💻 computer science

Side-Channel Attacks Bypass Protection in 3D Printers

Original authors: Eric Yocam, Varghese Vaidyan, Micah Flack, Gurcan Comert, Judith L. Mwakalonge

Published 2026-06-15

📖 5 min read🧠 Deep dive

Original authors: Eric Yocam, Varghese Vaidyan, Micah Flack, Gurcan Comert, Judith L. Mwakalonge

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very expensive, secret recipe for a cake. You send the digital instructions to a 3D printer in a different building to bake it for you. You think your secret is safe because the file is encrypted (locked up tight) while it travels.

However, this paper reveals that the printer itself is "talking" while it works. Even if you can't see the cake being made, the printer makes noise and shakes in a way that accidentally tells a spy exactly what shape it is building.

Here is the story of how the researchers tested a new "silencer" and what they found, explained simply:

The Problem: The Printer is a Noisy Neighbor

3D printers work by moving a hot nozzle around to melt plastic. As it moves, the motors whine and the whole machine vibrates.

The Old Spy: In the past, spies could stand next to the printer, record the sound, and use a computer to figure out if the printer was making a key, a cat, or a helix. They could even guess the shape with very high accuracy.
The New Defense: To stop this, a company called Bambu Lab installed a feature called Active Motor Noise Cancellation (AMNC). Think of this like noise-canceling headphones for the printer. It listens to the motor noise and plays a "reverse sound" to cancel it out, making the printer whisper-quiet.

The Big Question

The researchers asked: Does this "noise-canceling" feature actually stop the spies, or does the printer still leak secrets in a different way?

They tested this using a public dataset of two different printers (a P1P and an A1 Mini) printing 12 different objects.

The Findings: The Silence is Real, But the Floor is Still Shaking

1. The Sound is Dead (The Good News)
When the researchers tried to listen to the printer with the noise-canceling feature turned on, they got zero results.

The Analogy: It's like trying to guess what song a band is playing by listening to them through a soundproof wall. The computer guessed the object only about 8% of the time, which is the same as just guessing randomly (like rolling a die).
Conclusion: The noise-canceling feature works perfectly. It completely blocks the "acoustic" (sound) channel.

2. The Vibration is Still Alive (The Bad News)
While the sound was silenced, the shaking of the machine was not. The researchers put a sensor on the table to feel the vibrations.

The Analogy: Imagine the printer is a person trying to whisper a secret. The noise-canceling feature stops their voice from being heard, but their feet are still stomping on the floorboards. If you put your hand on the floor, you can still feel the rhythm of their stomping.
The Result: By just looking at how hard the machine shook (the "amplitude"), the computer could guess the object about 31% of the time. This is better than random guessing, but not perfect.

3. The Secret is in the "Dance," Not the "Steps"
The researchers dug deeper to see what about the shaking gave it away.

The Analogy: They realized the spy wasn't learning the shape of the steps (the frequency), but rather the intensity of the dance (how hard the printer pushed).
The Twist: When they looked at the entire sequence of the print (how the shaking changed from the start of the object to the finish), the accuracy jumped to 61%.
Why? The "dance" of the printer changes as it builds the object. A tall tower shakes differently at the start than at the end. By watching the whole movie of the vibration, the computer could tell what was being built much better than just looking at a single snapshot.

4. The "Fingerprint" Problem
Here is the catch: The vibration signature is unique to the specific machine.

The Analogy: If you learn the "footprint" of a specific person walking on a wooden floor, you can't use that knowledge to guess what another person is doing on a different floor.
The Result: If the researchers trained their spy computer on the P1P printer and then tried to use it on the A1 Mini printer, it failed completely (dropped back to random guessing). The "leak" is specific to the machine's internal design.

The Final Verdict

The paper concludes that the new noise-canceling feature is a one-trick pony.

It successfully silences the sound, so you can't hear the printer.
But it leaves the vibration wide open.

However, the vibration leak has limits:

It only works if you know exactly which machine model you are spying on.
It can tell you what object is being made (e.g., "It's a cat"), but it cannot currently rebuild the exact 3D shape or the secret code (G-code) just from the shaking.

To truly steal the secret design, a spy would still need to listen to other things the paper didn't test, like the electrical power usage or magnetic fields, which the noise-canceling feature ignores completely.

In short: The printer is now quiet, but it's still shaking its secrets out on the floor. If you want to be truly safe, you need to stop the shaking, not just the noise.

Technical Summary: Side-Channel Attacks Bypass Protection in 3D Printers

Problem Statement
As additive manufacturing (specifically Fused Deposition Modeling or FDM) becomes distributed across organizational boundaries, the physical printing process remains vulnerable to side-channel attacks (SCAs). Even with encrypted design files, unintended physical emanations—such as acoustic noise, mechanical vibration, electromagnetic radiation, and power draw—can leak information about the printed geometry. In response to acoustic SCAs, commercial printer manufacturer Bambu Lab deployed Active Motor Noise Cancellation (AMNC) in its A1 Mini and P1P models. This hardware countermeasure uses adaptive current control to suppress motor resonance frequencies. However, the efficacy of this deployed defense against acoustic attacks, and the extent to which it leaves other physical channels (specifically vibration) exposed, had not been empirically evaluated on a public dataset.

Methodology
The authors conducted the first empirical evaluation of a deployed hardware countermeasure using the "Madamopoulos–Tsoutsos 2024" public dataset. This dataset consists of 144 synchronized recordings (audio and triaxial vibration) from two distinct printer architectures (Bambu Lab P1P, a core-XY system, and A1 Mini, a bed-slinger system) printing 12 distinct object classes.

The study employed a passive, closed-set classification threat model, where an adversary attempts to identify which known design is being printed. The evaluation followed five specific analytical phases:

Acoustic Evaluation: Assessing classification accuracy under active AMNC and with additional simulated notch filters.
Vibration Summary Analysis: Using statistical features (mean, std, RMS, peak-to-peak, dominant frequency) to classify prints.
Feature Ablation: Isolating amplitude-based features from frequency-based (waveform shape) features to determine the source of the signal.
Temporal Modeling: Ingesting the ordered evolution of the print via a full-sequence 1D-CNN, compared against an order-shuffled control to verify sequential dependency.
Cross-Printer Transfer: Training classifiers on one printer architecture and testing on the other to assess device specificity.

Statistical validity was ensured through grouped cross-validation (preventing data leakage from the same recording session), Wilson confidence intervals, label-permutation null tests, and binomial tests against an 8.33% random baseline (1/12 classes).

Key Results

Acoustic Channel Neutralization: Under active AMNC, acoustic classification accuracy was 12.50% (95% CI [8.1%, 18.9%]), which is statistically indistinguishable from the 8.33% random baseline. The addition of simulated notch filters did not significantly alter this result. This confirms AMNC successfully neutralizes the airborne acoustic channel it targets.
Vibration Channel Leakage: The vibration channel, which AMNC does not address, remains a viable side channel.
- Summary Statistics: Using amplitude-based summary features, pooled classification accuracy reached 31.25% (significantly above chance, $p=0.005$ ). Within-printer accuracy ranged from 36.11% to 47.22%.
- Signal Source: Feature ablation revealed that the signal is driven almost entirely by vibration amplitude (magnitude) and offset. Frequency-only (waveform shape) features performed at chance levels (~6.25%).
- Temporal Structure: A full-sequence temporal model that analyzed the ordered evolution of the print increased accuracy to approximately 61%. An order-shuffling control reduced this to ~33%, confirming that a substantial component of the leak is genuinely sequential and tied to the macro-evolution of the print geometry.
Device Specificity: The vibration signal is highly architecture-dependent. A classifier trained on one printer transferred to the other with accuracy near chance (11.1–12.5%), indicating that vibration signatures do not generalize across different mechanical designs (core-XY vs. bed-slinger).

Significance and Claims
The paper claims to provide the first empirical evaluation of a deployed hardware countermeasure (AMNC) on a public dataset. Its primary conclusions are:

AMNC is an acoustic-only defense: It effectively neutralizes the specific acoustic channel it targets but leaves structural vibration untouched.
Vibration is a partial, geometry-correlated leak: While the vibration channel leaks information, the leakage is coarse (amplitude-driven) and device-specific. On this dataset, it supports object identification but does not support full geometric reconstruction.
Reconstruction requires other channels: The authors assert that achieving "reconstruction-grade" attacks (recovering unknown geometry or G-code) would likely require exploiting channels that AMNC also leaves untouched, specifically magnetic or power side channels.
Defensive Implications: Defenders should not view AMNC as a comprehensive side-channel solution. Mitigating vibration leaks requires distinct measures (e.g., chassis isolation, randomized acceleration profiles) that involve trade-offs in print quality, speed, or cost. Furthermore, the device-specific nature of the leak suggests that heterogeneous printer fleets impose a calibration cost on attackers, offering a form of natural protection.

The authors conclude that securing additive manufacturing against IP theft requires countermeasures that address structural vibration, not just acoustic emission. All code and the dataset are released to support further study.

The Problem: The Printer is a Noisy Neighbor

The Big Question

The Findings: The Silence is Real, But the Floor is Still Shaking

The Final Verdict

More like this