## 5 Discussion  
We obtain encouraging results on encrypted data, with the best model achieving a mean F1-score of 0.81, which is comparable to one of the models that won the Physionet 2017 Challenge with a mean F1-score of 0.82 (see Table 3). As shown in Table 1, both privacy-preserving neural network-based models provide satisfactory results, indicating that the proposed approach is capable of performing machine learning-based analysis on personal ECG data without jeopardizing the confidentiality of personal data. The best results are obtained with the MLP-based classifier trained on encrypted hand-crafter features. Compared to the machine learning-based approach considered in [29], the proposed privacy-preserving MLP-based classifier yields comparable F1-scores for the detection of normal and atrial fibrillation related recordings, but a slightly lower F1-score for the detection of other rhythms (Table 3). As shown in [15], the performance of neural network-based models trained and evaluated on MORE homomorphically encrypted data are statistically indistinguishable from the performance of the corresponding regular model on plaintext data (when the comparison is made under the same conditions). Since the preprocessing step used in the MLP-based approach, including feature extraction, is performed under the same conditions as in [29], the difference in performance is entirely due to the architecture of the machine learning-based classifier. The input features were carefully selected to distinguish atrial fibrillation symptoms and to differentiate the regularity of a clean ECG signal from a random noisy signal. In the work described in [29], the authors leverage this information in their two-stage classification pipeline. However, due to the privacy component, a single multi-class model is proposed herein. Therefore, no distinction can be made between features, nor can prior knowledge be leveraged. It also appears that using convolutional networks to automatically extract features from the raw ECG signal did not help to improve performance, as shown by the decline in the cross-validation accuracy displayed in Table 1. Although the proposed 1D-CNN deep learning-based model performs worse than the MLP-based approach on all classes, it has the advantage of automatically performing feature extraction during classification. A possible explanation for the drop in performance, compared to the MLP-based classifier, \begin{table}
\begin{tabular}{l l} \hline \hline
**Classifier** & **Inference Time on the Server [Seconds]** \\ \hline \multirow{2}{*}{MLP} & Single instance: 0.076 \(\pm\) 0.024 \\  & All data (8528 samples): 7.223 \(\pm\) 1.248 \\ \multirow{2}{*}{1D-CNN} & Single instance: 1.353 \(\pm\) 0.268 \\  & All data (8528 samples): 2293.831 \(\pm\) 31.722 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Inference time of the proposed classifiers on MORE homomorphically encrypted data. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Classifier**} & \multicolumn{6}{c}{**Performance**} \\ \cline{2-9}  & \multicolumn{2}{c}{**F1 Normal**} & \multicolumn{2}{c}{**F1 AF**} & \multicolumn{2}{c}{**F1 Other**} & \multicolumn{2}{c}{**F1 Mean**} \\ \cline{2-9}  & **Mean** & **Std.** & **Mean** & **Std.** & **Mean** & **Std.** & **Mean** & **Std.** \\ \hline MLP & 0.90 & 0.005 & 0.80 & 0.017 & 0.73 & 0.012 & 0.81 & 0.011 \\
1D-CNN & 0.87 & 0.010 & 0.68 & 0.032 & 0.65 & 0.026 & 0.73 & 0.023 \\
[29] & 0.90 & 0.002 & 0.79 & 0.006 & 0.77 & 0.004 & 0.82 & 0.002 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance of the proposed methodology using 5-fold cross validation. Comparison with state-of-the-art. is the size of the training dataset, as it is commonly shown that deep convolutional neural networks require large data sets to train properly. Since the 1D-CNN model is a fully data-driven model, the classification performance is affected by the quality and quantity of the training data.