REVIEW 4 major objections 6 minor 3 cited by
QuietPrint: Protecting 3D Printers Against Acoustic Side-Channel Attacks
T0 review · 4 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash
Pith's one-line read Extending every print move to a bounding box lets a 3D printer hide its true shape from acoustic side-channel attacks using only G-code edits.
desk verdict Novel G-code decoy defense with a real promise, but the security claim hinges on an untested assumption about extrusion-state leakage. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central mechanism is Stealth Head Movement (SHM): for each G-code move, compute a collinear extension point on the boundary of a bounding rectangle around the object, add that move to the G-code, then move back to the next original point. The sudden acoustic spikes from direction changes are thereby displaced to the rectangle's boundary, and fan-noise-derived position estimates trace the decoy shape. Optimization uses a convex hull of the object, Procrustes dissimilarity as the shape-distance metric, and a reward function that subtracts added white area from dissimilarity to choose which rectangles to add or remove.
What would settle it
Record the same set of nozzle moves twice, once with filament extruding and once with the extruder idle; if a classifier (e.g., on spectrogram features or the 8 kHz fan band) can reliably label which moves extruded, then an attacker could drop all decoy segments and reconstruct the original shape, refuting the paper's central claim.
Extended reading notes
Core claim
QuietPrint claims that acoustic side-channel attacks on FDM 3D printers—which recover nozzle positions from stepper-motor spikes and fan noise—can be neutralized by altering the G-code alone. By adding a collinear extension to every motion so that all paths reach the boundary of a bounding rectangle, the nozzle's sudden direction changes occur at rectangle corners rather than at the true object's vertices. Even if an attacker accurately decodes the audio and reconstructs a shape, that shape is the obfuscated polygon, not the original. The paper supports this with experiments: a test triangle and a key-shaped object, where the reconstructed shape from recorded audio matches the decoy polygon.
Load-bearing premise
The defense holds only if an attacker cannot tell the difference between a genuine extruding move and a decoy non-extruding move from the audio—the paper only tests whether the transition points are detectable, not whether extrusion itself leaves an audible signature.
Editorial extensions
If this is right
- If SHM works as claimed, acoustic side-channel IP theft from FDM printers can be mitigated without expensive noise-masking hardware, lowering the barrier to deployment.
- The defense is compatible with existing printers and slicers, since it only rewrites G-code; the same approach could be applied during slicing.
- Even if an attacker detects sudden direction changes, they only recover a decoy bounding shape, so the original geometry remains hidden.
- The optimization reduces print-time overhead from roughly tripling (naive) to about 55% on the key example, making the defense practical for protected prints.
Reading between the lines
- The paper does not test whether the decoy and real moves are distinguishable by the sound of the extruder motor or by changes in filament-fan load when material is being deposited; if such an extrusion-state signature exists, an attacker could discard non-extruding decoy moves and recover the true shape. This is the most direct testable extension of the paper's claim.
- SHM only addresses acoustic leakage; power and magnetic side channels would still leak the original motion profile, so the defense would need to be layered with other countermeasures in a realistic threat model.
- The transition-detection experiment uses a single classifier family (XGBoost) and hand-chosen spectrogram segments; a broader search over features or a deep model might find transition markers, which would be a natural follow-up evaluation.
- Applying SHM to a CoreXY printer (where both axes move the nozzle) might be more complex than the Cartesian test bed used here; the extension logic would need to handle diagonal moves.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper addresses acoustic side-channel attacks on 3D printers. It identifies two information sources—cooling-fan noise energy and stepper-motor direction-change spikes—and demonstrates a proof-of-concept reconstruction of nozzle motion from audio using commodity hardware (a Surface Pro microphone). It then proposes Stealth Head Movement (SHM), a G-code-only defense that extends tool paths to a bounding rectangle or optimized convex-hull-based polygon, so that an attacker who reconstructs the motion sees an obfuscated shape rather than the original. The defense is evaluated on a triangle and a key-shaped object, with an XGBoost-based test of transition-point detectability and an optimization algorithm to reduce added print time.
Significance. If the central claims hold, SHM would be a valuable low-cost defense against acoustic IP theft, requiring no additional hardware and only G-code modifications. The paper also contributes a simple, reproducible acoustic reconstruction pipeline and a clearly articulated threat model. However, the security of SHM depends critically on the assumption that decoy travel moves are acoustically indistinguishable from genuine extrusion moves. That assumption is not tested, and the defense is only evaluated against the authors' own simple attack pipeline. The optimization section also contains a likely sign error. The idea is promising, but the current evidence is insufficient to support the stated security guarantee.
major comments (4)
- [Section 6.1, 6.3] The central security claim is that an attacker who can decode acoustic motion still recovers only an obfuscated shape because SHM decoy moves are indistinguishable from real printing moves. The only test of this is transition-point detection by a single XGBoost model (MAPE 33.79%, r=0.4). This does not test whether an attacker can classify whole motion segments as extruding vs. non-extruding. Since SHM extensions are travel moves (no filament extrusion) while genuine moves are printing moves with extrusion, an attacker could potentially distinguish them through the extruder stepper motor's acoustic signature, changes in filament-cooling fan load, or speed/acceleration differences. The paper never analyzes this leakage channel. This is load-bearing: if extrusion state is detectable, the decoy segments can be discarded and the original shape recovered. Please add a direct experiment on ext
- [Section 6.3, Section 5] The defense is evaluated only against the authors' own reconstruction pipeline (fan-energy linear interpolation plus stepper-spike peak detection). The stronger ML-based attacks cited in [3,10,18] use richer spectral features and trained classifiers to predict speed and direction. The current evaluation does not demonstrate that SHM defeats those attacks. Please evaluate against an ML-based attacker with access to features beyond fan energy and low-frequency spikes, or clearly state the limited scope of the security guarantee.
- [Section 6.2, Algorithm 2, Eq. (1)] The reward is defined as R(x)=D(x)−A(x), where D is Procrustes dissimilarity and A is added area. However, Algorithm 2 line 43 computes reward = all_area − all_score, with all_score storing the dissimilarity. This is the opposite sign. The arg max in line 44 will therefore tend to select shapes with large added area and low dissimilarity, contrary to the stated optimization goal. Please correct the sign and re-evaluate the optimized SHM shapes and timing results.
- [Section 6.3] Reconstruction results are presented only as images (Figures 7, 9, 10), with no quantitative reconstruction-error metrics or repeated trials. The claimed success of the attack and the defense is therefore hard to assess. Please report quantitative measures such as mean absolute position error, shape similarity, or reconstruction accuracy, with error bars or multiple runs, especially for the key example.
minor comments (6)
- [Introduction] The text states 'no viable solution has been proposed yet' but later cites [29] as an active-noise defense. Clarify whether the claim is that no practical, low-cost, non-hardware solution exists.
- [Section 4.2.3, Figure 2] The linear calibration between log-energy and X position appears to be based on a single sweep. Report the correlation coefficient or R² and test sensitivity to fan speed, temperature, and room noise.
- [Algorithm 1] The pseudocode has formatting errors (e.g., the quoted condition for skipping lines and Unicode symbols in the comparison on line 16). Clean this up for readability.
- [Section 6.2] The sentence 'both of our metrics A and B are dimensionless' is confusing: A is a count of points and D is a squared error. Please clarify what 'dimensionless' means here.
- [Section 6.1] Please describe how the 300 spectrogram segments are extracted and why the 70/30 split without shuffling avoids temporal data leakage, since the test set may be temporally adjacent to the training set.
- [Section 6.2, Figure 10] The figure would benefit from axis labels and a clear caption explaining what each column represents, especially for readers unfamiliar with the SHM notation.
Circularity Check
No significant circularity: the SHM defense is a geometric G-code modification, and the paper's remaining weaknesses are unvalidated attacker-model assumptions, not circular derivations.
full rationale
The paper's central claim is that SHM—extending every head movement to the bounding rectangle—makes an acoustic attacker recover a decoy shape rather than the original. This is a construction property, not a fitted prediction: the extended path is by design the rectangle, so any movement-based reconstruction sees the rectangle. No equation in the derivation is defined in terms of its own output. The fan-energy line in Section 4.2.3 is calibrated on one motion and applied to a different random sequence (out-of-sample), and the spike reconstruction in Section 5 uses stated assumptions (constant speed, constant Y increment); neither parameter is fitted to the defended test object. The XGBoost transition test in Section 6.1 is an empirical evaluation, not a fitted input of the defense. The optimization in Section 6.2 has a likely sign inconsistency between R(x)=D(x)-A(x) and Algorithm 2's reward = area - dissimilarity, but that is a correctness/implementation issue, not circularity. Self-citations ([5], [6]) appear only in background paragraphs and are not load-bearing for the security argument. The key security limitation—that the paper does not analyze whether an attacker can distinguish extrusion moves from non-extruding SHM travel—is an unsupported assumption about the adversary's capabilities, not a circular step in the derivation. Under the stated hard rules, claims that are merely under-tested or unimplemented do not constitute circularity.
Assumptions & free parameters
free parameters (3)
- Fan-energy calibration line =
slope and intercept from a 0→18 cm calibration run
- Stepper reconstruction speed and peak-detection parameters =
1200 mm/min; peak thresholds; manually ignored environmental peaks
- SHM optimization hyperparameters =
not specified (min_s, max_s, step, attempts, random seed)
assumptions (3)
- domain assumption The acoustic side channel leaks only head position/motion, not extrusion state
- domain assumption Attacker uses a single laptop microphone on one side and the paper's reconstruction strategy
- domain assumption Procrustes dissimilarity is a valid proxy for shape hiding
Cite this review
Pith. "Pith review of QuietPrint: Protecting 3D Printers Against Acoustic Side-Channel Attacks." pith.science (2026). https://pith.science/paper/TBSA7MYK
@misc{pith2026260202198,
author = {Pith},
title = {Pith review of: QuietPrint: Protecting 3D Printers Against Acoustic Side-Channel Attacks},
year = {2026},
howpublished = {\url{https://pith.science/paper/TBSA7MYK}},
note = {Machine review of arXiv:2602.02198}
}
read the original abstract
The 3D printing market has experienced significant growth in recent years, with an estimated revenue of 15 billion USD for 2025. Cyber-attacks targeting the 3D printing process whether through the machine itself, the supply chain, or the fabricated components are becoming increasingly common. One major concern is intellectual property (IP) theft, where a malicious attacker gains access to the design file. One method for carrying out such theft is through side-channel attacks. In this work, we investigate the possibility of IP theft via acoustic side channels and propose a novel method to protect 3D printers against such attacks. The primary advantage of our approach is that it requires no additional hardware, such as large speakers or noise-canceling devices. Instead, it secures printed parts by minimal modifications to the G-code.
Figures
Figures from the paper (7 more)
Forward citations
Cited by 3 Pith papers
-
Firewall3D: A Hardware Firewall for Defending 3D Printers Against Firmware Attacks
A dedicated hardware monitor detects firmware attacks on 3D printers by comparing real-time physical signals (stepper currents, temperatures, fans, endstops) against intended G-code execution.
-
A Non-Line-of-Sight, Multi-Modality-based Side-Channel IP Theft Attack on Additive Manufacturing Using Dual Smartphones
Dual-smartphone side-channel attack reconstructs 3D printer G-code from acoustic and magnetic emissions at 98.89% command-level accuracy in a 60 cm non-line-of-sight setup.
-
Side-Channel Attacks Survive Noise Cancellation in 3D Printers
The paper's abstract and full text contradict each other on whether AMNC 3D printers still leak acoustic side channels.
Reference graph
Works this paper leans on
-
[1]
[n. d.]. Global 3D Printing Market Size, Share, Latest Trends & Growth Analysis, 2024-2029 — marketsandmarkets.com. https://www.marketsandmarkets.com/ Market-Reports/3d-printing-market-1276.html. [Accessed 14-07-2025]
2024
-
[2]
Muhammad Ahsan and Irfan Ahmed. 2025. WattShield: A Power Side-Channel Framework for Detecting Malicious Firmware in Fused Filament Fabrication. QuietPrint: Protecting 3D Printers Against Acoustic Side-Channel Attacks Algorithm 2SHM algorithm 1:functionAddRects(𝑖𝑚𝑔, 𝑖𝑚𝑔_𝑛𝑒𝑔, 𝑛,) 2:𝑜𝑢𝑡←𝑖𝑚𝑔 3:(ℎ,𝑤)←Shape(𝑖𝑚𝑔) 4:for𝑖=1to𝑛do 5:for𝑗=1to𝑎𝑡𝑡𝑒𝑚𝑝𝑡do 6:𝑟𝑤←RandInt(𝑚...
2025
-
[3]
Mohammad Abdullah Al Faruque, Sujit Rokka Chhetri, Arquimedes Canedo, and Jiang Wan. 2016. Acoustic side-channel attacks on additive manufacturing systems. In2016 ACM/IEEE 7th international conference on Cyber-Physical Systems (ICCPS). IEEE, 1–10
2016
-
[4]
Osama T AlShaheen, Zeashan H Khan, and Samir N Mekid. 2024. RDM-3D: A Remote Dashboard for 3D Printer Performance Monitoring. In2024 1st Interna- tional Conference on Innovative Engineering Sciences and Technological Research (ICIESTR). IEEE, 1–5
2024
-
[5]
Seyed Ali Ghazi Asgar and Narasimha Reddy. 2025. Analysis of misconfigured iot mqtt deployments and a lightweight exposure detection system. InNetwork and Distributed System Security (NDSS) Symposium, Workshop on Security and Privacy in Standardized IoT (SDIoTSec)
2025
-
[6]
Seyed Ali Ghazi Asgar, Narasimha Reddy, and Satish T. S. Bukkapatnam. 2025. Never Trust the Manufacturer, Never Trust the Client: A Novel Method for Streaming STL Files for Secure Additive manufacturing. arXiv:2507.06421 [cs.CR] https://arxiv.org/abs/2507.06421
arXiv 2025
-
[7]
F W Baumann, T Ludwig, N Darwin Abele, S Hoffmann, and D Roller. 2017. Model- Data Streaming for Additive Manufacturing Securing Intellectual Property.Smart and Sustainable Manufacturing Systems1, 1 (2017), 142–152
2017
-
[8]
Christian Bayens, Tuan Le, Luis Garcia, Raheem Beyah, Mehdi Javanmard, and Saman Zonouz. 2017. See no evil, hear no evil, feel no evil, print no evil? malicious fill patterns detection in additive manufacturing. In26th USENIX Security Symposium (USENIX Security 17). 1181–1198
2017
Show all 35 references
-
[9]
Twisha Chattopadhyay, Fabricio Ceschin, Marco E Garza, Dymytriy Zyunkin, Animesh Chhotaray, Aaron P Stebner, Saman Zonouz, and Raheem Beyah. 2025. One Video to Steal Them All: 3D-Printing IP Theft through Optical Side-Channels. arXiv preprint arXiv:2506.21897(2025)
2025 arXiv
-
[10]
Sujit Rokka Chhetri, Arquimedes Canedo, and Mohammad Abdullah Al Faruque
-
[11]
Tarasankar DebRoy, Huiliang L Wei, James S Zuback, Tuhin Mukherjee, John W Elmer, John O Milewski, Allison Michelle Beese, A de Wilson-Heid, Amitava De, and Wei Zhang. 2018. Additive manufacturing of metallic components–process, structure and properties.Progress in materials s...
2018
-
[12]
Tonica P Garcia, Aimee Rachel O Aguilar, Juliah Faye T Dela Vega, Mary Mar- garette S Macatumpag, Mhikaella Mae M Vaay, Richard Josiah C Tan Ai, Ryan Rhay P Vicerra, Argel A Bandala, and Elmer P Dadios. 2023. Connecting 3D Printer to the Industrial Internet of Things (IIoT) th...
2023
-
[13]
Jacob Gatlin, Sofia Belikovetsky, Yuval Elovici, Anthony Skjellum, Joshua Lubell, Paul Witherell, and Mark Yampolskiy. 2021. Encryption is futile: Reconstructing 3d-printed models using the power side-channel. InProceedings of the 24th International Symposium on Research in At...
2021
-
[14]
2021.Additive manufacturing technologies
Ian Gibson, David W Rosen, Brent Stucker, Mahyar Khorasani, David Rosen, Brent Stucker, and Mahyar Khorasani. 2021.Additive manufacturing technologies. Vol. 17. Springer
2021
-
[15]
John C Gower. 2010. Procrustes methods.Wiley Interdisciplinary Reviews: Computational Statistics2, 4 (2010), 503–508
2010
-
[16]
Amirhossein Jamarani, Yazhou Tu, and Xiali Hei. 2025. Practitioner Paper: Decoding Intellectual Property: Acoustic and Magnetic Side-Channel Attack on a 3D Printer. InInternational Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles. Springer, 54–74
2025
-
[17]
2000.Principles of multivariate analysis
Wojtek Krzanowski. 2000.Principles of multivariate analysis. Vol. 23. OUP Oxford
2000
-
[18]
Ireneusz Kubiak, Artur Przybysz, and Andrzej Stańczak. 2020. Usefulness of acoustic sounds from 3D printers in an eavesdropping process and reconstruction of printed shapes.Electronics9, 2 (2020), 297
2020
-
[19]
Sizhuang Liang and Raheem Beyah. [n. d.]. Hiding My Real Self! Protecting Intellectual Property in Additive Manufacturing Systems Against Optical Side- Channel Attacks
-
[20]
Christos Madamopoulos and Nektarios Georgios Tsoutsos. 2024. 3D printer audio and vibration side channel dataset for vulnerability research in additive manufacturing security.Data in Brief57 (2024), 111002
2024
-
[21]
Zahid Mohammed, Abdullah Shahwan, Ali Alazawi, and Wael Elmedany. 2025. Enhancing IoT Communication Security: Analysis and Mitigation of Vulnerabili- ties in MQTT, CoAP, and XMPP Protocols
2025
-
[22]
Hammond Pearce, Kaushik Yanamandra, Nikhil Gupta, and Ramesh Karri. 2022. FLAW3D: A Trojan-Based Cyber Attack on the Physical Outcomes of Additive Manufacturing.IEEE/ASME Transactions on Mechatronics27, 6 (2022), 5361–5370. doi:10.1109/TMECH.2022.3179713
2022
-
[23]
Muhammad Haris Rais, Muhammad Ahsan, and Irfan Ahmed. 2024. SOK: 3D printer firmware attacks on fused filament fabrication. InProceedings of the 18th USENIX Conference on Offensive Technologies(Philadelphia, PA, USA)(WOOT’24). USENIX Association, USA, Article 18, 20 pages
2024
-
[24]
Muhammad Haris Rais, Muhammad Ahsan, and Irfan Ahmed. 2025. Sabotag- ing material extrusion-based 3D printed parts through low-magnitude kinetic manipulation attacks.ACM Transactions on Cyber-Physical Systems9, 1 (2025), 1–26
2025
-
[25]
Jost Rossel, Vladislav Mladenov, and Juraj Somorovsky. 2023. Security Analysis of the 3MF Data Format. InProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. 179–194. Trovato et al
2023
-
[26]
Jost Rossel, Vladislav Mladenov, Nico Wördenweber, and Juraj Somorovsky. [n. d.]. Security Implications of Malicious G-Codes in 3D Printing. ([n. d.])
-
[27]
Chen Song, Feng Lin, Zhongjie Ba, Kui Ren, Chi Zhou, and Wenyao Xu. 2016. My smartphone knows what you print: Exploring smartphone-based side-channel attacks against 3d printers. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 895–907
2016
-
[28]
Keval K Sonigara, Jayraj V Vaghasiya, Carmen C Mayorga-Martinez, and Martin Pumera. 2025. Point-of-use upcycling of 3D printing waste for developing 3D-printed Zn–I 2 batteries.Journal of Materials Chemistry A13, 16 (2025), 11804–11816
2025
-
[29]
Andrzej Stańczak and Ireneusz Kubiak. 2023. Evaluation of the Effectiveness of Protecting Three-Dimensional Printers against Acoustic Infiltration.Electronics 12, 22 (2023), 4641
2023
-
[30]
Andrzej Stańczak, Ireneusz Kubiak, Artur Przybysz, and Anna Witenberg. 2021. The possibility to recreate the shapes of objects on the basis of printer vibration in the additive printing process.Applied Sciences11, 11 (2021), 5305
2021
-
[31]
Shubham Bhaskar Thakare and Sanjay Poddar. 2025. Secure mechanical design and manufacturing: Preventing IP theft via cybersecurity.International Journal of Science and Research Archive14, 2 (2025), 638–645
2025
-
[32]
Bukkapatnam
Akash Tiwari, A L Narasimha Reddy, and Satish T S. Bukkapatnam. 2020. Cyber- security assurance in the emerging manufacturing-as-a-service (MaaS) paradigm: A lesson from the video streaming industry.Smart and Sustainable Manufacturing Systems4, 3 (2020), 324–329
2020
-
[33]
Syed A M Tofail, Elias P Koumoulos, Amit Bandyopadhyay, Susmita Bose, Lisa O’Donoghue, and Costas Charitidis. 2018. Additive manufacturing: scientific and technological challenges, market uptake and opportunities.Materials today 21, 1 (2018), 22–37
2018
-
[34]
Steven Eric Zeltmann, Nikhil Gupta, Nektarios Georgios Tsoutsos, Michail Ma- niatakos, Jeyavijayan Rajendran, and Ramesh Karri. 2016. Manufacturing and security challenges in 3D printing.Jom68, 7 (2016), 1872–1881
2016
-
[2017]
Confidentiality breach through acoustic side-channel in cyber-physical additive manufacturing systems.ACM Transactions on Cyber-Physical Systems2, 1 (2017), 1–25
2017
Reviewed August 3, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.