Source-linked AI summary
Engineering Attack Vectors and Detecting Anomalies in Additive Manufacturing
Md Mahbub Hasan, Marcus Sternhagen, Krishna Chandra Roy
TL;DR
Networked additive manufacturing faces stealthy attacks on G-code that can escape static validation, while detection without reference models remains a challenge. The paper implements attacks and an unsupervised IDS that analyzes printer logs, and reports validated attack feasibility and defense efficacy on two printer platforms.
Problem
Detecting stealthy G-code attacks without a golden reference remains a challenge, although instruction changes can evade visual inspection and basic geometry checks.
Source: §1 · p. 2Method
The IDS learns embeddings from benign printer logs using a frozen MiniLM encoder and contrastive learning, then applies clustering and a self-attention autoencoder.
Source: §1 · pp. 2–3, §5.3 · p. 12Results
Experiments on Creality K1 Max and Ender 3 validated the feasibility of the attacks and the efficacy of the defense model.
Source: §9 · p. 17Takeaways & Limitations
The approach uses structured printer logs without labeled attack data or golden STL/G-code references.
Source: §1 · p. 3The system assumes structured, timestamp-aligned logs, and attacks that barely perturb telemetry, such as IP theft without extrusion anomalies, may remain undetected.
Source: §9 · pp. 17–18
Abstract
from arXiv · showhide
Additive manufacturing (AM) is rapidly integrating into critical sectors such as aerospace, automotive, and healthcare. However, this cyber-physical convergence introduces new attack surfaces, especially at the interface between computer-aided design (CAD) and machine execution layers. In this work, we investigate targeted cyberattacks on two widely used fused deposition modeling (FDM) systems, Creality's flagship model K1 Max, and Ender 3. Our threat model is a multi-layered Man-in-the-Middle (MitM) intrusion, where the adversary intercepts and manipulates G-code files during upload from the user interface to the printer firmware. The MitM intrusion chain enables several stealthy sabotage scenarios. These attacks remain undetectable by conventional slicer software or runtime interfaces, resulting in structurally defective yet externally plausible printed parts. To counter these stealthy threats, we propose an unsupervised Intrusion Detection System (IDS) that analyzes structured machine logs generated during live printing. Our defense mechanism uses a frozen Transformer-based encoder (a BERT variant) to extract semantic representations of system behavior, followed by a contrastively trained projection head that learns anomaly-sensitive embeddings. Later, a clustering-based approach and a self-attention autoencoder are used for classification. Experimental results demonstrate that our approach effectively distinguishes between benign and compromised executions.
1 Introduction
The introduction identifies stealthy G-code manipulation as a gap in detecting attacks on networked additive-manufacturing systems. It presents multi-scenario attacks and an unsupervised, log-based IDS as the paper’s response.
1 Introduction
- Prior detection approaches leave a gap in finding real-time, stealthy G-code attacks without predefined attacker models, static analysis, or a golden reference.G-code changes can alter toolpaths, extrusion, or timing without violating basic geometry constraints or triggering visual inspection.Source: §1 · p. 2
- The study implements three attack strategies across five sabotage scenarios on Creality K1 Max and Ender 3 printers with distinct architectures.The strategies are Deferred Print Exploit, Access-Jammed G-code Swap, and Execution-Phase Tampering; scenarios include extrusion changes, noisy injection, dimensional changes, and cavity insertion.Source: §1 · p. 2
- The proposed IDS learns benign-log embeddings with a frozen MiniLM encoder and contrastive learning, then uses clustering and a self-attention autoencoder to detect deviations.The autoencoder flags samples with high reconstruction loss; training does not require annotated attack data or golden STL/G-code references.Source: §1 · pp. 2–3
- The approach shifts the focus from static design-level validation to dynamic runtime anomaly detection.It analyzes structured telemetry and execution logs produced by the printer.Source: §1 · p. 3
2 Background and Preliminaries
The background traces how a digital model becomes executable G-code, then describes the two printer architectures and the G-code-layer attack surface. Both systems provide points where uploaded instructions can be intercepted or manipulated.
2.1 3D Printing Workflow
- A CAD model is exported as an STL mesh, sliced into layers, and converted into G-code instructions for motion, extrusion, temperature, and timing.The printer uploads and executes the G-code line by line.Source: §2.1 · p. 3
2.2 K1 Max & Ender 3: Architecture
- The K1 Max routes uploads through web frontends and Moonraker to Klipper, while the Ender 3 uses OctoPrint on a Raspberry Pi to relay commands over USB.The K1 Max host communicates with its microcontroller over serial; OctoPrint is the Ender 3’s controller and relay.Source: §2.2 · p. 4
2.3 Attack Surface
- The threat model places an attacker between user and firmware through network, proxy-interface, or filesystem access to manipulate G-code.Table 1 identifies the G-code categories used in the implemented attack scenarios.Source: §2.3 · p. 4, Table 1 · p. 5
3 Related Work
Related work covers attacks on design files, G-code, firmware, side channels, and networked printers, alongside monitoring and reconstruction defenses. The paper positions its contribution as a multi-point threat model paired with unsupervised runtime anomaly detection.
3 Related Work
- Prior studies show that STL edits can evade inspection, while G-code manipulations can be difficult to detect without golden models [3] [7].Tsoutsos et al. proposed reconstructing approximate models from toolpaths and assessing structural soundness with FEA.Source: §3 · p. 5
- Other work examines firmware attacks, side-channel leakage, IP protection, and network attack-path assessment through C3PO.These lines address persistent firmware compromise, reconstruction from emissions, and security of IP-sensitive manufacturing.Source: §3 · pp. 5–6
- Defenses include sensor-based process monitoring, statistical mappings between emissions and G-code, and laboratory attack modeling.The paper contrasts these single-vector approaches with a threat model spanning multiple intrusion points and log-embedding-based anomaly detection.Source: §3 · p. 6
4 Attack Strategy
The attack strategy assumes root access to a printer host and uses a rogue interface to observe operations and alter G-code. Attacks can replace uploaded files, tamper with an active print, sabotage part structure, or steal design files.
4.1 Assumptions
- The threat model assumes root-level host access through compromised credentials; lab tests used brute-force and dictionary attacks on systems with weak passwords and SSH rate limiting disabled.The authors frame this compromise as a feasible, reproducible starting point for downstream attacks.Source: §4.1 · pp. 6–7
4.2 Rogue Interface and Attacks
- After access, a rogue interface acts as a transparent proxy, observing uploads, print progress, temperatures, logs, and configuration changes through the print-server API.The authors state that this stealth layer bypasses traditional network-layer monitoring and supports downstream G-code manipulation.Source: §4.2 · p. 7
- Deferred Print Exploit replaces a file after upload, while Access-Jammed G-code Swap briefly locks it during modification before restoring its name.The jammed swap blocks access for 5 to 10 seconds to reduce the chance that printing begins before replacement.Source: §4.2 · p. 8
- Execution-Phase Tampering replaces the G-code for an active job after a typical 2-to-5-minute delay, modifying only its remaining layers.Targeting later layers can make anomalies less apparent during early inspection, according to the passage.Source: §4.2 · p. 8
- With filesystem access, an attacker can exfiltrate G-code or STL derivatives, recover manufacturing information, and reproduce designs on remote printers.The passage highlights particular risk to aerospace, biomedical, and defense manufacturing.Source: §4.2 · pp. 8–9
- G-code sabotage includes under- or over-extrusion, noisy motion commands, coordinate scaling, and skipped extrusion that inserts internal cavities.These changes can weaken bonding, distort dimensions, disrupt motion or thermal control, or reduce load-bearing capacity while leaving external geometry intact.Source: §4.2 · p. 9
5 Defense Methodology
The defense collects printer logs from benign and malicious runs, filters redundant features, and detects anomalies from learned log embeddings. It combines clustering with a self-attention autoencoder for complementary anomaly scoring.
5.1 Data Collection
- Printer logs were collected during benign workflows and malicious scenarios.Figure 3 depicts the K1 Max and Ender 3 printing during an attack.Source: §5.1 · p. 9, Figure 3 · p. 10
5.2 Feature Selection
- Feature selection removes benign-dataset features with variance below 0.01, then prunes remaining pairs with Pearson correlation above 0.95.The initial feature set covers printing state, thermal stability, communication health, and system workload.Source: §5.2 · p. 10
5.3 Model Architecture
- Reduced log records become sentence-like strings, pass through a frozen Transformer encoder, and map to 128-dimensional embeddings with a contrastively trained projection head.The projection head is trained on benign log lines and synthetically perturbed versions.Source: §5.3 · pp. 10–11
- K-Means centroids learned from benign embeddings support detection by flagging test embeddings with high minimum Euclidean distance to a centroid.PCA and UMAP are used to visually validate clustering boundaries.Source: §5.3 · pp. 11–12
- A self-attention autoencoder compresses embeddings to an 8-dimensional latent space, reconstructs them, and flags errors above the 95th-percentile benign threshold as anomalous.Its single-head attention captures interactions among embedding features.Source: §5.3 · pp. 12–13
6 Experimental Analysis
The experiments used a Klipper-based K1 Max and an Ender 3 setup to assess attack portability. Attack categories were excluded from training, which used benign log windows and no attack labels.
6.1 Experimental Setup:
- The K1 Max used Klipper, Moonraker, and Fluidd/Mainsail; an Ender 3 with Raspberry Pi 4 and OctoPrint validated attack portability across control stacks.Both printers shared a LAN with the attacker host.Source: §6.1 · p. 13
6.2 Dataset Description
- All attack categories were excluded from training to simulate zero-day detection, and class proportions were chosen for diversity and to avoid attack-specific bias.Table 3 presents the training and validation distribution, but the supplied passage gives no cell values.Source: §6.2 · p. 14, Table 3 · p. 14
6.3 Training Details
- Training used 98,720 benign log samples in fixed-length windows, with a frozen 384-dimensional MiniLM encoder and a projection head mapping embeddings to 128 dimensions.The model trained for 25 epochs on benign data only, with Adam at a 1×10−4 learning rate and batch size 64.Source: §6.3 · p. 14
7 Qualitative Evaluation
Across both printer platforms, attacks produced physical defects, although dimensional manipulation could remain visually plausible. Extrusion attacks also changed printed-object mass in consistent directions.
7 Qualitative Evaluation
- Cavity insertion left missing internal material and incomplete infill, while noise injection caused stringing, irregular paths, and chaotic surfaces.These effects were described for both Creality K1 Max and Ender-3 prints.Source: §7 · p. 14
- A 98% scale could escape naked-eye detection while potentially impairing fit and function in mechanical assemblies.Source: §7 · p. 15
- Under-extrusion lowered K1 Max mass from 6.03g to 4.32g and Ender-3 mass from 5.80g to 4.60g; over-extrusion raised them to 9.00g and 8.54g.The passage reports these weights as benign, under-extrusion, and over-extrusion samples, respectively, for each printer.Source: §7 · p. 15
8 Quantitative Evaluation
The self-autoencoder achieved strong reported classification metrics, while clustering visualizations showed separation between benign and anomalous embeddings. Reconstruction errors also differed by class and relative to the selected threshold.
8.1 Clustering Results
- K-Means separated benign and anomalous embeddings along PCA-1, with UMAP showing even more pronounced separation.Source: §8.1 · p. 16
8.2 Classification- Reconstruction Error:
- The anomaly threshold was 0.0019, set at the 95th percentile of reconstruction errors on benign validation data.Source: §8.2 · p. 16
- 95.37% accuracy, 90.55% precision, 96.14% recall, 93.26% F1-score, and 0.98 AUC were reported for the self-autoencoder.Source: §8.2 · p. 16, Table 4 · p. 17
- 94.99% of benign samples were correctly classified, while 5.01% were marked as attacks; 96.14% of attack samples were identified as malicious.Source: §8.2 · p. 16, Table 5 · p. 17
- Benign samples had tightly grouped reconstruction errors centered lower, while attack samples had right-shifted distributions with greater spread.Source: §8.2 · p. 17
- Across test samples, benign errors stayed below the threshold, while attack errors frequently crossed it.Source: §8.2 · p. 17
9 Conclusion
The study reports feasible attacks and an effective unsupervised log-based detection framework on Creality K1 Max and Ender 3 printers. It also identifies log availability and subtle telemetry changes as limits on detection.
9 Conclusion
- Experiments on Creality K1 Max and Ender 3 validated the feasibility of attacks and the efficacy of an unsupervised framework using contrastive representations and structured-log analysis.Source: §9 · p. 17
- The system assumes structured, timestamp-aligned logs, which may be unavailable in proprietary or closed-source firmware environments.Source: §9 · p. 17
- Stealthy attacks that do not significantly perturb telemetry, such as subtle IP theft without extrusion anomalies, may remain undetected.Source: §9 · pp. 17–18