Pith. sign in

REVIEW 3 major objections 4 minor 2 cited by

Never Trust the Manufacturer, Never Trust the Client: A Novel Method for Streaming STL Files for Secure Additive manufacturing

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proposes layer-by-layer streaming of STL files so neither the manufacturer sees the full design nor the client supplies machine-control G-code.

desk verdict A working STL-streaming printer pipeline with a security claim that fails under the paper's own threat model: the manufacturer can just keep the slices. read the letter →

arxiv 2507.06421 v2 pith:6SQY2JKK submitted 2025-07-08 cs.CR

Seyed Ali Ghazi Asgar , Narasimha Reddy , Satish T.S. Bukkapatnam This is my paper · ORCID
classification cs.CR
keywords additivemanufacturingsecuritySTLstreamingintellectualpropertyprotectionG-codeasaservicecyber-physicalsystems3Dprintinglayer-wiseslicing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a 3D-printing client and a manufacturer can do business without either side surrendering its intellectual property. The mechanism is to replace the two usual vulnerable exchanges—the full STL design file or a ready-made G-code program—with a stream of horizontal STL layers: the client cuts its design into layer-height sections and sends them one at a time, and the manufacturer converts each section into its own machine-specific G-code and prints it before requesting the next. If the scheme works, a manufacturing-as-a-service platform can run on mutual distrust, because the manufacturer never holds the entire geometry at once and the client never injects motion commands that could damage or seize control of the machine. The authors validate the workflow with real prints of a gear and a support-requiring part, reporting dimensional agreement around ±0.3 mm and tensile peak loads within a few percent of conventional printing. The design-IP guarantee rests on the manufacturer discarding each layer after use, an assumption the paper itself flags as a limitation.

What carries the argument

The carrying mechanism is a pair of complementary slicing routines. The client-side routine orients the part, bakes support geometry into the mesh, and cuts the STL along horizontal planes separated by the agreed layer height h, producing k STL sections plus a configuration file holding designer choices such as infill. The manufacturer-side routine deletes any previously stored STL and G-code files, slices each incoming section with the local machine configuration, increments the Z-offset by h for the next section, removes redundant start-up and shut-down commands, and feeds the G-code to the printer over a serial connection while a separate thread already fetches and converts the following layer. A fixed rectangular guideline border added to every section prevents the slicer from shifting successive layers in the XY plane, and a small printed dot verifies that registration is unchanged.

What would settle it

Monitor the manufacturer-side computer during a streaming print of a known benchmark part and check whether each received STL section is actually erased from disk and memory after slicing; if any layer remains accessible, then a malicious manufacturer can reassemble the complete STL and the design-IP claim fails. A second check is to reconstruct the design from all captured per-layer streams and measure the geometric error against the original mesh.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that dividing an STL mesh into horizontal sections and streaming them one at a time, with the manufacturer performing all G-code generation locally, lets both parties protect IP under mutual distrust. The client never transmits the complete mesh, so a curious manufacturer sees only the current slice, and the manufacturer never executes client-authored G-code, so a malicious client cannot drive the printer into unsafe motion or temperature settings. The print process still works because the manufacturer's translator applies the agreed layer height and an increasing Z-offset to each incoming section, and because supports and alignment aids are pre-embedded in the client's sections. The authors report that the streamed gear and a specially oriented supported part printed successfully, with measured dimensions within about ±0.3 mm of the conventional print and a peak tensile force about 1.9% lower at 100% infill.

Load-bearing premise

The client's design stays secret only if the manufacturer's computer actually discards each received layer and no worker can read its memory; the paper itself says a worker with memory access could save all streamed files and reconstruct the original.

Editorial extensions

If this is right

  • A manufacturing-as-a-service platform could let clients send designs without ever transmitting the complete STL mesh, removing the single-file theft point from the digital thread.
  • Manufacturers would never execute client-supplied G-code, eliminating a class of attacks where malicious or malformed motion commands damage the printer or its output.
  • Process IP such as temperatures, speeds, and toolpath generation stays on the manufacturer's side, since the client only sees machine specifications and the final printed part.
  • Parts needing supports or special orientation can still be printed because support geometry is generated client-side and embedded in each layer, with a guideline border keeping layers registered.
  • Streamed parts remain dimensionally and mechanically close to conventional prints in the authors' tests, with about ±0.3 mm dimensional agreement and roughly 1.9% lower peak tensile force at 100% infill.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The practical security ceiling of this scheme is set by whether layer files are erased inside a memory-isolated controller; putting the translator and printer controller in a trusted execution environment would close the reconstruction loophole the paper names as a limitation.
  • The same layer-wise split of knowledge could apply to mesh formats other than STL, since the essential idea is that the client produces geometry slices while the manufacturer owns toolpath generation.
  • A testable scaling rule emerges from the reported tolerances: accumulated Z-offset error should grow with the number of layers, so tall parts should show larger layer-to-layer misalignment if offset drift is real.
  • A direct extension would stream encrypted or server-distributed layers so that a compromise of any single connection does not expose the whole sequence, weakening the assumption that no malicious worker can collect all slices.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a mutual-distrust manufacturing-as-a-service protocol in which a client splits an STL file into horizontal layer-sized STL sections and streams them one at a time to a manufacturer; the manufacturer slices each received section into machine-specific G-code and prints it. The client supplies a configuration file, and the manufacturer never executes client-authored G-code. The authors claim that this simultaneously protects the client's design IP and the manufacturer's process IP, and they demonstrate a prototype on an Elegoo Neptune 3 FFF printer, including a gear, a part with supports and special orientation, and tensile tests comparing streaming and normal printing. They also introduce a guideline border to maintain layer alignment and a buffering method to mitigate latency-induced nozzle oozing.

Significance. If the central security claim were valid, the paper would be a useful contribution to additive-manufacturing security, addressing a real mutual-distrust problem with a concrete implementation. The mechanical results support basic feasibility: the 100% infill streaming sample broke at 396.27 N versus 404.05 ± 11.59 N for normal prints, a 1.9% difference. The process-IP half of the claim is reasonably credible, because the client never receives G-code. However, the client-design-IP half is not established and is in fact contradicted by the paper's own statements. The protocol has no fitted parameters or circular derivations, and the implementation appears reproducible; the failure is in the threat model rather than in the engineering demonstration.

major comments (3)
  1. [Section 4.1, Section 6, Algorithm 2] The central design-IP claim is contradicted by the paper's own statements. Section 4.1 says that if malicious workers have access to the manufacturer's computer memory, 'it is possible to save all the streamed files together and reconstruct the original file,' and Section 6 concedes that 'a malicious manufacturer can put all these slices together and reconstruct the design file.' In the proposed architecture the manufacturer's computer necessarily receives, buffers, and processes every STL layer; the only countermeasure, Algorithm 2's RemovePrintedfiles(), is executed by the very party the protocol treats as untrusted. The method therefore does not protect design IP from a malicious manufacturer, which is one of the two parties the title and abstract say are not trusted.
  2. [Section 4.1] The assumption 'that malicious workers do not have access to the manufacturer's computer memory' is not a consequence of the Section 3 threat model and effectively removes the manufacturer from the manufacturer-threat scenario. A malicious manufacturer controls its own computer and memory, so this assumption is equivalent to assuming the manufacturer will not accumulate received layers. Since the abstract claims security in a setting where 'the client and manufacturer do not trust each other,' this unenforced trust assumption is load-bearing and invalidates the stated threat model.
  3. [Section 4.1, Figure 3] The claimed protection against communications-related attacks is incomplete. If an attacker can intercept the client-manufacturer channel, the attacker can collect all streamed STL layers and reconstruct the design in the same way as a malicious manufacturer. The paper mentions a 'secure channel' in Figure 3 and distributed servers in Section 4.1, but no cryptographic mechanism, key management, or adversary model for the network is provided or implemented, so confidentiality of the design against network attackers is not demonstrated.
minor comments (4)
  1. [Section 5.3] The text says the second set of samples was printed with '700% infill'; this should presumably be '70% infill.'
  2. [Table 3] Table 3 reports only normal-print trials; the streaming results (396.27 N and 367.35 N) appear only in the text. Reporting repeated streaming trials with standard deviations would strengthen the mechanical-equivalence claim.
  3. [Algorithm 2] In Algorithm 2, line 6 requests the next STL file before line 7 calls RemovePrintedfiles(), so even the intended deletion policy leaves the next layer in memory while previous layers are processed; the algorithm's comments should clarify the intended synchronization and exactly which files are deleted.
  4. [Section 5.1] The paper does not state whether the guideline border and debug dot are removed after printing or remain attached to the part, which affects the practical usability of the method for finished components.

Circularity Check

1 steps flagged · score 6.0 of 10

Design-IP protection claim reduces to the assumption that the untrusted manufacturer will not accumulate the streamed layers; the paper's own limitation section concedes the protocol cannot enforce this.

  1. self definitional [Section 4.1 (Security Advantages of the Proposed Approach) and Section 6 (Conclusions and Future Work)]
    "...since we are minimizing human intervention during printing and limit manufacturer's access to the design file, we enhance the security of the design files against IP theft... we expect that malicious workers do not have access to the manufacturer's computer memory. Otherwise, it is possible to save all the streamed files together and reconstruct the original file. [Section 6:] there is no guarantee that the manufacturer would delete the previous slices and not save all of them together... a malicious manufacturer can put all these slices together and reconstruct the design file."

    The design-IP claim of Section 4.1 is justified only by the expectation that malicious workers lack access to the manufacturer's computer memory; otherwise the streamed files can be saved and reassembled. Yet the protocol sends every STL layer into that computer, making the untrusted manufacturer the party with persistent access to all slices. The claimed security is therefore not a protocol-enforced property; it is logically equivalent to assuming the malicious manufacturer will not accumulate the data the protocol hands it. Section 6 concedes exactly this: a malicious manufacturer can put all slices together and reconstruct the design file.

full rationale

The paper contains no fitted parameters, no numerical predictions, and no derivation chain in the usual sense; its contribution is a streaming protocol plus an experimental demonstration of printability and tensile behavior. The manufacturing-process-IP claim is supported by the protocol design (the client never receives machine-specific G-code) and is not circular. The design-IP claim, however, is circular in structure: the security benefit is asserted from the assumption that malicious workers cannot access the manufacturer's computer memory, despite the protocol transmitting every layer of the design into that same computer. The paper's own Section 6 admits that a malicious manufacturer can save all slices and reconstruct the design file, so the central 'secures design IP' conclusion reduces to an unenforced trust assumption equivalent to the property it claims to provide. No self-citation chain, uniqueness theorem, or renamed known result is load-bearing. Because the circularity affects only the design-IP half of the central claim and the paper is transparent about the limitation, a score of 6 (partial circularity by construction) is appropriate rather than 8 or 10.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numeric parameters are fitted to data: layer height, temperature, infill, and Z-offset increments are chosen configuration values, and the tensile strengths are measurements. No new physical entities are postulated; the guideline border and dot are printed design artifacts, not independent entities in the sense of new particles, forces, or conserved quantities.

assumptions (4)
  • domain assumption Layer-by-layer STL segmentation into horizontal sections preserves the original geometry when printed with Z-offset increments equal to layer height.
    The method relies on slicing the STL mesh by horizontal planes and printing each section on top of the previous one with Z-offset h. No proof of geometric equivalence is given; only two demonstration parts are shown.
  • domain assumption The serial connection between the manufacturer's computer and the AM machine is secure, and malicious workers cannot access the manufacturer's computer memory.
    Stated explicitly in Section 4.1. If these fail, an attacker can sniff the stream or save all layers and reconstruct the design.
  • ad hoc to paper The manufacturer will not accumulate the received STL layers.
    The design-IP claim requires that the manufacturer does not save all slices, but the threat model includes an untrusted manufacturer who might do exactly that. The paper admits this in Section 6, so the assumption does the real work for the security claim.
  • domain assumption Client-side generated supports and a guideline border are sufficient to keep layers aligned and printable without slicer-generated supports.
    The alignment and support strategy is validated on a single complex part; there is no broader evaluation across geometries.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Never Trust the Manufacturer, Never Trust the Client: A Novel Method for Streaming STL Files for Secure Additive manufacturing." pith.science (2026). https://pith.science/paper/6SQY2JKK

@misc{pith2026250706421,
  author       = {Pith},
  title        = {Pith review of: Never Trust the Manufacturer, Never Trust the Client: A Novel Method for Streaming STL Files for Secure Additive manufacturing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6SQY2JKK}},
  note         = {Machine review of arXiv:2507.06421}
}
read the original abstract

While additive manufacturing has opened interesting avenues to reimagine manufacturing as a service (MaaS) platform, transmission of design files from client to manufacturer over networks opens up many cybersecurity challenges. Securing client's intellectual property (IP) especially from cyber-attacks emerges as a major challenge. Earlier works introduced streaming, instead of sharing process plan (G-code) files, as a possible solution. However, executing client's G-codes on manufacturer's machines exposes them to potential malicious G-codes. This paper proposes a viable approach when the client and manufacturer do not trust each other and both the client and manufacturer want to preserve their IP of designs and manufacturing process respectively. The proposed approach is based on segmenting and streaming design (STL) files and employing a novel machine-specific STL to G-code translator at the manufacturer's site in real-time for printing. This approach secures design and manufacturing process IPs as demonstrated in a real-world implementation.

Figures

Figures reproduced from arXiv: 2507.06421 by the authors.

Figure 1
Figure 1. (a) The shares the whole file with the manufacturer. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The workflow of an additive manufacturing chain. In the first step, the file is designed in a CAD application. Then, it [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. First, client asks the manufacturer for the machine specifications. Then, (a) the client designs the file and converts its [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: (a) Sample component with special orientation and [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Manufactured object from (a) streamed data with [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: (a) Dimension of the specimen (D638 V) and printed parts with 100% and 70% infill in normal and streaming methods. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Force/displacement curves for tensile experiment. [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Firewall3D: A Hardware Firewall for Defending 3D Printers Against Firmware Attacks

    cs.CR 2026-07 conditional novelty 6.5 of 10

    A dedicated hardware monitor detects firmware attacks on 3D printers by comparing real-time physical signals (stepper currents, temperatures, fans, endstops) against intended G-code execution.

  2. QuietPrint: Protecting 3D Printers Against Acoustic Side-Channel Attacks

    cs.CR 2026-02 conditional novelty 6.0 of 10

    Rewriting G-code to add decoy head movements can make an acoustic side-channel attacker reconstruct a different shape than the one being printed.

Reference graph

Works this paper leans on

22 extracted references · 22 canonical work pages · cited by 2 Pith papers

  1. [1]

    Dennis Bauer, Daniel Stock, and Thomas Bauernhansl. 2017. Movement towards service-orientation and app-orientation in manufacturing IT. Procedia CIRP 62 (2017), 199–204

    work page 2017

  2. [2]

    F W Baumann, T Ludwig, N Darwin Abele, S Hoffmann, and D Roller. 2017. Model- Data Streaming for Additive Manufacturing Securing Intellectual Property.Smart and Sustainable Manufacturing Systems 1, 1 (2017), 142–152

    work page 2017

  3. [3]

    Fei Chen, DINESH PINISETTY, and Nikhil Gupta. 2021. Embedded Obfuscated Barcodes for Identification of Genuine Additive Manufactured Parts. (2021)

    work page 2021

  4. [4]

    Tarasankar DebRoy, Huiliang L Wei, James S Zuback, Tuhin Mukherjee, John W Elmer, John O Milewski, Allison Michelle Beese, A de Wilson-Heid, Amitava De, and Wei Zhang. 2018. Additive manufacturing of metallic components–process, structure and properties. Progress in materials science 92 (2018), 112–224

    work page 2018

  5. [5]

    Ian Gibson, David W Rosen, Brent Stucker, Mahyar Khorasani, David Rosen, Brent Stucker, and Mahyar Khorasani. 2021. Additive manufacturing technologies. Vol. 17. Springer

    work page 2021

  6. [6]

    Nikhil Gupta, Akash Tiwari, Satish T S Bukkapatnam, and Ramesh Karri. 2020. Additive Manufacturing Cyber-Physical System: Supply Chain Cybersecurity and Risks. IEEE Access 8 (2020), 47322–47333. doi:10.1109/ACCESS.2020.2978815

    work page arXiv 2020

  7. [7]

    Abhiram Haridas, Adil Abdul Samad, Vysakh D, Deepak Lawrence K, and Vinod Pathari. 2022. A blockchain-based platform for smart contracts and intellectual property protection for the additive manufacturing industry. In 2022 IEEE Inter- national Conference on Signal Processing, Informatics, Communication and Energy Systems (SPICES), Vol. 1. 223–230. doi:10....

    work page arXiv 2022

  8. [8]

    Ashif Sikandar Iquebal, Zimo Wang, Woo-Hyun Ko, Zhujiang Wang, P R Kumar, Arun Srinivasa, and Satish T S Bukkapatnam. 2018. Towards realizing cyber- manufacturing kiosks: Quality assurance challenges and opportunities. Procedia Manufacturing 26 (2018), 1296–1306

    work page 2018

Show all 22 references
  1. [9]

    Thomas Kurfess and William J Cass. 2014. Rethinking additive manufacturing and intellectual property protection. Research-Technology Management 57, 5 (2014), 35–42

    2014

  2. [10]

    Priyanka Mahesh, Akash Tiwari, Chenglu Jin, Panganamala R Kumar, A L Narasimha Reddy, Satish T S Bukkapatanam, Nikhil Gupta, and Ramesh Karri. 2020. A survey of cybersecurity of digital manufacturing. Proc. IEEE 109, 4 (2020), 495–516

    2020

  3. [11]

    Hammond Pearce, Kaushik Yanamandra, Nikhil Gupta, and Ramesh Karri. 2022. FLAW3D: A Trojan-Based Cyber Attack on the Physical Outcomes of Additive Manufacturing. IEEE/ASME Transactions on Mechatronics 27, 6 (2022), 5361–5370. doi:10.1109/TMECH.2022.3179713

    2022

  4. [12]

    Gaurav Prashar, Hitesh Vasudev, and Dharam Bhuddhi. 2023. Additive manufac- turing: expanding 3D printing horizon in industry 4.0. International Journal on Interactive Design and Manufacturing (IJIDeM) 17, 5 (2023), 2221–2235

    2023

  5. [13]

    Alessandro Ranellucci. [n. d.]. GitHub - slic3r/Slic3r: Open Source toolpath generator for 3D printers — github.com. https://github.com/slic3r/Slic3r

  6. [14]

    Bukkapatnam

    Akash Tiwari, A L Narasimha Reddy, and Satish T S. Bukkapatnam. 2020. Cyber- security assurance in the emerging manufacturing-as-a-service (MaaS) paradigm: A lesson from the video streaming industry.Smart and Sustainable Manufacturing Systems 4, 3 (2020), 324–329

    2020

  7. [15]

    Akash Tiwari, Eduardo Jose Villasenor, Nikhil Gupta, Narasimha Reddy, Ramesh Karri, and Satish T S Bukkapatnam. 2021. Protection against counterfeiting attacks in 3D printing by streaming signature-embedded manufacturing process instructions. In Proceedings of the 2021 Worksho...

    2021

  8. [16]

    Syed A M Tofail, Elias P Koumoulos, Amit Bandyopadhyay, Susmita Bose, Lisa O’Donoghue, and Costas Charitidis. 2018. Additive manufacturing: scientific and technological challenges, market uptake and opportunities. Materials today 21, 1 (2018), 22–37

    2018

  9. [17]

    Tullio Antonio Maria Tolio, László Monostori, József Váncza, and Olaf Sauer

  10. [18]

    Mark Warren. 2015. Modern IP theft and the insider threat. Computer Fraud & Security 2015, 6 (2015), 5–10

    2015

  11. [19]

    Massimo Zanardini, Andrea Bacchetti, Simone Zanoni, and Milad Ashourpour

  12. [20]

    Steven Eric Zeltmann, Nikhil Gupta, Nektarios Georgios Tsoutsos, Michail Ma- niatakos, Jeyavijayan Rajendran, and Ramesh Karri. 2016. Manufacturing and security challenges in 3D printing. Jom 68, 7 (2016), 1872–1881

    2016

  13. [2016]

    Procedia CIRP 47 (2016), 543–548

    Additive manufacturing applications in the domain of product service system: An empirical overview. Procedia CIRP 47 (2016), 543–548

    2016

  14. [2023]

    CIRP Annals 72, 2 (2023), 697–723

    Platform-based manufacturing. CIRP Annals 72, 2 (2023), 697–723

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.