CoChat
Sign Up
PreprintCited by 168Digital Media Forensic DetectionAdversarial Robustness in Machine LearningPrivacy-Preserving Technologies in Data

CT-GAN: Malicious Tampering of 3D Medical Imagery using Deep Learning

Open access
Mirsky, Yisroel, Mahler, Tom, Shelef, Ilan, Elovici, Yuval·2019·arXiv
DOI 10.48550/arxiv.1901.03597arXiv 1901.03597
Open this paper in CoChat — free accountOpen PDF

Abstract

In 2018, clinics and hospitals were hit with numerous attacks leading to significant data breaches and interruptions in medical services. An attacker with access to medical records can do much more than hold the data for ransom or sell it on the black market. In this paper, we show how an attacker can use deep-learning to add or remove evidence of medical conditions from volumetric (3D) medical scans. An attacker may perform this act in order to stop a political candidate, sabotage research, commit insurance fraud, perform an act of terrorism, or even commit murder. We implement the attack using a 3D conditional GAN and show how the framework (CT-GAN) can be automated. Although the body is complex and 3D medical scans are very large, CT-GAN achieves realistic results which can be executed in milliseconds. To evaluate the attack, we focused on injecting and removing lung cancer from CT scans. We show how three expert radiologists and a state-of-the-art deep learning AI are highly susceptible to the attack. We also explore the attack surface of a modern radiology network and demonstrate one attack vector: we intercepted and manipulated CT scans in an active hospital network with a covert penetration test. Demo video: https://youtu.be/_mkRAArj-x0 Source code: https://github.com/ymirsky/CT-GAN

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1901.03597

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Once made aware of the tampering mechanisms in an open trial, the misdiagnosis rates decreased to 60% and 87% respectively.

    “Once made aware of the tampering mechanisms in an open trial, the misdiagnosis rates decreased to 60% and 87% respectively.”

    From Machine learning based medical image deepfake detection: A comparative study (2022) · cites this paper as Mirsky et al., 2019

    The open-trial results (Section 6.3, p. 13) report that, after radiologists learned of the attack, success rates fell to 70% for cancer injection and 90% for cancer removal—not 60% and 87%. The paper supports a decrease, but contradicts both figures attributed to it. (LLM, conf=0.89)

    Checked by a reasoning model — may be wrong.

    Experimental — accuracy not yet measured

  • In the open trial conducted by CT-GAN researchers, attack success rates dropped a mere 5.8% from its initial 95.8%.

    “In the open trial conducted by CT-GAN (Mirsky et al., 2019) researchers, where knowledge of the attack was known, attack success rates dropped a mere 5.8% from its initial 95.8%.”

    From Machine learning based medical image deepfake detection: A comparative study (2022) · cites this paper as Mirsky et al., 2019

    Section 6.3 (p. 13) reports that cancer-removal attack success fell from 95.8% to 90% in the open trial—a drop of 5.8 percentage points. The claim does not specify cancer removal and implies this small drop applies to attack success rates generally; cancer-injection success fell much more, from 99.2% to 70%. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • One avenue of deepfake creation is aligned with injection and removal of tumors from medical scans.

    “One avenue of deepfake creation is aligned with injection and removal of tumors from medical scans.”

    From Machine learning based medical image deepfake detection: A comparative study (2022) · cites this paper as Mirsky et al., 2019

  • The AI lung cancer screening model misdiagnosed 100% of the tampered patients in the blind trial.

    “In addition, they found the AI lung cancer screening model misdiagnosed 100% of the tampered patients in the blind trial.”

    From Machine learning based medical image deepfake detection: A comparative study (2022) · cites this paper as Mirsky et al., 2019

  • In the blind trial, 99% of tumor injected scans were misdiagnosed as malignant, and 94% of tumor removed scans were misdiagnosed as benign.

    “The results of the blind trial showed 99% of tumor injected scans were misdiagnosed as malignant, and 94% of tumor removed scans were misdiagnosed as benign.”

    From Machine learning based medical image deepfake detection: A comparative study (2022) · cites this paper as Mirsky et al., 2019

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 44

  1. [1][1] Papanicolas I, Woskie LR, and Jha AK. Health care spending in the united states and other high-income countries. JAMA , 319(10):1024-1039, 2018. -
  2. [2][2] John R. Haaga. CTand MRI of the Whole Body . Number v. 1 in CT and MRI of the Whole Body. Mosby/Elsevier, 2008. -
  3. [6][6] Lynne Coventry and Dawn Branley. Cybersecurity in healthcare: A narrative review of trends, threats and ways forward. Maturitas , 113:48 - 52, 2018. -
  4. [7][7] Mohammad S Jalali and Jessica P Kaiser. Cybersecurity in hospitals: A systematic, organizational perspective. Journal of medical Internet research , 20(5), 2018. -
  5. [9][9] H.K. Huang. PACS-Based Multimedia Imaging Informatics: Basic Principles and Applications . Wiley, 2019. -
  6. [11][11] Freddie Bray, Jacques Ferlay, Isabelle Soerjomataram, Rebecca L Siegel, Lindsey A Torre, and Ahmedin Jemal. Global cancer statistics 2018: Globocan estimates of incidence and mortality worldwide for 36 cancers in 185 countries. CA: a cancer journal for clinicians , 68(6):394-424, 2018. -
  7. [12][12] Xian Wu, Kun Xu, and Peter Hall. A survey of image synthesis and editing with generative adversarial networks. Tsinghua Science and Technology , 22(6):660-674, 2017. -
  8. [13][13] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural information processing systems , pages 2672-2680, 2014. -
  9. [14][14] Weiwei Hu and Ying Tan. Generating adversarial malware examples for black-box attacks based on gan. arXiv preprint arXiv:1702.05983 , 2017. - · arXiv
  10. [15][15] Maria Rigaki and Sebastian Garcia. Bringing a gan to a knife-fight: Adapting malware communication to avoid detection. In 2018 IEEE Security and Privacy Workshops (SPW) , pages 70-75. IEEE, 2018. -
  11. [17][17] Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with conditional adversarial networks. arXiv preprint , 2017. -
  12. [18][18] Tara Seals. Rsa conference 2019: Ultrasound hacked in two clicks, threatpost. https: //threatpost.com/ultrasound-hacked/142601/ , 2019. (Accessed on 05/06/2019). -
  13. [19][19] Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycleconsistent adversarial networks. arXiv preprint , 2017. -
  14. [20][20] Amit Kumar Singh, Basant Kumar, Ghanshyam Singh, and Anand Mohan. Medical Image Watermarking Techniques: A Technical Survey and Potential Challenges , pages 13-41. Springer International Publishing, Cham, 2017. -
  15. [21][21] Somayeh Sadeghi, Sajjad Dadkhah, Hamid A. Jalab, Giuseppe Mazzola, and Diaa Uliyan. State of the art in passive digital image forgery detection: copy-move image forgery. Pattern Analysis and Applications , 21(2):291-306, May 2018. -
  16. [22][22] A. Kharboutly, W. Puech, G. Subsol, and D. Hoa. Ct-scanner identification based on sensor noise analysis. In 2014 5th European Workshop on Visual Information Processing (EUVIP) , pages 1-5, Dec 2014. -
  17. [23][23] Yuping Duan, Dalel Bouslimi, Guanyu Yang, Huazhong Shu, and Gouenou Coatrieux. Computed tomography image origin identification based on original sensor pattern noise and 3d image reconstruction algorithm footprints. IEEE journal of biomedical and health informatics , 21(4):1039-1048, 2017. -
  18. [24][24] Xin Yi, Ekta Walia, and Paul Babyn. Generative adversarial network in medical imaging: A review. arXiv preprint arXiv:1809.07294 , 2018. - · arXiv
  19. [25][25] Lei Bi, Jinman Kim, Ashnil Kumar, Dagan Feng, and Michael Fulham. Synthesis of Positron Emission To- 26. mography (PET) Images via Multi-channel Generative Adversarial Networks (GANs). pages 43-51. Springer, Cham, 2017. -
  20. [26][26] Avi Ben-Cohen, Eyal Klang, Stephen P. Raskin, Michal Marianne Amitai, and Hayit Greenspan. Virtual PET Images from CT Data Using Deep Convolutional Networks: Initial Results. pages 49-57. Springer, Cham, 2017. -
  21. [28][28] Qi Dou, Cheng Ouyang, Cheng Chen, Hao Chen, and Pheng-Ann Heng. Unsupervised Cross-Modality Domain Adaptation of ConvNets for Biomedical Image Segmentations with Adversarial Loss. In Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence , pages 691-697, California, 7 2018. International Joint Conferences on Artificial Intelligence Organization. -
  22. [32][32] Jelmer M. Wolterink, Tim Leiner, and Ivana Isgum. Blood Vessel Geometry Synthesis using Generative Adversarial Networks. In 1st Conference on Medical Imaging with Deep Learning (MIDL 2018) , Amsterdam, The Netherlands, The Netherlands, 2018. -
  23. [33][33] Christoph Baur, Shadi Albarqouni, and Nassir Navab. Melanogans: High resolution skin lesion synthesis with gans. arXiv preprint arXiv:1804.04338 , 2018. - · arXiv
  24. [35][35] Maria JM Chuquicusma, Sarfaraz Hussein, Jeremy Burt, and Ulas Bagci. How to fool radiologists with generative adversarial networks? a visual turing test for lung cancer 37. diagnosis. In Biomedical Imaging (ISBI 2018), 2018 IEEE 15th International Symposium on , pages 240-244. IEEE, IEEE, 4 2018. -
  25. [36][36] W. Hruby. Digital (R)Evolution in Radiology . Springer Vienna, 2013. -
  26. [37][37] A. Peck. Clark's Essential PACS, RIS and Imaging Informatics . Clark's Companion Essential Guides. CRC Press, 2017. -
  27. [38][38] C. Carter and B. Veale. Digital Radiography and PACS . Elsevier Health Sciences, 2018. -
  28. [41][41] Sébastien Jodogne, Claire Bernard, Magali Devillers, Eric Lenaerts, and Philippe Coucke. Orthanc-a lightweight, restful dicom server for healthcare and medical research. In Biomedical Imaging (ISBI), 2013 IEEE 10th International Symposium on , pages 190-193. IEEE, 2013. -
  29. [42][42] Carlos Costa, Carlos Ferreira, Luís Bastião, Luís Ribeiro, Augusto Silva, and José Luís Oliveira. Dicoogle-an open source peer-to-peer pacs. Journal of digital imaging , 24(5):848-856, 2011. -
  30. [47][47] Mathy Vanhoef and Frank Piessens. Key reinstallation attacks: Forcing nonce reuse in wpa2. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages 1313-1328. ACM, 2017. -
  31. [54][54] Samuel G Armato III, Geoffrey McLennan, Luc Bidaut, Michael F McNitt-Gray, Charles R Meyer, Anthony P Reeves, Binsheng Zhao, Denise R Aberle, Claudia I Henschke, Eric A Hoffman, et al. The lung image database consortium (lidc) and image database resource initiative (idri): a completed reference database of lung nodules on ct scans. Medical physics , 38(2):915-931, 2011. -
  32. [55][55] Keelin Murphy, Bram van Ginneken, Arnold MR Schilham, BJ De Hoop, HA Gietema, and Mathias Prokop. A large-scale evaluation of automatic pulmonary nodule detection in chest ct using local image features and k-nearest-neighbour classification. Medical image analysis , 13(5):757-770, 2009. -
  33. [56][56] Andre Esteva, Brett Kuprel, Roberto A Novoa, Justin Ko, Susan M Swetter, Helen M Blau, and Sebastian Thrun. Dermatologist-level classification of skin cancer with deep neural networks. Nature , 542(7639):115, 2017. -
  34. [57][57] Anthony J Conger. Integration and generalization of kappas for multiple raters. Psychological Bulletin , 88(2):322, 1980. -
  35. [58][58] Trafton Drew, Melissa L-H Võ, and Jeremy M Wolfe. The invisible gorilla strikes again: Sustained inattentional blindness in expert observers. Psychological science , 24(9):1848-1853, 2013. -
  36. [59][59] FCao,HKHuang,andXQZhou. Medicalimagesecurity in a hipaa mandated pacs environment. Computerized medical imaging and graphics , 27(2-3):185-196, 2003. -
  37. [61][61] Ahmed Ghoneim, Ghulam Muhammad, Syed Umar Amin, and Brij Gupta. Medical image forgery detection for smart healthcare. IEEE Communications Magazine , 56(4):33-37, 2018. -
  38. [62][62] Andreas Rössler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensics++: Learning to detect manipulated facial images. arXiv preprint arXiv:1901.08971 , 2019. - · arXiv
  39. [63][63] Falko Matern, Christian Riess, and Marc Stamminger. Exploiting visual artifacts to expose deepfakes and face manipulations. In 2019 IEEE Winter Applications of Computer Vision Workshops (WACVW) , pages 83-92. IEEE, 2019. -
  40. [64][64] Shahroz Tariq, Sangyup Lee, Hoyoung Kim, Youjin Shin, and Simon S Woo. Detecting both machine and human created fake face images in the wild. In Proceedings of the 2nd International Workshop on Multimedia Privacy and Security , pages 81-87. ACM, 2018. -
  41. [65][65] Davide Cozzolino, Justus Thies, Andreas Rössler, Christian Riess, Matthias Nießner, and Luisa Verdoliva. Forensictransfer: Weakly-supervised domain adaptation for forgery detection. arXiv preprint arXiv:1812.02510 , 2018. - · arXiv
  42. [66][66] Lilei Zheng, Ying Zhang, and Vrizlynn LL Thing. A survey on image tampering and its detection in real-world photos. Journal of Visual Communication and Image Representation , 58:380-399, 2019. -
  43. [67][67] Minyoung Huh, Andrew Liu, Andrew Owens, and Alexei A Efros. Fighting fake news: Image splice detection via learned self-consistency. In Proceedings of the European Conference on Computer Vision (ECCV) , pages 101-117, 2018. -
  44. [69][69] P. Korus and J. Huang. Multi-scale analysis strategies in prnu-based tampering localization. IEEE Trans. on Information Forensics & Security , 2017.

Cited by

Sorted by citations

Authors
Mirsky, Y., Mahler, T., Shelef, I., & Elovici, Y.
Affiliations
Ben-Gurion University of the Negev (IL)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2019
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1901.03597
arXiv
1901.03597
OpenAlex
W2910333870
Cited by
168
References
3
Citations by year
2026: 2 · 2025: 9 · 2024: 18 · 2023: 23 · 2022: 27 · 2021: 33 · 2020: 39 · 2019: 17
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
computed tomography, adversarial attacks, medical records security, artificial intelligence in radiology, hospital network security, insurance fraud

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review