# CT-GAN: Malicious Tampering of 3D Medical Imagery using Deep Learning

arXiv: https://arxiv.org/abs/1901.03597 · HTML: https://mlsanity.com/paper/1901.03597/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Jan 2019.

## Built on by (most cited first, 30 of 32)

- [Collaborative Federated Learning For Healthcare: Multi-Modal COVID-19 Diagnosis at the Edge](https://mlsanity.com/paper/2101.07511/) (2021)
- ["Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practice](https://mlsanity.com/paper/2212.14315/) (2022)
- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [Large Language Model Benchmarks in Medical Tasks](https://mlsanity.com/paper/2410.21348/) (2024)
- [Data synthesis and adversarial networks: A review and meta-analysis in cancer imaging](https://mlsanity.com/paper/2107.09543/) (2021)
- [The Age of Synthetic Realities: Challenges and Opportunities](https://mlsanity.com/paper/2306.11503/) (2023)
- [M3Dsynth: A dataset of medical 3D images with AI-generated local manipulations](https://mlsanity.com/paper/2309.07973/) (2023)
- [Jekyll: Attacking Medical Image Diagnostics using Deep Generative Models](https://mlsanity.com/paper/2104.02107/) (2021)
- [IPatch: A Remote Adversarial Patch](https://mlsanity.com/paper/2105.00113/) (2021)
- [Lung Cancer Risk Estimation with Incomplete Data: A Joint Missing Imputation Perspective](https://mlsanity.com/paper/2107.11882/) (2021)
- [Machine Learning based Medical Image Deepfake Detection: A Comparative Study](https://mlsanity.com/paper/2109.12800/) (2021)
- [Back-in-Time Diffusion: Unsupervised Detection of Medical Deepfakes](https://mlsanity.com/paper/2407.15169/) (2024)
- [CT-SGAN: Computed Tomography Synthesis GAN](https://mlsanity.com/paper/2110.09288/) (2021)
- [The Security of Deep Learning Defences for Medical Imaging](https://mlsanity.com/paper/2201.08661/) (2022)
- [Toward Generating Synthetic CT Volumes using a 3D-Conditional Generative Adversarial Network](https://mlsanity.com/paper/2104.02060/) (2021)
- [Adversarially Robust Feature Learning for Breast Cancer Diagnosis](https://mlsanity.com/paper/2402.08768/) (2024)
- [Synthetic Medical Imaging Generation with Generative Adversarial Networks For Plain Radiographs](https://mlsanity.com/paper/2403.19107/) (2024)
- [Can We Revitalize Interventional Healthcare with AI-XR Surgical Metaverses?](https://mlsanity.com/paper/2304.00007/) (2023)
- [SecGenAI: Enhancing Security of Cloud-based Generative AI Applications within Australian Critical Technologies of National Interest](https://mlsanity.com/paper/2407.01110/) (2024)
- [Localization of Synthetic Manipulations in Western Blot Images](https://mlsanity.com/paper/2408.13786/) (2024)
- [SoK: Security and Privacy Risks of Healthcare AI](https://mlsanity.com/paper/2409.07415/) (2024)
- [GAN-based Medical Image Small Region Forgery Detection via a Two-Stage Cascade Framework](https://mlsanity.com/paper/2205.15170/) (2022)
- [Pathology-Aware Adaptive Watermarking for Text-Driven Medical Image Synthesis](https://mlsanity.com/paper/2503.08346/) (2025)
- [Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models](https://mlsanity.com/paper/2602.09431/) (2026)
- [Redatuming physical systems using symmetric autoencoders](https://mlsanity.com/paper/2108.02537/) (2021)
- [Comparative Analysis of Deep Convolutional Neural Networks for Detecting Medical Image Deepfakes](https://mlsanity.com/paper/2406.08758/) (2024)
- [Longitudinal Mammogram Exam-based Breast Cancer Diagnosis Models: Vulnerability to Adversarial Attacks](https://mlsanity.com/paper/2411.00837/) (2024)
- [Filtered-ViT: A Robust Defense Against Multiple Adversarial Patch Attacks](https://mlsanity.com/paper/2511.07755/) (2025)
- [Quantum-Inspired Reinforcement Learning for Secure and Sustainable AIoT-Driven Supply Chain Systems](https://mlsanity.com/paper/2601.22339/) (2026)
- [CTForensics: A Comprehensive Dataset and Method for AI-Generated CT Image Detection](https://mlsanity.com/paper/2603.01878/) (2026)

## Abstract (arXiv)

In 2018, clinics and hospitals were hit with numerous attacks leading to significant data breaches and interruptions in medical services. An attacker with access to medical records can do much more than hold the data for ransom or sell it on the black market. In this paper, we show how an attacker can use deep-learning to add or remove evidence of medical conditions from volumetric (3D) medical scans. An attacker may perform this act in order to stop a political candidate, sabotage research, commit insurance fraud, perform an act of terrorism, or even commit murder. We implement the attack using a 3D conditional GAN and show how the framework (CT-GAN) can be automated. Although the body is complex and 3D medical scans are very large, CT-GAN achieves realistic results which can be executed in milliseconds. To evaluate the attack, we focused on injecting and removing lung cancer from CT scans. We show how three expert radiologists and a state-of-the-art deep learning AI are highly susceptible to the attack. We also explore the attack surface of a modern radiology network and demonstrate one attack vector: we intercepted and manipulated CT scans in an active hospital network with a covert penetration test. Demo video: https://youtu.be/_mkRAArj-x0 Source code: https://github.com/ymirsky/CT-GAN