# Engineering Attack Vectors and Detecting Anomalies in Additive Manufacturing

arXiv: https://arxiv.org/abs/2601.00384 · HTML: https://mlsanity.com/paper/2601.00384/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 29 references that are in the map.
- First posted on arXiv 1 Jan 2026.

## Builds on (most cited first, 4 of 4)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [dr0wned - Cyber-Physical Attack with Additive Manufacturing](https://mlsanity.com/paper/1609.00133/) (2016)
- [Needle in a Haystack: Detecting Subtle Malicious Edits to Additive Manufacturing G-code Files](https://mlsanity.com/paper/2111.12746/) (2021)
- [A Survey on Limitation, Security and Privacy Issues on Additive Manufacturing](https://mlsanity.com/paper/2103.06400/) (2021)

## Built on by (most cited first, 2 of 2)

- [What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics](https://mlsanity.com/paper/2606.25182/) (2026)
- [GuidedFlow: An Attention-Guided Framework for Anomaly Detection in Additive Manufacturing](https://mlsanity.com/paper/2608.22789/) (2026)

## Abstract (arXiv)

Additive manufacturing (AM) is rapidly integrating into critical sectors such as aerospace, automotive, and healthcare. However, this cyber-physical convergence introduces new attack surfaces, especially at the interface between computer-aided design (CAD) and machine execution layers. In this work, we investigate targeted cyberattacks on two widely used fused deposition modeling (FDM) systems, Creality's flagship model K1 Max, and Ender 3. Our threat model is a multi-layered Man-in-the-Middle (MitM) intrusion, where the adversary intercepts and manipulates G-code files during upload from the user interface to the printer firmware. The MitM intrusion chain enables several stealthy sabotage scenarios. These attacks remain undetectable by conventional slicer software or runtime interfaces, resulting in structurally defective yet externally plausible printed parts. To counter these stealthy threats, we propose an unsupervised Intrusion Detection System (IDS) that analyzes structured machine logs generated during live printing. Our defense mechanism uses a frozen Transformer-based encoder (a BERT variant) to extract semantic representations of system behavior, followed by a contrastively trained projection head that learns anomaly-sensitive embeddings. Later, a clustering-based approach and a self-attention autoencoder are used for classification. Experimental results demonstrate that our approach effectively distinguishes between benign and compromised executions.