M3DSYNTH: A DATASET OF MEDICAL 3D IMAGES WITH AI-GENERATED LOCAL MANIPULATIONS

🎯 Pitch

AI-injected or removed lung cancer nodules in CT scans easily fool automated diagnostic tools and even human experts, yet detectors trained on natural images fail on medical data. Our M3Dsynth dataset enables forensic detectors to accurately localize these synthetic manipulations and generalize across unseen generator types—but only when fine-tuned on medical scans.

1. Executive Summary

This paper introduces M3Dsynth, a large dataset of manipulated lung CT scans where lung cancer nodules are injected or removed using three generative methods—two GAN-based (Pix2Pix, CycleGAN) and one diffusion-based (DDPM)—yielding 8,577 tampered 3D images. The authors demonstrate that these AI-generated manipulations easily fool an automated diagnostic tool, then benchmark several state-of-the-art forensic detectors fine-tuned on the dataset, showing that TruFor and ManTraNet achieve strong localization (F1 up to 89.9%, IoU up to 82.9% on aligned data) and detection performance (Pd@1% near 100% for several methods) even when training and test generators differ, establishing that data-driven detectors can generalize across manipulation types when trained on a sufficiently diverse medical image forensics dataset—though this generalization holds only when the detectors are fine-tuned on medical data rather than general-purpose images.

2. Context and Motivation

The Core Problem: Medical Images Are Vulnerable to AI-Powered Tampering, and Forensic Defenses Lag Behind

The fundamental problem this paper tackles is both specific and alarming: deep learning can be weaponized to modify 3D medical images in ways that fool both automated diagnostic tools and human experts, yet the research community has devoted almost no attention to detecting such manipulations. This is not a hypothetical concern — Mirsky et al. (2019) demonstrated that an attacker who gains access to a hospital's Picture Archive and Communication System (PACS) could use a 3D conditional GAN to inject or remove lung cancer nodules from CT scans, with the potential to alter patient diagnoses. The consequences span insurance fraud, falsification of clinical trial data, and even political terrorism, as the authors note in Section 1.

The gap the paper identifies is not that medical image tampering is impossible — that was already established. Rather, the gap is that there exists no adequate dataset or benchmark for developing and evaluating forensic detectors to combat this threat. Defending against a threat requires understanding its signatures, and understanding signatures requires data. Without a large, diverse dataset of manipulated medical images generated by multiple methods, researchers cannot train detectors robustly, evaluate their generalization, or establish reliable performance baselines. The field was stuck with a single, small dataset created by one specific GAN architecture, leaving critical questions unanswered: do the forensic traces left by one generator transfer to another? Can detectors trained on one manipulation method detect manipulations from a different tool? How well do general-purpose image forensics methods work on medical imagery, which has fundamentally different properties than natural photographs?

Why This Problem Matters: The Real-World Stakes of Medical Image Integrity

The paper grounds its motivation in a concrete attack scenario laid out in prior work (Section 1, referencing Mirsky et al., 2019). Medical CT scans are stored in PACS servers, which are networked systems that can be penetrated by attackers. Once inside, an attacker with access to deep generative models can modify scans in clinically significant ways — enlarging a benign nodule to appear malignant, or shrinking a malignant nodule to appear benign — without leaving obvious visual artifacts. The authors cite evidence that such manipulations "can easily fool automated cancer detectors and even medical experts" (Section 1).

The real-world impact is multi-dimensional:

Patient harm: A manipulated scan could lead to unnecessary invasive procedures (biopsies, surgeries) for a healthy patient, or cause a cancer patient's disease to go undiagnosed and untreated.
Insurance fraud: Fabricating medical evidence to justify fraudulent claims or deny legitimate ones.
Scientific integrity: Falsifying data in clinical trials or medical research, undermining the evidence base for treatment decisions.
Security and terrorism: Targeted attacks against specific individuals (political figures, military personnel) by manipulating their medical records to trigger harmful interventions or conceal treatable conditions.

This threat profile distinguishes medical image forensics from the more widely studied problem of deepfake detection in natural images and videos. In the deepfake domain, the primary harms are reputational (non-consensual pornography, political disinformation) or related to identity fraud. In medical imaging, the harm is direct physical injury or death. The stakes are categorically higher, yet the research attention has been disproportionately lower. The paper's motivation is thus partly a call to arms: this is a serious, understudied problem that the forensics community needs to engage with urgently.

The Theoretical Significance: Forensic Trace Transfer Across Domains and Generators

Beyond the immediate practical concern, the paper addresses a deeper technical question that cuts across the entire field of synthetic image detection: do forensic detectors trained on one type of synthetic content generalize to other types, especially when the image domain itself changes? This question has two layers.

First, there is the problem of cross-generator generalization within medical images. Different generative architectures — GANs (Pix2Pix, CycleGAN) and diffusion models (DDPM) — leave different forensic traces. GANs are known to leave specific spectral fingerprints related to upsampling operations in the generator architecture (Corvi et al., 2023). Diffusion models, being fundamentally different in their generative process (iterative denoising rather than single-pass generation), leave different traces. A detector that works well on Pix2Pix-generated nodules might fail completely on CycleGAN or DDPM nodules if the forensic traces are architecture-specific. Understanding whether and when cross-generator generalization is possible requires testing with multiple generators — exactly what M3Dsynth provides.

Second, and perhaps more fundamental, is the problem of cross-domain generalization. General-purpose forensic detectors are trained on natural images — photographs from cameras, faces, landscapes, objects in the wild. Medical CT scans are a completely different domain: they are 3D volumetric data, acquired through X-ray attenuation measurements rather than visible-light photography, stored in DICOM format with different intensity distributions, and lack the compression artifacts, demosaicing patterns, and sensor noise characteristics that many forensic methods rely upon. Whether detectors designed for natural images can transfer to medical images is an open question, and the paper provides preliminary evidence that they cannot without domain-specific fine-tuning (Table 2, where a detector achieving ~99% accuracy on general-purpose images drops to ~50% — chance level — on M3Dsynth).

Where Prior Approaches Fall Short

The paper identifies four specific limitations in the existing literature that motivate the creation of M3Dsynth.

1. A single, small, generator-specific dataset. The foundational work by Mirsky et al. (2019) created a dataset of 100 tampered medical images using 3D CT-GAN (a 3D conditional GAN for injection and removal). This dataset was groundbreaking in demonstrating the feasibility of the attack, but it is severely limited for developing forensic defenses. One hundred images constitute a tiny training set by deep learning standards, making it impossible to train detectors from scratch or to study generalization systematically. More critically, the dataset uses only one generator architecture, meaning any detector trained on it could be learning architecture-specific artifacts rather than general properties of medical image manipulation. The paper explicitly flags this: "all above detectors only focus on the detection task and were trained and tested on the same type of manipulations, without exploring their ability to generalize" (Section 1).

2. No generalization testing across generators. The subsequent detection papers that used Mirsky's dataset — Solaiyappan and Wen (2022) exploring machine learning and deep learning detectors with augmentation and fine-tuning, and Sharafudeen and Chandra (2022) proposing a 3D CNN — both trained and tested on the same generator's outputs. As the paper notes, "it is well known that data driven detectors perform very well on the image manipulations they were trained for but exhibit a sharp performance drop on images displaying new types of synthetic generation, because the forensic traces introduced by unrelated generators may be very different" (Section 1, citing Corvi et al., 2023). Without a multi-generator dataset, it was impossible to know whether these detectors would survive an adversary who switches to a different generation tool — a highly realistic scenario given "new tools for creating synthetic images are developed by the day" (Section 1).

3. General-purpose forensic methods are untested on medical imagery. As the authors note in Section 3, "several classical approaches look for compression artifacts or traces of internal camera processing, but compression is not customary for CT images, and medical imaging sensors have very different properties than smartphones or general-purpose cameras." CT scans undergo no JPEG compression (they are stored in DICOM format), have no color filter array (no demosaicing), no camera sensor pattern noise, and no lens distortion. The entire pipeline of forensic trace generation — from photon capture to digital storage — is completely different. Prior work had not systematically evaluated whether deep learning-based forensic methods, which might learn relevant features from data rather than relying on handcrafted priors, could adapt to medical imagery. The preliminary experiment in Table 2 (the Corvi et al., 2023 detector) provides the first evidence that the answer is no — fine-tuning on medical data is necessary.

4. No localization capability has been established for medical image forensics. Prior work on medical image tampering detection (Mirsky et al., 2019; Solaiyappan and Wen, 2022; Sharafudeen and Chandra, 2022) focused exclusively on the detection task — binary classification of whether a scan has been tampered with. But in a clinical setting, detection alone is insufficient. A radiologist confronted with a flagged scan needs to know where the manipulation occurred to assess its clinical significance. Was a nodule injected that should not be there? Was a malignant nodule removed? Without localization, a detection alert is a needle-in-a-haystack problem — the radiologist would need to re-examine the entire 3D scan, which is time-consuming and error-prone. The paper explicitly enables both tasks: "we carry out a preliminary study of several state-of-the-art detectors showing that, by training on our large dataset of pristine and synthetic images, it is possible to detect and also localize both injections and removals" (Section 1).

How This Paper Positions Itself

M3Dsynth is positioned primarily as an enabling contribution — a dataset and benchmark that fills a critical infrastructure gap — rather than as a new detection method. The paper's stance is that the field cannot progress without adequate data, and that providing this data is a necessary precondition for all subsequent methodological advances. This is reflected in the paper's structure: the dataset construction (Section 2) occupies the largest portion of the paper, with the benchmark evaluation (Section 3) serving as a validation that the dataset is useful and as an initial characterization of what works and what doesn't.

Within this dataset-first framing, the paper makes several specific positioning choices:

Choice of manipulation types. The authors focus on injection and removal of large (malignant) lung nodules, defined as having diameter >10mm. They justify this through clinical relevance — large nodules carry the most diagnostic weight, and thus manipulating them has the greatest potential for harm. However, a subtle design choice that isn't fully spelled out: rather than creating nodules from scratch or removing them entirely, the authors "most of the times... enlarge an existing small one and, likewise, do not remove altogether an existing large nodule but reduce it to a smaller size. This is to reduce the visual impact of manipulations" (Section 2). This is an attacker-modeling decision — a sophisticated adversary would make minimal changes to avoid detection, and a realistic forensic detector must be able to catch these subtle alterations, not just blatant ones. The manipulation preserves anatomical context: "newly generated nodules are placed near existing benign ones" (Section 2), again reducing visual conspicuity.

Choice of generators. The paper deliberately selects three generators representing fundamentally different architectural paradigms. Pix2Pix (CT-GAN, a 3D conditional GAN based on Isola et al., 2017) represents paired image-to-image translation with an L1 reconstruction loss plus adversarial loss — a workhorse architecture for medical image synthesis that the original attack paper used. CycleGAN represents unpaired image-to-image translation using cycle consistency loss — a different GAN paradigm that doesn't require aligned training pairs. DDPM (Denoising Diffusion Probabilistic Models, Ho et al., 2020) represents the newer diffusion-based generation paradigm, extended to 3D by adapting the 2D U-Net denoiser to a 3D U-Net (following Dorjsembe et al., 2022 and Kim and Ye, 2022). The choice of three architecturally diverse generators is strategic: it enables the first systematic study of cross-generator generalization in medical image forensics, testing whether forensic traces are architecture-specific or reflect deeper properties of synthetic content.

Positioning relative to general-purpose forensics. The paper explicitly delineates which forensic approaches are in-scope versus out-of-scope. Classical approaches relying on handcrafted features (JPEG compression artifacts, camera sensor noise, color filter array patterns) are deemed inappropriate because the underlying signal formation processes in CT imaging are completely different. The paper restricts attention to "deep learning-based methods that may be used or adapted to perform both detection and localization of synthetic content, and such to be easily fine-tuned on our dataset" (Section 3). This is a practical scoping decision: these methods are data-hungry and benefit directly from the larger, more diverse dataset that M3Dsynth provides.

Positioning as a benchmark. The paper explicitly frames M3Dsynth as "a first benchmark" (Section 3) and closes with a forward-looking call: "We hope this dataset will stimulate the research community to work on this topic, contributing new data and methods, and exploring challenging situations such as using adversarial attacks to fool the detectors" (Section 4). This positions the contribution not as a solved problem but as a foundation for a new subfield — medical image forensics — that the authors are inviting the community to build upon.

The reconciliation of conflicting needs. The paper navigates an inherent tension in forensic dataset design. On one hand, for practical relevance, manipulated images must be realistic enough to fool diagnostic tools — which the paper verifies through the classification score histogram analysis (Figure 3). On the other hand, for detector training, the manipulations must leave detectable traces that a network can learn. The paper resolves this tension by creating manipulations that are clinically convincing (fooling the automated diagnostic tool) but forensically detectable (achieving high detection rates with fine-tuned detectors) — the ideal regime for developing forensic methods.

The Broader Research Context This Work Enters

The paper situates itself within the broader deepfake detection literature but with a sharp domain shift. The deepfake detection community has produced large-scale datasets (FaceForensics++, Rossler et al., 2019; DFDC; Celeb-DF) and sophisticated detection architectures, but almost exclusively for facial imagery in natural photographs and videos. Medical images have received "very limited attention" (Section 1), with the only exceptions being Mirsky et al. (2019) for the attack vector, Solaiyappan and Wen (2022) and Sharafudeen and Chandra (2022) for detection, and Mandelli et al. (2022) for forensic analysis of synthetic Western blot images in biomedical publications — a related but distinct problem involving 2D scientific images rather than 3D clinical scans.

This neglect creates an asymmetry that the paper aims to correct: the attack capabilities have been demonstrated and are advancing rapidly, but the defense capabilities are essentially nonexistent. M3Dsynth is designed to close this gap by providing the foundational resource that the medical forensics subfield needs to develop and benchmark defenses at the same pace that generative models are advancing the attack capabilities.

3. Technical Approach

3.1 Reader Orientation

M3Dsynth is a dataset construction and benchmarking framework for studying how well forensic detectors can identify AI-generated manipulations in 3D medical CT scans. The system solves the problem of no adequate training and evaluation resource for medical image forensics by systematically building a large, multi-generator dataset of manipulated lung CT scans—where cancerous nodules are injected or removed using three architecturally diverse generative models—and then using this dataset to fine-tune and benchmark state-of-the-art forensic detectors, establishing the first standardized evaluation protocol for the field.

3.2 Big-Picture Architecture (Diagram in Words)

The system has five major components connected in a sequential pipeline:

Pristine CT Scan Source — the LIDC-IDRI dataset (Armato et al., 2011), containing 1018 annotated lung CT scans from 1010 patients with ground-truth nodule positions and sizes, serving as the raw material for both training generative models and creating pristine/manipulated image pairs.
Manipulation Pipeline — a three-stage process (pre-processing, generative synthesis, post-processing) that takes a pristine CT scan, isolates a 32mm cubic region around a target nodule, replaces the inner 16mm cube with synthetically generated tissue containing either an injected/enlarged malignant nodule or a removed/shrunken benign nodule, and blends the result back into the original scan.
Three Generative Engines — architecturally distinct models that produce the synthetic tissue: a 3D Pix2Pix conditional GAN (CT-GAN), a 3D CycleGAN for unpaired translation, and a 3D Denoising Diffusion Probabilistic Model (DDPM) adapted for inpainting. Each engine generates both injection and removal variants, yielding 8,577 total manipulated scans from three different forensic trace distributions.
Forensic Detector Suite — six state-of-the-art deep learning architectures (Xception, U-Net, HP-FCN, ManTraNet, MVSS-Net, TruFor) that are fine-tuned on M3Dsynth to perform two tasks: binary detection (tampered or not?) and pixel-level localization (where was the manipulation?). Each detector produces a 3D localization map and/or a global tampering score.
Evaluation Framework — a cross-generator testing protocol that trains each detector on images manipulated by one generator and tests on all three, using per-patient data splits (488 train, 100 validation, 150 test) to prevent data leakage, with metrics including F1/IoU for localization and Accuracy/Pd@1% for detection.

Information flows as follows: pristine CT scans enter the manipulation pipeline → one of three generators synthesizes the modified 16mm inner cube → post-processing blends the cube back into the scan → the resulting manipulated scan (or a pristine control) enters the forensic detector → the detector produces a localization map (pixel-level tampering mask) and/or a global detection score → evaluation metrics measure how well the detector distinguishes manipulated from pristine and localizes the tampered region.

3.3 Roadmap for the Deep Dive

First, the manipulation pipeline mechanics — pre-processing, the 32mm/16mm cube design, post-processing blending, and why this specific spatial design matters for both anatomical realism and forensic detectability.
Second, the three generators — their architectures, training procedures, and what forensic traces each architectural paradigm (conditional GAN, CycleGAN, diffusion model) is expected to leave.
Third, the dataset composition — the numbers (8,577 total images, injection/removal splits, per-generator counts), the per-patient splitting strategy, and the difficulty estimation via diagnostic tool evaluation.
Fourth, the forensic detector architectures — what each detector does, how it produces localization maps and detection scores, and what makes each method architecturally distinct.
Fifth, the training and evaluation protocol — fine-tuning strategy, loss functions, metrics (F1/IoU for localization, Accuracy/Pd@1% for detection), and the cross-generator testing design that tests generalization.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily a dataset and benchmark paper whose core idea is that a large, multi-generator dataset of manipulated 3D medical images enables training and systematic evaluation of forensic detectors, and that the resulting detectors can generalize across manipulation types when trained on sufficiently diverse data.

The Manipulation Pipeline: Pre-Processing, Synthesis, and Post-Processing

The manipulation process, illustrated in Figure 2 of the paper, operates on a single CT scan at a time and modifies only a local 3D region. The pipeline is designed to produce manipulations that are both clinically convincing (they fool automated diagnostic tools) and minimally disruptive to the surrounding anatomy (reducing visual artifacts that would make detection trivial). The process has three stages.

Stage 1: Pre-processing — from physical CT coordinates to a normalized input cube.

A CT scan is a 3D array of Hounsfield Units (HU), where each voxel represents the X-ray attenuation at a specific physical location. The physical spacing between voxels — both in-plane (within a slice) and through-plane (between slices) — varies across CT scanners and acquisition protocols. This means that a fixed physical volume (say, a 32mm cube) corresponds to a different number of voxels in different scans. To feed a neural network that expects a fixed-size input, the data must be rescaled.

The paper specifies the following pre-processing steps, described in Section 2.1 and Figure 2:

Candidate site selection: A 3D cube of physical side length 32mm is extracted around a target nodule. The target is either an existing small (benign) nodule (for injection/enlargement) or an existing large (malignant) nodule (for removal/shrinkage). The 32mm side length is chosen to be "much larger than the nodules, both benign and malignant, found in the lungs" (Section 2.1), ensuring that the manipulated region includes surrounding anatomical context.
Rescaling to fixed voxel dimensions: The 32mm physical cube is rescaled to a fixed grid of 32 × 32 × 32 pixels regardless of the original CT's voxel spacing. This step uses interpolation to map from the original voxel grid (which might be, for example, 40 × 40 × 25 voxels for a 32mm cube) to the uniform 32 × 32 × 32 grid. The authors refer to this as "the original data are suitably rescaled in advance" (Section 2.1). The rescaling ensures that every input to every generator has identical spatial dimensions, making the training and inference process independent of the source CT scanner's specifications.
Equalization: CT scans from different machines or acquisition protocols can have different intensity ranges (e.g., different window widths and levels). To create uniform inputs, the data are equalized to a common range of values. The paper states: "to ensure uniformity, data are also equalized to the same range of values" (Section 2.1). While the specific equalization procedure (min-max scaling, z-score normalization, or histogram matching) is not detailed, the intent is clear: remove scanner-dependent intensity variations so the generator learns anatomical structure rather than acquisition artifacts.
Center masking: Within the 32 × 32 × 32 input cube, only the central 16 × 16 × 16 region is actually processed by the generator. The outer portion (a 32 × 32 × 32 shell with a 16 × 16 × 16 hollow center) is left intact and serves as conditioning context. Specifically, the inner 16 × 16 × 16 voxels are "masking (zeroing) all input data" (Section 2.1) — they are set to zero (or possibly the mean intensity) before being fed to the generator. The outer 16mm-thick shell provides the generator with the surrounding anatomical context (blood vessels, bronchial walls, lung parenchyma texture) that the synthetic inner cube must be consistent with. This design choice is critical: the generator does not generate the entire 32mm cube from scratch but rather inpaints the central 16mm region conditioned on the surrounding 16mm of real tissue.

Why this specific spatial design?

The 32mm outer cube / 16mm inner cube split is inherited from Mirsky et al. (2019) and reflects a careful balance of competing constraints. The 32mm cube is large enough that the 16mm of real surrounding tissue captures substantial anatomical context (blood vessel trajectories, airway patterns, tissue density gradients), providing the generator with strong conditioning signals. If the outer context were too small (e.g., only a few millimeters), the generator would have little information about where in the lung the cube is located and what structures should be present. Conversely, if the inner cube were too small, it might not fully contain a large malignant nodule (which can exceed 10mm in diameter). The 16mm inner cube accommodates nodules up to 16mm in diameter (before rescaling), covering the clinically significant "large nodule" category (D > 10mm) with margin.

Stage 2: Generative synthesis — producing the synthetic tissue.

The zeroed 16 × 16 × 16 inner region is replaced with synthetic tissue by one of three generator architectures (detailed in the next subsection). The generator receives the full 32 × 32 × 32 cube (with the inner region zeroed) as input and produces a complete 32 × 32 × 32 cube as output, where the outer 16mm shell should be approximately unchanged (acting as a skip connection or identity mapping) and the inner 16mm cube contains the synthetic tissue. In practice, the generator may modify the outer shell slightly, but the post-processing step handles this.

For injection, the generator synthesizes a large malignant nodule (or enlarges an existing small one) in the inner cube. The target is to produce a nodule with diameter D > 10mm when measured in physical coordinates. The generator is conditioned on the surrounding anatomy, so it should, for example, insert a spherical or lobulated high-density mass consistent with the surrounding lung parenchyma and nearby structures.

For removal, the generator replaces an existing large malignant nodule with either healthy lung tissue or a smaller benign nodule (targeting D < 8mm after manipulation). This is the inverse task: the generator must "erase" the high-density nodule and fill the space with appropriate low-density lung parenchyma, small vessels, or a tiny residual nodule, all consistent with the surrounding anatomy.

Stage 3: Post-processing — reinsertion into the original CT scan.

The generator's output (32 × 32 × 32 voxels) must be transformed back into the original CT scan's coordinate system and intensity range. The post-processing steps invert the pre-processing:

De-equalization: The generated cube's intensity values are mapped back from the normalized range to the original CT scan's Hounsfield Unit range. This is the inverse of the equalization step and uses the same parameters (e.g., if min-max scaling to [0, 1] was used, the inverse mapping is applied with the original min and max values). The paper states "all operations are inverted in output before reinserting the generated data in the original CT scan" (Section 2.1).
Inverse rescaling: The 32 × 32 × 32 voxel grid is rescaled back to the original physical voxel dimensions of the 32mm cube in the source CT scan. If the original cube was, say, 40 × 40 × 25 voxels, the generated data is interpolated to match those dimensions. This step ensures that the generated tissue fits exactly into the region it was extracted from, with no resampling misalignment.
Touch-up blending: The paper mentions a "touch-up to improve blending into the host CT scan" (Figure 2 caption). While the specific blending technique is not detailed, typical approaches include Poisson blending (which matches gradients at the boundary to smooth the transition) or simple alpha blending (averaging the generated and original voxels in a narrow transition zone at the 16 × 16 × 16 boundary). The goal is to eliminate any visible seam between the synthetic inner cube and the real outer tissue. This step is crucial for making the manipulation clinically invisible — a radiologist scrolling through slices should see a continuous, artifact-free anatomical structure, not a sharp boundary where the generator's output begins.
Reinsertion: The blended cube is placed back into the original CT scan at the exact spatial coordinates from which it was extracted, replacing the original voxels. The rest of the CT scan (everything outside the 32mm cube) remains untouched.

Why this pipeline design matters.

The pre-processing → synthesis → post-processing pipeline creates manipulations where:

The generated tissue is anatomically coherent with the surrounding context because conditioning on real tissue constrains the generator.
Scanner-specific acquisition properties (voxel spacing, intensity range) are preserved because pre-processing removes them before synthesis and post-processing restores them after.
Visual artifacts are minimized through blending, making the manipulation challenging for human experts to detect and therefore requiring algorithmic forensic methods.
The manipulation is local (only a 16mm inner cube is actually synthesized), meaning forensic detectors can be evaluated on their ability to both detect the presence of any manipulation and localize where in the 3D volume the manipulation occurred.

Generator 1: Pix2Pix (CT-GAN) — Paired Conditional GAN

The first generator is a 3D version of the Pix2Pix architecture, originally proposed by Isola et al. (2017) for 2D image-to-image translation and adapted to 3D for CT scans by Mirsky et al. (2019) as CT-GAN. This is a conditional GAN that requires paired training data: for each input (a CT cube with the central region masked out), there is a corresponding ground-truth output (the original unmasked CT cube). The model learns a direct mapping from masked input to complete output, supervised by both a reconstruction loss and an adversarial loss.

Architecture. Pix2Pix uses a U-Net-style generator — an encoder-decoder with skip connections between corresponding encoder and decoder layers. The encoder (downsampling path) progressively compresses the 32 × 32 × 32 input into a low-resolution latent representation, capturing the anatomical context from the outer 16mm shell. The decoder (upsampling path) expands this representation back to 32 × 32 × 32, generating the synthetic tissue for both the inner and outer regions. Skip connections directly copy feature maps from encoder layers to corresponding decoder layers, bypassing the bottleneck. These connections serve two purposes: they preserve fine-grained spatial information that might be lost through the bottleneck (important for maintaining the identity of the outer shell, which should pass through unchanged), and they provide the decoder with direct access to the conditioning context at multiple resolutions. The discriminator is a PatchGAN — a fully convolutional network that classifies overlapping patches of the output as real or fake, rather than classifying the entire volume. This encourages the generator to produce locally realistic textures rather than just globally plausible volumes.

Training procedure. The authors train two separate Pix2Pix models: one for the injection task (mapping from masked cubes containing small benign nodules to unmasked cubes with large malignant nodules) and one for the removal task (mapping from masked cubes containing large malignant nodules to unmasked cubes with small benign nodules or healthy tissue). Training uses paired data: for injection, each training example is a (masked_input, ground_truth_full_cube) pair where the ground truth is the original unmasked CT cube containing a malignant nodule (or an enlarged version thereof). The generator is trained to minimize a combined loss:

$L_{\text{Pix2Pix}} = L_{\text{GAN}} + \lambda \cdot L_1$

where $L_{\text{GAN}}$ is the standard adversarial loss (generator tries to fool the discriminator into classifying generated outputs as real) and $L_1$ is the L1 distance between the generated output and the ground-truth cube, computed voxel-by-voxel.

What the L1 term computes: the mean absolute difference between each generated voxel value and the corresponding ground-truth voxel value. This is a per-voxel reconstruction loss that penalizes any deviation from the target, encouraging the generator to produce anatomically accurate tissue rather than just "realistic-looking" tissue (which might be anatomically wrong but visually convincing).

Why this form: The L1 loss promotes sharp, deterministic reconstructions (L2/MSE would blur the output by averaging over plausible tissue variations at each voxel, while L1 encourages the generator to commit to a specific tissue configuration). The GAN loss promotes realism by penalizing any deviation from the distribution of real CT tissue, catching artifacts that L1 alone would miss (e.g., slightly blurry but anatomically plausible tissue that a human would notice as "not quite right"). The hyperparameter $\lambda$ balances these terms: too low and the output loses anatomical accuracy (nodules in wrong positions, vessels disconnected); too high and the output becomes blurry (averaged over multiple plausible tissue configurations).

The paper does not report specific training hyperparameters for Pix2Pix (learning rate, batch size, optimizer, number of epochs, or the specific $\lambda$ value), noting that the implementation follows Mirsky et al. (2019) with architectural adaptation to 3D. The models are trained on the LIDC-IDRI dataset, with injection and removal models trained separately on appropriately composed input-output pairs.

Forensic trace characteristics. As a GAN, Pix2Pix is expected to leave specific forensic traces in the generated tissue. GAN generators typically contain upsampling layers (transposed convolutions or nearest-neighbor upsampling followed by convolution) that introduce characteristic spectral artifacts — peaks in the frequency domain at specific spatial frequencies corresponding to the upsampling factors. These artifacts arise from the uneven overlap of filter kernels during transposed convolution, producing a "checkerboard" pattern in the spatial domain that manifests as high-frequency peaks in the Fourier domain. Additionally, GANs may leave statistical fingerprints in the co-occurrence patterns of pixel intensities that differ from natural CT tissue. However, these traces may be subtle because the generator only modifies the inner 16mm cube, and the post-processing (rescaling, blending) may partially mask or distort them.

Generator 2: CycleGAN — Unpaired Cross-Domain Translation GAN

The second generator is a 3D adaptation of CycleGAN, originally proposed for unpaired image-to-image translation between two visual domains (Zhu et al., 2017). Unlike Pix2Pix, CycleGAN does not require paired training examples. Instead, it learns to translate between two sets of images — in this case, between the domain of masked CT cubes and the domain of full (unmasked) CT cubes — using a cycle consistency constraint.

Why unpaired translation? In the injection task, there is no naturally paired example of the exact same CT cube with and without a malignant nodule, because a given anatomical location in a patient either has a large nodule or doesn't. Pix2Pix requires such pairs, which must be synthesized artificially (e.g., by starting with a cube containing a large nodule, masking out the center, and using the original as ground truth). CycleGAN relaxes this requirement: it only needs a collection of masked cubes and a separate collection of unmasked cubes containing the desired output type (e.g., cubes with large malignant nodules for injection, or cubes with healthy tissue/small nodules for removal). The two collections need not be spatially aligned or from the same patients.

Architecture and training. The paper adapted a 3D CycleGAN implementation originally designed for MRI brain image translation between T1-weighted and T2-weighted contrasts (Iommi, GitHub repository). The adaptation involves:

Replacing 2D convolutions with 3D convolutions to handle the 32 × 32 × 32 input cubes.
Defining two generators: $G_{\text{masked} \to \text{full}}$ (maps from masked cubes to synthetic full cubes, used for both injection and removal depending on the target domain) and $F_{\text{full} \to \text{masked}}$ (maps from full cubes to synthetic masked cubes, used only for cycle consistency, not for manipulation).
Defining two discriminators: $D_{\text{full}}$ that distinguishes real full cubes from generated full cubes, and $D_{\text{masked}}$ that distinguishes real masked cubes from generated masked cubes.

The training objective combines three loss terms:

$L_{\text{CycleGAN}} = L_{\text{GAN}}(G, D_{\text{full}}) + L_{\text{GAN}}(F, D_{\text{masked}}) + \lambda \cdot L_{\text{cycle}}(G, F)$

where $L_{\text{GAN}}(G, D_{\text{full}})$ is the adversarial loss encouraging $G_{\text{masked} \to \text{full}}$ to produce full cubes indistinguishable from real full cubes, $L_{\text{GAN}}(F, D_{\text{masked}})$ is the adversarial loss for the reverse mapping, and $L_{\text{cycle}}$ is the cycle consistency loss:

$L_{\text{cycle}} = \mathbb{E}_{x \sim p_{\text{masked}}} \left[ || F(G(x)) - x ||_1 \right] + \mathbb{E}_{y \sim p_{\text{full}}} \left[ || G(F(y)) - y ||_1 \right]$

where $x$ is a masked cube from the masked domain and $y$ is a full cube from the full domain.

What the cycle consistency term computes: For any masked cube $x$ , we generate a full cube $G(x)$ , then generate a masked cube from it $F(G(x))$ , and measure the L1 distance between the original $x$ and the cycled-back $F(G(x))$ . The same is done in reverse for full cubes. The expectation $\mathbb{E}$ means this is averaged over all training samples. The result is two scalar penalties (one for each direction) that are summed and weighted by $\lambda$ .

Why this form: Without cycle consistency, the GAN losses alone could lead to mode collapse or meaningless translations — $G$ could learn to produce realistic-looking full cubes that have no relationship to the input masked cube (e.g., always generating the same generic nodule regardless of surrounding anatomy). The cycle loss enforces that the translation is invertible: the information about the specific anatomical context in $x$ must be preserved through the $G \to F$ cycle, or else $F(G(x))$ would differ from $x$ , incurring a penalty. This forces $G$ to produce outputs that are anatomically consistent with the specific masked input, not just domain-typical outputs. The L1 norm (rather than L2) is used for the same reason as in Pix2Pix: it encourages sharp, committed reconstructions rather than blurry averages.

Usage for manipulation. For injection, the paper uses $G_{\text{masked} \to \text{full}}$ where the "full" domain consists of cubes containing large malignant nodules (or enlarged benign nodules). A masked input (a cube with the central 16mm zeroed out, but with surrounding tissue showing a small benign nodule's context) is mapped to a synthetic full cube that should contain a large malignant nodule consistent with the surrounding anatomy. For removal, the "full" domain consists of cubes containing healthy lung tissue or small benign nodules. A masked input (with surrounding tissue showing a large malignant nodule's context) is mapped to a synthetic full cube where the nodule is replaced by appropriate non-malignant tissue. Two separate CycleGAN models are trained for injection and removal, each with its own target "full" domain.

The paper does not report specific CycleGAN hyperparameters (learning rate, batch size, $\lambda$ value, number of training epochs, optimizer).

Forensic trace characteristics. CycleGAN may leave different forensic traces than Pix2Pix despite both being GANs, because the training objective and architectural constraints differ. CycleGAN's reliance on cycle consistency rather than paired L1 supervision means that the generator may learn different feature representations. Additionally, the discriminator in CycleGAN operates on full cubes without conditioning on the input, which may cause the generator to produce traces that are optimized for overall domain realism rather than input-specific detail preservation. The cycle consistency loss itself may introduce artifacts — if the generators are not perfectly invertible, the reconstructed cubes after a full cycle may contain subtle inconsistencies (blurring, ghosting, structural distortions) that propagate into the generated tissue. These cycle-specific artifacts could provide a different forensic signature than the paired Pix2Pix.

Generator 3: Denoising Diffusion Probabilistic Model (DDPM) — Diffusion-Based Inpainting

The third generator represents the newer paradigm of diffusion-based generation, using a Denoising Diffusion Probabilistic Model (DDPM) as introduced by Ho et al. (2020) and extended to 3D medical images by Dorjsembe et al. (2022) and Kim and Ye (2022). Unlike GANs, which generate images in a single forward pass, diffusion models generate images through an iterative denoising process — starting from pure Gaussian noise and progressively refining it into a structured image by repeatedly applying a learned denoising function. The paper adapts this framework for conditional inpainting, where the generation is guided by the surrounding (unmasked) tissue.

Core diffusion idea. A diffusion model is defined by two processes:

Forward (diffusion) process: A clean image $x_0$ (the ground-truth 32 × 32 × 32 CT cube) is progressively corrupted by adding Gaussian noise over $T$ timesteps:

$x_t = \sqrt{\bar{\alpha}_t} \, x_0 + \sqrt{1 - \bar{\alpha}_t} \, \epsilon$

where $t \in \{1, 2, ..., T\}$ indexes the timestep, $x_t$ is the noisy image at timestep $t$ , $\epsilon \sim \mathcal{N}(0, I)$ is standard Gaussian noise, and $\bar{\alpha}_t$ is a decreasing sequence of values that controls the noise schedule (how quickly the image is corrupted). At $t = T$ , $x_T$ is essentially pure Gaussian noise. The paper uses $T = 2000$ timesteps with a linear noise schedule — a standard choice that provides sufficiently fine-grained denoising steps for high-quality generation.

Reverse (denoising) process: Starting from pure noise $x_T \sim \mathcal{N}(0, I)$ , a learned denoiser $\epsilon_\theta(x_t, t)$ (a neural network parameterized by $\theta$ ) is applied iteratively to remove the noise, producing progressively cleaner images $x_{T-1}, x_{T-2}, ..., x_0$ . At each timestep, the denoiser predicts the noise component that was added to produce $x_t$ , and this predicted noise is subtracted with appropriate scaling:

$x_{t-1} = \frac{1}{\sqrt{\alpha_t}} \left( x_t - \frac{1 - \alpha_t}{\sqrt{1 - \bar{\alpha}_t}} \epsilon_\theta(x_t, t) \right) + \sigma_t z$

where $\alpha_t = \bar{\alpha}_t / \bar{\alpha}_{t-1}$ controls the per-step noise reduction, $\sigma_t$ is a variance schedule parameter, and $z \sim \mathcal{N}(0, I)$ is random noise added for stochasticity (set to zero for deterministic DDIM sampling, but the paper uses standard DDPM with non-zero $z$ ). The term $\frac{1 - \alpha_t}{\sqrt{1 - \bar{\alpha}_t}} \epsilon_\theta(x_t, t)$ is the noise prediction scaled to match the forward process statistics.

Adaptation for 3D inpainting. The key modification for the inpainting task is that the denoiser must condition on the available (unmasked) context. The paper modifies the DDPM architecture by providing the denoiser with an additional input: the masked cube. Specifically, the denoiser $\epsilon_\theta$ receives both the current noisy estimate $x_t$ (a 32 × 32 × 32 volume) and the masked input cube (also 32 × 32 × 32, but with the inner 16mm zeroed out and the outer shell containing real tissue). These are concatenated channel-wise (producing a 2-channel input to the 3D U-Net), giving the denoiser direct access to the anatomical context at every denoising step.

The architectural backbone for the denoiser is a 3D U-Net, adapted from the 2D U-Net typically used in diffusion models (Ho et al., 2020) and following the 3D architecture used by Kim and Ye (2022) for cardiac image registration. The 3D U-Net consists of:

An encoder path with 3D convolutional layers and downsampling (via strided convolution or pooling) that progressively compresses the 32 × 32 × 32 input into a lower-resolution feature representation.
A bottleneck with self-attention or residual blocks operating at the coarsest resolution.
A decoder path with 3D convolutional layers and upsampling (via transposed convolution or interpolation + convolution) that expands back to 32 × 32 × 32.
Skip connections from encoder to decoder layers at each resolution level, preserving fine-grained spatial information.
Timestep conditioning: the current timestep $t$ is embedded via a sinusoidal positional encoding and fed into each residual block through a learned projection, allowing the denoiser to adapt its behavior based on how much noise remains.

The paper does not specify the exact U-Net depth, number of channels, or whether attention mechanisms are used at specific resolutions, citing the architecture as following Kim and Ye (2022).

Training procedure. The denoiser $\epsilon_\theta$ is trained to predict the noise $\epsilon$ that was added to a clean CT cube $x_0$ to produce $x_t$ at a random timestep $t$ , given the masked cube as conditioning. The training loss is:

$L_{\text{DDPM}} = \mathbb{E}_{x_0, \epsilon, t} \left[ || \epsilon - \epsilon_\theta(x_t, t, m) ||_2^2 \right]$

where $x_0$ is a clean full CT cube (from the training set, containing the desired output tissue for injection or removal), $\epsilon \sim \mathcal{N}(0, I)$ is the added noise, $t \sim \text{Uniform}(1, T)$ is a randomly sampled timestep, $x_t$ is the noisy cube constructed as $x_t = \sqrt{\bar{\alpha}_t} x_0 + \sqrt{1 - \bar{\alpha}_t} \epsilon$ , and $m$ is the masked cube (conditioning input). The expectation is over training samples, noise realizations, and timesteps.

What this loss computes: the mean squared error between the true noise vector $\epsilon$ (which was added to $x_0$ to create $x_t$ ) and the denoiser's prediction of that noise vector given the noisy image, the timestep, and the masked context. The loss is computed across all voxels of the 32 × 32 × 32 volume.

Why this form: The denoiser is learning to reverse the forward diffusion process. At timestep $t$ , given the noisy image $x_t$ and the known masked context $m$ , the denoiser must estimate how much of $x_t$ is noise versus signal, and specifically which component of the noise came from the forward process (as opposed to being part of the true signal). For the outer 16mm shell, the context $m$ provides the ground-truth tissue, so the denoiser learns to preserve these voxels and only denoise the noise that was added (effectively learning the identity mapping). For the inner 16mm cube, the context provides surrounding anatomical cues, and the denoiser learns to generate tissue consistent with these cues — effectively learning a conditional generative model. The MSE loss on noise prediction is equivalent to optimizing a variational lower bound on the data likelihood under the diffusion model, and is the standard training objective for DDPMs (Ho et al., 2020). It works because predicting the noise is a simpler task than predicting the clean image directly — the noise is isotropic Gaussian, making the target distribution simple, while the clean image distribution is complex and multi-modal.

Why diffusion instead of a GAN for this task? Diffusion models have several properties that make them attractive for medical image inpainting. They typically produce higher-quality samples with better mode coverage (less mode collapse) than GANs, which is important for generating diverse but anatomically plausible tissue. The iterative denoising process provides a natural mechanism for incorporating conditioning at every step — the masked context guides the denoising trajectory, ensuring the generated tissue remains consistent with the surrounding anatomy throughout the generation process, not just at the final output. Diffusion models are also generally more stable to train than GANs, avoiding issues like discriminator-generator imbalance and mode collapse. The tradeoff is generation speed: a diffusion model requires $T = 2000$ forward passes through the denoiser to generate one cube, versus one forward pass for a GAN. However, for dataset creation (where images are generated offline, once), this speed penalty is acceptable, and there exist accelerated sampling techniques (DDIM, progressive distillation) that could reduce this cost in future work.

Forensic trace characteristics. Diffusion models are known to leave different forensic traces than GANs (Corvi et al., 2023). GANs tend to introduce spectral peaks at specific frequencies due to upsampling operations in the generator. Diffusion models, by contrast, do not contain upsampling layers in the generative process (the U-Net denoiser operates at a fixed resolution and the image size never changes during denoising). Instead, diffusion models may leave traces related to the iterative denoising procedure: subtle correlations between voxels that arise from the repeated application of the same denoiser across timesteps, or statistical deviations in the final noise residual (the difference between $x_0$ and the final denoised output) that differ from natural CT noise characteristics. The 2000-step linear schedule used in this paper is a relatively standard choice; different schedules or fewer steps would produce different trace patterns.

The paper notes that "with respect to [12, 13] we modify the architecture by providing the denoiser with an additional input set to the masked cube" (Section 2.1). This conditioning approach (channel-wise concatenation of the masked cube with the noisy input) is a standard technique from the image inpainting literature (e.g., RePaint, Lugmayr et al., 2022) and ensures the denoiser always has access to the known tissue, so that the denoising process never corrupts the conditioning context.

Dataset Composition and Organization

The M3Dsynth dataset consists of 8,577 manipulated 3D CT scans, generated by applying the manipulation pipeline with each of the three generators to the pristine CT scans from the LIDC-IDRI dataset. The distribution across generators and manipulation types is detailed in Table 1.

Generator-specific counts:

Pix2Pix (CT-GAN): 2,009 injection images + 509 removal images = 2,518 total
CycleGAN: 2,220 injection images + 1,016 removal images = 3,236 total
DDPM (Diffusion Model): 2,009 injection images + 814 removal images = 2,823 total

The unequal distribution reflects several factors. First, injection is substantially more common than removal because there are more small (benign) nodules available as injection targets than there are large (malignant) nodules available as removal targets in the LIDC-IDRI dataset. The LIDC-IDRI dataset annotates all detected nodules regardless of malignancy suspicion; small benign nodules far outnumber large malignant ones in a typical screening population. Second, the exact numbers depend on training dynamics: a generator can only be used for a specific manipulation task after it has been successfully trained for that task, and the training success rate may vary across architectures and tasks. The Pix2Pix removal count (509) is notably lower than CycleGAN (1,016) and DDPM (814), possibly because Pix2Pix requires carefully curated paired training data for removal (which is harder to construct when the goal is to "un-generate" a nodule).

Manipulation type totals: 6,238 injection images (73% of the dataset) and 2,339 removal images (27%). This imbalance reflects the clinical reality — there are more opportunities for injection (enlarging existing small nodules or creating new ones near existing ones) than for removal (shrinking existing large nodules). However, this imbalance should be considered when training forensic detectors: a detector trained naively on this dataset might become biased toward detecting injections and underperform on removals. The paper does not explicitly address this class imbalance in the training protocol, leaving it as a consideration for future detector development.

Multiple manipulations per patient. A single pristine CT scan can generate multiple manipulated images by injecting and removing nodules at different locations. The LIDC-IDRI dataset contains 1018 scans from 1010 patients, with each scan containing multiple annotated nodules (the paper does not report the exact average, but the LIDC-IDRI dataset typically contains 2–5 nodules per scan). This means that from one scan, one could produce several injection images (targeting different small nodules) and several removal images (targeting different large nodules), each possibly generated by multiple generators. The 8,577 manipulated images therefore come from fewer than 1018 unique source scans (each scan contributes multiple manipulations).

Per-patient data split. To prevent data leakage — where a detector could memorize a specific patient's anatomy rather than learning forensic traces — the data are split on a per-patient basis. The paper specifies: "488 patients for training, 100 for validation and 150 more for testing" (Section 3). This means that all manipulations (regardless of generator or manipulation type) derived from Patient X's scans are placed entirely in one split (train, validation, or test), never split across them. This is a stronger guarantee than splitting at the image level — if images from the same patient appeared in both training and test, a detector could potentially recognize the patient's specific anatomical features (unique vessel branching patterns, scar tissue, lung shape) and use this as a shortcut to detect manipulations, rather than learning general forensic traces. The per-patient split forces the detector to generalize to unseen patients, which is the clinically relevant scenario.

The split sizes (488 train / 100 val / 150 test) sum to 738 patients, which is less than the 1010 patients in LIDC-IDRI. The paper does not specify why 272 patients are unused, but possible reasons include: withholding patients with insufficient nodules for manipulation, excluding scans with artifacts or poor image quality, or reserving patients for generator training (the generators themselves need training data, which must be separate from the forensic detector evaluation data to avoid circularity).

Difficulty estimation via diagnostic tool evaluation. To verify that the manipulated images are clinically convincing, the paper applies an automated diagnostic tool — the 3D Deep Leaky Noisy-OR Network proposed by Liao et al. (2019) — to the manipulated images. This tool consists of a detection network (to find nodules) and a classification network (to score each detected nodule for malignancy likelihood). The paper uses only the classification network, applied at the known position where the nodule was injected or removed. This evaluates whether the manipulation successfully fooled the malignancy classifier, not whether the nodule was detected (the position is given).

The classification network outputs a malignancy score in an unspecified range (likely [0, 1] or an unnormalized logit). The paper visualizes the histograms of these scores in Figure 3:

Top panel (pristine): The histogram for benign nodules (blue) is concentrated at lower scores, while malignant nodules (red) show higher scores. The distributions overlap partially, reflecting that malignancy prediction from CT appearance alone is imperfect (some benign nodules look suspicious and vice versa). However, the separation is clear enough that the tool would classify most malignant nodules as higher risk.
Bottom panel (manipulated): After manipulation, the histogram for removed/shrunken nodules (red) shifts to the left, now matching the distribution that benign nodules had in the pristine case. Conversely, the histogram for injected/enlarged nodules shifts to the right, matching the distribution that malignant nodules had in the pristine case. The two histograms have "exchanging roles" (Section 2.2) — the diagnostic tool now sees the injected nodules as equivalently malignant to real malignant nodules, and the removed nodules as equivalently benign to real benign nodules.

Implications of the diagnostic tool analysis. This analysis serves three purposes. First, it validates the quality of the generated manipulations: if the synthetic tissue were unrealistic, the diagnostic tool (a deep network trained on real CT data) would likely assign anomalous scores — either confidently wrong or uncertain (near 0.5). The clear separation in the post-manipulation histograms confirms that the generated nodules are realistic enough to elicit the expected diagnostic response. Second, it establishes that the threat is real: an automated diagnostic pipeline would be fooled by these manipulations, potentially leading to misdiagnosis if no human expert double-checks the flagged nodules. Third, it provides an implicit difficulty calibration for forensic detectors: a forensic detector that can catch manipulations that fool a diagnostic tool is solving a harder problem than the diagnostic tool (detecting synthetic origin rather than classifying malignancy), and success on this dataset is therefore a meaningful benchmark.

Forensic Detector Architectures

The paper benchmarks six state-of-the-art forensic detectors, selected for their ability to perform both detection (binary: tampered or pristine) and localization (pixel-level: where was the manipulation). All detectors are deep learning-based and are fine-tuned on M3Dsynth rather than trained from scratch, except where pre-trained weights are unavailable. The detectors span different architectural paradigms — from generic CNNs to specialized forensic networks with noise-sensitive features.

Xception (Chollet, 2017). Xception is a generic deep CNN that uses depthwise separable convolutions — factoring a standard convolution into a depthwise convolution (spatial filtering applied independently to each channel) followed by a pointwise convolution (1×1×1 convolution mixing across channels). This factorization reduces parameters and computation while maintaining representational capacity. Xception was originally designed for ImageNet classification but has become a standard backbone for deepfake detection (Rossler et al., 2019) because its efficient architecture allows training deep networks (71 layers in the original) without overfitting on medium-sized forensic datasets.

For the M3Dsynth benchmark, Xception is used for detection only, not localization. The paper reports detection metrics (Accuracy and Pd@1%) for Xception but not localization metrics (F1, IoU). This is noted in Table 3, where Xception rows are separated from the localization methods and labeled with "Acc / Pd@1%". The network is adapted to 3D by processing CT scans slice-by-slice: each 2D axial slice is passed through Xception independently, producing a per-slice tampering score. The maximum score across all slices of a scan is used as the scan-level detection score. The per-slice scores could theoretically be assembled into a coarse 2D localization map (along the axial dimension), but the paper does not evaluate this.

U-Net (Ronneberger et al., 2015). U-Net is the canonical biomedical image segmentation architecture, consisting of an encoder-decoder with skip connections. The encoder progressively downsamples the input (capturing context), while the decoder upsamples back to the original resolution (enabling precise localization). Skip connections concatenate encoder feature maps to decoder feature maps at each resolution, providing the decoder with fine-grained spatial information that might be lost through the bottleneck.

For M3Dsynth, U-Net is adapted to perform binary segmentation of tampered versus pristine voxels: the input is a full 3D CT volume (or sub-volume), and the output is a 3D map of the same spatial dimensions where each voxel is classified as tampered (1) or pristine (0). The network is trained with focal loss for localization (the paper mentions "focal loss for localization" in Section 3). U-Net serves as a baseline localization method — if U-Net works well, the task is relatively easy; if U-Net struggles (as it does in Table 3, with F1 of 35.5–57.7% on aligned data), the task is challenging and benefits from specialized forensic architectures.

HP-FCN (Li and Huang, 2019). HP-FCN (High-Pass Fully Convolutional Network) is a forensic localization method specifically designed to detect deep inpainting in natural images. Its key architectural feature is a high-pass pre-filtering layer applied to the input before the main network. This layer is a fixed (non-learned) convolutional filter that extracts high-frequency residuals — essentially computing local differences that suppress smooth regions and emphasize edges and textures. The motivation is that inpainting artifacts are often subtle in the pixel domain but more visible in high-frequency components (e.g., blurring at inpainting boundaries, inconsistent texture statistics in filled regions).

For M3Dsynth, HP-FCN is applied slice-by-slice to 2D axial slices extracted from the 3D CT volume, or possibly adapted to 3D convolutions (the paper is ambiguous on whether 3D adaptations were made). The high-pass filter should emphasize the boundary between the synthetic 16mm inner cube and the real outer tissue, where blending artifacts might manifest as unusual high-frequency patterns. The network produces a 2D localization map per slice, which is stacked to form a 3D localization map.

ManTraNet (Wu et al., 2019). ManTraNet (Manipulation Tracing Network) is a comprehensive forensic network designed to detect and localize a wide variety of image manipulations. Its architecture has three distinct stages:

Feature extraction: A feature extractor (based on VGG or similar) processes the input image to produce feature maps at multiple scales.
Anomaly detection with LSTM: A Long Short-Term Memory (LSTM) module processes the feature maps to assess local anomalies. The LSTM treats the image as a sequence of patches (in raster-scan order) and learns to identify patches that deviate from the statistical patterns of the surrounding patches. This is motivated by the observation that manipulations create local inconsistencies — a spliced object may have different noise characteristics or compression history than the background, and an LSTM can detect these discontinuities.
Self-supervised pre-training: ManTraNet is pre-trained on a dataset of 385 different image manipulation operations (including various types of blurring, noising, JPEG compression, resampling, and splicing), learning a general notion of "manipulation" from these diverse examples. This pre-training is meant to make the network sensitive to a broad range of forensic traces rather than overfitting to a specific manipulation type.

For M3Dsynth, ManTraNet is fine-tuned on the 3D CT data, adapting its 2D architecture to process volumetric data slice-by-slice (or potentially with 3D convolutions in the feature extractor). The network produces both a localization map (per-voxel tampering probability) and a global detection score (the maximum or average of the localization map). The LSTM-based anomaly detection is particularly relevant for M3Dsynth because the manipulation is inherently local — only the 16mm inner cube is synthetic, surrounded by real tissue — creating a spatial discontinuity that the LSTM might detect.

MVSS-Net (Chen et al., 2021). MVSS-Net (Multi-View Multi-Scale Supervision Network) is a recent image forgery localization and detection network with two key design features:

Multi-scale modules: The network processes the input at multiple resolutions (through a feature pyramid or multi-branch architecture), capturing both fine-grained details (small-scale artifacts at the manipulation boundary) and global context (larger-scale inconsistencies).
Two-branch architecture: One branch processes the RGB (intensity) data, learning to detect semantic inconsistencies (objects that don't belong, unnatural textures). A second branch processes noise residuals — typically extracted via a learned or fixed high-pass filter (similar to HP-FCN's approach) — learning to detect inconsistencies in noise patterns. The two branches are fused to produce the final localization map and detection score.

For M3Dsynth, the "RGB" branch would process the CT Hounsfield Unit values (the grayscale intensity representing tissue density), while the noise branch would process the noise residuals of the CT scan — variations that might reflect acquisition noise, reconstruction artifacts, or generator-specific noise patterns. The multi-scale design should help localize the 16mm manipulated region (which is relatively small compared to the full CT scan) while the noise branch should capture the forensic traces left by the generative models. The network produces both a localization map and a detection score (the paper reports both localization and detection metrics for MVSS-Net in Table 3).

TruFor (Guillaro et al., 2023). TruFor is a transformer-based forensic network that represents the state-of-the-art in image forgery detection and localization at the time of the paper. Its architecture combines:

RGB stream: A transformer backbone (likely a Vision Transformer, ViT, or Swin Transformer) processes the image patches, using self-attention to capture long-range dependencies and global context. Transformers are well-suited for forensic tasks because manipulations often create inconsistencies that span the entire image — a transformer can compare a suspicious region with distant parts of the image to detect anomalies.
Noise-sensitive fingerprint stream: In parallel, a learned noise extractor (a compact CNN or fixed filter) produces a noise residual map from the input, and a separate transformer stream processes this noise map. The noise fingerprint is designed to capture the "camera/model fingerprint" — subtle, invisible patterns that are characteristic of the source device or generator. Real CT scans would carry the fingerprint of the CT scanner; synthetic tissue would carry the fingerprint of the generator, creating a mismatch.
Fusion and detection head: The outputs of the two streams are fused (concatenated, added, or cross-attended) and passed through a detection head that produces both a per-pixel localization map and a global confidence score. The global score can be thresholded for detection decisions.

For M3Dsynth, TruFor's noise fingerprint stream is theoretically well-motivated because CT scanners and generative models have fundamentally different noise characteristics. CT noise is quantum noise from X-ray photon statistics, which follows a Poisson distribution (approximately Gaussian at typical dose levels) and is spatially correlated by the reconstruction algorithm (typically filtered back-projection or iterative reconstruction). GAN and diffusion model generators have learned noise patterns that may differ from true CT noise in their spatial correlation structure, frequency spectrum, or intensity distribution. The transformer architecture's ability to compare patches across the entire volume should help detect the transition zone where these noise characteristics change — i.e., the boundary of the manipulated 16mm cube.

Training and Evaluation Protocol

All detectors are fine-tuned on M3Dsynth rather than trained from scratch. The paper explicitly states: "Some preliminary experiments have shown that all these methods trained on the original datasets provide unsatisfactory results both for localization and detection on M3Dsynth, hence in the following we fine-tune on our medical data" (Section 3). This means the networks start from weights pre-trained on their respective original datasets (natural images for most, 385 manipulation types for ManTraNet) and are then further trained on M3Dsynth's CT images.

Why fine-tuning rather than from-scratch training? The forensic detectors were designed for natural images and pre-trained on large natural image datasets (ImageNet, COCO, or forensic-specific datasets like FaceForensics++). CT scans are domain-shifted from natural images in almost every respect: they are grayscale instead of RGB, they represent X-ray attenuation rather than visible light reflectance, they lack natural image statistics (texture, color distributions, object shapes), and they are 3D volumes rather than 2D images. Training from scratch on the modestly-sized M3Dsynth training set (488 patients, producing some thousands of image cubes) would likely result in poor feature learning — the networks would overfit to the training data before learning general forensic features. Fine-tuning transfers the low-level feature extraction capabilities (edge detection, texture analysis, anomaly detection) learned from natural images, while adapting the higher-level representations to CT-specific forensic traces through additional training.

Loss functions. The paper specifies the loss functions used for training (Section 3):

For localization: Focal loss. The focal loss (Lin et al., 2017) is a modification of the standard binary cross-entropy loss that down-weights the loss contribution from well-classified examples:

$L_{\text{focal}} = -\alpha_t (1 - p_t)^\gamma \log(p_t)$

where $p_t$ is the model's predicted probability for the true class (tampered or pristine) at a given voxel, $\alpha_t$ is a class-balancing weight (to address the imbalance between tampered and pristine voxels, since the manipulated region is only the 16mm inner cube — a small fraction of the total volume), and $\gamma$ (typically $\gamma = 2$ ) is the focusing parameter that reduces the loss for easy examples (where $p_t$ is close to 1).

What it computes: For each voxel in the 32 × 32 × 32 localization map, the loss compares the predicted tampering probability to the ground-truth binary label (1 if the voxel is within the manipulated 16mm inner cube, 0 otherwise). Voxels that are correctly classified with high confidence ( $p_t \approx 1$ ) contribute very little to the loss (the $(1 - p_t)^\gamma$ factor is near zero), while voxels that are misclassified or uncertain contribute significantly.

Why focal loss: In the M3Dsynth task, the tampered region occupies only (16/32)^3 = 1/8 of the volume (12.5% of voxels are tampered, 87.5% are pristine). With standard binary cross-entropy, the model could achieve low loss simply by predicting "pristine" everywhere, because the 87.5% of pristine voxels dominate the loss. Focal loss counteracts this by (a) using class weights $\alpha_t$ to up-weight the underrepresented tampered class, and (b) reducing the loss for easily classified pristine voxels (far from the manipulation boundary) so the model focuses on the challenging transition zone and the synthetic interior. This is standard practice for imbalanced segmentation tasks and was presumably important for achieving the reported localization performance.

For detection: Binary cross-entropy loss. The detection head (present in some architectures like MVSS-Net, ManTraNet, and TruFor) produces a single scalar probability that the entire scan (or sub-volume) has been tampered. This is trained with standard binary cross-entropy against the binary ground-truth label (tampered or pristine).
For methods that perform both tasks: The paper states that their "combination when both tasks are performed" is used (Section 3). This typically means a weighted sum of the focal loss (localization) and binary cross-entropy loss (detection), where the weight balances the two objectives. The specific weight is not reported.

Detection decision and the 0.5 threshold. For the Accuracy metric, detection decisions are made by "comparing the maximum detection score obtained over all slices of an image with the fixed 0.5 threshold" (Section 3). This means:

The detector processes each 2D slice (or 3D sub-volume) of the CT scan and produces a per-slice tampering score.
The maximum of these per-slice scores is taken as the scan-level score — if any slice looks tampered, the entire scan is flagged.
If the maximum score exceeds 0.5, the scan is classified as manipulated; otherwise, pristine.

Why maximum pooling? The manipulation is local (affecting only a few slices — the 32mm cube corresponds to approximately 32–64 slices depending on slice thickness, out of a total scan thickness of 300–500mm containing hundreds of slices). Maximum pooling ensures that a strong local signal (high tampering score on the slices intersecting the manipulated region) is not diluted by low scores on the majority of pristine slices. Alternative approaches (mean pooling, median pooling) would require a larger fraction of the scan to be manipulated before the scan-level score exceeds the detection threshold, which would miss the local manipulations in M3Dsynth.

The paper acknowledges that the fixed 0.5 threshold may be suboptimal for some detectors: "Several methods provide dismaying results, close to 50%, but these may be also due to the fixed choice of the threshold, and could be improved through calibration" (Section 3). A mis-calibrated detector might produce accurate relative rankings (high scores for tampered, low scores for pristine) but with scores clustered in the wrong range (e.g., all scores between 0.3 and 0.7, making the 0.5 threshold unreliable). This motivates the Pd@1% metric, which is threshold-independent.

Pd@1%: Threshold-free detection evaluation. The Probability of Detection at 1% False Alarm Rate (Pd@1%) metric avoids the fixed-threshold problem by calibrating the threshold on pristine-only data:

Collect the detection scores for all pristine validation images.
Set the decision threshold such that exactly 1% of these pristine images are falsely classified as tampered (i.e., 1% false positive rate).
Apply this threshold to the test images and compute the fraction of tampered images that are correctly detected (true positive rate, or probability of detection).

Why Pd@1% is the clinically relevant metric. In a real-world deployment, the vast majority of CT scans are pristine — the manipulation attack is rare. A detector that falsely flags 10% of pristine scans (10% false positive rate) would generate an unmanageable number of false alarms in a hospital processing thousands of scans per day, causing alarm fatigue and likely being ignored. The 1% false alarm rate is a strict but practical constraint: it means that out of 1,000 pristine scans, only 10 would trigger an alert requiring manual review. The corresponding Pd@1% measures how many actual manipulations would be caught under this constraint. A high Pd@1% (e.g., 95–100%) means the detector catches almost all tampered scans while keeping false alarms rare — the ideal operating point for clinical deployment.

Cross-Generator Training and Testing Protocol

The core experimental design for benchmarking is the cross-generator evaluation: train a detector on images manipulated by one generator (e.g., Pix2Pix), and test it on images manipulated by all three generators (Pix2Pix, CycleGAN, and DDPM). This is repeated for each training generator, yielding a 3 × 3 matrix of results for each detector.

What this protocol measures. The diagonal entries (training and testing on the same generator, e.g., Pix2Pix → Pix2Pix) measure the detector's performance when it has been trained on exactly the type of manipulation it encounters at test time — the "aligned" scenario. The off-diagonal entries (e.g., training on Pix2Pix, testing on CycleGAN) measure cross-generator generalization: can the detector detect manipulations from a generator it has never seen examples of during training?

This is arguably the most important evaluation in the paper because it tests a realistic threat model. An adversary deploying the attack would choose a specific generation tool (perhaps a custom GAN or diffusion model not publicly available). The defender, developing a detection system, would have access to some known generators for training but cannot anticipate every possible tool the adversary might use. If detectors only work on the specific generator they were trained on, they provide no protection against novel attacks. If they generalize — detecting manipulations from unseen generators based on shared forensic properties — they are practically useful.

The forensic traces question. Cross-generator generalization probes a deep question about the nature of forensic traces. If GANs (Pix2Pix and CycleGAN) leave different traces than diffusion models (DDPM), and if Pix2Pix leaves different traces than CycleGAN (due to architectural and training differences), then a detector trained on Pix2Pix might learn Pix2Pix-specific artifacts and fail on CycleGAN or DDPM. But if there exist "universal" traces of synthetic generation — properties shared by all current generative models, perhaps related to the fact that they all learn to approximate the data distribution rather than capturing the true physical generation process — then cross-generator generalization should be possible. The paper's results in Table 3 suggest partial generalization: performance on off-diagonal entries is generally lower than on diagonal entries, but still substantially above chance level for several detectors, indicating that some forensic traces are shared across architectures while others are architecture-specific.

Training details by generator. The paper mentions: "When network weights are available, they are imported and fine-tuned on the proposed dataset." For the detection-only experiment in Table 2 (using Corvi et al.'s 2023 detector), the paper explicitly states "fine tuning on the proposed dataset" improved M3Dsynth accuracy from ~50% to >90%.

For the main benchmark (Table 3), the fine-tuning is performed separately for each training generator: the detector is fine-tuned on the Pix2Pix-manipulated training images (plus pristine images), then separately fine-tuned on the CycleGAN-manipulated images, then separately on the DDPM-manipulated images, producing three versions of each detector. Each version is tested on all three generators' test images.

Metrics computation. For localization, the paper reports:

F1 score: The harmonic mean of precision and recall at the voxel level. For each voxel in the localization map, the prediction is thresholded (presumably at 0.5) to produce a binary mask, and this mask is compared to the ground-truth binary mask (1 for tampered inner 16mm cube, 0 for pristine outer shell). F1 is computed as $2 \times (\text{precision} \times \text{recall}) / (\text{precision} + \text{recall})$ , averaged across all test images. A high F1 requires both that the detector identifies most tampered voxels (high recall) and that it does not falsely label many pristine voxels as tampered (high precision).
Intersection-over-Union (IoU): The Jaccard index between the predicted and ground-truth binary masks: $|\text{TP}| / (|\text{TP}| + |\text{FP}| + |\text{FN}|)$ where TP, FP, FN are true positive, false positive, and false negative voxels. IoU is a stricter metric than F1 because it penalizes both false positives and false negatives relative to the union of predicted and ground-truth regions, whereas F1 balances them harmonically. IoU is standard for segmentation evaluation.

Both metrics are averaged over all images of the same type (same training generator, same test generator). The paper reports them as "F1 / IoU" in Table 3, top panel.

For detection, the paper reports:

Accuracy: The (balanced) fraction of correct binary decisions using the fixed 0.5 threshold on the maximum slice score. The paper explicitly states "balanced" accuracy, which typically means the average of sensitivity (true positive rate) and specificity (true negative rate), computed to account for potential class imbalance between tampered and pristine test images. (The paper does not specify the pristine-to-tampered ratio in the test set, but given the per-patient split and multiple manipulations per patient, the test set likely contains more tampered than pristine images.)
Pd@1%: As described above, the detection rate at 1% false alarm rate calibrated on pristine-only data.

The paper reports these as "Acc / Pd@1%" in Table 3, bottom panel. For methods that produce localization maps but not explicit detection scores (U-Net, HP-FCN, ManTraNet, MVSS-Net, TruFor), the detection score is derived from the localization map — for ManTraNet and TruFor (which have explicit detection heads), the native detection score is used; for others, the "maximum detection score obtained over all slices" (Section 3) serves as the detection score.

Summary of Design Choices and Their Justifications

32mm outer / 16mm inner cube design: Provides sufficient conditioning context (16mm of real tissue surrounding the manipulation) while keeping the synthetic region large enough to contain clinically significant nodules (>10mm diameter). This spatial design, inherited from Mirsky et al. (2019), is validated by the diagnostic tool analysis: the generated tissue is anatomically consistent enough to fool the classifier.
Three architecturally diverse generators (conditional GAN, unpaired CycleGAN, diffusion model): Enables the first systematic study of cross-generator generalization in medical image forensics. The choice spans the three dominant generative paradigms, ensuring that detectors trained on M3Dsynth are evaluated against realistic variation in attack tools.
Pre-processing (rescaling, equalization) and post-processing (de-equalization, inverse rescaling, blending): Makes the manipulation pipeline scanner-agnostic and minimizes visual artifacts, creating realistic manipulations that challenge both human experts and forensic detectors. The equalization/de-equalization ensures that generator training is not confounded by scanner-specific intensity variations.
Per-patient data split: Prevents the detector from learning patient-specific anatomical features as a shortcut for tampering detection, ensuring that reported performance reflects genuine forensic trace detection rather than patient re-identification.
Fine-tuning rather than from-scratch training: Leverages the feature representations learned from large natural image datasets while adapting to the CT domain, avoiding overfitting on the modestly-sized M3Dsynth training set.
Focal loss for localization: Addresses the severe class imbalance (tampered voxels are only ~12.5% of the volume) by down-weighting easy negative examples, focusing training on the challenging boundary and interior of the manipulated region.
Pd@1% alongside Accuracy for detection: Pd@1% is the clinically relevant metric because it simulates real-world deployment where false alarms must be rare; Accuracy with a fixed 0.5 threshold measures raw discriminability but may be misleading for poorly calibrated detectors.
Cross-generator evaluation protocol: Directly tests the practical scenario where defenders train on known generators but must detect manipulations from unseen tools, probing whether forensic traces are architecture-specific or universal.

4. Key Insights and Innovations

Innovation 1: Defining Medical Image Forensics as a Cross-Generator Generalization Problem Rather Than a Single-Generator Detection Task

The dominant assumption in prior medical image tampering detection work — and indeed in large swaths of the deepfake detection literature more broadly — was that training and testing on the same generator's outputs constitutes a valid and sufficient evaluation. Mirsky et al. (2019) demonstrated the attack with CT-GAN (a single 3D conditional GAN). Solaiyappan and Wen (2022) and Sharafudeen and Chandra (2022) trained and tested detectors exclusively on this same generator's outputs. The implicit model was: find the forensic traces of this specific generator, and you've solved the detection problem.

M3Dsynth fundamentally reframes the problem by introducing generator identity as an experimental variable rather than a fixed property of the dataset. The paper constructs a 3 × 3 cross-generator evaluation matrix (Table 3) where detectors are trained on manipulations from one generator (Pix2Pix, CycleGAN, or DDPM) and tested on all three. This reframing changes the research question from "can we detect CT-GAN manipulations?" to "can we detect any AI-generated manipulation of lung CT scans, including from generators never seen during training?"

This is not an incremental dataset expansion — adding a few more images from the same generator paradigm. It is a conceptual shift in what the detection task means. The field's prior approach studied a static attack (one generator, one forensic signature), which is unrealistic: an adversary chooses their tool, and new generative models appear continuously. The cross-generator framework studies a dynamic threat where the defender must generalize across architectural paradigms (conditional GANs, unpaired GANs, diffusion models) that leave fundamentally different forensic traces — GAN upsampling artifacts versus diffusion iterative denoising residuals versus CycleGAN cycle-consistency signatures.

The empirical payoff of this reframing appears in Table 3. The diagonal entries (same-generator training and testing) show strong performance: TruFor achieves 89.9% F1 and 82.9% IoU on Pix2Pix → Pix2Pix, and 89.3% F1 and 82.0% IoU on DM → DM. But the off-diagonal entries are where the reframing proves its value. TruFor trained on Pix2Pix achieves 68.1% F1 and 55.5% IoU on CycleGAN — a meaningful drop from 89.9%/82.9%, but still far above random, demonstrating that cross-generator generalization is possible but imperfect. The 3 × 3 matrix quantifies how much generalization degrades when the training and test generators differ, providing a diagnostic tool that single-generator datasets simply cannot offer.

This reframing has downstream consequences for how the field should develop detectors. If cross-generator generalization is partial (as the results show), then the natural research direction is not to build better single-generator detectors, but to understand what shared properties across generators enable generalization — a question that only a multi-generator benchmark can pose.

Innovation 2: Establishing That General-Purpose Forensic Detectors Are Blind to Medical Image Manipulations Without Domain-Specific Fine-Tuning — But Highly Effective With It

The paper provides the first systematic evidence that the domain gap between natural photographs and medical CT scans is not merely an inconvenience for forensic detectors — it is a hard failure mode. The experiment in Table 2 is simple but diagnostically decisive: a detector (Corvi et al., 2023) that achieves 99.9% accuracy on ProGAN-generated general-purpose images and 100% on StyleGAN2 images collapses to ~50% accuracy — random guessing — when tested on M3Dsynth's CT images. This is not a modest performance drop; it is complete blindness. The detector, trained to recognize synthetic artifacts in natural images (faces, objects, scenes), has no representation of what constitutes "synthetic" in the CT domain.

This finding is significant because it challenges a plausible default assumption: that deep learning-based forensic methods, being data-driven rather than handcrafted, would automatically learn domain-invariant features that transfer across image types. The evidence says otherwise. The forensic traces that distinguish real from synthetic in natural photographs — spectral peaks from GAN upsampling, statistical deviations from natural image priors, inconsistencies in noise patterns characteristic of camera sensors — are either absent in CT scans or manifest in forms that the detector, trained only on natural images, cannot recognize.

Yet the paper's second move is equally important: this blindness is reversible through fine-tuning. After training on M3Dsynth, the same detector architecture achieves 99.5% on Pix2Pix, 98.5% on CycleGAN, and 97.3% on DM — restoring near-perfect detection. This establishes a clear operational recipe: general-purpose forensic architectures can work for medical images, but only if they are explicitly adapted to the medical domain through exposure to medical-specific synthesized data. The architectures are capable; the missing ingredient is domain-relevant training data.

This dual finding — failure without fine-tuning, success with it — has direct practical implications. A hospital or regulatory agency cannot simply deploy an off-the-shelf deepfake detector and expect it to catch CT tampering. They need a detector trained on medical-specific manipulations. M3Dsynth provides the training resource that makes such a detector possible, and the paper demonstrates that once that resource exists, building an effective detector is achievable with existing architectures. This converts a seemingly intractable problem (building medical-specific detectors from scratch, with limited data and domain expertise) into a manageable one (fine-tuning established forensic architectures on a curated medical manipulation dataset).

Innovation 3: Introducing Localization as a First-Class Requirement for Medical Image Forensics, and Showing It Is Achievable

Prior work on medical image tampering detection — the original Mirsky et al. (2019) attack paper, Solaiyappan and Wen (2022), and Sharafudeen and Chandra (2022) — treated the problem exclusively as binary detection: is this CT scan tampered or pristine? The paper argues, implicitly through its benchmark design, that detection alone is insufficient for clinical deployment. A radiologist confronted with a "tampered" alert on a 3D volume containing hundreds of slices and potentially millions of voxels has no actionable information — they must manually re-examine the entire scan to find the manipulation, undermining the efficiency gain of automated screening.

By including pixel-level localization as a core evaluation task alongside detection, the paper elevates localization from a nice-to-have to a necessary capability for practical medical forensics. The localization maps produced by the detectors (F1 scores up to 89.9%, IoU up to 82.9% for TruFor on aligned data) pinpoint the manipulated 16mm inner cube, directly telling the radiologist where to look. This transforms the detector from an alarm system into a diagnostic aid: it not only flags suspicious scans but directs attention to the specific anatomical region that has been altered, enabling efficient and targeted manual verification.

The benchmark results in Table 3 demonstrate that localization is achievable with existing architectures — it is not an aspirational future capability. TruFor, ManTraNet, and MVSS-Net all produce localization maps that substantially overlap with the ground-truth tampered region. U-Net, the baseline segmentation architecture, struggles (F1 35.5–57.7% on aligned data), suggesting that specialized forensic architectures (with noise-sensitive streams, anomaly detection modules, or transformer-based global context) provide meaningful advantages for the localization subtask beyond what a generic segmentation network can achieve.

The localization requirement also implicitly raises the bar for what counts as a successful forensic detector. A method that achieves 95% detection accuracy but localizes the manipulation to the wrong lobe of the lung would be worse than useless — it would misdirect clinical attention. By evaluating both tasks jointly, the benchmark prevents the field from optimizing a misleadingly simple metric (detection accuracy) at the expense of practical utility.

Innovation 4: Validating the Clinical Plausibility of Manipulations Through Diagnostic Tool Fooling, Establishing an Implicit Difficulty Calibration

The paper's use of the automated diagnostic tool (Liao et al., 2019) to evaluate manipulation quality goes beyond a simple sanity check. It establishes what amounts to an implicit difficulty calibration for the forensic detection task.

The logic is as follows. The diagnostic tool is a deep network trained to classify nodules as benign or malignant based on their CT appearance. It represents the state of the art in automated lung nodule assessment — the very system that, in a clinical pipeline, would flag suspicious nodules for radiologist review. If the manipulated images fool this tool (as Figure 3 demonstrates — the post-manipulation malignancy score histograms swap roles, with injected nodules receiving high scores matching real malignant nodules, and removed nodules receiving low scores matching real benign nodules), then the manipulations are not merely visually plausible to a casual observer. They are diagnostically convincing to the automated system that would make the initial triage decision in a modern AI-assisted radiology workflow.

This calibration matters because it establishes that the forensic detectors benchmarked on M3Dsynth are solving a harder problem than the diagnostic tool. The diagnostic tool asks: "given this nodule, is it malignant or benign?" The forensic detector asks: "given this nodule that looks convincingly malignant/benign, was it actually generated by an AI?" The forensic task is meta-diagnostic: it must see through a synthetic nodule that has already passed the diagnostic classifier's scrutiny. Success on this task — achieving Pd@1% near 100% with TruFor, ManTraNet, and MVSS-Net (Table 3, bottom) — means the forensic detectors are capturing signals that are invisible to the diagnostic network, likely subtle statistical or noise-level artifacts rather than semantic appearance features.

This implicit difficulty calibration also provides a meaningful performance floor. A forensic detector that merely matched the diagnostic tool's performance (i.e., that detected manipulations by noticing that injected nodules looked "too malignant" or removed nodules looked "too benign") would be trivially defeated by an adversary who calibrates their generator to produce nodules with realistic malignancy scores. The fact that the forensic detectors succeed despite the manipulations being diagnostically calibrated suggests they are leveraging genuinely orthogonal information — generator-specific forensic traces rather than semantic anomaly detection.

5. Experimental Analysis

Evaluation Methodology

Dataset. M3Dsynth, comprising 8,577 manipulated 3D lung CT scans generated from the LIDC-IDRI dataset (Armato et al., 2011, 1018 scans from 1010 patients) by injecting or removing lung cancer nodules using three generative models: Pix2Pix (2,518 images), CycleGAN (3,236 images), and DDPM (2,823 images). The data are split on a per-patient basis into 488 patients for training, 100 for validation, and 150 for testing, ensuring that manipulations derived from the same patient never appear across splits.
Base model(s). Six forensic detector architectures are evaluated: Xception (Chollet, 2017), a deep CNN using depthwise separable convolutions, applied slice-by-slice for detection only; U-Net (Ronneberger et al., 2015), the encoder-decoder segmentation network, adapted for binary voxel-level tampering classification; HP-FCN (Li and Huang, 2019), a fully convolutional network with a fixed high-pass pre-filtering layer designed to detect inpainting artifacts; ManTraNet (Wu et al., 2019), a manipulation tracing network combining a feature extractor with an LSTM-based anomaly detection module, pre-trained on 385 image manipulation operations; MVSS-Net (Chen et al., 2021), a multi-scale two-branch network processing both intensity data and noise residuals; and TruFor (Guillaro et al., 2023), a transformer-based network with parallel RGB and noise-sensitive fingerprint streams, representing the state-of-the-art at the time of writing. All detectors are fine-tuned on M3Dsynth rather than trained from scratch, starting from weights pre-trained on natural image datasets.
Metrics. Four metrics are reported across two tasks. For localization, F1 score (the harmonic mean of voxel-level precision and recall, computed by thresholding the predicted localization map at 0.5 and comparing to the ground-truth binary mask) and Intersection-over-Union (IoU, the Jaccard index between predicted and ground-truth tampering masks), both averaged across all test images of the same type. For detection, Accuracy (the balanced probability of correct binary decision, using a fixed threshold of 0.5 applied to the maximum detection score across all slices of a scan) and Pd@1% (Probability of Detection at 1% False Alarm Rate: the detection threshold is calibrated offline on pristine images to fix the false positive rate at 1%, and the corresponding true positive rate is measured on tampered images).
Baselines. Each detector fine-tuned on a single generator's manipulations is evaluated against the other two generators' manipulations — the aligned case (same generator for training and testing) serves as an upper-bound reference, while the off-diagonal comparisons measure generalization. No separate "prior work" baseline is established beyond the pre-fine-tuning performance (which the paper reports as "unsatisfactory" in preliminary experiments, without specific numbers, beyond the representative experiment in Table 2 where Corvi et al., 2023 achieves ~50% accuracy on M3Dsynth prior to fine-tuning, compared to >90% after).
Generation budget / compute accounting. Not applicable in the traditional sense — this is a detection and localization benchmark, not a generation-time compute scaling study. All generators produce images offline before detector training. The paper does report the total number of manipulated samples per generator (Table 1) and notes the computational cost implicitly: the DDPM generator requires 2,000 iterative denoising steps per sample, while GANs require a single forward pass, but this cost is borne during dataset construction only, not during detector inference.
Cross-validation / statistical protocol. The per-patient split (488/100/150) is fixed, not cross-validated — each detector is fine-tuned once on the training set and evaluated once on the test set. No confidence intervals, standard deviations, or statistical significance tests are reported for any metric in Table 3. The paper notes that "decisions are made by comparing the maximum detection score obtained over all slices of an image with the fixed 0.5 threshold" (Section 3) and acknowledges this threshold may be suboptimal, suggesting calibration could improve results, but does not perform calibration analysis beyond reporting Pd@1% as an alternative metric.

Main Quantitative Results

Detection on General-Purpose vs. Medical Images: The Domain Gap (Table 2)

The paper's initial experiment establishes the necessity of domain-specific training by testing a synthetic image detector (Corvi et al., 2023) both before and after fine-tuning on M3Dsynth. The detector, originally trained on general-purpose (G.P.) images, achieves near-perfect accuracy when tested on its own training domain: 99.9% on ProGAN images, 100% on StyleGAN2, and 100% on LDM. However, when tested on M3Dsynth images without fine-tuning, accuracy collapses to approximately 50% across all three generators: 50.0% on Pix2Pix, 50.4% on CycleGAN, and 44.6% on DM (Table 2, top). This is chance-level performance — the detector has no ability to distinguish pristine from manipulated CT scans.

After fine-tuning on M3Dsynth (training on images from all three generators simultaneously, not per-generator as in the main benchmark), accuracy on M3Dsynth images rises to 99.5% for Pix2Pix, 98.5% for CycleGAN, and 97.3% for DM (Table 2, bottom). Simultaneously, performance on G.P. images drops: accuracy on ProGAN falls from 99.9% to 50.5%, on StyleGAN2 from 100% to 49.0%, and on LDM remains at 50.7% (up slightly from 50.8%). This is the expected catastrophic forgetting effect — fine-tuning on medical images overwrites the representations learned for natural images.

The cross-domain generalization experiment in the bottom panel reveals an asymmetry: when fine-tuned on M3Dsynth, the detector shows moderate generalization to G.P. images of diffusion models (50.7% on LDM is essentially chance) but stronger generalization across M3Dsynth generators (95.8% when trained on Pix2Pix and tested on DM; 91.6% when trained on CycleGAN and tested on DM). This suggests that the forensic traces within the medical domain share common properties across generators that are distinct from traces in natural images, and that fine-tuning on one medical generator transfers reasonably well to other medical generators.

Cross-Generator Localization Performance (Table 3, Top)

The headline result for localization is that TruFor and ManTraNet achieve strong performance on aligned data (training and testing on the same generator) and retain meaningful — though degraded — performance on misaligned data (training on one generator, testing on another). The full 3 × 3 matrices in Table 3 (top panel) provide results for all five localization-capable detectors.

TruFor (Guillaro et al., 2023) is the strongest performer overall. On aligned data, TruFor achieves F1/IoU of 89.9%/82.9% (Pix2Pix → Pix2Pix), 88.2%/81.2% (CycleGAN → CycleGAN), and 89.3%/82.0% (DM → DM). These IoU values above 80% indicate that the predicted localization map substantially overlaps the ground-truth 16mm manipulated cube. On misaligned data, performance degrades but remains usable: training on Pix2Pix and testing on CycleGAN yields 68.1%/55.5%; training on Pix2Pix and testing on DM yields 68.0%/54.7%; training on DM and testing on Pix2Pix yields 84.4%/75.2%. The asymmetry is notable — training on DM generalizes better to Pix2Pix (84.4%/75.2%) than training on Pix2Pix generalizes to DM (68.0%/54.7%). Training on CycleGAN shows intermediate generalization: 63.6%/49.8% to Pix2Pix and 36.4%/24.6% to DM. The CycleGAN → DM performance drop (36.4% F1, 24.6% IoU) is the weakest off-diagonal entry for TruFor, suggesting that CycleGAN's forensic traces are least similar to DDPM's among the three generators.

ManTraNet (Wu et al., 2019) is the second-strongest localizer. On aligned data: 87.0%/79.1% (Pix2Pix), 85.5%/77.2% (CycleGAN), 87.2%/78.5% (DM). On misaligned data: Pix2Pix → DM yields 61.4%/45.5%; DM → Pix2Pix yields 83.2%/73.0%. The same asymmetry appears — DM-trained detectors transfer better to GAN-generated images than vice versa. ManTraNet's CycleGAN → DM generalization is poor (60.5%/47.4%), similar to TruFor's 36.4%/24.6% on the same pair, though ManTraNet's absolute numbers are higher.

MVSS-Net (Chen et al., 2021) performs comparably to ManTraNet on aligned data: 81.4%/70.4% (Pix2Pix), 86.2%/78.0% (CycleGAN), 84.9%/75.4% (DM). Its misaligned generalization follows the same pattern: DM → Pix2Pix (79.5%/68.5%) outperforms Pix2Pix → DM (56.8%/42.5%). The CycleGAN → DM gap is again the largest (55.1%/44.1%).

HP-FCN (Li and Huang, 2019) shows substantially weaker performance: aligned F1/IoU of 85.0%/75.3% (Pix2Pix), 84.5%/75.3% (CycleGAN), 84.9%/75.4% (DM) — competitive on-diagonal, but cross-generator generalization collapses. Pix2Pix → CycleGAN yields only 59.1%/43.4%; CycleGAN → DM yields 36.4%/24.6% — the worst off-diagonal entry in the entire localization table. HP-FCN's reliance on a fixed high-pass filter, designed for natural image inpainting artifacts, appears to capture generator-specific features that do not transfer well.

U-Net (Ronneberger et al., 2015) is the weakest localizer by a large margin. Aligned F1/IoU: 44.5%/30.7% (Pix2Pix), 57.5%/43.6% (CycleGAN), 57.7%/43.6% (DM). Misaligned performance is uniformly poor: Pix2Pix → DM drops to 35.5%/23.2%; DM → Pix2Pix reaches only 46.9%/33.3%. U-Net's failure is informative because it demonstrates that the forensic localization task is not trivially solvable by a generic segmentation architecture — the specialized forensic designs (noise streams, anomaly detection, transformer attention) provide essential advantages.

Generalization patterns. Across all detectors, three patterns emerge. First, the diagonal entries are uniformly the strongest, confirming that generator-specific traces exist and are learnable. Second, cross-generator generalization is asymmetric: detectors trained on DM generalize better to GAN-generated images than GAN-trained detectors generalize to DM. This suggests that the forensic traces left by diffusion models — perhaps related to the iterative denoising process — are more "universal" or overlap more with GAN traces than GAN traces overlap with diffusion traces. Third, the CycleGAN → DM transfer is consistently the weakest, possibly because CycleGAN's unpaired training and cycle-consistency objective produce a forensic signature that is most dissimilar to the other two generators.

Cross-Generator Detection Performance (Table 3, Bottom)

Detection performance is evaluated using Accuracy with a fixed 0.5 threshold and Pd@1%.

Accuracy (0.5 threshold). Results are notably worse and more variable than localization results. TruFor achieves 95.0% on Pix2Pix → Pix2Pix, 96.0% on CycleGAN → CycleGAN, and 94.9% on DM → DM. Cross-generator accuracy drops but remains well above chance: Pix2Pix → CycleGAN yields 95.8%, Pix2Pix → DM yields 94.3%, DM → Pix2Pix yields 95.0%. However, ManTraNet — which performed well on localization — shows alarmingly low detection accuracy: 52.7% on Pix2Pix → Pix2Pix, 56.6% on CycleGAN → CycleGAN, 52.8% on DM → DM. These values near 50% indicate the network is essentially guessing, despite producing reasonable localization maps. U-Net similarly shows ~52–60% accuracy across all conditions, and HP-FCN shows 59.8–71.4%. Xception, which does not produce localization maps, achieves 83.7% on Pix2Pix → Pix2Pix and 87.4% on CycleGAN → CycleGAN, but drops to 64.1% on DM → CycleGAN — the weakest off-diagonal for Xception. MVSS-Net shows moderate detection accuracy: 73.0% (Pix2Pix → Pix2Pix), 92.7% (CycleGAN → CycleGAN), 76.0% (DM → DM), with generalization following the now-familiar asymmetry (DM → Pix2Pix: 73.0%; Pix2Pix → DM: 75.4%).

The paper explicitly addresses these poor accuracy numbers: "Several methods provide dismaying results, close to 50%, but these may be also due to the fixed choice of the threshold, and could be improved through calibration" (Section 3). The finding that methods with strong localization (ManTraNet: 87.0% F1 aligned) can have near-chance detection (ManTraNet: 52.7% accuracy aligned) is a case study in why accuracy with a fixed threshold can be a misleading metric: the localization maps contain strong signal, but the maximum score across slices may cluster near 0.5, making the binary decision unreliable.

Pd@1% (calibrated threshold). The Pd@1% metric paints a dramatically different and more optimistic picture. Because the threshold is calibrated on pristine-only data to ensure 1% false positive rate, poorly calibrated detectors are rescued from the fixed-threshold problem. TruFor achieves near-perfect Pd@1%: 100% on Pix2Pix → Pix2Pix, 97.8% on Pix2Pix → CycleGAN, 97.0% on Pix2Pix → DM, 95.9% on DM → Pix2Pix, 99.4% on CycleGAN → CycleGAN, and 99.6% on DM → DM. The worst TruFor entry is 89.1% (DM → CycleGAN), which is still high.

MVSS-Net also shows strong Pd@1%: 95.8% (Pix2Pix → Pix2Pix), 97.2% (Pix2Pix → CycleGAN), 86.2% (Pix2Pix → DM), 91.2% (DM → Pix2Pix), 99.3% (CycleGAN → CycleGAN), 99.3% (DM → DM). The DM → CycleGAN and CycleGAN → DM transfers remain the weakest (67.4% and 98.0% respectively, with an anomalous asymmetry).

ManTraNet, which produced near-50% accuracy, achieves respectable Pd@1%: 100% on Pix2Pix → Pix2Pix, 99.9% on Pix2Pix → CycleGAN, 91.2% on Pix2Pix → DM, 99.9% on DM → Pix2Pix, 100% on CycleGAN → CycleGAN, 100% on DM → DM. The worst entry is 87.3% (DM → CycleGAN). This confirms the paper's hypothesis: ManTraNet's detection scores were poorly calibrated (scores for tampered and pristine images overlapped near 0.5), but when the threshold is set properly using calibration data, the underlying discriminability is strong.

Xception achieves strong Pd@1% across the board: 99.8% (Pix2Pix → Pix2Pix), 95.2% (Pix2Pix → CycleGAN), 80.3% (Pix2Pix → DM), 97.7% (DM → Pix2Pix), 99.2% (CycleGAN → CycleGAN), 96.9% (DM → DM). The lowest entry is 37.8% (DM → CycleGAN) — a notable failure case where the DM-trained Xception catches only about a third of CycleGAN manipulations at the strict 1% false alarm threshold.

HP-FCN is the only method that performs poorly even under Pd@1%: 45.6% (Pix2Pix → Pix2Pix), 50.8% (Pix2Pix → CycleGAN), 31.7% (Pix2Pix → DM), 45.4% (DM → Pix2Pix), 52.0% (CycleGAN → CycleGAN), 33.6% (DM → DM). These values are far below the other detectors, and the aligned performance (45.6–52.0%) is barely above chance for a binary detector (50%). HP-FCN's high-pass filter, designed for 2D natural image inpainting, appears fundamentally unsuited to the 3D CT domain, regardless of calibration.

Ablation Studies and Robustness Checks

Fine-tuning vs. no fine-tuning for general-purpose detectors (Table 2): The most impactful ablation — though it involves a different detector than those in the main benchmark — demonstrates that without fine-tuning, a detector achieving ~100% accuracy on natural synthetic images performs at chance level (~50%) on medical CT manipulations. After fine-tuning on M3Dsynth, accuracy on medical images rises to 91.6–99.5% depending on the generator, while natural image performance drops to near chance. This establishes that domain adaptation through fine-tuning is both necessary and effective, and that catastrophic forgetting of the source domain is the tradeoff.

Cross-generator generalization within M3Dsynth (Table 3, all entries): The 3 × 3 matrices themselves constitute a systematic ablation of the training generator's identity. The consistent finding — that DM-trained detectors generalize better to GAN images than vice versa, and that CycleGAN → DM is the weakest transfer direction — is replicated across multiple detector architectures (TruFor, ManTraNet, MVSS-Net, HP-FCN for localization; Xception, TruFor, MVSS-Net for Pd@1% detection). This pattern is unlikely to be an artifact of a single architecture and likely reflects genuine differences in the forensic trace distributions.

Localization vs. detection task difficulty for the same architecture (Table 3, top vs. bottom): A cross-task comparison reveals that some architectures (ManTraNet: 87.0% F1 vs. 52.7% accuracy on aligned Pix2Pix; U-Net: 44.5% F1 vs. 52.9% accuracy) can produce meaningful localization maps while failing at detection under a fixed threshold. However, when detection is evaluated under Pd@1%, the divergence largely disappears for most methods (ManTraNet reaches 100% Pd@1% on Pix2Pix), confirming that the detection failure was a calibration issue rather than a fundamental inability to discriminate. HP-FCN is the exception — its Pd@1% remains poor (45.6% aligned), indicating genuine discriminative weakness.

Architectural components as implicit ablations: While the paper does not run formal ablation studies removing specific architectural components, the suite of six detectors spans a range of design choices, and performance differences are informative. The high-pass filter in HP-FCN is present in some form in MVSS-Net's noise branch, yet MVSS-Net vastly outperforms HP-FCN on both localization and detection, suggesting that the high-pass filter alone is insufficient — the multi-scale, multi-branch design with learned noise extraction is critical. The transformer backbone in TruFor is not ablated against a CNN equivalent (TruFor is the only transformer in the suite), but TruFor's consistent top performance suggests transformers provide advantages for this task, possibly through their ability to model long-range dependencies that help detect the boundary between synthetic and real tissue. The LSTM anomaly detection module in ManTraNet is not ablated against a simpler global pooling or fully-connected detection head, but ManTraNet's strong localization and Pd@1% (despite poor fixed-threshold accuracy) suggests the module is effective at identifying local anomalies, even if the score magnitudes are miscalibrated.

3D vs. slice-by-slice processing: The paper does not explicitly ablate 2D vs. 3D processing. Most detectors (Xception, HP-FCN, likely ManTraNet and MVSS-Net in their original forms) operate slice-by-slice on 2D axial slices, stacking results to form a 3D localization map. TruFor's architecture description mentions processing the full volume, but whether this means true 3D convolutions or slice-wise processing with 3D context is unclear. U-Net, being originally designed for 3D biomedical segmentation, likely uses 3D convolutions, yet it performs the worst. This is a non-obvious result: 3D processing does not automatically confer an advantage for this task, and the forensic trace properties (which may be slice-independent or have weak inter-slice correlations) may be equally detectable from 2D slices. However, without a controlled ablation (training the same architecture with 2D vs. 3D convolutions), this remains speculative.

Missing ablations. Several experiments that would substantially strengthen the paper are not performed. There is no ablation of the number of training samples — it is unclear whether 8,577 total images (with ~5,700 in the training set after per-patient splitting) is near the saturation point for detector performance, or whether more data would yield further improvements. There is no ablation of manipulation type: all experiments train and test on a mix of injections and removals, without separating performance by manipulation type to see if injections (73% of the dataset) are easier or harder to detect than removals. There is no ablation of nodule size or visual impact: the paper notes that nodules are "enlarged" or "reduced" rather than created/removed entirely to "reduce the visual impact of manipulations," but does not test whether detectors perform worse on these subtle manipulations compared to more obvious ones (e.g., creating large nodules from scratch in healthy tissue). And there is no ablation of the blending post-processing step: the "touch-up to improve blending" mentioned in Figure 2 could be ablating by testing detectors on pre-blended vs. post-blended images to determine whether blending masks or preserves forensic traces.

Critical Assessment

Does the paper demonstrate that M3Dsynth enables training detectors that generalize across generators?

Yes, with important qualifications. The 3 × 3 cross-generator matrices in Table 3 clearly demonstrate that detectors fine-tuned on one generator can detect manipulations from the other two at levels substantially above chance. TruFor's Pd@1% on misaligned pairs ranges from 89.1% to 100%, and localization F1 scores on misaligned pairs range from 36.4% to 84.4% depending on the specific generator pair. This is genuine cross-generator generalization — the detectors are not merely memorizing the training generator's specific artifacts.

However, the generalization is imperfect and highly asymmetric. Training on Pix2Pix and testing on CycleGAN yields much lower localization IoU (55.5% for TruFor) than the aligned case (82.9%). The CycleGAN → DM transfer is consistently weak (24.6% IoU for TruFor, 47.4% for ManTraNet, 44.1% for MVSS-Net). This means that a defender who trains only on CycleGAN data and faces an adversary using a diffusion model would have substantially degraded detection capability. The paper presents this honestly — the off-diagonal entries show the degradation — but the claim of "good generalization ability" in the abstract should be understood as "generalization well above chance," not "generalization matching within-distribution performance." The practical implication is that a robust deployment would need to train on multiple generators (ideally spanning different architectural paradigms) to ensure coverage, which M3Dsynth enables but the paper does not explicitly test (training on all three generators simultaneously, except in the Table 2 experiment with a different detector).

Does the paper establish that the manipulated images fool automated diagnostic tools?

Yes, but only partially. Figure 3 shows that the Liao et al. (2019) classification network's malignancy score distributions for benign and malignant nodules swap roles after manipulation — injected nodules receive scores matching real malignant nodules, and removed nodules receive scores matching real benign nodules. This is compelling evidence that the manipulations are diagnostically convincing to this specific automated tool. However, two limitations apply. First, the paper only tests one diagnostic tool (Liao et al., 2019). Different tools with different architectures and training data might respond differently, and a tool trained adversarially against such manipulations might be more robust. Second, the paper does not test fooling of human experts — the claim in the introduction that manipulated images "can easily fool automated cancer detectors and even medical experts" cites Mirsky et al. (2019) for the human expert portion, not this paper's own experiments. M3Dsynth does not include a radiologist reader study, which would be the gold standard for clinical plausibility. The diagnostic tool analysis is a reasonable proxy — if a state-of-the-art deep learning classifier is fooled, the manipulations are not trivially detectable — but it does not fully close the loop on clinical impact.

Does the paper provide a fair and comprehensive benchmark for medical image forensics?

The benchmark is a strong initial contribution but has several notable gaps. On the positive side: the six-detector suite covers a range of architectural paradigms (CNN, FCN, LSTM-augmented, multi-branch, transformer), the cross-generator evaluation is well-designed and practically relevant, the inclusion of both detection and localization tasks is forward-looking, and Pd@1% is a clinically meaningful metric that most forensic benchmarks neglect.

The gaps include:

No confidence intervals or variance estimates. Table 3 reports point estimates (e.g., "89.9 / 82.9") without standard deviations, confidence intervals, or any measure of statistical reliability. With only 150 test patients, the test set size per generator may be relatively small (the paper does not report exact per-generator test counts, but given the imbalanced totals in Table 1 and the per-patient split, some off-diagonal evaluations may involve relatively few test images, especially for CycleGAN → DM comparisons). Without variance estimates, it is impossible to assess whether differences between methods (e.g., TruFor's 89.9% F1 vs. ManTraNet's 87.0% F1 on Pix2Pix) are statistically significant or within sampling noise.
No separation of injection vs. removal performance. The dataset contains 6,238 injections and 2,339 removals (Table 1) — a nearly 3:1 imbalance. All metrics are reported aggregated across both manipulation types. It is plausible that injection (adding synthetic tissue) and removal (replacing tissue with synthetic filler) leave different forensic traces, and that detectors perform differently on the two tasks. Without per-task breakdowns, a detector that excels at detecting injections but fails on removals could still achieve high aggregate scores, masking a critical blind spot.
No baseline using non-deep-learning forensic methods. The paper explicitly excludes classical forensic approaches (JPEG compression analysis, camera sensor noise, etc.) because "compression is not customary for CT images, and medical imaging sensors have very different properties" (Section 3). While this reasoning is sound for camera-model-specific methods, there exist generic anomaly detection and statistical feature-based approaches that might work on CT scans without requiring domain-specific assumptions. The complete absence of any non-deep-learning baseline makes it impossible to assess whether the deep learning methods are solving a genuinely difficult problem or one that simpler approaches could handle.
No test of robustness to simple countermeasures. An adversary aware of forensic detection might apply counter-forensic techniques: adding noise to the manipulated region, applying mild blurring, or using adversarial perturbations to fool the detector. The paper's closing statement mentions "exploring challenging situations such as using adversarial attacks to fool the detectors" as future work but provides no results. This is a significant gap because a detector that achieves 100% Pd@1% on the dataset as constructed may collapse to near-zero if the adversary adds even minimal post-processing to disrupt forensic traces.
No evaluation of false positive rate on other types of benign anomalies. The Pd@1% threshold is calibrated on pristine CT scans — images with no manipulations. But real clinical CT scans contain many benign anomalies that are not AI-generated: motion artifacts, beam hardening, metal implants, surgical changes, radiation therapy effects, and naturally occurring rare anatomical variants. Whether the forensic detectors would flag these as "tampered" (producing false positives) is not tested. A detector that achieves 1% false alarm rate on pristine scans but 20% on scans with benign surgical changes would be clinically unusable. The paper's pristine test set from LIDC-IDRI consists of screening CT scans from a lung nodule detection study, which may not contain the full range of benign anomalies seen in clinical practice.
Single CT protocol and anatomy. All images are lung CT scans from the LIDC-IDRI dataset, acquired with specific protocols at specific institutions. Whether the forensic detectors would transfer to CT scans of other body regions (brain, abdomen, cardiac), other modalities (MRI, ultrasound, X-ray), or even lung CTs acquired with different reconstruction kernels or dose levels is completely untested. The claim that M3Dsynth "stimulates the research community to work on this topic, contributing new data and methods" (Section 4) implicitly acknowledges this limitation — the dataset is a starting point, not a comprehensive solution.

Does the fixed 0.5 threshold constitute a meaningful evaluation of detection capability?

The paper's own results demonstrate that it does not — and the authors acknowledge this explicitly. The discrepancy between Accuracy (with 0.5 threshold) and Pd@1% for ManTraNet (52.7% Accuracy vs. 100% Pd@1% on aligned Pix2Pix) reveals that the fixed threshold metric is measuring calibration, not discriminability. A method that is poorly calibrated (scores compressed near 0.5) will appear to fail under the fixed threshold even if it perfectly separates the tampered and pristine distributions (e.g., pristine scores all at 0.51, tampered scores all at 0.49 — perfect discriminability, zero accuracy at 0.5 threshold). The paper's decision to report both metrics is appropriate, but the Accuracy column in Table 3 should be interpreted primarily as a calibration diagnostic, not a performance metric. The clinically relevant detection metric is Pd@1%, which directly answers the question: "if I set the alarm threshold to keep false positives at a manageable 1%, what fraction of real attacks will I catch?"

Does the paper demonstrate that localization is practically useful, or merely that it's achievable?

The paper demonstrates that localization is achievable — detectors produce segmentation masks that substantially overlap the ground-truth manipulated region, with IoU values exceeding 80% for TruFor on aligned data. Whether this level of localization accuracy is practically useful is not directly tested. An IoU of 82.9% means the detector correctly identifies most of the manipulated 16mm cube but also includes some false positive voxels outside it and misses some true tampered voxels inside it. In a clinical setting, a radiologist directed to the predicted localization map would need to examine a region somewhat larger than the actual manipulation (due to false positives) and might miss some subtle aspects of the manipulation at the boundaries (due to false negatives). The paper does not include a user study or task-based assessment (e.g., "does providing the localization map to a radiologist improve their ability to correctly identify manipulated scans compared to providing only a binary flag?") that would establish clinical utility. The localization metrics are standard computer vision segmentation metrics, which are a reasonable proxy but do not directly measure clinical impact.

6. Limitations and Trade-offs

Limitation 1: Cross-Generator Generalization Is Partial and Highly Direction-Dependent

The assumption or constraint. The paper's central claim is that M3Dsynth enables training detectors with "good generalization ability" (Abstract) across synthetic generators. The benchmark evaluates this through 3 × 3 cross-generator training/testing matrices (Table 3), but the results reveal that generalization is far from symmetric or uniform. The paper acknowledges this implicitly through the matrix format itself, but does not explicitly characterize which generalization directions fail.

The consequence. A defender deploying a detector trained on M3Dsynth faces a critical strategic question: which generator(s) should they train on? If they train on CycleGAN, TruFor's localization IoU drops from 81.2% (aligned) to 55.5% on Pix2Pix and 24.6% on DM — the latter being a factor of 3.3× worse than aligned performance. In detection, Xception trained on DM catches only 37.8% of CycleGAN manipulations at Pd@1% (Table 3, bottom). The consistent weakness of CycleGAN → DM and DM → CycleGAN transfers, observed across multiple detectors, means that training on one generator leaves substantial blind spots against others. An adversary who knows which generators the defender trained on can select an architecturally dissimilar tool to maximize their chance of evasion. The "good generalization" claim holds only for favorable generator pairs (DM → Pix2Pix), not as a uniform property of the dataset or detectors.

What evidence exists in the paper. The 3 × 3 matrices in Table 3 are the only evidence. For TruFor localization: DM → Pix2Pix achieves 84.4% F1 / 75.2% IoU, while CycleGAN → DM achieves 36.4% F1 / 24.6% IoU. For MVSS-Net detection: DM → CycleGAN reaches only 67.4% Pd@1%. The asymmetry — DM-trained detectors generalize better to GAN images than GAN-trained detectors generalize to DM — is consistent across TruFor, ManTraNet, and MVSS-Net, suggesting it reflects genuine differences in forensic trace overlap rather than detector-specific artifacts.

Mitigation status. The paper does not address this limitation directly. It does not report results for training on all three generators simultaneously (the Table 2 experiment with the Corvi et al. detector does multi-generator training, but that is a different detector architecture and reports only detection accuracy, not the full localization and Pd@1% suite). Section 4's call for "exploring challenging situations such as using adversarial attacks to fool the detectors" indirectly acknowledges that robustness is incomplete, but the paper does not frame cross-generator asymmetry itself as a limitation to be mitigated. A natural mitigation — training on the union of all available generators to maximize coverage — is not evaluated in the main benchmark, leaving practitioners without guidance on whether combining training data from multiple generators closes the generalization gap.

Limitation 2: The Fixed 0.5 Detection Threshold Produces Misleading Failure Results — And the Superior Pd@1% Metric Requires Pristine-Only Calibration Data

The assumption or constraint. The paper reports detection accuracy using "the fixed 0.5 threshold" applied to the maximum detection score across slices (Section 3). The authors acknowledge the problem: "Several methods provide dismaying results, close to 50%, but these may be also due to the fixed choice of the threshold, and could be improved through calibration." Pd@1% is introduced as the alternative, calibrated offline "working only on pristine images."

The consequence. The Accuracy column in Table 3 (bottom) is almost entirely uninformative for comparing methods. ManTraNet achieves 52.7% accuracy on aligned Pix2Pix but 100% Pd@1% — the accuracy number reflects calibration failure, not discriminative failure. However, Pd@1% has its own dependency: it requires access to a representative set of pristine images from the same distribution as the deployment data to calibrate the threshold. In a real hospital, the distribution of pristine CT scans (scanner models, acquisition protocols, patient demographics, reconstruction algorithms) may differ from the calibration set, causing the realized false alarm rate to deviate from the nominal 1%. The paper provides no analysis of how sensitive Pd@1% is to calibration set size or distribution shift. A detector that achieves 100% Pd@1% on the M3Dsynth test set might produce 5% false alarms in clinical deployment if the calibration set does not match the deployment distribution — and the paper provides no tools to anticipate or detect this.

What evidence exists in the paper. Table 3 (bottom) provides the direct evidence: ManTraNet's Accuracy ranges from 52.7% to 56.6% across aligned conditions, while its Pd@1% ranges from 87.3% to 100%. U-Net's Accuracy is 52.9% on aligned Pix2Pix but Pd@1% is 93.1%. The divergence between the two metrics demonstrates that threshold sensitivity is large enough to flip the conclusion from "method fails" to "method succeeds."

Mitigation status. The paper addresses the calibration problem by reporting Pd@1% alongside Accuracy, which is the correct approach and a genuine strength of the benchmark. However, it does not address the calibration data dependency: no experiment varies the calibration set size, domain, or patient composition to measure Pd@1% sensitivity. Section 4 does not list calibration robustness as a future work item. A practitioner deploying these detectors would need to collect their own pristine calibration data from their specific clinical environment and validate the false alarm rate locally — a non-trivial operational requirement that the paper does not discuss.

Limitation 3: The Difficulty Estimation (Diagnostic Tool Analysis) Is Performed on Only One Automated Tool — Human Expert Fooling Is Unverified

The assumption or constraint. The paper validates manipulation quality by testing against a single automated diagnostic tool: "the computer-aided diagnostic tool proposed in [15]" (Liao et al., 2019, Section 2.2). Figure 3 demonstrates that this specific classifier's malignancy score distributions swap roles after manipulation. The Introduction cites Mirsky et al. (2019) for the claim that manipulated images "can easily fool automated cancer detectors and even medical experts" — but the "medical experts" portion of that claim comes from Mirsky's study, not M3Dsynth.

The consequence. The clinical plausibility of M3Dsynth's manipulations is established only relative to one specific neural network classifier trained on LIDC-IDRI data. Different diagnostic tools — with different architectures, training data, or input processing — might respond differently. More critically, the paper provides no evidence about whether human radiologists would be fooled by M3Dsynth's manipulations. Radiologists use cognitive strategies (comparing to prior scans, assessing nodule morphology beyond simple size, evaluating edge characteristics and calcification patterns) that may differ from the features the Liao et al. classifier learned. The "touch-up" blending step that minimizes visual artifacts (Section 2.1) is motivated by human visual imperceptibility, but its effectiveness is never tested with human observers. If the manipulations contain subtle but detectable artifacts that radiologists would notice (unusual texture transitions, unrealistic vessel-to-nodule relationships, inconsistent tissue density gradients), then the clinical threat — and thus the real-world importance of forensic detectors — is overstated.

What evidence exists in the paper. Only Figure 3 (Liao et al. classifier histograms for pristine vs. manipulated data). No radiologist reader study, no comparison against other diagnostic tools, no qualitative examples analyzed by medical experts, no survey of whether the "reduced visual impact" achieved by enlarging/reducing existing nodules rather than creating/removing entirely is sufficient to fool humans. The paper's closing statement — "We hope this dataset will stimulate the research community to work on this topic" — reflects an implicit acknowledgment that validation is incomplete.

Mitigation status. Not addressed. The paper relies entirely on the Liao et al. classifier as a proxy for clinical plausibility and does not discuss the absence of human expert validation as a limitation. Future work involving radiologist reader studies would be needed to establish whether M3Dsynth's manipulations pose a genuine threat to clinical diagnosis, as opposed to a threat specifically to automated screening tools.

Limitation 4: No Evaluation of Robustness to Simple Counter-Forensic Attacks That an Adversary Would Realistically Deploy

The assumption or constraint. All forensic detectors in the benchmark are evaluated on M3Dsynth images exactly as generated — the manipulations are produced by the pipeline (Section 2.1), post-processed with blending, and then presented to detectors without further modification. The paper implicitly assumes that a real adversary would stop at generation and blending.

The consequence. An adversary aware that forensic detection systems exist — and the paper's own premise is that such attacks are realistic — would likely apply counter-forensic measures to disrupt detection. Even simple operations could severely degrade detector performance: adding Gaussian noise to the manipulated region (mimicking higher-dose CT acquisition, which would be clinically plausible), applying mild Gaussian blurring (to smooth forensic traces in the frequency domain), resampling the manipulated cube at a slightly different resolution (to disrupt generator-specific upsampling artifacts), or using targeted adversarial perturbations optimized against known detector architectures. The paper's Pd@1% numbers (near 100% for TruFor, ManTraNet, MVSS-Net) represent performance against an unaware adversary — an adversary who makes no effort to hide forensic traces beyond blending. Against an adversary who post-processes their manipulations specifically to evade detection, these numbers could collapse to near zero.

What evidence exists in the paper. None. No robustness evaluation is performed. Section 4's concluding sentence mentions "exploring challenging situations such as using adversarial attacks to fool the detectors" as future work, so the authors are aware of the gap. But this means the current benchmark evaluates detectors in the most favorable possible scenario — static, unmodified generator outputs — which is unlikely to represent real adversarial conditions.

Mitigation status. Acknowledged as future work only. The paper does not even test simple, non-adversarial robustness (e.g., re-saving images, minor intensity adjustments, different window/level settings for display) that would occur in normal clinical image handling. This is the most significant gap in the benchmark's practical relevance: the evaluated detectors may be fragile in ways that are not captured by the current evaluation protocol, and a practitioner deploying them would need to conduct their own adversarial robustness testing before relying on the system.

Limitation 5: All Manipulations Are Local 16mm Cubes — Detectors Are Evaluated Only on This Single Spatial Scale, and the False Alarm Rate on Naturally Occurring Benign Anomalies Is Completely Untested

The assumption or constraint. The manipulation pipeline always modifies a 16 × 16 × 16 voxel inner cube within a 32 × 32 × 32 voxel conditioning cube (Section 2.1). Every tampered image in M3Dsynth contains exactly one manipulated region of this fixed spatial extent. Detectors are trained and evaluated exclusively on this manipulation geometry. The Pd@1% calibration uses pristine LIDC-IDRI scans, which are screening CTs from a lung nodule detection study.

The consequence. In a real clinical PACS server, CT scans contain diverse anomalies that are not AI-generated but could visually resemble synthetic tissue: post-surgical changes (resection cavities, staple lines, tissue remodeling), radiation fibrosis (scarring from radiotherapy with atypical density patterns), pneumonia consolidations, atelectasis (collapsed lung regions), motion artifacts, beam hardening artifacts near dense bones, and naturally occurring rare anatomical variants. The forensic detectors might flag any of these as "tampered" if they produce visual patterns that deviate from the detector's learned notion of "pristine LIDC-IDRI lung parenchyma." The Pd@1% metric, calibrated on healthy screening CTs, provides no information about false alarms on non-healthy-but-still-pristine scans. A detector achieving 1% false alarm rate on a screening population might produce 20% false alarms on a clinical population with diverse pathologies — making it clinically unusable because the alert would be ignored by staff desensitized to false positives.

A second consequence of the fixed 16mm spatial scale: detectors might learn to associate "manipulation" with "anomalous region of approximately 16mm extent." If an adversary uses a different sized manipulation (e.g., a much smaller 4mm injection to evade size-based detection, or a much larger 30mm region to modify entire anatomical structures), the detector might fail because the spatial extent falls outside its training distribution. The paper provides no analysis of whether detector performance depends on the size or number of manipulated regions.

What evidence exists in the paper. The paper provides evidence of the fixed spatial design (Section 2.1: the 32mm / 16mm cube specification), but no evaluation that tests sensitivity to manipulation size or to naturally occurring benign anomalies. There is no experiment introducing non-malignant clinical abnormalities into the test set to measure specificity under realistic clinical conditions. The Pd@1% calibration uses only "pristine images" from LIDC-IDRI — a term the paper does not further qualify — and the false positive analysis stops at the calibration step without domain-shift testing.

Mitigation status. Not addressed. The paper does not discuss the fixed spatial scale as a potential overfitting risk, nor does it suggest testing on scans with benign anomalies as future work. The clinical specificity gap is entirely unexamined. A minimal mitigation — including common CT artifacts (motion, beam hardening) and benign pathologies (granulomas, scars, atelectasis) in the pristine calibration set — is not explored.

Limitation 6: Single Anatomical Site, Single Modality, Single Dataset — The Entire Benchmark Rests on Lung CTs from LIDC-IDRI

The assumption or constraint. Every image in M3Dsynth is a lung CT scan from the LIDC-IDRI dataset (Armato et al., 2011). The detectors are fine-tuned and evaluated exclusively on this specific anatomical site, imaging modality, and acquisition protocol. The paper does not claim generalization beyond lung CTs, but it also does not discuss this as a limitation — the threat is framed generically: "malicious tampering of 3D medical imagery" (citing Mirsky et al., 2019), "modifying the content of medical images" (Abstract), and "medical image forensics" (Section 2).

The consequence. A hospital or regulatory agency seeking to deploy forensic detection for medical imaging would need protection across multiple anatomical sites (brain MRI for tumor detection, cardiac CT for coronary assessment, mammography for breast cancer screening) and modalities (CT, MRI, ultrasound, X-ray, PET). The paper provides no evidence that detectors fine-tuned on M3Dsynth's lung CTs would transfer to any other imaging context. The forensic traces that distinguish real from synthetic in lung CTs — Poisson quantum noise from X-ray attenuation, filtered back-projection reconstruction artifacts, specific tissue density distributions — are modality-specific. MRI has completely different signal formation physics (RF pulse excitation, gradient encoding, k-space sampling) and different reconstruction artifacts (Gibbs ringing, chemical shift, susceptibility). Ultrasound involves coherent wave interference and speckle. A detector trained on CT forensic traces would almost certainly fail on MRI or ultrasound without domain-specific retraining, but the required retraining data and procedures are not established by this paper.

Additionally, the LIDC-IDRI dataset represents a specific acquisition era and protocol — screening chest CTs acquired under research protocols with standardized dose and reconstruction. Clinical CT scans vary enormously in slice thickness, in-plane resolution, reconstruction kernel (smooth vs. sharp), dose level, and presence of contrast agent. Whether detectors trained on LIDC-IDRI data would transfer to CT scans from different institutions, scanners, or protocols is untested. The paper's own finding that general-purpose forensic detectors fail on medical images without fine-tuning (Table 2, ~50% accuracy pre-fine-tuning) suggests that domain sensitivity is high even within the forensic task itself — and that domain shift across medical imaging contexts could be similarly severe.

What evidence exists in the paper. None beyond the single-site, single-modality nature of the dataset, which is described but not framed as a limitation. Table 2 provides indirect evidence of domain sensitivity — the collapse from ~100% to ~50% accuracy when moving from natural images to medical CTs before fine-tuning — implying that cross-domain transfer is hard. But within medical imaging, no cross-site or cross-modality experiment is conducted.

Mitigation status. Not addressed. The paper's future work statement does not mention extending M3Dsynth to other anatomical sites or modalities. Section 4 calls for "contributing new data," which implicitly acknowledges that the current dataset does not cover the full threat surface, but the paper does not characterize this as a limitation of the current benchmark. A practitioner reading the paper would need to assume that the entire evaluation applies only to lung CTs from protocols similar to LIDC-IDRI, and that extending to other contexts would require building analogous datasets from scratch.

7. Implications and Future Directions

How This Work Changes the Landscape

M3Dsynth does not introduce a new detection algorithm, a novel architecture, or a theoretical advance in forensic trace analysis. Its contribution is infrastructural — and in a field where progress has been bottlenecked by data scarcity, an infrastructural contribution can be more impactful than a methodological one. The paper establishes the minimum viable foundation for medical image forensics as a coherent subfield: a large, multi-generator, systematically constructed dataset with a standardized evaluation protocol that spans detection and localization under realistic cross-generator conditions. Before M3Dsynth, the subfield did not exist in any meaningful sense — there was one attack demonstration (Mirsky et al., 2019) and two detection papers (Solaiyappan and Wen, 2022; Sharafudeen and Chandra, 2022) that trained and tested on the same single generator. After M3Dsynth, there is a benchmark, a set of baselines, and a clearly articulated generalization challenge that any new method must address to claim practical relevance.

The conceptual shift the work introduces is the reframing described in Innovation 1 of the Key Insights: generator identity becomes an experimental variable, not a fixed property of the problem. This seems simple in retrospect — of course an adversary can choose which tool to use — but the field's default assumption had been that training and testing on the same generator constitutes a valid evaluation. M3Dsynth's 3 × 3 cross-generator matrices (Table 3) make this assumption visibly untenable: the 36.4% F1 gap between TruFor's aligned CycleGAN performance (88.2%) and its CycleGAN → DM generalization (36.4%) quantifies what single-generator evaluation hides. Any future work that evaluates only on the training generator will be immediately recognizable as incomplete, because M3Dsynth has demonstrated that the harder — and practically relevant — question is cross-generator transfer.

The paper also reshapes which research directions look promising versus dead-end. The HP-FCN results (45.6% Pd@1% aligned, 24.6–52.0% across all conditions) strongly suggest that handcrafted high-pass filtering — a mainstay of natural image inpainting detection — does not transfer to the 3D CT domain. The forensic traces in CT manipulations are not simply high-frequency edge artifacts at the manipulation boundary; they require learned, domain-specific feature extraction. Conversely, the strong performance of TruFor (100% Pd@1% aligned, 89.1–100% cross-generator) and ManTraNet (87.3–100% Pd@1%) validates the architectural direction of combining intensity-domain processing with noise-sensitive fingerprint streams, and of using transformers rather than purely convolutional backbones. These results redirect effort away from adapting classical forensics and toward refining architectures that learn noise-level and statistical features from data.

The paper resolves a latent tension that had no forum for expression before M3Dsynth existed. The original Mirsky et al. (2019) work demonstrated that CT-GAN could produce diagnostically convincing manipulations. One could reasonably ask: is CT-GAN's forensic signature a one-off, or do all generative paradigms leave detectable traces in medical images? M3Dsynth provides the first answer: yes, across conditional GANs, unpaired GANs, and diffusion models, all three leave traces that are learnable by fine-tuned detectors. But the traces are sufficiently different that cross-generator generalization is partial. This is not a contradiction — it is a boundary condition: medical image forensics is possible, but it requires multi-generator training data and architectures that can capture the shared subspace of synthetic artifacts rather than overfitting to one generator's specific fingerprint. Prior to M3Dsynth, this distinction — between the existence of traces and their cross-generator transferability — was invisible because single-generator datasets conflated the two questions.

The work also implicitly deprecates the strategy of building detectors from scratch for every new medical imaging context. The Table 2 experiment — where a detector pre-trained on natural images achieves ~50% accuracy (chance) on M3Dsynth, then jumps to 91.6–99.5% after fine-tuning — suggests that the feature extraction capabilities learned from large natural image datasets are transferable to medical imagery if there is medical-specific manipulation data to adapt them. The path forward is not to design medical-specific architectures from first principles, but to fine-tune general-purpose forensic networks on domain-relevant data. This makes the barrier to entry for medical forensics lower than it initially appeared: the architectures exist; the missing ingredient was the dataset, which M3Dsynth now provides.

Finally, the paper establishes localization as a first-class evaluation requirement. Prior medical tampering detection work was detection-only. M3Dsynth's benchmark demonstrates that detection and localization are partially decoupled — ManTraNet achieves 100% Pd@1% but only produces localization maps through a separate output head — and that methods strong at localization (high F1/IoU) can still require calibration to achieve usable detection decisions (the Accuracy vs. Pd@1% discrepancy). Future work cannot credibly report only detection accuracy; it must address where the manipulation is, both because the clinical workflow demands it and because the benchmark now supports evaluating it.

Follow-Up Research This Work Enables

Multi-generator joint training and the upper bound on cross-generator generalization. The most immediate follow-up is to train each detector on the union of all three M3Dsynth generators and evaluate against each individually, establishing whether multi-generator training closes the generalization gap observed in Table 3. For instance, does TruFor trained on Pix2Pix + CycleGAN + DDPM achieve localization F1 above 85% on all three generators, or does the CycleGAN → DM weakness persist? The paper's Table 2 experiment with a different detector architecture suggests multi-generator fine-tuning works (91.6–99.5% accuracy across generators), but this was detection-only with a fixed 0.5 threshold, not localization and not Pd@1%. A clean experiment would: (1) train TruFor and ManTraNet on all three generators simultaneously, (2) report the full 3 × 3 localization (F1/IoU) and detection (Pd@1%) matrix, and (3) compare against the single-generator baselines in Table 3. If multi-generator training achieves near-aligned performance across all entries, the practical guidance is clear: deployers should collect data from multiple generator types. If persistent gaps remain (e.g., CycleGAN → DM still below 50% IoU), then architectural innovations — not just data diversity — are needed for robust generalization.

Adversarial robustness of forensic detectors to post-processing countermeasures. Section 4 flags "adversarial attacks to fool the detectors" as future work, but the more tractable first step is evaluating robustness to non-adversarial post-processing that an adversary could apply without specialized knowledge. Specific experiments: (1) Add Gaussian noise of increasing standard deviation to the 16 × 16 × 16 inner cube (mimicking legitimate CT dose variation — noise levels of 10–50 HU are clinically normal) and measure the Pd@1% degradation curve for the top three detectors (TruFor, ManTraNet, MVSS-Net). (2) Apply Gaussian blurring with σ = 0.5, 1.0, 1.5 voxels to the inner cube and measure the same. (3) Resample the manipulated cube at a slightly different resolution and resample back (simulating the inverse rescaling step being imperfect). The key question is whether Pd@1% collapses to near zero under mild processing that does not visibly degrade image quality. If TruFor's 100% Pd@1% drops to 50% under σ = 20 HU Gaussian noise (well within clinical dose variation), the apparently strong detection performance is illusory for any adversary willing to apply trivial countermeasures. This experiment requires no new data — only post-processing the existing M3Dsynth test set before detector evaluation.

Human expert reader study to validate clinical plausibility and calibrate the threat model. The paper's diagnostic tool analysis (Figure 3) validates that the Liao et al. (2019) classifier is fooled, but the claim that manipulations can "easily fool... medical experts" (Introduction, citing Mirsky et al., 2019) is not tested on M3Dsynth's specific manipulations. A reader study would: (1) recruit board-certified radiologists (ideally thoracic specialists), (2) present a balanced mix of pristine, Pix2Pix-injected, CycleGAN-injected, DDPM-injected, and corresponding removal cases, (3) ask radiologists to classify each nodule as benign or malignant (the diagnostic task) and also to rate their suspicion of image tampering on a Likert scale (the forensic task), and (4) measure both diagnostic accuracy and tampering detection sensitivity/specificity. The critical result is whether radiologists' diagnostic decisions are affected by the manipulations (replicating the automated tool finding with humans), and whether radiologists can detect the manipulations at above-chance rates when explicitly asked to look for them (testing whether forensic traces are human-visible). If radiologists are fooled on the diagnostic task but can detect tampering when attending to it, the forensic detectors serve to automate what humans can already do with effort. If radiologists are fooled on both tasks, the threat is more severe and the forensic detectors fill a capability gap that humans cannot cover.

Extension to other anatomical sites, modalities, and manipulation types using the M3Dsynth pipeline as a template. The M3Dsynth pipeline — pre-processing (cube extraction, rescaling, equalization, masking), generative synthesis, post-processing (inverse rescaling, de-equalization, blending) — is not specific to lung CT. It can be adapted to: (1) brain MRI for tumor injection/removal (clinical motivation: falsifying glioma progression in clinical trials), (2) cardiac CT for coronary artery stenosis injection/removal (fraudulent justification for bypass surgery), (3) mammography for microcalcification injection/removal (breast cancer screening fraud). Each adaptation requires: a suitable annotated dataset (e.g., BraTS for brain tumors, CAD-RADS datasets for cardiac), adaptation of the 3D generator architectures to the new anatomy and modality (MRI has different intensity distributions and artifacts than CT), and generation of a cross-generator benchmark following the Table 3 protocol. A strong follow-up would produce one such dataset and demonstrate whether the forensic lessons from M3Dsynth transfer: do TruFor and ManTraNet, fine-tuned on the new dataset, achieve similar cross-generator generalization patterns, or are the forensic traces modality-specific? This would establish whether medical image forensics is a unified problem (one detector architecture, fine-tuned per-modality, works everywhere) or requires fundamentally different approaches per imaging context.

Investigation of what forensic traces the detectors are actually learning — synthetic attribution and feature visualization. The paper demonstrates that detectors work but provides no insight into why they work. A forensic science perspective demands understanding what traces distinguish synthetic from real tissue. Specific experiments: (1) Train a detector to perform three-way classification (Pix2Pix vs. CycleGAN vs. DDPM vs. Pristine) rather than binary detection, measuring whether generator-specific traces are separable. If accuracy on the three-way task is high (e.g., >80%), then the forensic traces are generator-specific and cross-generator generalization is inherently limited. If accuracy is low (near chance for distinguishing between generators), then detectors are learning a shared "synthetic vs. real" feature that spans architectures. (2) Apply feature visualization techniques (Grad-CAM, integrated gradients) to TruFor's localization maps to identify which anatomical features — edges, textures, noise patterns, intensity gradients — drive the detector's decision at the boundary of the manipulated cube. (3) Compute frequency-domain representations of the difference between synthetic and real tissue in the 16 × 16 × 16 cube, and test whether simple spectral features (power in specific frequency bands) can separate synthetic from real without a deep network. If spectral features work, the forensic trace is a known GAN artifact (upsampling peaks) and classical methods might be viable after all, contradicting HP-FCN's failure and suggesting that HP-FCN's specific high-pass filter design, not the frequency-domain approach itself, was the problem.

Calibration set shift: how sensitive is Pd@1% to mismatches between calibration and deployment data? The paper's strongest detection metric, Pd@1%, depends on calibrating the threshold using pristine images. In a real deployment, the calibration set (collected from one institution, one scanner model, one patient population) will differ from the deployment stream. A follow-up study would: (1) Split the LIDC-IDRI test patients by scanner manufacturer or acquisition protocol if that metadata is available, (2) calibrate each detector's threshold on one subset and measure Pd@1% on the other, quantifying the degradation from calibration set shift. (3) Measure how many pristine images are needed for stable calibration — compute Pd@1% using calibration sets of size 10, 50, 100, 200, 500 pristine images and identify the sample size at which Pd@1% stabilizes. If 500 pristine images are required, every hospital deploying the system needs a substantial local calibration effort; if 20 suffice, the system is plug-and-play. This experiment uses only the existing M3Dsynth pristine data, split differently, and answers a question that any practitioner would need to resolve before deployment.

Practical Applications and Downstream Use Cases

PACS integrity monitoring systems for hospital networks. The most direct application is deploying a fine-tuned forensic detector (e.g., TruFor or ManTraNet, trained on all three M3Dsynth generators simultaneously) as a background process on a hospital's PACS server. Every incoming CT scan is passed through the detector. The detector produces a global tampering score and, if the score exceeds the calibrated Pd@1% threshold, generates a localization map highlighting the suspected manipulated region. A flagged scan is routed to a dedicated radiologist for manual review before the scan is released to the referring physician or used for clinical decision-making. The numbers from the paper justify feasibility: TruFor achieves 100% Pd@1% on aligned data and 89.1–100% on cross-generator data (Table 3, bottom), meaning it catches essentially all Pix2Pix and DDPM manipulations and 89–98% of CycleGAN manipulations at the strict 1% false alarm rate. In a hospital processing 100,000 CT scans per year, a 1% false alarm rate means 1,000 scans flagged for review — approximately 3 per day — which is operationally manageable. The 11% miss rate on the hardest cross-generator case (DM → CycleGAN at 89.1% Pd@1%) represents the residual risk that the monitoring system would accept, and which could be reduced by multi-generator training (an experiment not yet performed).

Verification of clinical trial imaging data integrity. Pharmaceutical companies and contract research organizations conducting multi-center clinical trials rely on CT scans to assess treatment response (e.g., tumor shrinkage in oncology trials). Manipulating these scans — enlarging tumors in the placebo arm to make the treatment look more effective, or shrinking tumors in the treatment arm to hide progression — could falsify trial results. M3Dsynth-trained detectors could be integrated into the imaging core lab pipeline that reviews all trial scans for protocol compliance. Each scan would be screened for AI-generated manipulation before being read by the central radiologist. The benefit: the detector's localization map would direct the core lab radiologist's attention to the specific region where manipulation is suspected, making the review efficient even for trials involving thousands of scans across hundreds of sites. The cross-generator generalization demonstrated in Table 3 is critical here because a malicious trial site could use any generative tool, not only the three in M3Dsynth. The paper's evidence that detectors partially generalize suggests that training on M3Dsynth's three generators would provide coverage against unknown generators as well, though the exact coverage is unquantified and should be tested explicitly (as in the multi-generator training follow-up proposed above).

Forensic analysis of medical images in legal and insurance dispute resolution. In cases of suspected insurance fraud — where a claimant submits CT scans allegedly showing a condition that justifies a large payout — or medical malpractice litigation — where the authenticity of imaging evidence is contested — M3Dsynth-trained detectors could provide an objective, quantitative assessment of whether the images contain AI-generated manipulation. The localization map (with F1 up to 89.9% and IoU up to 82.9% on aligned data, Table 3, top) provides a visual exhibit that a non-expert audience (judge, jury, insurance adjuster) can interpret: it highlights exactly where the manipulation is claimed to be, and the numerical confidence (the detector's per-voxel score) quantifies the strength of evidence. The strict 1% false alarm rate calibration is essential in this context because falsely accusing a claimant or physician of fraud based on a detector error would have severe legal consequences. TruFor's 100% Pd@1% on aligned data and 89.1–100% cross-generator (Table 3) provides the low-false-positive operating point that legal admissibility requires (analogous to DNA evidence's error rate reporting). However, deployment would require additional validation: the calibration must be performed on scans from the specific institutions and scanner types involved in the case, and the detector's decision must be supplemented by expert human testimony because the algorithm's internal reasoning is not interpretable — a limitation the paper does not address but that becomes critical in legal contexts.