ACM Multimedia 2026

HexMIL: Hierarchical Attention MIL for
Ante-Hoc Explainable Detection of
AI-Manipulated CT Volumes

1 University of Catania   2 State University of New York Polytechnic Institute
AIGC Detection Medical Deepfakes XAI

Abstract

The emergence of medical deepfakes, i.e., medical images manipulated by deep generative models, poses a significant threat to clinical workflows. However, existing detectors suffer from two critical limitations: poor generalization to unseen generative architectures for manipulation detection and lack of interpretability. In this context, we present HexMIL (Hierarchical EXplainable Multiple Instance Learning), a mask-free medical deepfake detector that simultaneously addresses both limitations using only binary volume-level supervision. HexMIL decomposes each CT volume into a two-level hierarchy of patches and slices, aggregated via independent Gated Attention modules whose weights are directly combined into a full-resolution 3D attention volume that localizes the manipulated sub-region without any pixel-level annotation. Unlike post-hoc methods such as Grad-CAM, HexMIL's attention weights constitute the exact forward computation driving the classification decision, providing ante-hoc and structurally faithful spatial attribution. We evaluate HexMIL on M3DSynth and CT-GAN datasets under a rigorous cross-generator generalization protocol, training on a single generative architecture and testing on unseen ones. HexMIL outperforms all baselines by +9.1 AUC and +9.4 F1 in out-of-domain classification, and achieves the best average IoU and Pointing Game score in localization.

Method

HexMIL two-stage pipeline overview
Figure 1 — HexMIL graphical overview. (a) SliceMIL training: a 2D slice is decomposed into patches encoded by a shared CNN Patch Encoder; a Patch Gated Attention module pools them into a slice representation and yields an intra-slice attention map. (b) HexMIL training: the frozen SliceMIL encodes each of the K slices; a sinusoidal positional encoding and a second, independent Slice Gated Attention module aggregate them into a volume-level decision and an inter-slice attention vector. (c) Inference: a generic K′-slice volume is split into K-slice sub-volumes; the highest sub-volume score determines the final prediction, and the two attention maps are combined by the XAI Module into a 3D attention volume and bounding box. frozen  ·  trainable.

Results

Evaluated under a rigorous out-of-distribution protocol: the detector is trained on a single generative architecture and tested on the others. Reported per cross-generator transfer and averaged. Bold = best, underline = second.

Out-of-Domain Classification  (AUC / F1 %)

Cross-generator generalization across Pix2Pix, CycleGAN, Diffusion Model (DM) and CT-GAN.

Method Train: Pix2Pix Train: CycleGAN Train: DM Train: CT-GAN Avg
CycleGANDMCT-GAN Pix2PixDMCT-GAN Pix2PixCycleGANCT-GAN Pix2PixCycleGANDM
R3D-1866.8/67.066.5/64.462.1/65.470.8/64.070.1/67.264.3/61.869.5/64.667.6/68.471.2/74.960.4/66.261.3/62.165.5/68.066.3/66.2
ResNet50-ABMIL64.6/62.877.6/70.265.8/66.069.4/62.261.1/58.368.0/72.361.9/58.454.3/59.657.8/61.060.7/59.870.1/65.668.0/67.965.3/63.7
ViT-ABMIL65.3/70.668.5/68.061.2/66.468.3/64.468.2/66.764.9/62.166.8/64.564.7/68.569.1/73.358.7/65.062.4/60.560.1/68.864.9/66.6
DFX-SN73.1/76.070.9/70.668.4/74.263.4/63.175.0/65.859.7/61.367.4/68.569.7/69.972.1/70.466.2/71.564.8/63.467.9/75.868.2/70.0
HP-FCN60.4/65.474.0/67.655.2/63.864.5/60.361.1/63.167.8/65.472.1/60.455.0/65.264.3/71.253.4/59.166.2/74.457.9/56.662.1/64.4
MVSS-Net63.4/66.972.9/63.258.7/64.265.4/59.164.9/63.169.2/71.574.8/58.959.0/66.867.5/65.955.1/62.368.4/70.160.8/63.465.0/64.6
FreqNet62.0/71.471.9/67.457.8/63.253.4/63.162.0/64.755.6/62.172.4/75.568.7/65.066.5/72.358.9/66.464.2/67.861.3/60.962.9/66.6
NPR70.4/71.064.9/70.966.8/72.477.4/73.179.0/65.371.2/70.590.4/85.175.7/76.984.1/88.365.5/70.162.4/68.073.0/71.673.4/73.6
TruFor84.0/75.984.9/70.471.2/76.883.4/63.182.0/65.678.5/82.490.4/65.578.7/74.985.1/89.371.4/74.281.3/79.572.8/75.080.3/73.3
75.0/76.084.9/75.468.4/74.288.0/87.192.2/82.683.2/81.589.4/90.579.7/76.985.7/93.372.1/78.979.4/77.270.3/76.580.7/80.8
ManTraNet86.1/75.388.9/63.373.5/70.289.0/61.185.7/64.781.2/88.493.4/62.676.8/76.587.9/85.372.4/77.183.5/81.275.8/73.582.9/73.7
HexMIL (Ours)91.6/86.299.3/97.588.4/92.197.1/93.598.3/96.094.2/91.898.7/96.590.1/80.890.5/84.285.1/90.386.4/83.084.2/90.092.0/90.2

Out-of-Domain Localization  (IoU / PG %)

Spatial grounding on unseen manipulation types, evaluated for the pixel-grounding detectors.

Method Train: Pix2Pix Train: CycleGAN Train: DM Train: CT-GAN Avg
CycleGANDMCT-GAN Pix2PixDMCT-GAN Pix2PixCycleGANCT-GAN Pix2PixCycleGANDM
HP-FCN14.9/20.823.1/32.316.9/21.526.4/34.08.8/17.325.3/29.835.9/31.27.2/13.434.3/28.811.5/16.322.7/33.816.5/16.820.3/24.7
MVSS-Net41.1/60.333.9/50.638.5/63.140.8/56.830.3/43.838.1/58.946.2/66.529.3/45.446.1/67.442.7/56.233.1/49.937.3/59.138.1/56.5
TruFor34.4/62.835.1/63.233.7/57.837.8/71.035.5/65.638.2/69.253.9/80.719.5/47.849.7/83.731.4/60.337.7/62.932.4/58.736.6/65.3
ManTraNet38.2/67.243.7/69.033.7/63.141.4/71.933.9/63.742.4/73.750.4/83.510.6/33.047.9/81.934.3/65.544.5/71.234.9/66.038.0/67.5
HexMIL (Ours)40.0/66.146.7/75.637.8/63.447.1/77.044.1/70.743.5/73.250.7/84.831.7/55.549.2/81.136.4/62.542.1/78.438.9/64.042.4/70.6

Ante-Hoc Attention vs. Ground Truth

The manipulated sub-region emerges purely as a by-product of the binary classification objective — no pixel-level supervision is ever used.

HexMIL attention heatmaps compared to the ground-truth manipulation region
Qualitative localization. For two manipulated slices (rows), the leftmost column shows the CT with the ground-truth region (green box); the remaining columns overlay the attention heatmaps, which concentrate compactly on the tampered nodule.

3D Attention Volume & Bounding Box

XAI Module output: tri-axial attention projections, 3D heatmap and 3D bounding box
XAI Module output. (left) CT, CT + Attention and CT + Attention Volume projected along the axial, coronal and sagittal axes. (right) 3D visualization of the attention heatmap (top) and the extracted axis-aligned 3D bounding box for spatial localization (bottom).

BibTeX

If you find our work useful, please consider citing:

  @inproceedings{pontorno2026hexmil,
    title     = {{HexMIL: Hierarchical Attention MIL for Ante-Hoc Explainable Detection of AI-Manipulated CT Volumes}},
    author    = {Pontorno, Orazio and Guarnera, Luca and Akhtar, Zahid and Battiato, Sebastiano},
    booktitle = {Proceedings of the 34th ACM International Conference on Multimedia},
    year      = {2026},
  }
 
University of Catania SUNY Polytechnic Institute IPLab