Generative models in AI offer clinicians the power to instantly change pathologies or disease development for hypothetical or real patient images. They also allow clinicians to refine image quality for images made on poorly functioning or basic equipment. Understanding how bad actors might want to use such tools is helping physicians inform security software designers. These security insights will help health care providers tell AI-generated images, sometimes called “deepfakes,” apart from real ones. They will also help better protect real images and health care databases.
Currently, clinicians are training AI algorithms to generate medical images of large body parts, like the chest. This is creating case studies of the inputs and effort that go into making AI tools successful. The “what works and what doesn’t” details and the development of beneficial processes are forming the basis for the next wave of AI models. These will be used to generate images of rarer disorders, such as primary bone tumors.
Bachir Taouli, MD, a professor of radiology at Mount Sinai Hospital in New York, says, right now, a radiologist can ask an AI algorithm to generate reports and images for different purposes. “This helps you customize your teaching. That creates so much richness,” Taouli says. He serves his appointment through the body imaging section of the department of radiology and the Biomedical Engineering and Imaging Institute at the Icahn School of Medicine.
Taouli says AI’s current capabilities allow a researcher to add artifacts to images with the entry of a keyword. He says it is possible to instantaneously add distortion caused by patient movement or odd shapes that turn out to be metal implants to CT scans. These techniques are helpful for training students, as well as AI models, to recognize artifacts.
“Turn this around, and you see how AI is becoming better at denoising medical images and improving the quality of scans. Now it’s clear how AI could remove problems from a very low-quality EKG scan,” says Mickael Tordjman, MD. Tordjman is a postdoctoral fellow at the Biomedical Engineering and Imaging Institute of Mount Sinai Hospital.
Tordjman says AI-powered tools could be helpful in clarifying data from scans made on more basic equipment, older equipment, and poorly functioning equipment. These machines may be the only equipment available in remote and economically depressed areas.
Hacking Concerns
A study published in the March 2026 issue of Radiology stated that radiologists and multimodal large language models could not easily distinguish AI-generated X-ray images from real ones. The study referenced two AI-generation software programs: ChatGPT (GPT-4o), introduced in 2024, and RoentGen, a “vision-language foundation model” used to generate realistic chest X-ray (CXR) images. Yet the term “easily” in “easily distinguish” is significant.
As of late spring 2026, there are telltale signs that indicate AI created an image. Tordjman says these include a high degree of symmetry, extremely homogenous soft tissue, and smooth bone contours.
“Right now, imaging systems manufacturers are asking whether we should create a watermark or a cryptographic key,” Tordjman says. “It might be possible to create a security key to assign to each AI-generated image.”
Raym Geis, MD, an adjunct associate professor for National Jewish Health in Denver, says the race to guard images is a “cat-and-mouse game. Using watermarks or other methods to verify images are needed, but deepfake techniques are getting better and duplicating those, as well,” he says. “Anyone or any institution that generates real images will probably have to invest significantly to deliver new, robust identification/verification techniques for their images.”
Security tools would prevent a hacker from flooding a database with fake images. They would also prevent an individual from generating images and trying to earn a profit from selling them.
Christian Bluethgen, MD, is an assistant professor of radiology specializing in thoracic imaging at Stanford University. He is also a member of the group that developed RoentGen. He says the potential harms resulting from the misuse of AI-generated medical images include the introduction of false-positive or false-negative findings. These could lead to suboptimal diagnostic decisions and patient management, as well as unnecessary costs for the patient or the health care system.
To Hack or Hack Not
Historically, these issues have not been a concern. In the 15 years that John Mongan, MD, PhD, has been at the University of California, San Francisco (UCSF), to his knowledge, there has not been a breach related to medical images. Mongan is the associate chair for translational informatics and a professor of clinical radiology in the abdominal imaging and ultrasound section at the department of radiology and biomedical imaging for UCSF.
In addition, he chairs UCSF’s Research Information Technology Executive Committee, the central forum for budgetary prioritization for research-related IT capital expenditures at UCSF. Further, Mongan cochair’s UCSF’s Health Imaging AI Oversight subcommittee, a body to approve implementation of clinical imaging-related AI.
“There’s no open way to insert or modify an image in a hospital’s database. No one outside the hospital has authority to insert or modify images,” Mongan says. “In addition, it’s difficult to hack into a computer system that holds medical imaging data. If someone achieved the level of access needed to change images, there are a whole host of far more destructive and easier-to-accomplish actions they could take.” He explains that it is much easier to alter radiology reports or data in the EHR than to insert convincingly faked images.
Bradley Erickson, MD, a professor of radiology at the Mayo Clinic in Rochester, Minnesota, agrees with Mongan. He says the protocol for communicating images between scanners and the image archive is fairly secure.
“An attacker would have to have access to the internal network. Most hospitals grant such access only to employees and to their specific devices,” Erickson says. “Second, they would have to ‘impersonate’ the scanner in terms of internet protocol address and application entity title. That is probably not very difficult. One can use transport layer security to encrypt the traffic. In that case, an attacker would have to know to talk via that encrypted channel. So, it certainly is possible, but I think there are much more effective ways to have a major impact (eg, just hack the EHR that has the results).”
Teaching Tool?
Researchers are always working to train AI so it will make fewer errors, accomplish more tasks, utilize less resources, and move more quickly. The RoentGen team has now developed the second generation of its software.
“In RoentGen v2, the appearance of the generated images is not only steerable through text descriptions of findings but also by using structured patient metadata, including sex, age, and race/ethnicity. We used this to create a large, demographically balanced synthetic dataset comprising over 565,000 CXR images. In the new study, we demonstrate that synthetic data significantly improves both classification performance and fairness metrics across demographic subgroups,” Bluethgen says.
As RoentGen learns the distribution of its training data, it can flexibly reproduce a large variety of pathologies, as opposed to a predetermined select few. “This means without having to retrain the model I can—within reasonable limits—ask the model for various pathologies that come to mind,” Bleuthgen says. “[I can] also influence aspects like size or laterality. This way, a model like RoentGen can be used to illustrate pathologies for teaching purposes on-the-fly, without having to look for a suitable image in the hospital database or on the internet.”
Yet there are medical educators who remain skeptical about the utility of AI-generated medical images. “I think people will continue to use nongenerated, real images, simply because there are so many of them. Real images don’t have any of the potential problems, like unnatural features, that AI images might have,” Mongan says.
He adds that there may be some circumstances where AI might be useful in generating images of rare conditions. “For example, a tension pneumothorax (when air gets trapped in the pleural space between the lung and chest wall under pressure) is not particularly common. If you were training AI to detect this, it would be helpful to use generated images to expand your training set,” Mongan says. “But at the same time, AI software might not be likely to be good at generating images of rare conditions like this for the same reason: It doesn’t have enough images to train on.”
Erickson says that he does not see AI-generated images as the best images for teaching. “Teaching usually is focused on unusual things or specific aspects of a finding or disease. Synthetic images are not necessarily good for that,” he says. “The main advantage of synthetic is that privacy is easier to protect. But in [a] teaching situation, residents are already allowed to see personal health information (PHI), so the benefit is likely not realized.”
Erickson adds that he has developed a research project regarding AI. “We are studying if synthetic images can compensate for bias in AI models that result from undersampling of underrepresented groups (eg, minorities, age groups, sex). That could be very meaningful if it proves effective,” he says.
Personal Effects
The March 2026 Radiology study on recognizing AI-generated images raised a great deal of alarm among radiologists. The article prompted an editorial on the subject, written by Rajesh Bhayana, MD, and Satheesh Krishna, MD, both abdominal radiologists at University Medical Imaging in Toronto. The subhead of that piece was, “Seeing is no longer believing.”
Mongan says he thinks people are frightened by AI-image generation tools because they are used to considering a video or photo as proof. “Historically, it wasn’t so possible to fake those,” Mongan says. “So, now, AI causes people to be worried that somehow medical images may be faked. Yet people should not be so scared of this. Medical images are very tightly controlled and secured throughout their whole lifecycle, from their creation on a scanner to their display on a radiology monitor.”
Mongan says people should be more concerned about taking actions that might affect the privacy of their own data. “Each person owns their medical images,” he says. “They have the right to share them. Yet they should know that if they upload a large set of their medical images to a program like ChatGPT, to try and get a diagnosis, the company running the service may retain copies for their own purposes.”
Patients should be less concerned about sharing their medical images on social media software like Meta/Facebook. “Large size (high resolution) files are not often allowed. Say a patient made their medical images smaller so they could upload them. The quality on a social media program is not good enough for an AI software program to scrape them and then use them to make synthetic CT or MRI images,” Bachir and Tordjman say.
Looking Ahead
The lessons of AI-image generation tools that researchers have already developed clarify what challenges may lie ahead. Bluethgen says the RoentGen team focused on CXRs because of data availability, technical feasibility, and medical relevance.
“They have been released in sufficiently large amounts to train deep learning models very early … CXRs are also 2D images, as opposed to CT studies which are 3D or even 4D. [This makes] them easier to handle on more modest hardware,” Bluethgen says.
From a medical standpoint, CXRs remain arguably the most frequently ordered study type because they are fast to acquire, relatively inexpensive, broadly available, and give health care professionals rapid insights into vital aspects of a patient’s condition. The same task might prove more difficult for medical images that are rare, infrequently ordered, and more expensive. This also explains why patients who upload their medical images to software such as ChatGPT, looking for a quick and clear analysis of their concerns, should not expect AI to replace a radiologist or radiologic technologist.
Tordjman says radiologists may want to use AI-image generation tools to create a digital twin of a patient. “Then they could do virtual control trials for a drug or set of drugs and/or treatment. They would have a mirror image of the patient to evaluate and set a course for progress,” he says.
Colleagues’ opinions of AI-powered technology is a factor as to how many professionals in a field adopt tools, and what reservations they have in doing so. Bluethgen says there was a significantly positive public response and some critical voices when the RoentGen team first published the software in November 2022.
The RoentGen team has shared the model weights (the parameters that store the model’s learned functionality) with over 300 researchers around the world. The Roent-Gen team requires those who receive the model weights to undergo the same training required to access the MIMIC-CXR dataset. This involves signing a data usage agreement and taking a course in responsibly handling biomedical data. The MIMIC-CXR Database is a 377,110-image, publicly available dataset of CXRs in DICOM format, with PHI removed, from radiographic studies performed at Beth Israel Deaconess Medical Center in Boston.
Bluethgen says RoentGen has now also been used as a foundation for further improved models and as a baseline comparison for other groups. Such models are expensive to build from scratch. They can cost more than $100,000. Bluethgen refers to the process of making model weights accessible as “democratizing access.”
“Democratizing access … allows researchers to experiment with state-of-the-art models without expensive hardware,” Bluethgen says. “This is different [from] earlier years. What would have taken a dedicated team of several engineers months or years to develop was possible to create with just a small team within a few weeks of focused work.”
As AI algorithms are analyzed and used more, it is likely that researchers will develop a better idea of how to benefit from them. “No machine learning algorithm will be 100% accurate in all situations. But no medical professional will be either,” Mongan says. “The question is how we can use generated images to develop diagnostic AI that’s more accurate. That’s going to be what will help us as clinicians make better decisions for treatment.”
— Jessica Zimmer is a freelance writer living in northern California. She specializes in covering AI and legal matters.