## 5 Discussion
Therefore, the detection capabilities can be further improved by increasing the number of ECG training samples. Moreover, the performance of the proposed models is also affected by the capabilities of the CipherML library. More specifically, the inability to include max pooling operations, better optimization methods, activation functions that could improve the flow of gradients through the model, the inability to check and compare performance between epochs or stop training when the best model is found are all aspects that limit the performance. Both models show good performance for the majority of classes but fail to achieve similar performance for the underrepresented classes (Table 2). This is a common behavior observed for models trained on imbalanced datasets. Recent work on the impact of data augmentation on atrial fibrillation classification in short single-lead ECGs [33] shows that although oversampling of minority classes does not significantly improve performance, deep learning models can benefit from synthetically generated data. Although not considered in these experiments, more advanced augmentation techniques could increase the robustness of classification when dealing with imbalanced data. These include synthetic augmentation of the dataset using Synthetic Minority Oversampling Technique (SMOTE) [5] or synthetic ECG signal generating using Generative Adversarial Networks (GANs) [34]. We also observe that all models yield a much lower F1-score when used to classify other rhythm recordings. Due to the lack of actual disease information associated with each recording in this class, identifying the appropriate features becomes more difficult. We obtained small standard deviations of the F1 scores across testing folds for both privacy-preserving neural network-based models, as presented in Table 3, suggesting that the models produce stable results and that training is not affected by the differences that come from different splits of the training samples. The advantage of wearable medical devices is that they allow real-time health monitoring. Ultimately, it is not only the performance of the analysis that matters but also the ability to perform it in real time. Although the proposed encryption mechanism is less secure than classical homomorphic encryption, it has the potential to provide results in a runtime suitable for real-time health monitoring applications (Table 4). More specifically, the privacy-preserving AI-based analysis on a single-channel ECG recording lasting for 60 s is performed in less than 2 s.  
Although the results are promising, the analysis has some limitations. First, we only experimented with 1D-CNN for the deep learning-based approach, while sequence data-oriented architectures such as RNNs and Temporal Convolutional Networks (TCNs) have been used in the past [35; 36]. This limitation is imposed by the current capabilities of the CipherML library. Second, the detection performance needs to be further improved, especially in terms of robustness. Appropriate ways to handle an imbalanced dataset need to be explored. Finally, MORE is a symmetric key-based homomorphic encryption scheme. Although both training and prediction can be performed on MORE encrypted data, training a machine learning-based model on a collection of encrypted samples located on the cloud implies that each sample is encrypted with the same key.