initializing
the example to a random point in the $\epsilon$-ball of interest (decided by
the $L_{\infty}$ norm) and does random restarts. In contrast, BIM initializes
in the original point [24].

  * •

Carlini-Wagner (CW): This is an optimization-based white-box attack [5]. It
resolves the unboundedness issue by using line search to optimize the attack
objective. We utilized the version with the $L_{\infty}$ norm, i.e., for
maximum perturbation applied to each point in the signal.

  * •

Decision-based Boundary Attack (DBB): This is a decision-based black-box
attack that starts from querying a large adversarial perturbation and then
seeks to reduce the perturbation while staying adversarial [4]. It only
requires the final class prediction of the model.

  * •

Hop Skip Jump Attack (HSJ): A powerful black-box attack that only requires the
final class prediction of the model [10]. And it is an advanced version of the
boundary attack, requiring significantly fewer model queries than Boundary
Attack.

##  3 Experiments

###  3.1 Data Set Preparation

We used the PhysioNet MIT-BIH Arrhythmia dataset for our experiment [28]. We
divided the dataset into four categories, N [Normal beat, Left and right
bundle branch block beats, Atrial and Nodal escape beat], S [Atrial premature
beat, Aberrated atrial, Supraventricular and Nodal premature beat], V
[Premature ventricular contraction, Ventricular escape beat], and F [Fusion of
the ventricular and regular beat]. We first find the R-peak for every signal,
use a sampling rate of 280 centering on R-peak, and then normalize the
amplitude between $[0,1]$. In the benchmarking, we combine and split the
samples into 80% and 20% sets of train and test data. So we end up having
train samples of N: 69958, S: 4766, V: 1965, F:617, and test samples of N:
17571, S: 1126, V: 473, and F: 157. To overcome the lack of minority class
samples, we use Synthetic Minority Over-sampling Technique (SMOTE) [8] to
increase the number of samples for S, V, and F to 10,000 each. We do not use
SMOTE on test data. Next, we use the train and test ECG signals to create the
six types of adversarial attacked ECGs (using Adversarial Robustness toolbox
[29]). So we end up having same number attacked ECGs as non-attacked ones for
each adversarial attacks. Next, we combine the original and adversarial ECGs
to create our whole training dataset, $E_{x}+E_{xadv}=E^{{}^{\prime}}_{x}$
(Fig. 1). We use 5-fold cross validation and select the model with the best
validation score.

We also benchmark on PTB Diagnostic ECG Database [3], which consists of Normal
and Myocardial Infraction beats. For each category, we use 10,000 samples,
meaning we end up having 20,000 ECGs in total. We split them into 80% training
and 20% test data. In similar manner to MITBH, we apply six adversarial
attacks on these ECG signals. For training we end up having 32,000 (16,000
non-attacked and 16,0000 attacked) signals for each attack types. We use the
same 5-fold cross-validation method.

Table 1: MIT-BIH Dataset : Comparison of architectures trained and evaluated
on non-attacked/attacked ECGs for normal and three arrhythmia beat
classification.

Model Accuracy N S V F Sensitivity Specificity Sensitivity Specificity
Sensitivity Specificity Sensitivity Specificity No Attack Proposed Method 99.2
98.8 95.2 83.7 99.8 97.9 99.7 92.4 99.3 Shaker et al. [30] 98.6 97.4 98.1 93.0
98.7 99.2 99.0 87.2 99.6 Kachuee et al. [20] 98.1 96.8 94.5 88.7 97.6 92.5
99.6 90.4 99.3 Acharya et al. [1] 96.4 92.8 96.2 86.2 97.0 95.9 98.8 94.2 97.1
FGSM Proposed Method 98.7 97.9 95.0 82.6 99.2 99.2 98.7 73.2 99.8 Shaker et
al. [30] 92.6 84.7 93.3 81.8 89.9 96.5 95.6 57.9 98.7 Kachuee et al. [20] 86.5
73.1 82.8 68.9 83.4 73.7 97.3 82.8 93.2 Acharya et al. [1] 77.2 53.3 87.9 65.7
74.1 66.2 92.3 65.6 87.9 BIM Proposed Method 98.1 97.1 91.2 76.1 98.6 95.0
99.4 84.1 98.9 Shaker et al. [30] 96.2 93.1 90.1 69.1 98.2 97.6 94.9 55.4 99.8
Kachuee et al. [20] 85.6 70.6 90.4 67.4 90.5 83.6 92.3 82.1 88.5 Acharya et
al. [1] 76.9 54.4 87.5 49.0 88.2 42.1 91.9 87.8 73.8 PGD Proposed Method 98.4
97.0 96.1 89.0 98.0 97.5 99.3 88.5 99.6 Shaker et al. [30] 96.5 93.4 92.8 81.3
97.9 94.5 98.2 82.8 97.4 Kachuee et al. [20] 87.2 74.0 86.9 66.3 87.6 84.7
91.8 65.6 95.2 Acharya et al. [1] 77.2 54.0 88.8 54.1 91.3 57.8 82.0 66.2 80.6
CW Proposed Method 98.8 97.8 97.0 91.1 98.8 98.3 99.5 91.0 99.5 Shaker et al.
[30] 95.4 90.8 96.0 84.7 97.0 97.8 94.1 72.6 99.7 Kachuee et al. [20] 91.9
84.5 83.3 74.4 89.3 79.7 99.3 61.1 96.3 Acharya et al. [1] 81.2 61.8 89.1 64.6
81.5 67.7 94.1 83.4 86.8 DBB Proposed Method 93.0 85.8 94.9 84.4 96.1 91.3
96.2 84.1 93.9 Shaker et al. [30] 90.1 80.6 86.7 65.1 94.2 79.4 94.9 83.4 91.7
Kachuee et al. [20] 79.7 57.9 86.4 78.0 69.3 70.9 96.6 82.1 93.6 Acharya et
al. [1] 81.9 62.6 85.8 68.1 75.6 77.0 95.8 82.8 92.7 HSJ Proposed Method 71.9
44.8 68.2 34.6 78.6 35.7 82.6 32.4 83.8 Shaker et al. [30] 70.5 41.2 67.4 33.0
77.1 40.4 81.1 37.5 83.4 Kachuee et al. [20] 68.6 39.3 65.8 21.3 82.5 10.3
94.5 43.9 62.2 Acharya et al. [1] 68.4 37.6 70.0 32.3 57.4 23.6 90.4 20.3 90.0

###  3.2 Hyper-parameters

We chose $\lambda_{atk}=10$ (Eq. 1), $\lambda_{ary}=10$ (Eq. 2), and
$\lambda_{mse}=1$ (Eq. 3), to give more weight to classification losses than
to adversarial loss. We give more weight to attacked signals than non-attacked
ones by using $\kappa=[1,1.05]$ (Eq. 1). We used Adam optimizer [21] with a
learning rate of $\alpha=0.0001$, $\beta_{1}=0.5$ and $\beta_{2}=0.999$. We
used Tensorflow 2.0 to train the model with batch size, $b=128$ for 100 epochs
taking 4 hours to train on NVIDIA P100 GPU. We initialized the noise vector,
$z$ with float values between $[0,1]$. Code repository is provided in this
link.

###  3.3 Quantitative Evaluation

We perform the quantitative evaluation by comparing our model with other
state-of-the-art architectures [30, 1, 20] on both attacked and non-attacked
data from MITBH and PTB datasets. In the first experiment, we use either only
normal or adversarial attacked test data (19,327 and 4,000 for MITBH and PTB)
for benchmarking the models on normal/abnormal beat classification, which is
illustrated in Table. 1 and Table. 2. We train all the models on their
respective attacked and non-attacked training samples for a fair comparison.
For metrics, we use Accuracy, Sensitivity, and Specificity. We can see that
for ‘No Attack’, all models achieve comparatively good results. However, for
each distinct attack, the results worsen for other models compared to ours.
The architecture in [30, 1, 20] utilizes 1D Convolution based architecture.
Out of these models, Shaker et al. [30] adopt DC-GAN, a generative network for
adversarial signal generation. However, their classification architecture is
trained separately, and they provide results only on real ECG signals. One
reason for their model’s good performance for the no-attack scenario is
training with GAN-generated adversarial samples, which helps to learn out-of-
distribution signals. Moreover, the two 1D CNN architectures achieve better
sensitivity for minority category F for FGSM, BIM, and HSJ attacks. Similarly,
our model’s performance on the minority category F is best for PGD, CW, and
DBB attacks and second best for FGSM and BIM. Our model performs poorly
against HSJ attacks because the signals have too much high noise and no clear
pattern, as illustrated in 3. Besides that, our architecture’s overall
performance is more robust against adversarial attacks for classifying
arrhythmia and myocardial infractions, as shown in Table. 2.

Table 2: PTB Dataset : Comparison of architectures trained and evaluated on
non-attacked/attacked ECGs for normal and myocardial infarction beat
classification.

Methods No Attack FGSM BIM PGD CW DBB HSJ Accuracy Proposed Method 99.5 99.4
99.6 99.6 99.5 93.1 71.8 Shaker et al. [30] 98.0 98.6 95.8 96.4 98.3 91.4 70.2
Kachuee et al. [20] 95.2 97.1 94.4 92.2 91.3 88.6 56.5 Acharya et al. [1] 79.8
84.1 83.2 84.1 80.9 77.4 54.7 Sensitivity Proposed Method 99.3 99.2 99.6 99.7
99.2 92.6 79.8 Shaker et al. [30] 96.7 98.3 92.1 94.8 98.0 91.5 83.7 Kachuee
et al. [20] 98.3 96.0 95.9 92.1 95.4 86.7 85.5 Acharya et al. [1] 82.1 93.1
93.4 90.6 90.3 88.5 90.7 Specificity Proposed Method 99.7 99.5 99.7 99.5 99.7
93.7 64.0 Shaker et al. [30] 99.3 98.9 99.4 98.0 98.7 91.2 56.8 Kachuee et al.
[20] 92.1 98.2 93.0 92.2 87.3 90.3 28.1 Acharya et al. [1] 77.7 75.3 73.2 77.8
71.6 66.5 19.4

Table 3: Generator’s Performance: Similarity of adversarial and attacked /
non-attacked signals.

MITBIH PTB Mean-Squared-Error Structural Similarity Cross-corelation
Coefficiet Normalized RMSE Mean-Squared-Error Structural Similarity Cross-
corelation Coefficient Normalized RMSE No Attack 0.0129 99.90 99.86 3.487e-5
0.0184 99.87 99.93 8.152e-5 FGSM 0.0117 99.81 99.89 2.890e-5 0.0001 99.84
99.89 0.02391 BIM 0.0134 99.80 99.86 3.737e-5 0.0155 99.91 99.95 5.769e-5 PGD
0.0122 99.84 99.89 3.115e-5 0.0179 99.88 99.92 7.722e-5 CW 0.0065 99.95 99.97
9.038e-6 0.0188 99.87 99.92 8.498e-5 DBB 0.0002 99.00 99.39 0.03159 0.0007
99.19 99.29 0.05532 HSJ 0.0003 99.42 99.45 0.0393 0.0003 99.51 99.60 0.03872

###  3.4 Qualitative Evaluation

For finding the similarity between real and synthesized attacked/non-attacked
ECG signals, we benchmarked generated adversarial signals using four different
metrics, i) Mean Squared Error (MSE), ii) Structural Similarity (SSIM), iii)
Cross-correlation coefficient, and iv) Normalized Mean Squared Error (NRMSE).
In Table. 3, We use both attacked and non-attacked signals from the test set.
We score SSIM of $99.90\%$, $99.81\%$ (FGSM), $99.80\%$ (BIM), $99.84\%$
(PGD), $99.95\%$ (CW), $99.00\%$ (DBB) and $99.43\%$ (DBB) for MITBH Dataset.
On the other hand we achieve SSIM of $99.87\%$ (No Attack), $99.84\%$ (FGSM),
$99.91\%$ (BIM), $99.84\%$ (PGD), $99.87\%$ (CW), $99.19\%$ (DBB) and
$99.51\%$ (DBB) for PTB Dataset. As for cross-correlation, MSE, and NRMSE, our
model generates quite realistic signals with minimal error.

##  4 Conclusions and Future Work

This paper presents ECG-ATK-GAN, a novel conditional Generative Adversarial
Network for accurately predicting different types of arrhythmia from both
regular and adversarially attacked ECGs. In addition, our architecture
incorporates a new class-weighted categorical objective function for capturing
out-of-distribution signals and robustly discerning class-specific features
corrupted by adversarial perturbations. We provided an extensive benchmark on
two publicly available datasets to prove the robustness of our proposed
architecture. One future direction is to improve our architecture by defending
against other types of adversarial attacks.

Prospect of application: Detecting arrhythmia accurately and robustly in real-
time will pave the way for better patient care and disease monitoring. In
addition, insurance companies, contractors, partners, and many stakeholders
will financially benefit from a trusted cardiac arrhythmia diagnostic system
that is robust against adversarial attacks. This system can also help identify
new attack types by distinguishing signal anomalies.

## References

  * [1] Acharya, U.R., Oh, S.L., Hagiwara, Y., Tan, J.H., Adam, M., Gertych, A., San Tan, R.: A deep convolutional neural network model to classify heartbeats. Computers in biology and medicine 89, 389–396 (2017)
  * [2] Ahmad, Z., Tabassum, A., Guan, L., Khan, N.: Ecg heart-beat classification using multimodal image fusion. In: ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1330–1334. IEEE (2021)
  * [3] Bousseljot, R., Kreiseler, D., Schnabel, A.: Nutzung der ekg-signaldatenbank cardiodat der ptb über das internet. Biomedical Engineering / Biomedizinische Technik (1995)
  * [4] Brendel, W., Rauber, J., Bethge, M.: Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248 (2017)
  * [5] Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. IEEE (2017)
  * [6] Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: Adversarial attacks and defences: A survey. arXiv preprint arXiv:1810.00069 (2018)
  * [7] Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology 6(1), 25–45 (2021)
  * [8] Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: synthetic minority over-sampling technique. Journal of artificial intelligence research 16, 321–357 (2002)
  * [9] Chen, H., Huang, C., Huang, Q., Zhang, Q., Wang, W.: Ecgadv: Generating adversarial electrocardiogram to misguide arrhythmia classification system. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 3446–3453 (2020)
  * [10] Chen, J., Jordan, M.I., Wainwright, M.J.: Hopskipjumpattack: A query-efficient decision-based attack. In: 2020 ieee symposium on security and privacy (sp). pp. 1277–1294. IEEE (2020)
  * [11] Faziludeen, S., Sabiq, P.: Ecg beat classification using wavelets and svm. In: 2013 IEEE Conference on Information & Communication Technologies. pp. 815–818. IEEE (2013)
  * [12] Finlayson, S.G., Bowers, J.D., Ito, J., Zittrain, J.L., Beam, A.L., Kohane, I.S.: Adversarial attacks on medical machine learning. Science 363(6433), 1287–1289 (2019)
  * [13] Golany, T., Freedman, D., Radinsky, K.: Ecg ode-gan: Learning ordinary differential equations of ecg dynamics via generative adversarial learning. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 35, pp. 134–141 (2021)
  * [14] Golany, T., Radinsky, K.: Pgans: Personalized generative adversarial networks for ecg synthesis to improve patient-specific deep ecg classification. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 33, pp. 557–564 (2019)
  * [15] Golany, T., Radinsky, K., Freedman, D.: Simgans: Simulator-based generative adversarial networks for ecg synthesis to improve deep ecg classification. In: International Conference on Machine Learning. pp. 3597–3606. PMLR (2020)
  * [16] Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)
  * [17] Han, X., Hu, Y., Foschini, L., Chinitz, L., Jankelson, L., Ranganath, R.: Deep learning models for electrocardiograms are susceptible to adversarial attack. Nature medicine 26(3), 360–363 (2020)
  * [18] Hossain, K.F., Kamran, S.A., Tavakkoli, A., Pan, L., Ma, X., Rajasegarar, S., Karmaker, C.: Ecg-adv-gan: Detecting ecg adversarial examples with conditional generative adversarial networks. In: 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA). pp. 50–56. IEEE (2021)
  * [19] Jambukia, S.H., Dabhi, V.K., Prajapati, H.B.: Classification of ecg signals using machine learning techniques: A survey. In: 2015 International Conference on Advances in Computer Engineering and Applications. pp. 714–721. IEEE (2015)
  * [20] Kachuee, M., Fazeli, S., Sarrafzadeh, M.: Ecg heartbeat classification: A deep transferable representation. In: 2018 IEEE International Conference on Healthcare Informatics (ICHI). pp. 443–444. IEEE (2018)
  * [21] Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)
  * [22] Kurakin, A., Goodfellow, I., Bengio, S., et al.: Adversarial examples in the physical world (2016)
  * [23] Lam, J., Quan, P., Xu, J., Jeyakumar, J.V., Srivastava, M.: Hard-label black-box adversarial attack on deep electrocardiogram classifier. In: Proceedings of the 1st ACM International Workshop on Security and Safety for Intelligent Cyber-Physical Systems. pp. 6–12 (2020)
  * [24] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)
  * [25] Mahajan, R., Kamaleswaran, R., Howe, J.A., Akbilgic, O.: Cardiac rhythm classification from a short single lead ecg recording via random forest. In: 2017 Computing in Cardiology (CinC). pp. 1–4. IEEE (2017)
  * [26] Mao, X., Li, Q., Xie, H., Lau, R.Y., Wang, Z., Paul Smolley, S.: Least squares generative adversarial networks. In: Proceedings of the IEEE international conference on computer vision. pp. 2794–2802 (2017)
  * [27] Medtronic: Linq ii, cardiac monitors, https://www.medtronic.com/us-en/healthcare-professionals/products/cardiac-rhythm/cardiac-monitors/linq-ii.html
  * [28] Moody, G.B., Mark, R.G.: The impact of the mit-bih arrhythmia database. IEEE Engineering in Medicine and Biology Magazine 20(3), 45–50 (2001)
  * [29] Nicolae, M.I., Sinn, M., Tran, M.N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., Ludwig, H., Molloy, I., Edwards, B.: Adversarial robustness toolbox v1.2.0. CoRR 1807.01069 (2018), https://arxiv.org/pdf/1807.01069
  * [30] Shaker, A.M., Tantawi, M., Shedeed, H.A., Tolba, M.F.: Generalization of convolutional neural networks for ecg classification using generative adversarial networks. IEEE Access 8, 35592–35605 (2020)
  * [31] iRhythm Technologies: How could using ai impact cardiology?, https://www.irhythmtech.com/providers/evidence/ai
  * [32] Wang, B., Liu, C., Hu, C., Liu, X., Cao, J.: Arrhythmia classification with heartbeat-aware transformer. In: ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1025–1029 (2021)
  * [33] Yu, F., Koltun, V.: Multi-scale context aggregation by dilated convolutions. arXiv preprint arXiv:1511.07122 (2015)


#  Extreme events in discrete nonlinear lattices

A. Maluckov$\ {}^{1}$, Lj. Hadžievski$\ {}^{2}$, N. Lazarides$\ {}^{3,4}$, and
G. P. Tsironis$\ {}^{3}$ $\ {}^{1}$Faculty of Sciences and Mathematics,
Department of Physics, P. O. Box 224, 18001 Niš, Serbia
$\ {}^{2}$Vinča Institute of Nuclear Sciences, P. O. Box 522, 11001 Belgrade,
Serbia
$\ {}^{3}$Department of Physics, University of Crete, and Institute of
Electronic Structure and Laser, Foundation for Research and Technology –
Hellas, P. O. Box 2208, 71003 Heraklion, Greece
$\ {}^{4}$Department of Electrical Engineering, Technological Educational
Institute of Crete, P. O. Box 140, Stavromenos, 71500, Heraklion, Crete,
Greece

###### Abstract

We perform statistical analysis on discrete nonlinear waves generated though
modulational instability in the context of the Salerno model that interpolates
between the intergable Ablowitz-Ladik (AL) equation and the nonintegrable
discrete nonlinear Schrödinger (DNLS) equation. We focus on extreme events in
the form of discrete rogue or freak waves that may arise as a result of rapid
coalescence of discrete breathers or other nonlinear interaction processes. We
find power law dependence in the wave amplitude distribution accompanied by an
enhanced probability for freak events close to the integrable limit of the
equation. A characteristic peak in the extreme event probability appears that
is attributed to the onset of interaction of the discrete solitons of the AL
equation and the accompanied transition from the local to the global
stochasticity monitored through the positive Lyapunov exponent of a nonlinear
map.

###### pacs:

63.20.Ry; 47.20.Ky; 05.45+a

Introduction.- The motivation of the present work stems from observations of
the sudden appearance of extremely large amplitude sea waves referred to as
rogue or freak waves Kharif . These waves appear very suddenly in relatively
calm seas, reach amplitudes of over $20m$ and may destroy or sink small as
well as large vessels Muller . Theoretical analysis of ocean freak waves has
been linked to nonlinearities in the waver wave equations, studied though the
nonlinear Schrödinger (NLS) equation and shown that the probability of their
appearance is not insignificant Onorato . A scenario for freak wave generation
in NLS is through a Benjamin-Feir (modulational) instability, resulting in
self-focusing effects and subsequent formation of freak waves Zakharov .
Modulational instability (MI) induces local exponential growth in the wave
train amplitude Onorato1 ; Shukla  that has been confirmed experimentally and
numerically Ruban .

Intriguingly, there are completely different physical systems that possess the
required nonlinear characteristics which favour the appearance of rogue waves.
Recent observation of optical rogue waves in a microstructured optical fiber
was reported Solli  in a regime near the threshold of soliton-fission
supercontinuum generation, i.e., in a region where MI plays a key role in the
dynamics. A generalized NLS equation was used successfully to model the
generation of optical rogue waves while, additionally, control and
manipulation of rogue soliton formation was also discussed Dudley . The
mechanism of the rogue waves creation, or, more generally of extreme events,
has become an issue of principal interest in various other contexts as well,
since rogue waves can signal catastrophic phenomena such as an earthquake, a
thunderstorm, or a severe financial crisis. Knowledge of the probability of
occurrence of extreme events and the capability to predict the time at which
such an event may take place is of a great value. Such events are usually
rare, and they exhibit ”extreme-value” statistics, typically characterized by
heavy-tailed probability distributions. Experimental observation of optical
rogue-wave-like fluctuations in fiber Raman amplifiers show that the
probability distribution of their peak power follows a power law Hammani .

In this work we focus on the discrete counterparts of rogue waves that may
appear in nonlinear lattices as a result of discrete soliton or breather
induction and their mutual interactions. Specifically we investigate the role
of integrability in the formation of discrete rogue waves (DRW) and the
resulting extreme event statistics. Their appearance may affect dramatically
the physical systems. We use the Salerno model Salerno  that through a unique
parameter interpolates between a fully integrable discrete lattice, viz. the
Ablowitz-Ladik (AL) lattice Ablowitz  , and the nonintegrable DNLS equation
ELS ; MT . One of the basic questions to be addressed below is the probability
of occurrence of a DRW as a function of the degree of integrability of the
lattice and thus study the role of the latter in the production of extreme
lattice events Nicolis .

The Salerno model.- The Salerno model (SM) is given through the following set
of equations

$\displaystyle
i\frac{d\psi_{n}}{dt}=-(1+\mu|\psi_{n}|^{2})(\psi_{n+1}+\psi_{n-1})-\gamma|\psi_{n}|^{2}\psi_{n}$
(1)

where $\mu$ and $\gamma$ are two nonlinearity parameters. When $\mu=0$ the
model becomes the DNLS equation while for $\gamma=0$ it reduces to AL. Several
properties of the model such as integrability Rumpf  and stability of
localized travelling waves Cai ; Hennig  have been analyzed. Both the norm $N$
and the Hamiltonian $H$ of the model are conserved quantities. They are given
by

$\displaystyle N$ $\displaystyle=$
$\displaystyle\frac{1}{\mu}\sum_{n}\ln{|1+\mu|\psi_{n}|^{2}|},$ (2)
$\displaystyle H$ $\displaystyle=$
$\displaystyle\sum_{n}\left[\frac{\gamma}{\mu^{2}}\ln|1+\mu|\psi_{n}|^{2}|-\frac{\gamma}{\mu}|\psi_{n}|^{2}-2Re[\psi_{n}\psi_{n+1}^{*}]\right].$
(3)

It is also known that Eq. (1) exhibits MI, which may give rise to stationary,
spatially localized solutions in the form of discrete breathers (DBs), i.e.,
periodic and spatially localized nonlinear excitations DBs . The MI induced
DBs appear in random lattice locations and may be mobile. High-amplitude DBs
tend to absorb low-amplitude ones, resulting after some time in a small number
of very high amplitude excitations, which may get pinned at a specific lattice
site due to the Peierls-Nabarro potential barrier in nonintegrable lattices
Kivshar1 . In general, high-amplitude DBs are virtual bottlenecks which slow
down the relaxation processes in nonlinear lattices Tsironis ; Rasm , and it
has been proposed that they may serve as models for freak waves Dysthe . The
development of MI in Eq. (1) can be analyzed with the linear stability
analysis of its the plane wave solutions perturbed by small phase and
amplitude perturbations Maluckov . The interplay between the on-site and
intersite nonlinear terms (i.e., according to the variation of their relative
strength through $\mu$ and $\gamma$), may change MI properties and,
consequently, the conditions for the DBs to exist in the lattice Kivshar . The
SM has recently found applications in modelling Bose-Einstein condensates of
dipolar atoms in a strong periodic potential Gomez , dilute Bose-Einstein
condensates trapped in a periodic potential Trombettoni , and even biological
systems Salerno1 .

For later convenience in the numerical simulation, the variables $\psi_{n}$ in
Eq. (1) are rescaled as $\psi_{n}=\xi_{n}/\sqrt{\mu}$, so that in terms of
$\xi_{n}$ the dynamic equations read

$\displaystyle
i\frac{d\xi_{n}(t)}{dt}=-(1+|\xi_{n}(t)|^{2})(\xi_{n+1}+\xi_{n-1})-\Gamma|\xi_{n}(t)|^{2}\xi_{n},$
(4)

where $\Gamma=\gamma/\mu$. Therefore, the whole two-dimensional parameter
space $(\gamma,\mu)$ can be scaled by $\mu=1$, leaving $\gamma$ as a free
parameter. With that scaling we may go as close to the DNLS limit as we want
to, by simply let $\Gamma$ to attain very large values. However, the exact
DNLS limit $\mu=0$ has to be calculated separately.

Figure 1:  Evolution of the scaled amplitudes $|\xi_{n}|$ for a lattice of
size $N=101$, with $\Gamma$ ($\mu$ and $\gamma$ in the DNLS case), is shown on
the figure. The initial conditions for all cases are $\xi_{n}=1$ for any $n$
(uniform) plus a small amount of white noise.

Statistics of extreme events.- We integrate numerically the system of Eqs. (4)
with periodic boundary conditions using a sixth order Runge-Kutta algorithm
with fixed time-stepping $\Delta t=10^{-4}$. We started simulations with
different initial conditions (the plane wave, uniform background with white
noise and Gaussian noise) which gave similar results. Here we present
calculations in which the initial condition is uniform, $\xi_{n}=1$ for any
$n$, with the addition of a small amount of white noise to accelerate the
development of the MI. The uniform solution is chosen in the interval where it
is known from linear stability analysis that it is unstable. By varying the
nonlinearity parameters we identify broadly three regimes of DRWs that are
shown as spatiotemporal evolutions in Fig. 1. For the purely integrable AL
lattice ($\Gamma=0$) DBs are mobile and essentially noninteracting; as a
result we do not observe significant formation of high DRWs (Fig. 1a). In the
vicinity of the AL limit, i.e. for small $\Gamma$ ($\Gamma\sim 0.1$), there is
an onset of weak interaction of the localized modes of the AL lattice leading
to a significant increase in DRW formation that are mobile (Fig. 1b,c). In
this regime the DBs are highly mobile indicating that DB merging could be
responsible for creation of high-amplitude localized waves. For $\Gamma>>0.1$
on the other hand, DNLS-type behavior dominates the SM and localized
structures that are initially created through the MI become easily trapped in
the lattice (Fig. 1d).

The three regimes mentioned previously are probed by calculating the time-
averaged height distributions $P_{h}$. We first define the forward (backward)
height at the $n-$th site as the difference between two successive minimum
(maximum) and maximum (minimum) values of $|\xi_{n}(t)|$. We use then both the
forward and the backward heights for the calculation of the local height
distribution; after spatial averaging the latter results in the height
probability densities (HPDs) shown in Fig. 2. We note that the tails of the
HPDs are related to extreme events and the appearance of DRWs. For $\Gamma$
finite the HPDs are sharply peaked but have extended tails indicating that
extreme events are more than several times as large as the mean distribution
height. In the DNLS limit ($\Gamma\gg 1$) the obtained HPD is very close to
the Rayleigh distribution whose tails decay very fast VanKampen , indicating
negligible probability for the occurrence of extreme events (dotted curve in
Fig. 2). In all the other cases the decay of the tails of the HPDs is much
slower.

In order to probe further the onset of extreme discrete events we employ the
practice used in water waves and define a DRW as one that has a height greater
than $h_{th}=2.2h_{s}$, with $h_{s}$ being the significant wave height. The
latter is defined as the average height of the one-third higher waves in the
height distribution. As a result, the probability of occurrence of extreme DRW
events $P_{ee}=P_{h}(h>h_{th})$ is obtained by integration of the (normalized)
HPD from $h=h_{th}$ up to infinity. By evaluating several HPDs as those in
Fig. 2 we may estimate the probability of occurrence of DRWs $P_{ee}$ as a
function of the parameter $\Gamma$ (the results are shown in Fig. 3). We note
that the probability for the occurrence of a DRW has a certain value in the AL
case, subsequently peaks for small values of $\Gamma$ and decays precipitously
when $\Gamma>>1$. This behavior of the probability $P_{ee}$ is compatible with
the DB picture outlined earlier, viz. in the very weakly nonintegrable regime
the AL modes may interact leading to DB fusion and DRW generation. On the
other hand, as nonintegrability becomes stronger, the scattering of the AL
modes is more chaotic leading to a suppression of DRW formation.

Figure 2:  The normalized height probability density $P_{h}(h)$ for several
values of $\Gamma$ and for the DNLS limit (with $\gamma=6$). The line with
slope $-1$ is added to assist comparisons and corresponds to $P_{h}\sim 1/h$.
Approximately vertical drop corresponds to the DNLS limit with an exponential
tail. The increase of $\Gamma(\mu=1)$ leads to the decrease of the slope and
appearance of plateau on the $P_{h}$ curve; the latter increases the extreme
event probability leading a maximum at $\Gamma=0.07$ (Fig. 3.)  Figure 3:  The
normalized probability $P_{ee}=P_{h}(h\geq h_{th})$ for the occurrence of
extreme events as a function of the integrability parameter $\Gamma$. All data
present averaged results of five numerical measurements differing in the
initial conditions.

Map approach.- In order to probe deeper on the formation of DRWs we substitute
$\psi_{n}=\phi_{n}\exp(-i\omega t)$ into Eq. (1), with $\phi_{n}$ a real-
valued function of the lattice site $n$, and obtain the stationary equation

$\displaystyle\omega\phi_{n}+(1+\mu|\phi_{n}|^{2})(\phi_{n+1}+\phi_{n-1})+\gamma|\phi_{n}|^{2}\phi_{n}=0,$
(5)

which can be transformed in the two-dimensional map

$\displaystyle x_{n+1}=-\frac{\omega+\gamma x_{n}^{2}}{1+\mu
x_{n}^{2}}x_{n}-y_{n},\qquad y_{n+1}=x_{n},$ (6)

where we have defined $x_{n}=\phi_{n}$ and $y_{n}=\phi_{n-1}$. Eqs. (6)
represent a real analytic area-preserving map Hennig ; Hennig1  with the
lattice index $n$ playing the role of discrete ’time’.

The phase portraits of the map Eq. (6) for several $\Gamma$-values are shown
in Fig. 4. In the AL limit, the phase space consists of perfectly disconnected
separatrices while for non-zero $\Gamma$, the stable and unstable manifolds
intersect transversely, resulting in the generation of a homoclinic tangle.
With increasing $\Gamma$ the motion near separatrices becomes exceedingly
complicated and the trajectories wander irregularly before approaching an
attracting set (Figs. 4b and 4c). Moreover, for any $\Gamma\neq 0$, the
position of separatrices in phase space changes in time, resulting in
overlapping of neighboring separatrices and diffusion in those regions which
have been traversed by a separatrix. The sharp peak of the probability of
occurrence of extreme events $P_{ee}(h>h_{th})$ in the SM (Fig. 3) can be
associated with the opening of a stochasticity web, when orbits fast explore
all extended narrow stochasticity regions leading to an anomalous relaxation
phase Rumpf ; VanKampen . This event signs the transition from the local to
global stochasticity Lichtenberg  in SM. On the other hand, the decrease of
$P_{ee}(h>h_{th})$ for larger $\Gamma$’s is related to the increasingly longer
trapping time in more developed stochasticity region.

The Melnikov analysis in the SM Hennig  shows that the magnitude of the
separatrix splitting and the consequent development of stochasticity depends
on the $\Gamma/|\omega|$ ratio. The conjecture that $P_{ee}$ is associated
with the complexity of the phase portraits of the corresponding maps implies
that $P_{ee}$ should also depend on the $\Gamma/|\omega|$ ratio. In our case
$|\omega|$ is related to the modulation frequency of the initially uniform
solution $U$ with the relation $|\omega|=(\gamma+2\mu)U^{2}+2$, which, through
the MI process it transformed into a train of localized DB-like
configurations. We have checked numerically that for fixed ratio
$\Gamma/|\omega|$ and different values of $U$ and $\Gamma$ we obtain the same
HPD. As a consequence, the probability of extreme events $P_{ee}$ as a
function of the $\Gamma/|\omega|$ is qualitatively the same with that of
$P_{ee}$ as a function of $\Gamma$ shown in Fig. 3.

The degree of nonintegrability in the SM model can be quantified by
calculating the Lyapunov exponents of the corresponding maps Maluckov1 . We
have thus calculated the maximum Lyapunov exponent $L$ Lichtenberg  for the
map Eq. (6), for the parameters used in the calculation of the phase portrait
shown in the left panels of Fig. 4. It is observed that homoclinic orbits
which correspond to perfect separatrices are characterized by vanishing
Lyapunov exponent (Fig. 4a). With increasing stochasticity, $L$ tends to a
finite positive value which generally depends on the values of the parameters
and the initial conditions (Figs. 4a and 4b).

Figure 4:  Orbits started at different initial positions in the neighborhood
of map origin and corresponding the one-dimensional Liapunov exponents.

Conclusions.- The probability of occurrence of extreme events $P_{ee}$ in the
SM results from the competition between the self-focusing and the energy
transport mechanisms which are implicitly correlated with the degree of
integrability of the model Rumpf . Through modulational instability and
starting from a slightly perturbed uniform background we can generate high-
amplitude localized moving structures of the DB type that lead to the
formation of extreme events of DRW type. Depending on their number, amplitude
and life-time, they may prevent of facilitate the energy flow in the lattice,
affecting thus the probability of extreme event formation $P_{ee}$. We find
that the latter probability depends strongly on $\Gamma$ that affects the
degree of integrability of the lattice: DRW are much more probable very close
to the integrable SM limit rather than in the nonintegrable one. We find a
resonance-like maximum in $P_{ee}(\Gamma)$ that, through a nonlinear map
approach, is linked to separatrix breaking and the onset of global
stochasticity. This regime corresponds physically to weak interaction between
the quasi-integrable modes of the system.

A. M. and Lj.H. acknowledge support from the Ministry of Science of Serbia
(Project 141034). One of us (GPT) acknowledges discussions with Oriol Bohigas.

## References

  * (1) C. Kharif and E. Pelinovsky, Eur. J. Mech. B Fluids 22, 603 (2003).
  * (2) P. Müller, C. Garrett, and A. Osborne, Oceanography 18, 66 (2005).
  * (3) M. Onorato, A. R. Osborne, M. Serio, and S. Bertone, Phys. Rev. Lett. 86, 5831 (2001).
  * (4) V. E. Zakharov, A. I. Dyachenko, and A. O. Prokofiev, Eur. J. Mech. B Fluids 25, 677 (2006).
  * (5) M. Onorato, A. R. Osborne, and M. Serio, Phys. Rev. Lett. 96, 014503 (2006).
  * (6) P. K. Shukla, I. Kourakis, B. Eliasson, M. Marklund, and L. Stenflo, Phys. Rev. Lett. 97, 094501 (2006).
  * (7) V. P. Ruban, Phys. Rev. Lett. 99, 044502 (2007).
  * (8) D. R. Solli, C. Ropers, P. Koonath, and B. Jalali, Nature 450, 1054 (2007).
  * (9) J. M. Dudley, G. Genty, and B. J. Eggleton, Opt. Express 16, 3644 (2008).
  * (10) K. Hammani, C. Finot, J. M. Dudley, and G. Millot, Opt. Express 16, 16467 (2008).
  * (11) M. Salerno, Phys. Rev. A 46, 6856 (1992).
  * (12) M. J. Ablowitz and J. F. Ladik, J. Math. Phys. 17, 1011 (1976).
  * (13) C. H. Eilbeck, P. S. Lomdahl, and A. C. Scott, Physica D 16, 318 (1985).
  * (14) M. Molina and G. P. Tsironis, Physica D, 65, 267 (1993).
  * (15) C. Nicolis, V. Balakrishnan, and G. Nicolis, Phys. Rev. Lett. 97, 210602 (2006).
  * (16) B. Rumpf and A. C. Newell, Physica D 184, 162 (2003).
  * (17) D. Cai, A. R. Bishop, and N. Grønbech-Jensen, Phys. Rev. Lett. 72, 591 (1994).
  * (18) D. Hennig , K. Ø. Rasmussen, H. Gabriel and A. Bülow, Phys. Rev. E 54, 5788 (1996); D. Hennig, N. G. Sun, H. Gabriel and G. P. Tsironis, Phys. Rev. E 52, 255 (1995).
  * (19) S. Flach and C. R. Willis, Phys. Rep. 295, 181 (1998); S. Flach and A. V. Gorbach, Phys. Rep. 467, 1 (2008); and references therein.
  * (20) Yu. S. Kivshar and D. K. Campbell, Phys. Rev. E 48, 3077 (1993).
  * (21) G. P. Tsironis and S. Aubry, Phys. Rev. Lett. 77, 5225 (1996).
  * (22) K. Ø. Rasmussen, S. Aubry, A. R. Bishop and G. P. Tsironis, Eur. Jour. Phys. B 15, 169 (2000).
  * (23) K. B. Dysthe and K. Trulsen, Physica Scripta T82, 48 (1999).
  * (24) A. Maluckov, Lj. Hadžievski, and B. Malomed, Phys. Rev. E 76, 046605 (2007).
  * (25) Yu. S. Kivshar and M. Salerno, Phys. Rev. E 49, 3543 (1994).
  * (26) J. Gomez-Gardees, B. A. Malomed, L. M. Floria, and A. R. Bishop, Phys. Rev. E 73, 036608 (2006).
  * (27) A. Trombettoni and A. Smerzi, Phys. Rev. Lett. 86, 2353 (2001).
  * (28) M. Salerno, Phys. Rev. A 44, 5292 (2001).
  * (29) N. G. Van-Kampen, Stochastic Processes in Physics and Chemistry (North-Holland, Amsterdam) (1981).
  * (30) D. Hennig and G. P. Tsironis, Phys. Rep. 307, 333 (1999).
  * (31) A. J. Lichtenberg and M. A. Lieberman, Regular and Chaotic Dynamics (Springer-Verlag, New York, Inc.) (1992).
  * (32) A. Maluckov, Lj. Hadžievski, and M. Stepić, Physica D 216, 95 (2006).