{"id":"f94b9b32-8ad8-43c0-a3aa-c626ea2a1b8a","arxiv_id":"2607.06037","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":7,"one_line_summary":"A 1-D U-Net anonymizes ECG signals by exploiting near-orthogonal privacy and utility gradients, driving re-identification to chance while preserving diagnostic AUROC.","lead":"REAN is a neural network that anonymizes ECG signals by removing patient identity while preserving arrhythmia diagnosis quality. A smart generalist might read it because it claims to escape a fundamental privacy-utility tradeoff in medical data sharing via a geometric argument about gradient orthogonality.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"Orthogonality is measured on clean ECG in classifier parameter/input space, but the training argument invokes it in the U-Net's parameter space at anonymized outputs — two unverified jumps.","rationale":"The reader correctly identified the most load-bearing concern: orthogonality is verified on clean ECG but invoked during training on anonymized outputs. I extend this by noting a second gap — the measurement is in classifier parameter space and input space, but the training argument requires orthogonality in the U-Net's parameter space, which involves a shared Jacobian that can rotate directions. Despite this, I recommend UNCHANGED for two reasons. First, the paper's empirical results are strong and multi-faceted: the diagnostic CE barely moves during training (0.075→0.076), unseen-architecture attacks show ReID transfer (Table V), and the ablation (Table VIII) confirms all three terms are necessary. These results would be hard to explain if the objectives were in deep conflict. Second, the paper is transparent about its limitations — it explicitly acknowledges the retraining-aware adversary recovery (Table VI, ReID 0.886) and frames REAN as 'practical signal-level obfuscation rather than formal irreversible anonymization' (Section VI). The CONDITIONAL verdict already captures the right posture: the method works empirically, the orthogonality insight is genuine and motivating, but the theoretical argument has an unverified step, and the threat model is narrower than 'escaping the trade-off' suggests. The concern I raise sharpens the reader's point but does not change the verdict because the empirical evidence partially compensates for the theoretical gap, and the paper's own limitations section already hedges the strongest claims.","tokens_in":13316,"tokens_out":3540,"duration_ms":173661,"concrete_test":"After training REAN, compute the angle between ∇_{θ_UN} Lutil(x̂) and ∇_{θ_UN} Lpriv(x̂) — the U-Net parameter-space gradients at anonymized outputs — on the test set. Also log this angle at intervals during training (e.g., every 10 epochs). If the angle stays near 90° throughout training, the orthogonality argument is validated for the actual optimization. If it drifts substantially (say below 70° or above 110°) while the method still works, then the success is driven by something other than the orthogonality mechanism, and the theoretical framing needs revision. Additionally, compute ∇_{x̂} Lutil vs ∇_{x̂} Lpriv at anonymized outputs to isolate whether the gap is from the clean-to-anonymized shift or from the Jacobian rotation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's theoretical justification for why the privacy-utility trade-off is 'escapable' rests on Section III-A: 'With ⟨∇_θ Lutil, ∇_θ Lpriv⟩ ≈ 0 (Section II-B), changing the privacy loss shifts the diagnostic loss only through a first-order term that vanishes.' Here θ refers to REAN's U-Net parameters. But Section II-B measures orthogonality in two different spaces: (1) input space — ∇_x Lutil vs ∇_x Lpriv on clean ECG (89.8°), and (2) the frozen classifiers' parameter space — ∇_{θ_clf} Lutil vs ∇_{θ_clf} Lpriv on clean ECG (93.8°). Neither is the U-Net's parameter space, and neither is evaluated at anonymized outputs x̂. By the chain rule, ∇_{θ_UN} Lutil(x̂) = (∂x̂/∂θ_UN)^T ∇_{x̂} Lutil and similarly for Lpriv. Even if input gradients were orthogonal at x̂ (unverified), the shared Jacobian (∂x̂/∂θ_UN) can rotate and correlate these directions. So the claim that the two objectives 'behave as independent directions' during U-Net training is not directly supported by the measurement. The empirical training dynamics (diagnostic CE 0.075→0.076 while privacy CE rises 100×) provide indirect evidence that conflict is low in practice, but this is a post-hoc observation, not a verification of the orthogonality mechanism the paper invokes. If the mechanism is wrong, the method's success is incidental rather than principled, and the 'escaping the trade-off' framing is unsupported even if the numbers hold.","agreement_with_reader":"agree"},"referee_report":{"model":"glm-5.2","summary":"The paper proposes REAN, a 1-D U-Net that anonymizes raw ECG signals by exploiting the near-orthogonality of utility (arrhythmia diagnosis) and privacy (biometric re-identification, gender, age) gradients in ECG signal space. The core observation is that input gradients of diagnostic and biometric losses on clean ECG are nearly orthogonal (approximately 89.8 degrees in input space, 93.8 degrees in classifier parameter space), which motivates a joint training objective where privacy is suppressed without sacrificing diagnostic utility. REAN is trained with frozen diagnostic and biometric classifiers and produces anonymized ECGs in a single forward pass. On four PhysioNet databases, REAN drives re-identification accuracy from 0.964 to chance (0.000) while keeping arrhythmia macro-AUROC statistically indistinguishable from clean (0.9991 vs. 0.9982). The paper includes ablations, robustness checks under unseen attacker architectures, input purification, and a retraining-aware adversary analysis.","tokens_in":14197,"tokens_out":1408,"duration_ms":242743,"significance":"The paper addresses a practically important problem (ECG re-identification) with a clean, well-motivated approach. The empirical results are strong: REAN is the only method among seven baselines that simultaneously achieves chance-level re-identification and clean-level diagnostic AUROC, with PRD in the diagnostic-quality range. The ablation (Table VIII) cleanly separates the roles of each loss term. The robustness evaluation under unseen attacker architectures (Table V) and input purification (Table IV) is commendable and goes beyond what many anonymization papers provide. The honest reporting of retraining-aware recovery (Table VI) and the data-processing inequality limitation (Section VI) is appropriate. The single-pass inference (0.117 ms/window) is a practical advantage over per-sample methods like REACT. The orthogonality observation, while not formally proven to hold along the optimization trajectory, is empirically grounded and provides a useful design principle.","major_comments":[{"comment":"Section III-A, Eq. (2) and the surrounding text: The theoretical justification for why the privacy-utility trade-off is 'escapable' invokes orthogonality of gradients in the U-Net's parameter space (theta_UN), but Section II-B measures orthogonality in two different spaces: input space (nabla_x L, 89.8 degrees) and frozen classifier parameter space (nabla_theta_clf L, 93.8 degrees). By the chain rule, nabla_{theta_UN} L = (partial x_hat / partial theta_UN)^T nabla_{x_hat} L, and the shared Jacobian can rotate and correlate the two directions. The paper does not verify that orthogonality holds in the U-Net parameter space or at anonymized outputs x_hat. The empirical training dynamics (diagnostic CE 0.075 to 0.076 while privacy CE rises 100x) provide indirect evidence of low conflict, but this is post-hoc. The claim in Section III-A that 'the two objectives behave as independent' during U","section":null},{"comment":"Section IV-B, Table III: The main evaluation uses a shared 500-window set. While the 20,000-window REAN-only check (Section IV-B) is reassuring, the baseline comparison on 500 windows is relatively small given 186 subjects. The per-subject clustered bootstrap for the AUROC confidence interval is appropriate, but the privacy metrics (ReID, gender, age) on 500 windows lack confidence intervals. Given that REAN achieves ReID 0.000 on 500 windows, a Wilson interval would still be approximately [0.000, 0.007], which is above the random-chance floor of 0.005. The paper should report these intervals or clarify that 500 windows is sufficient to distinguish REAN from baselines, which it clearly is given the large gaps in Table III.","section":null}],"minor_comments":[{"comment":"Section II-B: The paper notes that two random vectors in R^2000 are already nearly orthogonal, and argues the causal consequence (Gaussian noise collapses AUROC to 0.62 while privacy-direction perturbation preserves it) rules out coincidence. This is a reasonable argument but could be strengthened by comparing against random unit vectors in signal space directly, rather than full-signal Gaussian noise which differs in magnitude distribution.","section":null},{"comment":"Table III: Gender is reported as raw binary accuracy with a caveat that below-chance values are invertible. This is methodologically sound but makes cross-method comparison awkward. Consider adding a 'gender distance from 0.5' column or marking invertible values distinctly.","section":null},{"comment":"Section III-B, Eq. (3): The amplitude bound epsilon_max=0.08 is described as validation-selected, but the relationship between epsilon_max and the normalized signal range is not fully specified. Clarifying the typical peak-to-peak amplitude of normalized ECG windows would help readers assess whether 0.08 is a large or small perturbation relative to the signal.","section":null},{"comment":"Section IV-A: The per-participant temporal split (70/15/15) means every subject appears in train, validation, and test. This is appropriate for the closed-set re-identification threat model but differs from the more challenging open-set (unseen-subject) setting. The limitation is acknowledged in Section VI but could be noted earlier in Section IV-A.","section":null},{"comment":"Fig. 1: The privacy and utility axes are labeled with percentages but the exact computation is not fully clear from the figure caption. A brief note on how the combined score is computed would improve clarity.","section":null},{"comment":"Section VI: The data-processing inequality argument (I(x_hat; y_a) <= I(x; y_a)) is correct but the phrasing 'rather than equality' may confuse readers unfamiliar with the DPI, since the inequality already permits equality. Consider rephrasing to emphasize that DPI does not guarantee a strict reduction.","section":null},{"comment":"References [2], [5], [6], [8] are dated 2025-2026. If these are accepted or published works, the dates are fine; if some are arXiv preprints, they should be marked as such.","section":null}],"recommendation":"minor_revision","confidential_remarks":"The orthogonality gap identified by the reader is real and worth addressing, but I assess it as a presentation issue rather than a load-bearing error. The empirical results are strong enough that the method works regardless of whether the orthogonality mechanism is the true explanation. The authors should soften the theoretical claim in Section III-A to match what they have verified, and optionally add a measurement of U-Net parameter-space gradient angles during training if feasible. The paper is a solid contribution to ECG privacy if the framing is adjusted."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive report. The referee correctly identifies that the paper's two main empirical claims—chance-level re-identification with clean-level diagnostic AUROC, and robustness under unseen attackers—are well-supported, and the recommendation is minor revision. We address both major comments below. In brief: (1) the referee is mathematically correct that orthogonality in input/classifier-parameter space does not automatically imply orthogonality in U-Net parameter space, and we will revise the manuscript to soften the claim from a statement of fact to a design principle supported by empirical training dynamics; (2) we will add Wilson confidence intervals for the privacy metrics on the 500-window evaluation set and clarify that the gaps between REAN and all baselines are large enough that the intervals do not affect any comparison conclusion.","responses":[{"response":"The referee is mathematically correct. By the chain rule, orthogonality of the input-space gradients ∇_x L_util and ∇_x L_priv does not formally guarantee orthogonality of the U-Net parameter-space gradients ∇_{θ_UN} L_util and ∇_{θ_UN} L_priv, because the shared Jacobian ∂x̂/∂θ_UN can rotate and correlate the two directions. The same applies to the classifier-parameter-space measurement (93.8°). We acknowledge this gap honestly and will revise the manuscript accordingly. Specifically, we will make the following changes: (1) Soften the claim in Section III-A. The sentence 'the two objectives behave as independent directions' will be revised to state that the input-space orthogonality provides a design principle—motivating the joint objective—and that the extent of conflict during U-Net training is an empirical question. (2) Reframe the logical structure. The argument will be: the input-space measurement (Section II-B) motivates the hypothesis that privacy and utility directions are separable in ECG signal space; the training dynamics (diagnostic CE 0.075→0.076 while privacy CE rises ~100×) provide empirical evidence that this separability is realized during optimization; but we do not claim a formal proof that orthogonality is preserved under the Jacobian mapping. (3) Add an explicit caveat noting that verifying orthogonality in θ_UN space or at anonymized outputs x̂ would require measuring the full Jacobian, which is computationally prohibitive for the U-Net architecture used, and that we rely on the training-dynamics evidence as the operational validation. We agree with the referee that the current phrasing overstates what the orthogonality measurement establishes, and the revision will make the logical chain transparent: observation (input-space) → design principle →","revision_made":"yes","referee_comment":"Section III-A, Eq. (2): The theoretical justification for why the privacy-utility trade-off is 'escapable' invokes orthogonality of gradients in the U-Net's parameter space (theta_UN), but Section II-B measures orthogonality in two different spaces: input space (nabla_x L, 89.8 degrees) and frozen classifier parameter space (nabla_theta_clf L, 93.8 degrees). By the chain rule, nabla_{theta_UN} L = (partial x_hat / partial theta_UN)^T nabla_{x_hat} L, and the shared Jacobian can rotate and correlate the two directions. The paper does not verify that orthogonality holds in the U-Net parameter space or at anonymized outputs x_hat. The empirical training dynamics (diagnostic CE 0.075 to 0.076 while privacy CE rises 100x) provide indirect evidence of low conflict, but this is post-hoc. The claim in Section III-A that 'the two objectives behave as independent' during U-Net training is not直接lyd"},{"response":"This is a fair point. We will add Wilson score confidence intervals for the privacy metrics (ReID, gender, age) on the 500-window evaluation set in Table III. The referee's calculation is correct: for ReID at 0/500, the 95% Wilson interval is approximately [0.000, 0.007], which technically includes the random-chance floor of 0.005 (1/186 ≈ 0.0054). We will report this transparently and add a clarifying note. The key point, which the referee acknowledges, is that the intervals do not affect any comparison conclusion: the gaps between REAN and every baseline are large (the next-best ReID among privacy-protective methods is 0.004 for PP-VAE, whose Wilson interval is approximately [0.000, 0.014], and all other baselines are far higher), so the 500-window set is sufficient to distinguish REAN from baselines. For the specific question of whether REAN's ReID is distinguishable from the random-chance floor itself, we note that the 20,000-window REAN-only evaluation (ReID 0.00025, i.e., 5/20,000) provides a much tighter interval that is clearly consistent with chance. We will add a sentence cross-referencing this larger-scale result for readers who want tighter bounds on the chance-level claim. We will also add Wilson intervals for gender and age, where the intervals are well-separated from both baselines and the relevant chance levels.","revision_made":"yes","referee_comment":"Section IV-B, Table III: The main evaluation uses a shared 500-window set. While the 20,000-window REAN-only check (Section IV-B) is reassuring, the baseline comparison on 500 windows is relatively small given 186 subjects. The per-subject clustered bootstrap for the AUROC confidence interval is appropriate, but the privacy metrics (ReID, gender, age) on 500 windows lack confidence intervals. Given that REAN achieves ReID 0.000 on 500 windows, a Wilson interval would still be approximately [0.000, 0.007], which is above the random-chance floor of 0.005. The paper should report these intervals or clarify that 500 windows is sufficient to distinguish REAN from baselines, which it clearly is given the large gaps in Table III."}],"tokens_in":13300,"tokens_out":1356,"duration_ms":182263,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"Bottom line: REAN is a well-engineered ECG anonymizer with strong empirical results — ReID driven to chance, arrhythmia AUROC statistically indistinguishable from clean, robust to unseen attacker architectures — but the theoretical justification for why it works has a gap the paper doesn't close. The method deserves a serious referee; the framing needs adjustment before publication.","headline":"Strong empirical ECG anonymizer; the orthogonality mechanism is measured in the wrong space but the method works regardless.","tokens_in":14391,"tokens_out":139,"would_cite":true,"duration_ms":107710,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"ECG anonymizer kills re-identification, keeps diagnosis perfect","keywords":["ECG anonymization","privacy-utility trade-off","gradient orthogonality","biometric re-identification","signal reconstruction","U-Net","arrhythmia diagnosis","PhysioNet"],"falsifier":"If the orthogonality angle between utility and privacy gradients degrades significantly as the U-Net residual grows from zero to its trained value, the combined objective would face conflicting gradients and the privacy-utility balance would collapse.","tokens_in":13409,"feed_emoji":"💓","tokens_out":974,"duration_ms":105827,"temperature":0.7,"pith_summary":"The paper claims that the privacy-utility trade-off in ECG anonymization is escapable because the directions in signal space that carry biometric identity and the directions that carry diagnostic information are nearly orthogonal (measured at about 90 degrees). REAN exploits this geometry by training a 1-D U-Net with frozen diagnostic and biometric classifiers: the U-Net learns a bounded, input-conditioned residual that moves the signal along the privacy direction, suppressing identity, gender, and age information while leaving arrhythmia diagnosis essentially untouched. On four PhysioNet databases, REAN drives re-identification accuracy from 0.96 to 0.00 (chance) while keeping arrhythmia macro-AUROC statistically indistinguishable from clean ECG (0.9991 vs 0.9982). The method anonymizes in a single forward pass, transfers to unseen attacker architectures, and resists signal purification.","feed_headline":"ECG anonymizer kills re-identification, keeps diagnosis perfect","feed_subtitle":"Biometric and diagnostic directions in heart signals are nearly perpendicular, so a single-pass transform can erase identity without harming","key_machinery":"A 1-D U-Net that adds a bounded residual (tanh-scaled to a maximum amplitude of 0.08) to the raw ECG, trained with a combined objective of utility preservation (cross-entropy from a frozen diagnostic classifier), privacy suppression (maximized cross-entropy from three frozen biometric classifiers for identity, gender, and age), and distortion limitation (PRD plus L1 norm).","core_discovery":"The central discovery is that biometric and diagnostic information in ECG signals occupy near-orthogonal directions in signal space, measured via input gradients of frozen classifiers at approximately 89.8 degrees. This orthogonality means a learned residual can suppress identity along the privacy direction with negligible effect on the utility direction, allowing a single U-Net forward pass to produce an anonymized waveform where re-identification collapses to chance while arrhythmia diagnosis remains at clean-signal levels.","pith_inferences":["If orthogonality arises because QRS morphology carries identity while P-T morphology and rhythm carry diagnosis, then signals where diagnostic and biometric features share the same morphological substructure (e.g., certain genetic cardiac conditions with QRS-based diagnosis) may not exhibit the same separability, bounding the scope of the approach.","The observation that gradient orthogonality holds across different classifier backbones (ResNet, InceptionTime, CNN-LSTM) suggests the property is intrinsic to the ECG signal structure rather than an artifact of a particular model architecture, which could extend to other biosignals with analogous feature decompositions.","A natural test would measure whether the orthogonality angle changes for pathological ECG subtypes where QRS shape is itself diagnostically relevant (e.g., bundle branch block), since those cases would collapse the separation between identity-carrying and diagnosis-carrying directions."],"forward_implications":["ECG sharing pipelines could deploy REAN as a pre-sharing filter that strips patient identity without requiring per-record optimization, enabling real-time anonymization at sub-millisecond latency.","The orthogonality observation suggests that other biomedical signals carrying both diagnostic and biometric information (e.g., EEG, PPG) may exhibit similar geometric separability, motivating analogous anonymizers.","The deterministic-leakage limitation under retraining-aware adversaries means that formal privacy guarantees for shared ECG data would still require stochastic mechanisms layered on top of REAN's geometric approach.","Clinical workflows that currently avoid sharing raw ECG due to privacy concerns could adopt REAN-transformed signals for secondary research use without degrading diagnostic quality."],"fun_headline_variants":["REAN erases ECG patient identity to chance, keeps arrhythmia AUROC at clean levels","Heart signal biometric and diagnostic directions are near-orthogonal, enabling identity re","Single-pass ECG transform drops re-identification to zero while preserving arrhythmia dete","Orthogonal privacy-utility gradients let REAN anonymize ECG without losing diagnostic sign","U-Net anonymizer collapses ECG re-identification from 0.96 to 0.00, arrhythmia AUROC uncha"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The paper measures gradient orthogonality on clean ECG signals and assumes it persists as the U-Net perturbs the signal during training, but does not verify that the near-90-degree angle holds along the optimization trajectory away from the clean signal manifold.","fun_headline_variants_meta":{"raw":{"variants":["REAN erases ECG patient identity to chance, keeps arrhythmia AUROC at clean levels","Heart signal biometric and diagnostic directions are near-orthogonal, enabling identity removal","Single-pass ECG transform drops re-identification to zero while preserving arrhythmia detection","Orthogonal privacy-utility gradients let REAN anonymize ECG without losing diagnostic signal","U-Net anonymizer collapses ECG re-identification from 0.96 to 0.00, arrhythmia AUROC unchanged"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":682,"prompt_tokens":559,"completion_tokens":123,"prompt_tokens_details":null},"tokens_in":559,"tokens_out":123,"duration_ms":24680,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T18:28:18.123499+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If the orthogonality angle between utility and privacy gradients degrades significantly as the U-Net residual grows from zero to its trained value, the combined objective would face conflicting gradients and the privacy-utility balance would collapse.","supporting_citations":[],"review_version":1}