S IDE -C HANNEL ATTACKS B YPASS P ROTECTION IN 3D P RINTERS
arXiv:2606.13952v1 [cs.CR] 11 Jun 2026
Eric Yocam Department of Computer Science California Polytechnic State University San Luis Obispo, CA 93407, USA Micah Flack Idaho National Laboratory
Varghese Vaidyan Beacom College of Computer and Cyber Sciences Dakota State University Madison, SD 57042 USA
Gurcan Comert Department of Computational Data Science and Engineering North Carolina A&T State University Greensboro, NC 27411, USA Judith L. Mwakalonge Department of Engineering South Carolina State University Orangeburg, SC 29117, USA
June 15, 2026
A BSTRACT Active Motor Noise Cancellation (AMNC) ships in commercial fused deposition modeling (FDM) 3D printers as a hardware countermeasure against acoustic side-channel attacks that target intellectual property (IP). We present the first empirical evaluation of a deployed AMNC countermeasure, using a public dataset of synchronized acoustic and vibration recordings from two AMNC-equipped Bambu Lab printers across 12 object classes. AMNC fully neutralizes the acoustic channel: classification accuracy is indistinguishable from the 8.33% random baseline. The vibration channel, which AMNC does not target, still leaks. With summary statistics the leak is coarse and amplitude-driven (vibration accuracy ≈31% pooled, 36–47% within-printer), while the waveform shape carries essentially nothing (frequency-only features at chance). A full-sequence temporal model that ingests the ordered evolution of the print raises accuracy to ≈61%, and an order-shuffling control (≈33%) shows that a substantial component is genuinely sequential and tied to print progression. The leak is devicespecific: a classifier trained on one printer transfers near chance to the other. We conclude that AMNC is an acoustic-only defense: vibration remains a partial, geometry-correlated side channel it does not address, but one that does not, on this dataset, support full geometric reconstruction; reconstruction-grade attacks would require the magnetic or power channels AMNC also leaves untouched. We release all code. Keywords side-channel attacks · additive manufacturing · vibration analysis · noise cancellation · temporal modeling · cyber-physical security
1
Introduction
Additive manufacturing has grown into a multibillion-dollar industry, and FDM technology now underpins distributed manufacturing ecosystems in which design files cross organizational boundaries to remote or third-party printers [1, 2]. Even when files are encrypted in transit and at rest, the physical printing process leaks information through unintended emanations observable without cyber access [3–5]. Side-channel attacks (SCAs) on 3D printers exploit acoustic noise, mechanical vibration, electromagnetic radiation, power draw, and thermal emission to identify or reconstruct printed geometry [6–8]. Al Faruque et al. [3] demonstrated
A PREPRINT - J UNE 15, 2026
78.35% acoustic axis prediction accuracy; Gatlin et al. [9] achieved 99%+ via the power side channel; Jamarani et al. [10] reached 98.80% by fusing acoustic and magnetic channels; Garza et al. [11] reconstructed G-code from optical video. In response, Bambu Lab deployed AMNC in their A1 Mini and P1P printers, suppressing motor resonance frequencies via adaptive current control [12,13]. AMNC is, to our knowledge, the first commercially deployed hardware countermeasure specifically targeting acoustic side-channel leakage in a consumer FDM printer. By construction it addresses airborne acoustic output only, and not structural vibration, power, or electromagnetic emanation [14]. This paper asks two questions: does AMNC neutralize the acoustic channel it targets, and what does it leave exposed? We answer empirically using the first public dataset collected on AMNC-equipped printers [15, 16]. Our contributions are: 1. To our knowledge, the first empirical evaluation of deployed AMNC. Acoustic attack accuracy under active AMNC is statistically indistinguishable from the 8.33% random baseline, confirming the countermeasure achieves its acoustic goal. 2. Characterization of the vibration channel. Summary-statistic features recover ≈31% pooled accuracy (36–47% within-printer); a feature ablation shows the signal is carried by vibration amplitude, with frequency (waveform-shape) features at chance. 3. A full-sequence temporal attack. Modeling the ordered evolution of the print raises accuracy to ≈61%, and an order-shuffling control (≈33%) establishes that a substantial component is genuinely sequential—evidence of geometry-correlated temporal structure. 4. Device specificity. A classifier trained on one printer transfers near chance to the other, showing the vibration signal is architecture-specific and requires per-device calibration. 5. A bounded security conclusion. AMNC is an acoustic-only defense; vibration remains a partial, geometrycorrelated side channel it does not address, but one that does not support full geometric reconstruction on this dataset. Reconstruction-grade attacks would require the magnetic or power channels AMNC also leaves untouched. We compare this work against prior 3D printer SCA studies in Section 2 (Table 1): no prior work has empirically evaluated a deployed hardware countermeasure on a public dataset.
2
Related Work
A growing body of work shows that 3D printers leak through multiple physical channels. We review them by channel and by defense, then summarize the landscape in Table 1, positioning this study as the first empirical evaluation of a deployed hardware defense on a public dataset. 2.1
Acoustic, Power, and Electromagnetic Channels
The earliest acoustic SCA on a printing system targeted dot-matrix printers [6]. Al Faruque et al. [3] extended acoustic SCAs to FDM printers; Chhetri et al. [17] showed smartphone-based attacks are feasible. Kubiak et al. [18] and Stańczak et al. [19] studied vibration–acoustic shape reconstruction, establishing vibration as an independent leakage channel. Gatlin et al. [9] reconstructed geometry via stepper-motor current; Dolgavin et al. [20] extended power SCAs to industrial PBF machines; Belikovetsky et al. [21] proposed audio signatures for print integrity. Kocher et al. [22] and Genkin et al. [23] established the broader feasibility of power and acoustic physical-channel attacks. 2.2
Multi-Modal, Optical, and Thermal Channels
Costa et al. [24] released a multi-channel dataset from an Ultimaker 3, with the vibration channel independently achieving strong state estimation—consistent with the partial vibration leakage we report. Jamarani et al. [10] fused acoustic and magnetic channels; Streit et al. [25] demonstrated electromagnetic SCA of neural accelerators; Garza et al. [11] reconstructed G-code from optical video; Chhetri et al. [26] pioneered thermal forensics; Liang and Beyah [27] proposed optical defenses. 2.3
Defenses, Integrity, and Evaluation
QuietPrint [14] proposed G-code modification as an acoustic defense; Chhetri et al. [28] proposed leakage-aware G-code generation; Al Faruque et al. [29] patented physical process encryption. Others studied Trojans [30], blockchain 2
A PREPRINT - J UNE 15, 2026
protection [31], physical hashing [32], MitM attacks [33], firmware attacks [34], ML-based detection [35], authentication [36], and broad surveys [5, 8, 37–39]. None of these works, however, empirically evaluates a deployed hardware countermeasure on a public dataset—the gap this paper fills. Table 1: Prior 3D printer SCA research: methodology and scope.
3
Study
Channel(s)
Printer
Defense Eval.
Stat. Test
Dataset
Al Faruque [3] (2016) Chhetri [17] (2016) Kubiak [18] (2020) Gatlin [9] (2021) Costa [24] (2021) Jamarani [10] (2025) Dolgavin [20] (2025) Garza [11] (2025) QuietPrint [14] (2026)
Acoustic Acoustic Acoustic Power Multi Acous.+Mag. Power Optical Acoustic
FDM FDM FDM FDM Ultimaker 3 FDM PBF FDM FDM
No No No No No No No No Yes (acous.)
No No No No No No No No No
Private Private Private Private Public Private Private Private Private
This work (2026)
Acous.+Vib.
Bambu P1P, A1 Mini
Yes (AMNC)
Yes
Public
Threat Model and Experimental Design
This section specifies the adversary we consider and the protocol used to evaluate AMNC. We assume a passive, physically proximate adversary performing closed-set object identification, and we structure the study as five analyses, each with appropriate validity checks. 3.1
Threat Model
The adversary seeks to identify which of a set of known designs is being printed (closed-set classification), operating in physical proximity with one or more passive sensors and no cyber access [3, 10, 17]. A labeled corpus from known print runs on the target device enables supervised classification [9, 14]; the cross-printer experiment in Section 6 tests whether this calibration transfers across devices. We distinguish identification from reconstruction (recovering unknown geometry or G-code), and are explicit about which our results support. 3.2
Experimental Phases
We evaluate (1) acoustic-only under active AMNC and an additional simulated notch filter; (2) vibration-only with summary features; (3) a feature ablation isolating amplitude from frequency content; (4) a full-sequence temporal model with an order-shuffle control; and (5) cross-printer transfer. Each recording is paired with its own capture and treated as a single sample; validity is assessed with grouped cross-validation, Wilson confidence intervals, a label-permutation null, and the order-shuffle control.
4
Dataset and Feature Extraction
This section describes the public dataset, the recording pairing and grouping that underpin all subsequent results, and the acoustic and vibration features extracted for the summary, ablation, and temporal analyses. 4.1
Dataset
We use the Madamopoulos–Tsoutsos 2024 dataset [15, 16] (Zenodo DOI: 10.5281/zenodo.13329934, CC BY 4.0): synchronized iPhone audio and Teensy 4.0 triaxial accelerometer captures on a P1P (core-XY) and an A1 Mini (bed-slinger), covering 12 objects with six paired recordings per object per printer (144 audio–vibration pairs total). Per-object durations span 88–11,273 s (Table 2), reflecting distinct toolpath lengths and movement profiles. 3
A PREPRINT - J UNE 15, 2026
Table 2: Per-object recording duration summary (seconds).
4.2
Object
Mean
Min
Max
01_key_easy 02_key_medium 03_key_hard 04_key_steps 05_2keys 06_Autodesk_FDM_test 07_NIST_additive_test 08_ASTM 09_All_in_1 10_Triple_Helix 11_CaliCat 12_retraction_test
240.8 241.5 239.9 241.8 432.2 5734.8 5177.6 7123.4 6433.0 3269.7 1204.0 325.3
88.3 89.8 88.4 89.8 170.6 2488.5 2089.2 3085.7 2773.7 1404.6 460.4 128.0
543.3 516.6 537.4 529.9 828.8 9064.1 7982.5 11273.3 10189.6 5223.9 2042.0 670.5
Recording Pairing and Cross-Validation
Each recording session stores its audio alongside its own accelerometer capture. We pair each audio file with the capture in its own session folder, giving 144 distinct audio–vibration pairs, and treat each recording as a single labeled sample. For cross-validation we group all samples derived from a given recording so that no recording contributes to both the training and test folds. Algorithm 1 states the evaluation protocol. Algorithm 1 Vibration side-channel evaluation protocol. Require: recordings R; each r has audio ar , vibration capture cr , label yr 1: Pair each ar with the capture cr in its session folder 2: Extract feature vector xr ← F EATURES(cr ) for all r 3: Group gr ← r ▷ samples from the same recording share a group 4: Validate with k-fold cross-validation grouped by g 5: Assess significance via Wilson CIs, a label-permutation null, and—for sequence models—an order-shuffle control 6: return accuracy and validity statistics
4.3
Feature Extraction
Acoustic. Audio is loaded at 16 kHz (30 s cap); we extract 13 MFCCs [40], spectral centroid, bandwidth, rolloff, and zero-crossing rate (mean and std), giving a 32-d vector. We additionally apply a simulated AMNC notch bank at 120–360 Hz (Q ∈ {15, 30, 60}) on top of the active hardware countermeasure. Vibration (summary). Per axis we compute mean, std, RMS, peak-to-peak, and dominant FFT frequency, giving a 15-d vector per recording. Vibration (temporal). For the sequence model we divide each recording into T = 120 ordered segments and compute per-axis std, RMS, peak-to-peak, and dominant frequency per segment, giving an ordered 120 × 12 sequence, z-scored per recording to remove absolute amplitude and isolate temporal shape.
5
Classification and Evaluation
This section specifies the classifiers, the grouped cross-validation, and the significance tests applied throughout the results. Summary-feature attacks use a Random Forest (200 trees) with standardized features and grouped five-fold cross-validation (each recording is one sample). The ablation adds Gradient Boosting, SVM (RBF, C = 10), and KNN (k = 5). The temporal attack uses a dilated 1D-CNN over the full 120-step sequence, averaged over three seeds. Cross-printer transfer trains on one printer and tests on the other. Significance uses Wilson confidence intervals [41], a 200-sample label-permutation null, and the order-shuffle control; we report the binomial test against the 8.33% baseline for comparability but treat the permutation null as the primary validity check. 4
A PREPRINT - J UNE 15, 2026
6
Results
We evaluate the acoustic channel under AMNC, characterize what the vibration channel leaks with summary and temporal features, and close with cross-printer transfer, confusion structure, and model ablation. 6.1
Acoustic Channel under AMNC
Acoustic accuracy under active AMNC is 12.50% (Wilson 95% CI [8.1%, 18.9%]), whose interval encompasses the 8.33% random baseline, and the additional simulated notch leaves it at baseline (9.72%). Across Q ∈ {15, 30, 60} acoustic accuracy stays near chance (Table 3). AMNC neutralizes the acoustic channel it targets. Table 3: AMNC filter sensitivity: acoustic accuracy by quality factor.
6.2
Quality factor Q
Notch width
Accuracy (%)
15 30 60
Broad Medium Narrow
13.19 9.72 10.42
Vibration Channel: Summary Features
The vibration channel leaks a real but modest signal: 31.25% pooled (Wilson 95% CI [24.2%, 39.2%], label-permutation p = 0.005), rising to 36.11% and 47.22% within the A1 Mini and P1P respectively (Figure 1). The pooled permutation null gives p = 0.005 and the within-printer Wilson intervals lie above the 8.33% baseline, confirming a genuine signal, but none approaches reconstruction-grade accuracy.
Figure 1: Accuracy by method. Acoustic sits at chance under AMNC; vibration leaks partially; the full-sequence temporal model recovers the most.
6.3
What the Vibration Channel Leaks
A feature ablation localizes the signal (Figure 2). Amplitude/offset features reproduce nearly all of the summary-feature accuracy (29.17%), while frequency-only features are at chance (6.25%); amplitude features that are stable to recording length (std, RMS) retain 27.08%, ruling out a pure duration artifact. The summary-feature leak is therefore coarse vibration magnitude, not waveform shape. Feature importance (Figure 3) confirms that amplitude statistics dominate. 5
A PREPRINT - J UNE 15, 2026
Figure 2: Feature ablation. Magnitude features carry the signal; frequency-only features are at chance.
Figure 3: Top-10 vibration feature importance (Random Forest, mean decrease in impurity). Amplitude statistics dominate.
6.4
Vibration Channel: Temporal Structure
A full-sequence model that ingests the ordered evolution of the print recovers substantially more: 60.65% ± 2.68 accuracy (seven times chance). Destroying the temporal order collapses this to 32.64% ± 4.54 (Figure 4). The ≈28point gap, far larger than the seed variance, establishes that a major component of the leak is genuinely sequential—the macro-evolution of the print, which is geometry-correlated. This is the strongest signal we obtain and the natural target for future temporal models. 6
A PREPRINT - J UNE 15, 2026
Figure 4: Full-sequence temporal model. Destroying segment order collapses accuracy, confirming a genuine sequential component.
6.5
Cross-Printer Transfer
Training on one printer and testing on the other collapses vibration accuracy to 11.1–12.5%, near chance, confirming that the leak is device-specific: the core-XY and bed-slinger architectures produce different vibration transfer functions, so an attacker must calibrate per device (Figure 5).
Figure 5: Cross-printer transfer. Vibration leakage is device-specific.
6.6
Confusion Structure and Model Ablation
The confusion matrix (Figure 6) shows graded, geometry-plausible confusions across the 12 classes. The signal is also model-dependent in the expected way: tree ensembles lead, while margin- and distance-based classifiers trail (Table 4). 7
A PREPRINT - J UNE 15, 2026
Figure 6: Confusion matrix (pooled vibration). Graded, geometry-plausible confusions across the 12 classes.
Table 4: Classifier ablation, vibration summary features. Classifier
Accuracy (%)
Random Forest Gradient Boosting SVM (RBF) KNN (k = 5)
7
31.25 21.53 9.03 11.11
Discussion: Security Implications
The results carry three practical implications, each scoped to what the measurements support. First, AMNC should be understood as an acoustic-only control: it neutralizes the channel it targets but leaves structural vibration untouched, so a defender who treats AMNC as a general side-channel countermeasure is exposed on a channel it never covered. Mitigating vibration requires dedicated measures—chassis–level isolation (damping feet, anti-vibration mounts), randomized stepper-acceleration profiles that de-correlate motion from toolpath geometry, or active vibration masking—each of which trades against print quality, speed, or hardware cost and therefore warrants explicit cost-benefit analysis before deployment. Second, the device-specificity of the leak is itself a defensive lever: because vibration signatures do not transfer across printer architectures (Section 6), a heterogeneous printer fleet imposes a per-device calibration cost on the attacker and provides partial natural protection that a homogeneous fleet does not. Third, the threat demonstrated here is closed-set identification— confirming which of a set of known designs is on the bed—rather than reconstruction of unknown geometry. This is a meaningful but bounded risk: it supports monitoring or espionage against a known design catalog, not theft of arbitrary IP. The temporal result, however, shows that geometry-correlated information survives into the vibration channel, marking identification as a floor rather than a ceiling and pointing to reconstruction as the natural escalation (Section 9). 8
A PREPRINT - J UNE 15, 2026
8
Limitations
This study has four principal limitations. First, the evaluation covers two FDM printers from a single manufacturer (144 recordings, 12 classes), so results are scoped to within-printer, within-dataset conditions and should not be extrapolated to arbitrary devices; the cross-printer collapse confirms vibration signatures are architecture-specific. Second, AMNC is active in hardware throughout collection with no user-accessible off switch, so we report acoustic accuracy under AMNC rather than a causal on/off reduction, and the simulated notch bank models only provide incremental suppression. Third, 144 recordings across 12 classes is modest and bounds the capacity and confidence of the temporal model; we mitigate this with grouped cross-validation, Wilson confidence intervals, a label-permutation null, multi-seed estimates, and the order-shuffle control. Fourth, the task is closed-set identification: the temporal result shows that geometry-correlated information survives into the vibration channel but does not demonstrate geometric reconstruction.
9
Future Work
Five directions follow from the results and address the limitations above directly. (1) Scale and diversity: a larger corpus spanning additional manufacturers, printer architectures, and non-FDM processes (SLA, SLS, PBF), the route to external validity beyond the two devices studied here [8,37]. (2) Reconstruction: sequence-to-sequence regression from vibration onto toolpath or G-code with ground truth is the proper test of whether the geometry-correlated temporal signal supports recovery rather than identification [11]. (3) Uncovered channels: joint collection of the magnetic and power channels that AMNC’s does not suppress is the likely route to reconstruction-grade recovery and a direct test of AMNC’s completeness [9, 10]. (4) Stronger temporal models and a causal AMNC study: attention or reservoir-computing architectures over the full trajectory could push the ordered-temporal signal past the convolutional baseline, and an AMNC on/off study on instrumentable hardware could quantify the causal acoustic reduction. (5) Vibration-specific defenses with quantified trade-offs: chassis damping, randomized acceleration profiles, and active vibration masking, each evaluated for their measured cost in print quality, speed, and hardware overhead, so that mitigation can be chosen against a concrete security-versus-performance budget [14, 28].
10
Conclusion
AMNC does what it is designed to do: under active cancellation the acoustic channel is indistinguishable from chance. It is, however, an acoustic-only defense. The vibration channel it ignores still leaks—coarsely through amplitude statistics, and more strongly through the ordered temporal evolution of the print, where a full-sequence model reaches ≈61% with a confirmed sequential component. That signal is device-specific and does not, on this dataset, support full geometric reconstruction; reconstruction-grade attacks would require the magnetic or power channels that AMNC also leaves untouched. Securing additive manufacturing against IP theft therefore calls for countermeasures that address structural vibration, not acoustic emission alone. We release all code to support further study.
Acknowledgment Dataset: Zenodo DOI 10.5281/zenodo.13329934. sidechannel_poc.
Code:
https://github.com/ericyoc/3d_printer_
References [1] Mark Yampolskiy, Jacob Gatlin, Anthony Skjellum, and Yuval Elovici. Intellectual property protection in additive layer manufacturing: Requirements for secure outsourcing. In Proceedings of the 4th Program Protection and Reverse Engineering Workshop (PPREW-4). ACM, 2014. [2] Mark Yampolskiy, Wayne E. King, Jacob Gatlin, Sofia Belikovetsky, Adam Brown, Anthony Skjellum, and Yuval Elovici. Security of additive manufacturing: Attack taxonomy and survey. Additive Manufacturing, 21:431–457, 2018. [3] Mohammad Abdullah Al Faruque, Sujit Rokka Chhetri, Arquimedes Canedo, and Jiang Wan. Acoustic sidechannel attacks on additive manufacturing systems. In 2016 ACM/IEEE 7th International Conference on Cyber-Physical Systems (ICCPS), pages 1–10. IEEE, 2016. [4] Sujit Rokka Chhetri and Mohammad Abdullah Al Faruque. Side channels of cyber-physical systems: Case study in additive manufacturing. IEEE Design & Test, 34(4):18–25, 2017. 9
A PREPRINT - J UNE 15, 2026
[5] Steven E. Zeltmann, Nikhil Gupta, Nektarios Georgios Tsoutsos, Michail Maniatakos, Jeyavijayan Rajendran, and Ramesh Karri. Manufacturing and security challenges in 3D printing. JOM, 68(7):1872–1881, 2016. [6] Michael Backes, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder. Acoustic sidechannel attacks on printers. In Proceedings of the 19th USENIX Security Symposium, pages 307–322, Washington, DC, 2010. USENIX Association. [7] Sujit Rokka Chhetri, Jiang Wan, and Mohammad Abdullah Al Faruque. Side-channel analysis of cyber-physical systems: Case study on additive manufacturing. In 2016 ACM/IEEE 7th International Conference on CyberPhysical Systems (ICCPS). IEEE, 2016. [8] Nikhil Gupta, Nektarios Georgios Tsoutsos, and Ramesh Karri. Cybersecurity of additive manufacturing. IEEE Design & Test, 37(2):77–84, 2020. [9] Jacob Gatlin, Sofia Belikovetsky, Yuval Elovici, Anthony Skjellum, Joshua Lubell, Paul Witherell, and Mark Yampolskiy. Encryption is futile: Reconstructing 3D-printed models using the power side-channel. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), pages 135–147. ACM, 2021. [10] Amirhossein Jamarani, Yazhou Tu, and Xiali Hei. Practitioner paper: Decoding intellectual property: Acoustic and magnetic side-channel attack on a 3D printer. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, 622:54–74, 2025. [11] Marco E. Garza et al. One video to steal them all: 3D-printing IP theft through optical side-channels. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2025. [12] Bambu Lab. Active motor noise cancellation – A1 Mini feature overview, 2023. Product documentation, https://bambulab.com. [13] Notebookcheck. Bambu lab adds motor noise cancellation to X1 series 3D printers with new firmware update, 2023. https://www.notebookcheck.net, accessed June 2026. [14] Seyed Ali Ghazi Asgar and Narasimha Reddy. QuietPrint: Protecting 3D printers against acoustic side-channel attacks. In arXiv preprint arXiv:2602.02198, 2026. [15] Christos Madamopoulos and Nektarios Georgios Tsoutsos. 3D printer audio and vibration side channel dataset for vulnerability research in additive manufacturing security. Data in Brief, 57:111002, 2024. [16] Christos Madamopoulos and Nektarios Georgios Tsoutsos. 3D printer audio and vibration side channels, 2024. Dataset, https://doi.org/10.5281/zenodo.13329934. [17] Sujit Rokka Chhetri, Arquimedes Canedo, and Mohammad Abdullah Al Faruque. My smartphone knows what you print: Exploring smartphone-based side-channel attacks against 3D printers. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 895–907. ACM, 2016. [18] Ireneusz Kubiak, Artur Przybysz, and Andrzej Stańczak. Usefulness of acoustic sounds from 3D printers in an eavesdropping process and reconstruction of printed shapes. Electronics, 9(2):297, 2020. [19] Andrzej Stańczak, Ireneusz Kubiak, Artur Przybysz, and Anna Witenberg. Acoustic emission analysis for additive manufacturing side-channel research. Electronics, 10(3):312, 2021. [20] Aleksandr Dolgavin, Jacob Gatlin, Moti Yung, and Mark Yampolskiy. Turning hearsay into discovery: Industrial 3D printer side channel information translated to stealing the object design. In arXiv preprint arXiv:2509.18366, 2025. [21] Sofia Belikovetsky, Yosef A. Solewicz, Mark Yampolskiy, Jinghui Toh, and Yuval Elovici. Digital audio signature for 3D printing integrity. IEEE Transactions on Information Forensics and Security, 14(5):1127–1141, 2018. [22] Paul Kocher, Joshua Jaffe, Benjamin Jun, and Pankaj Rohatgi. Introduction to differential power analysis. Journal of Cryptographic Engineering, 1(1):5–27, 2011. [23] Daniel Genkin, Adi Shamir, and Eran Tromer. RSA key extraction via low-bandwidth acoustic cryptanalysis. In Advances in Cryptology – CRYPTO 2014, pages 444–461. Springer, 2014. [24] Nathan Costa, Shih-Yuan Yu, Arnav Malawade, Sujit Chhetri, and Mohammad Abdullah Al Faruque. SideChannel3D: Acoustic, vibration, magnetic, and power side-channel 3D printer dataset. In IEEE DataPort, 2021. [25] Franz Josef Streit, Benedikt Kraß, Lukas Bauer, and Jörg Henkel. Electromagnetic side-channel analysis of neural network accelerators. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 42(11):3787–3800, 2023. 10
A PREPRINT - J UNE 15, 2026
[26] Mohammad Abdullah Al Faruque, Sujit Rokka Chhetri, Sina Faezi, and Arquimedes Canedo. Forensics of thermal side-channels in additive manufacturing systems. In Technical Report, University of California Irvine, 2016. [27] Sizhuang Liang and Raheem Beyah. Hiding my real self! protecting intellectual property in additive manufacturing systems against optical side-channel attacks. IEEE Transactions on Information Forensics and Security, 2023. [28] Sujit Rokka Chhetri, Sina Faezi, and Mohammad Abdullah Al Faruque. Fix the leak! an information leakage aware secured cyber-physical manufacturing system. In Design, Automation & Test in Europe (DATE), pages 1328–1333. IEEE, 2017. [29] Mohammad Abdullah Al Faruque, Sujit Rokka Chhetri, and Jiang Wan. Defending side channel attacks in additive manufacturing systems, 2019. U.S. Patent US10,212,185 B1. [30] Hammond Pearce, Kaushik Yanamandra, Nikhil Gupta, and Ramesh Karri. FLAW3D: A trojan-based cyber attack on the physical outcomes of additive manufacturing. IEEE/ASME Transactions on Mechatronics, 27(6):5361–5370, 2022. [31] Zhibo Shi, Chen Kan, Wei Tian, and Chen Liu. A blockchain-based G-code protection approach for cyber-physical security in additive manufacturing. Journal of Computing and Information Science in Engineering, 21(4):041007, 2021. [32] Joshua Brandman, Logan Sturm, Jules White, and Christopher Williams. A physical hash for preventing and detecting cyber-physical attacks in additive manufacturing systems. Journal of Computing and Information Science in Engineering, 23(1):011007, 2023. [33] Hamza Alkofahi, Heba Alawneh, and Anthony Skjellum. MitM attacks on intellectual property and integrity of additive manufacturing systems: A security analysis. Computers & Security, 140:103810, 2024. [34] Muhammad Haris Rais, Muhammad Ahsan, and Irfan Ahmed. SOK: 3D printer firmware attacks on fused filament fabrication. In Proceedings of the 18th USENIX Conference on Offensive Technologies (WOOT’24). USENIX Association, 2024. [35] Mingjie Wu, Zhuoran Song, and Young B. Moon. Detecting cyber-physical attacks in additive manufacturing using machine learning. Journal of Intelligent Manufacturing, 30(3):1537–1549, 2019. [36] Dimitris Mouris and Nektarios Georgios Tsoutsos. NFTs for 3D models: Sustaining ownership in industry 4.0. IEEE Consumer Electronics Magazine, 13(5):13–22, 2024. [37] Nektarios Georgios Tsoutsos, Nikhil Gupta, and Ramesh Karri. Cybersecurity road map for digital manufacturing. Computer, 53(9):80–84, 2020. [38] Sofia Belikovetsky, Mark Yampolskiy, Jinghui Toh, Jacob Gatlin, and Yuval Elovici. dr0wned – cyber-physical attack with additive manufacturing. In 11th USENIX Workshop on Offensive Technologies (WOOT). USENIX Association, 2017. [39] Jian Xing, Yanping Zhong, Mi Wen, and Jiankun Hu. A survey on machine learning-based side-channel analysis. IEEE Access, 9:63307–63322, 2021. [40] Steven Davis and Paul Mermelstein. Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences. IEEE Transactions on Acoustics, Speech, and Signal Processing, 28(4):357–366, 1980. [41] Edwin B. Wilson. Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158):209–212, 1927.
11