PaperlayerView exact revision on arXiv

Source-linked AI summary

CT-GAN: Malicious Tampering of 3D Medical Imagery using Deep Learning

Yisroel Mirsky, Tom Mahler, Ilan Shelef, Yuval Elovici

arXiv:1901.03597v3cs.CRcs.CVcs.LG

TL;DR

The paper addresses how attackers could realistically and automatically alter volumetric medical scans to add or remove disease evidence. It develops CT-GAN and evaluates lung-cancer tampering against radiologists and AI, finding high susceptibility while noting detection-method limitations for 3D CT imagery.

  • Problem

    The paper investigates the previously unshown threat of realistic, automated malicious alteration of 3D medical imagery, enabled by access to vulnerable healthcare imaging systems.

  • Method

    CT-GAN uses GAN-based in-painting with preprocessing to inject or remove lung cancer in large 3D CT scans, with evaluation against radiologists and a state-of-the-art AI model.

  • Results

    99% of injected patients and 94% of cancer-removed patients were misdiagnosed by radiologists, while the AI was fooled completely and radiologists could not consistently distinguish real from fake cancers.

  • Takeaways & Limitations

    Both radiologists and AI are highly susceptible to CT-GAN tampering, and attack knowledge does not eliminate substantial errors or confidence in incorrect judgments.

  • Takeaways & Limitations

    Existing countermeasures are limited because they were tested on 2D images, medical scans are usually uncompressed, CT/MR noise differs from camera noise, and PRNU did not work out-of-the-box on tampered CT scans.

Abstract

from arXiv · show

In 2018, clinics and hospitals were hit with numerous attacks leading to significant data breaches and interruptions in medical services. An attacker with access to medical records can do much more than hold the data for ransom or sell it on the black market. In this paper, we show how an attacker can use deep-learning to add or remove evidence of medical conditions from volumetric (3D) medical scans. An attacker may perform this act in order to stop a political candidate, sabotage research, commit insurance fraud, perform an act of terrorism, or even commit murder. We implement the attack using a 3D conditional GAN and show how the framework (CT-GAN) can be automated. Although the body is complex and 3D medical scans are very large, CT-GAN achieves realistic results which can be executed in milliseconds. To evaluate the attack, we focused on injecting and removing lung cancer from CT scans. We show how three expert radiologists and a state-of-the-art deep learning AI are highly susceptible to the attack. We also explore the attack surface of a modern radiology network and demonstrate one attack vector: we intercepted and manipulated CT scans in an active hospital network with a covert penetration test. Demo video: https://youtu.be/_mkRAArj-x0 Source code: https://github.com/ymirsky/CT-GAN

1 Introduction

Medical imagery is central to diagnosis, yet exposed healthcare networks and PACS create opportunities to alter scans before clinical interpretation. This paper presents CT-GAN as an automated way to inject or remove lung-cancer evidence and demonstrates susceptibility among radiologists and AI systems.

  • The Vulnerability: 1,849 DICOM servers and 842 PACS servers were found exposed to the Internet, while healthcare security policies often emphasize privacy over integrity.PACS receives, stores, and retrieves DICOM scans for radiologist analysis, and exposed portals have been shown capable of modifying 3D imagery.
  • The Threat: 3D medical scans provide strong diagnostic evidence, so altering them can change whether disease appears present or absent.Patients may be treated based on scan evidence without other tests, including cases involving obvious lesions or lesions not visible elsewhere.
  • The Threat: Attackers may target or randomly affect patients by injecting or removing medical evidence before diagnosis, through data-at-rest or data-in-motion access.The paper discusses targeted scenarios such as political interference and insurance fraud, as well as untargeted screening or routine-scan victims.
  • The Attack: 99% of injected patients were diagnosed with malignant cancer and 94% of cancer-removed patients were judged healthy by three radiologists.After the attack was disclosed, radiologists still misdiagnosed 60% of injection cases and 87% of removal cases; a state-of-the-art screening model misdiagnosed 100% of tampered patients.
  • The Contribution: The paper also presents a PACS infiltration model, demonstrates a covert hospital-network penetration test, and enumerates countermeasures and immediate preventive practices.Its stated contributions cover attack vectors, motivations, goals, implementation, evaluation against humans and machines, and mitigations.
  • The Contribution: CT-GAN uses a GAN with preprocessing to realistically and automatically inject or remove lung cancer in large 3D CT scans.The authors selected pix2pix in-painting after CycleGAN failed to inject realistic cancer into 3D samples, and describe deployment in milliseconds or autonomously in an air-gapped PACS.

2 Background: GANs

GANs use a generator and discriminator in competition, while conditional GANs add input context for image-to-image translation and in-painting.

  • Classic GANs: A classic GAN trains a generator to create realistic images and a discriminator to distinguish generated images from real samples.After training, the discriminator is discarded and the generator produces new samples.
  • Conditional GANs: A cGAN conditions both networks on additional information, extending the latent representation to improve generation and discrimination.The conditioning input can include class labels or surrounding image context.
  • In-painting: Pix2pix applies conditional GANs to image-to-image translation, including in-painting missing regions using surrounding context and training examples.The generator completes the masked region, while the discriminator evaluates the completed image alongside its context.
  • Training Procedure: The cGAN in-painting procedure alternates discriminator updates on real and generated pairs with generator updates based on discriminator feedback.Training begins by masking real samples and repeatedly forward- and back-propagating through the two networks.
  • Model Choice: The authors choose pix2pix over CycleGAN because it produced better results for realistic cancer injection in complex 3D anatomy with few training samples.In-painting also enables seamless placement within an existing scan without border effects.

3 Related Work

Prior medical-image GAN work largely focused on synthesis and dataset augmentation, while CT-GAN targets malicious tampering of full-resolution 3D scans and evaluates deception of clinical experts and AI.

  • Prior Forgery Methods: Earlier medical-image forgery methods used splicing, copy-move, or retouching, but these 2D editing approaches can produce suspicious duplication or inconsistent local noise.They also require manual editing and do not account for full 3D anatomical context.
  • Medical GAN Research: Medical GAN research primarily addressed reconstruction, denoising, synthesis, segmentation, detection, classification, registration, and dataset augmentation rather than malicious attacks.Examples include modality translation and generation of 2D or 3D medical images.
  • CT-GAN Contributions: CT-GAN introduces GAN-based tampering of 3D medical imagery and an overview of how such an attack can be performed in a modern medical system.The prior works synthesized samples for classifiers, experiments, or training, not malicious manipulation.
  • CT-GAN Contributions: CT-GAN modifies content within existing bodies while considering nearby anatomy and can modify full-resolution 3D scans, avoiding the limitations of context-free or low-resolution synthesis.The approach can also be extended to 2D imagery.
  • Evaluation: The evaluation measures whether GAN-generated lung-cancer alterations fool expert radiologists and state-of-the-art AI while preserving their consideration of surrounding anatomy.This extends prior medical-image GAN evaluation beyond sample realism toward clinical screening deception.

4 The Attack Model

The attack model targets medical scans before diagnosis by compromising PACS assets or network paths, enabling malware to alter stored or transmitted DICOM data. A penetration test demonstrated exploitable weaknesses in hospital-network handling of scans and credentials.

  • Network Topology: PACS connects imaging devices, storage, retrieval, radiologist workstations, and related hospital systems through servers and DICOM-based communications.Its components include PACS and RIS servers, modality workstations, radiologist workstations, and other hospital-connected access points.
  • Attack Scenario: The attacker alters target CT scans before diagnosis by targeting DICOM data at rest or in motion.Data at rest includes files on PACS or personal computers, while data in motion includes network transfers or application memory.
  • Target Assets: Compromising assets 1–4 grants access to every scan, whereas compromising assets 5–6 grants access only to a subset.The RIS can control the PACS server with suitable credentials or software exploitation, and network wiring can support man-in-the-middle modification of unencrypted traffic.
  • Attack Vectors: Attackers may infiltrate remotely through Internet-facing vulnerabilities or social engineering, or move laterally from an internal network when PACS lacks direct Internet exposure.The authors describe malware installation as likely after compromising a target asset, especially when diagnosis follows scanning immediately.
  • Attack Demonstration: The penetration test intercepted a dummy scan twice, found cleartext payloads even in a TLS transmission, and obtained credentials for over 27 staff members within 10 minutes.The scan was sent over cleartext TCP to a viewing service and to PACS storage using TLSv1.2 whose payload was also cleartext.
  • Attack Demonstration: Hospitals often do not encrypt internal PACS traffic because legacy components may lack compatibility, while isolation from the Internet can create a false sense of security.The authors report that these vulnerabilities were disclosed to hospital IT staff and the PACS software provider.

5 The CT-GAN Framework

CT-GAN uses two 3D conditional GANs to inject or remove lung-cancer evidence through masked-volume in-painting. The automated pipeline preprocesses CT cuboids, applies GAN completion, and merges the result back into scans, producing realistic tampering examples.

  • CT-GAN architecture: Two deep 3D conditional GANs separately perform cancer injection and removal by in-painting masked 32^3-voxel samples.A 16^3 central cube is zeroed in each 32^3 input; GANinj uses cancer samples, whereas GANrem uses healthy samples.
  • Training data: The framework trains on 888 annotated CT scans containing 1,186 radiologist-listed pulmonary nodules.GANinj uses 169 nodules measuring 10–16 mm, while GANrem uses 867 randomly selected benign micronodules with augmentation.
  • Training and model size: Each GAN trains for 200 epochs with batches of 50, requiring 26 hours on an NVIDIA GeForce GTX TITAN X.The reported model contains 162.6 million generator parameters and 26.9 million discriminator parameters.
  • Results and scope: The complete injection and removal process produces before-and-after examples and 3D visualizations of tampered cancer regions.The authors report that the process is automatic and can operate in autonomous malware or inside a viewing application for real-time tampering.

6 Evaluation

CT-GAN was evaluated against three radiologists and a state-of-the-art lung-cancer AI in blind and open trials. The attacks fooled detectors substantially, while a splice baseline produced obvious artifacts that CT-GAN avoided.

  • Evaluation Setup: Three radiologists and a state-of-the-art lung-cancer screening model evaluated CT-GAN on manipulated and authentic CT scans.The radiologists had 2, 5, and 7 years of experience; the AI won the 2017 Kaggle Data Science Bowl.
  • Baseline Performance: 0.975 average TPR and 1.0 TNR were obtained by all four detectors on baseline scans.These baseline results indicate reliable diagnosis when scans were not manipulated.
  • Blind Trial: 99.2% average injection and 95.8% average removal success were achieved in the blind trial.The AI was fooled completely, while radiologists were fooled less often, primarily because of human error.
  • Open Trial: Radiologists could not consistently distinguish real from fake cancers or locate removed cancers when told about the attack.The open trial measured accuracy, AUC, confidence, and false positives.
  • Open Trial: 90% removal success persisted after attack disclosure, while injection success fell from 99.2% to 70%.Injection detection accuracy was 61%, and removal detection accuracy was 39%, with significant false positives and low confidence.
  • Baseline Analysis: The splice baseline failed to trick a radiologist because pasted nodules created artifacts absent from CT-GAN’s anatomy-aware in-painting.Observed artifacts included cut bronchi, inconsistent noise patterns, and unaligned borders.

7 Countermeasures

The paper discusses countermeasures spanning PACS transport, stored-file integrity, watermarking, and machine-learning detection. It emphasizes that existing detection methods have important medical-imaging-specific limitations.

  • PACS Security: Administrators should secure both data-in-motion and data-at-rest in PACS networks.The authors specifically recommend encryption between PACS hosts using proper SSL certificates.
  • Integrity Verification: DICOM files can carry scanner-generated digital signatures that viewing applications should verify.The authors report that this feature was not observed in use within a PACS they examined.
  • Watermarking: Digital watermarking can indicate tampering and localize image changes, but may add noise that harms medical analysis.The authors found no medical devices or products implementing watermarking techniques.
  • Machine-Learning Detection: Existing countermeasures face three caveats: uncompressed scans limit compression methods, evaluations target 2D images, and CT/MR noise differs from camera noise.The authors found that PRNU did not work out-of-the-box on their tampered CT scans because CT reconstruction alters noise patterns.

8 Conclusion

The paper presents deep-learning modification of 3D medical imagery as a practical threat. CT-GAN can manipulate lung-cancer evidence in full-resolution CT scans and fool both radiologists and advanced AI.

  • Conclusion: CT-GAN demonstrates autonomous deep-learning attacks that inject or remove lung cancer from full-resolution 3D CT scans.The paper also discusses attack vectors and demonstrates one in a hospital network.
  • Conclusion: Both human experts and state-of-the-art AI can be fooled when they fully trust their observations.This conclusion is framed as a warning against closed-world assumptions.

Appendix

The appendix provides additional visual examples of CT-GAN tampering, failed blind-trial cases, cross-modality tumor injection, and full volumetric slice sequences.

  • Failure Cases: Figure 17 shows blind-trial failures caused by excessive additive noise and human error.A removal was classified as ground-glass cancer, while an injection was missed.
  • MRI Extension: CT-GAN is illustrated injecting brain tumors into healthy-brain MRIs using 64x64x16 cuboids.The figure shows context, the in-painted result, and ground truth.
  • Volumetric Example: Figure 20 displays all 32 slices of a sample injection before and after tampering.The sequence provides a volumetric view rather than only a single middle slice.
Loading 1901.03597v3…