💻 computer science

HexMIL: Hierarchical Attention MIL for Ante-Hoc Explainable Detection of AI-Manipulated CT Volumes

HexMIL is a novel hierarchical attention-based Multiple Instance Learning framework that achieves state-of-the-art generalization in detecting AI-manipulated CT volumes and provides structurally faithful, ante-hoc 3D localization of deepfake artifacts using only binary volume-level supervision.

Original authors: Orazio Pontorno, Luca Guarnera, Zahid Akhtar, Sebastiano Battiato

Published 2026-08-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Orazio Pontorno, Luca Guarnera, Zahid Akhtar, Sebastiano Battiato

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your favorite movie can be edited so perfectly that you can't tell if a character was actually there or just added by a computer. Now, imagine that same trick being played on the most important documents in your life: your medical records. This is the scary reality of "medical deepfakes." Just like a digital forger can alter a painting, powerful AI tools can now sneak fake tumors into healthy CT scans or erase real diseases from sick ones. If a doctor or a computer program can't tell the difference, a patient might get the wrong treatment, or a healthy person might be told they are sick. The big problem is that the "detectives" we have today are like old-fashioned security guards; they are great at spotting one specific type of fake but get confused when the forger changes their style, and they can't explain why they think something is fake. They just say "fake" without showing their work.

Enter HexMIL, a new kind of digital detective designed to solve both problems at once. Think of HexMIL not as a single guard, but as a two-level team of inspectors. Instead of looking at the whole 3D scan at once (which is like trying to find a needle in a haystack while blindfolded), HexMIL breaks the scan down into tiny slices and even smaller patches. It uses a clever "attention" system—like a spotlight that automatically shines brighter on the suspicious parts and dims on the normal ones. The magic is that this spotlight isn't just a fancy add-on; it's the actual engine that drives the decision. This means HexMIL doesn't just guess; it shows you exactly where it found the trouble, even if it has never seen that specific type of fake before. It's like a detective who can spot a new kind of forgery just by understanding the style of the mistake, rather than memorizing a list of known fakes.

The Paper's Big Discovery

The researchers behind this paper, led by Orazio Pontorno and his team, built HexMIL to be a "mask-free" detective. Usually, to teach a computer to find a fake tumor, you need to show it thousands of examples where someone has already drawn a box around the fake part. This is expensive and slow. HexMIL is different: it only needs to know if a whole scan is "real" or "fake." It figures out the rest on its own.

The team tested HexMIL in a very tough scenario: they trained it on fakes made by one specific AI tool, and then threw it into a test with fakes made by completely different AI tools it had never seen before. This is like training a dog to find a specific brand of shoe, and then seeing if it can find any shoe it's never encountered. The results were impressive. HexMIL beat all the other top detectors by a huge margin. In terms of accuracy (measured by a score called AUC), it improved by 9.1 points, and in terms of getting the right answer (F1 score), it improved by 9.4 points.

But the real superpower is in the "explainability." While other methods try to guess where the fake is after they've made their decision (like looking at a map after you've already taken a wrong turn), HexMIL's "spotlight" is built into the decision-making process itself. When the researchers tested how well these methods could point to the exact fake spot, HexMIL was the clear winner. It achieved an average overlap score (IoU) of 42.4% and a pointing game score of 70.6%, outperforming the next best methods.

Why Other Methods Failed (and HexMIL Won)

The paper explicitly rules out a few ideas that might seem like good solutions but actually don't work well for this specific job.

One-level attention isn't enough: The team tried a simpler version that only looked at slices or only looked at patches, but it failed. They found that you need both levels of inspection to catch the subtle tricks.
Standard "Self-Attention" is a trap: They tested a popular AI technique called "Self-Attention" (often used in chatbots). While it was good at guessing "fake," it completely failed at showing where the fake was. The paper suggests this is because Self-Attention mixes everything together so much that the computer loses track of the exact location, turning the "spotlight" into a blurry mess. HexMIL's "Gated Attention" is the only method that kept the location clear while still guessing correctly.
Big patches vs. Small patches: The researchers found a trade-off. Using very large patches made the computer better at guessing "fake" but worse at finding the exact spot. Using very small patches did the opposite. They settled on a middle ground (patches of size 64) to get the best balance.

How Sure Are We?

The authors are very confident in these results because they tested HexMIL on two major, public datasets (M3DSynth and CT-GAN) using a strict "cross-generator" test. This means the model was forced to generalize to unseen AI architectures, which is the hardest test possible. The numbers—like the +9.1 AUC improvement and the 42.4% IoU—are measured facts from these experiments, not just suggestions. The paper shows that HexMIL doesn't just work in a perfect lab setting; it holds up even when the "forger" changes their tools.

In short, HexMIL is a new kind of AI that doesn't just say "this scan is fake," but also points a finger at exactly where the lie is, even if it's never seen that specific lie before. It does this without needing a teacher to draw boxes around the fakes, making it a powerful, transparent, and robust tool for keeping medical records safe from digital forgeries.

Technical Summary: HexMIL

Problem Statement

The integration of deep generative models (e.g., GANs, Diffusion Models) into medical imaging has introduced the threat of "medical deepfakes"—volumetric CT scans manipulated to inject or remove pathologies (such as lung nodules). These manipulations pose a critical risk to clinical workflows, potentially leading to incorrect diagnoses. Existing detection methods face two primary limitations:

Poor Generalization: Detectors often fail to identify manipulations generated by unseen architectures (out-of-domain generalization).
Lack of Interpretability: Most detectors operate as black boxes, lacking native explainability. Post-hoc methods (e.g., Grad-CAM) provide approximations that may not faithfully represent the model's decision logic, which is insufficient for high-stakes medical applications.

Furthermore, existing approaches often require pixel-level spatial supervision (segmentation masks) for training, which is prohibitively expensive to annotate for 3D volumes.

Methodology: HexMIL

The authors propose HexMIL (Hierarchical EXplainable Multiple Instance Learning), a mask-free framework that addresses detection and localization using only binary volume-level supervision (pristine vs. tampered). The method employs a two-stage hierarchical architecture based on Attention-Based Multiple Instance Learning (MIL).

1. Hierarchical Decomposition

HexMIL decomposes a 3D CT volume ( $K$ slices) into a two-level hierarchy:

Level 1 (Patch): Each axial slice is divided into overlapping image patches.
Level 2 (Slice): The volume is treated as a bag of these slices.

2. Two-Stage Training Process

The framework is trained sequentially to decouple feature learning from evidence aggregation:

Stage 1: SliceMIL (Patch Aggregation)
- A 2D slice encoder processes individual slices.
- Each slice is decomposed into $N$ patches.
- A Patch Gated Attention module aggregates patch features into a single slice representation. This module learns to weight patches based on their forensic relevance without spatial supervision.
- The encoder and attention parameters are frozen after this stage.
Stage 2: HexMIL (Volume Aggregation)
- The frozen SliceMIL encodes each slice in a volume into a feature vector.
- Sinusoidal Positional Encoding is added to preserve the spatial ordering of slices.
- A Volume Gated Attention module aggregates slice representations into a single volume-level feature vector.
- A classification head predicts the binary label (tampered or pristine).
- Only the volume-level parameters are optimized in this stage.

3. Intrinsic 3D Explainability (Ante-Hoc)

Unlike post-hoc methods, HexMIL's attention weights are the exact aggregation function used for classification, providing structurally faithful explanations.

3D Attention Volume: The model combines the intra-slice patch weights ( $\alpha$ ) and inter-slice slice weights ( $\beta$ ) to generate a full-resolution 3D attention volume.
Localization: By thresholding this attention volume, the model extracts a tight 3D bounding box around the manipulated sub-region, effectively localizing the deepfake without ever seeing a segmentation mask during training.
Inference Strategy: For volumes with varying slice counts ( $K'$ ), the input is split into non-overlapping sub-volumes of size $K$ . The final prediction is the maximum probability across all sub-volumes.

Key Contributions

Unified Robust and Interpretable Framework: HexMIL is the first medical deepfake detector to jointly address out-of-domain generalization across unseen generative architectures while providing native interpretability.
Hierarchical Mask-Free Training: The method requires no pixel-level supervision, relying solely on binary volume labels, yet successfully recovers spatial localization as a by-product of the classification mechanism.
Native 3D Explainability: It introduces the first application of attention-based MIL for 3D medical deepfake detection, where attention weights constitute the exact forward computation (ante-hoc) rather than a retrofitted approximation.
State-of-the-Art Performance: The framework achieves superior performance in both detection and localization compared to existing baselines, including 2D forensic detectors, 3D CNNs, and Video Transformers.

Experimental Results

The authors evaluated HexMIL on the M3DSynth and CT-GAN datasets under a rigorous cross-generator generalization protocol (training on one generator, testing on others).

Out-of-Domain Classification: HexMIL achieved an average AUC of 92.0% and F1 of 90.2%, outperforming the strongest baseline (D3) by +9.1 AUC and +9.4 F1.
Out-of-Domain Localization: HexMIL achieved the best average Intersection-over-Union (42.4%) and Pointing Game score (70.6%), significantly outperforming baselines like MVSS-Net and ManTraNet.
Ablation Studies:
- The two-stage hierarchical structure was identified as the most critical component.
- Gated Attention was shown to be essential; replacing it with standard self-attention resulted in a catastrophic collapse in localization performance (IoU dropped from 42.4% to 1.6%) due to the loss of spatial correspondence.
- Sinusoidal Positional Encoding contributed an additional +5.3 AUC, highlighting the importance of anatomical context.

Significance and Claims

The paper claims that HexMIL represents a significant step forward in medical AI forensics by solving the "generalization vs. interpretability" trade-off. By leveraging hierarchical MIL, the model learns to identify sparse manipulation signals within large 3D volumes without requiring expensive pixel-level annotations. The authors emphasize that the ante-hoc nature of the attention mechanism provides a level of structural faithfulness that post-hoc methods (like Grad-CAM) cannot guarantee, making the system more reliable for clinical decision support. The work demonstrates that robust detection of unseen generative architectures is possible while maintaining high spatial precision in localization.