What Is M3DSynth and Why Does It Matter for Medical Image Security?

Deepfakes usually bring to mind manipulated faces in videos. But the same generative AI techniques can be pointed at something far more consequential: CT scans. Researchers at the University of Naples Federico II built M3DSynth, a large dataset of AI-tampered medical images, to give the forensic research community the tools it needs to catch this kind of manipulation before it causes real harm.

Why Are Manipulated Medical Images Such a Serious Threat?

• A CT scan can be altered to inject a fake malignant lung nodule or remove a real one, changing a diagnosis entirely
• Motivations for such attacks include insurance fraud, falsifying research data, or political and terrorism-related purposes
• Prior research has shown these manipulated scans can fool both automated cancer-detection tools and human medical experts
• Despite the severity of this threat, medical image tampering has received far less research attention than face-based deepfakes

What Is M3DSynth?

• A large dataset of 8,577 manipulated CT lung images, built from real scans
• Based on 1,018 real CT scans from 1,010 patients, drawn from a fully annotated public lung-nodule dataset
• Includes both nodule injection (creating or enlarging a malignant nodule) and nodule removal (shrinking or erasing one)
• Generated using three different AI methods — two GAN-based and one diffusion-based
• Dataset and code are publicly available, making it a ready-to-use benchmark for forensic researchers

How Are the Manipulations Actually Created?

• Only a small local region of the scan is modified — a cube roughly 32mm across, much larger than the nodules themselves
• The inner core of that cube is masked and regenerated by the AI model, while the surrounding tissue is preserved for a seamless blend
• For injection, the model generates a new malignant nodule larger than 10mm
• For removal, an existing malignant nodule is shrunk down to under 8mm rather than erased outright, to minimize visual traces
• Three separate generative architectures were used: a 3D Pix2Pix-style GAN (CT-GAN), a 3D CycleGAN, and a 3D diffusion model based on denoising diffusion probabilistic models

Do These Manipulations Actually Fool Diagnostic Tools?

• Researchers tested the manipulated scans against a real computer-aided diagnostic tool used for lung cancer detection
• Before manipulation, the tool reliably distinguished benign from malignant nodules
• After manipulation, removed or shrunk malignant nodules scored like benign ones, and injected nodules scored like genuine malignant ones — the histograms essentially swapped roles
• This confirms the tampered images are realistic enough to mislead automated cancer-screening systems

Can Forensic Detectors Be Trained to Catch These Manipulations?

• A synthetic-image detector trained only on general-purpose images performed at roughly 50% accuracy on medical scans — essentially no better than a coin flip
• After fine-tuning on M3DSynth, the same detector's accuracy jumped to over 90%, even when tested on manipulation methods it hadn't seen during training
• This demonstrates that domain-specific training data is essential — general deepfake detectors don't automatically transfer to medical imaging

Which Detection Methods Perform Best?

Several state-of-the-art forensic architectures were benchmarked on M3DSynth, including Xception, U-Net, HP-FCN, ManTraNet, MVSS-Net, and TruFor.

• TruFor, a transformer-based method combining image content with a learned noise fingerprint, delivered the strongest overall localization and detection performance
• ManTraNet also performed strongly across both metrics
• Most methods showed only limited performance loss when tested on a different generator than the one used for training — a good sign for real-world generalization
• Some methods performed poorly with a fixed decision threshold but improved substantially once properly calibrated for the low false-alarm rates required in real deployments

Who Can Use M3DSynth?

• Forensic researchers developing detectors specifically for medical image tampering
• Hospitals and PACS security teams assessing vulnerabilities in medical imaging systems
• Journal and research integrity reviewers screening for manipulated diagnostic images in publications
• Regulators and policymakers evaluating AI-related risks in healthcare infrastructure

Frequently Asked Questions

What is M3DSynth? M3DSynth is a public dataset of over 8,500 AI-manipulated CT lung scans, created by injecting or removing cancer nodules using three different generative AI methods, designed to help researchers build and test medical image forensic detectors.

Can AI-manipulated CT scans really fool cancer-detection tools? Yes. Testing against a real computer-aided diagnostic tool showed that manipulated nodules were scored just like their genuine counterparts, meaning the tampering was realistic enough to mislead automated screening.

Do general deepfake detectors work on medical images? Not well by default. A detector trained only on general-purpose images performed at chance level on CT scans, but reached over 90% accuracy after being fine-tuned on the M3DSynth dataset.

Which forensic detection method performed best on M3DSynth? TruFor, a transformer-based method that combines image content with a learned noise fingerprint, achieved the strongest results for both detecting and localizing manipulated regions.

Is the M3DSynth dataset publicly available? Yes, both the dataset and the accompanying code are publicly available for researchers to use and build on.

Note: This article was prepared with the support of artificial intelligence 

‍

Discover more about the paper: https://identifai.net/scientific-publications/m3dsynth-a-dataset-of-medical-3d-images-with-ai-generated-local-manipulations

‍