Prompt injection in additive manufacturing and 3D printing quality AI

Four adversarial injection surfaces in additive manufacturing and 3D printing quality AI

1. Layer-by-layer melt pool and porosity detection AI bypass (AS9100D Clause 8.5.6, NADCAP AC7110/7)

EOS EOSTATE MeltPool AI, Sigma Labs PrintRite3D AI, and Nikon SLM Solutions melt pool monitoring AI each perform real-time analysis of sensor camera captures taken at every layer of a laser powder bed fusion build. The display images ingested by these AI systems include melt pool geometry displays showing the elliptical melt pool footprint and its deviation from nominal geometry, spatter distribution heatmaps encoding the spatial density and velocity vector distribution of powder spatter particles ejected from the melt zone, and thermal emission distribution maps derived from photodiode or pyrometry sensor integrations that encode the temperature profile across the scan field. These display images — rendered at the end of each layer and stored as quality records associated with the build job — feed the AI defect classification pipeline that determines whether the layer is classified as defect-free or as containing a porosity indication requiring build abort or hold-for-engineering-review action. The AS9100D Clause 8.5.6 change control requirement for additive manufacturing process parameters, combined with the NADCAP AC7110/7 special process accreditation for additive manufacturing that audits in-situ monitoring system performance at NADCAP-accredited facilities, creates a regulatory framework in which the layer-level AI classification record is an auditable quality output that must demonstrably reflect actual layer quality.

The adversarial injection surface is the workflow through which melt pool monitor display images are transferred from the in-situ sensor system to the AI quality platform. At EOS-equipped facilities, EOSTATE MeltPool sensor data flows from the machine controller through EOS’s data management integration layer to the quality assurance platform. At Sigma Labs-equipped facilities, PrintRite3D sensor images are transmitted through the PrintRite3D In-Process Quality Assurance (IPQA) data pipeline to the PrintRite3D analytics portal where engineers review layer-level quality reports and make hold/proceed decisions. At facilities using Nikon SLM Solutions systems, melt pool monitoring data is accessed through the SLM Solutions monitoring software interface. In each pathway, a display image — rendered by the sensor processing software and stored as a PNG or TIFF quality record — is the artifact submitted to the AI classification system. An adversarially crafted melt pool geometry display image in which pixel-level perturbations are applied to the central melt pool region, the spatter density heatmap colour gradient, or the thermal emission anomaly indicator boundary can cause the AI classification model to assign a defect-free classification to a layer in which keyhole porosity or lack-of-fusion voids are physically present. The threshold for adversarial detection in this context is 65: above this score, Glyphward flags the melt pool monitor display image as adversarially perturbed before it reaches the AI classifier.

The regulatory consequence of a successful adversarial bypass of melt pool monitor AI is severe in the aerospace context. FAA Advisory Circular AC 33.15-1 addresses airworthiness of aircraft engine metal additive manufactured parts and requires that the manufacturing process produce parts consistently within the qualified process envelope; a corrupted in-situ monitoring record that classifies a defective layer as conforming creates a false process conformance record that cannot be reconciled with CT scan findings without triggering a material review board (MRB) action under AS9100D. NASA STD-6030, which defines additive manufacturing requirements for spaceflight hardware, explicitly requires that in-situ monitoring data be retained as quality records for spaceflight AM builds — making the integrity of melt pool monitor AI classifications a space-programme-level compliance requirement. For NADCAP-accredited facilities, AC7110/7 audit findings related to in-situ monitoring system performance qualification could result in suspension of NADCAP accreditation — loss of which disqualifies the facility from supplying additive manufactured parts to prime aerospace contractors under their supplier qualification requirements.

2. CT scan dimensional accuracy and internal defect AI injection (FDA 21 CFR §820.80, ISO 13485 Clause 7.5.9)

Post-build computed tomography (CT) scanning is the primary non-destructive evaluation method for additive manufactured metal parts where internal geometry and porosity distribution cannot be assessed by surface inspection methods. Materialise AI — integrated with Volume Graphics VGSTUDIO MAX, which holds more than 50,000 licenses globally — processes CT scan slice image stacks exported from industrial CT systems (GE Phoenix, Nikon Metrology XT, Zeiss Metrotom) to perform AI-assisted dimensional deviation analysis, internal porosity void detection and characterisation, and wall thickness distribution verification. 3D Systems DMP Factory AI processes CT scan outputs for titanium and cobalt-chrome medical implants and aerospace components built on its DMP Flex and DMP Factory 500 series systems. The display images ingested by CT scan AI verification systems include: internal porosity void location markers overlaid on CT slice reconstructions showing the centroid coordinates and volume estimates of detected voids, dimensional deviation colormap overlays displaying the point-cloud-to-CAD nominal deviation as a colour-coded surface map, and wall thickness distribution maps encoding the minimum, maximum, and mean wall thickness across the part geometry derived from the CT reconstruction.

The adversarial injection surface is the CT scan data export and AI submission workflow. CT scan operators at additive manufacturing facilities export DICOM or proprietary format CT data from the industrial CT system, import it into the CT analysis software (VGSTUDIO MAX, VGEasyPore, or Materialise’s CT analysis module), and submit the rendered display images — deviation colormaps, void markers, wall thickness maps — to the AI quality verification workflow for automated conformance classification against the part’s acceptance criteria. An adversarially crafted CT scan deviation colormap display in which pixel-level perturbations are applied to the out-of-tolerance red-zone region, an adversarially modified internal void marker overlay in which the void location indicator has been spatially displaced or reduced in apparent severity, or a perturbed wall thickness map in which a below-minimum thickness zone has been coloured to resemble a within-tolerance region can all cause the CT scan AI to classify a part with internal defects or dimensional non-conformance as accepted for release. The threshold for adversarial detection in this context is 60.

For medical device applications of additive manufacturing — titanium spinal fusion cages, cobalt-chrome knee replacement components, patient-specific hip implant cups — FDA 21 CFR §820.80 acceptance activity requirements mandate that acceptance determinations be based on validated inspection procedures. An adversarially corrupted CT scan AI classification that releases a Class III implant with internal porosity or dimensional non-conformance constitutes a validation failure for the AI acceptance activity procedure — one that, if discovered post-release, triggers a CAPA investigation, potential recall under 21 CFR Part 806, and MDR reporting under 21 CFR Part 803. ISO 13485 Clause 7.5.9 traceability requirements for medical device manufacturing mean that each lot of AM implants must maintain a traceable record linking the CT scan quality record to the product lot — a traceability chain that an adversarially corrupted CT scan AI classification record breaks at the point of AI-assisted acceptance. EAR 15 CFR Part 774 ECCN 2B352 controls on additive manufacturing equipment for certain controlled applications add an export compliance dimension: CT scan acceptance records for AM parts used in controlled applications that have been adversarially corrupted may also implicate the accuracy of export licence compliance documentation.

3. Surface finish and geometric accuracy visual inspection AI bypass (AS9100D Clause 8.6, ASTM F3122, ISO/ASTM 52902)

Post-build surface finish and geometric accuracy assessment for additive manufactured parts uses structured light scanning, photogrammetry, and contact coordinate measurement machine (CMM) data to generate point cloud representations of the as-built part geometry relative to the nominal CAD model. Keyence IM-8000 AI vision measurement systems, Materialise AI geometric verification workflows, and Capture 3D ATOS structured light scanner AI — with more than 1,000 aerospace installations — process the display outputs from these measurement systems: photogrammetry point cloud image displays showing the coloured reconstruction of the as-built part, structured light 3D scan deviation colormap displays showing the spatial distribution of positive and negative geometric deviation from nominal across the part surface, and surface roughness measurement profile images encoding the Ra and Rz surface roughness parameters measured by contact or non-contact profilometry at defined measurement locations. ASTM F3122, the standard test method for evaluating mechanical properties of metal additively manufactured parts, defines the specimen geometry and dimensional acceptance criteria against which these AI measurement systems classify conformance. ISO/ASTM 52902 provides geometric benchmark artefact specifications for AM machine qualification that similarly rely on AI-assisted dimensional verification.

The adversarial injection surface is the measurement output image export and AI submission pathway. Structured light scan operators at additive manufacturing quality labs export deviation colormap renders and point cloud display images from the ATOS or GOM software suite and submit them to the Materialise AI or Keyence IM-8000 AI classification workflow for automated conformance determination against the part’s geometric tolerances and surface finish acceptance criteria. An adversarially crafted deviation colormap display in which pixel-level perturbations applied to the red-zone out-of-tolerance region of a structural feature — a bore diameter, a datum surface, a fillet radius — cause the AI to classify the deviation as within tolerance when the physical measurement exceeds the engineering drawing callout can cause a non-conforming part to pass the AI surface finish and geometric accuracy acceptance gate. For ITAR-controlled aerospace components — Category VIII aircraft and related articles, Category XV spacecraft and related articles under ITAR 22 CFR Part 121 — geometric acceptance records are part of the manufacturing data package that accompanies the part and supports export licence compliance. Adversarially corrupted geometric acceptance records in the manufacturing data package create regulatory exposure under ITAR if the manufacturing data package is presented to customs or licensing authorities with falsified quality record content. The threshold for adversarial detection in this context is 70: surface finish and geometric accuracy AI has the highest adversarial detection threshold of the four AM surfaces because the image content — colormap gradients, point cloud renders, roughness profile traces — provides more signal channels for adversarial perturbation detection.

AS9100D Clause 8.6 release of products requires objective evidence of conformance to acceptance criteria before product release; an adversarially corrupted AI surface inspection record that provides false objective evidence of conformance creates direct AS9100D nonconformance exposure. For AM parts produced under NADCAP AC7110/7 accreditation, the surface finish and geometric accuracy verification procedure is part of the accredited special process scope — meaning that adversarially corrupted surface inspection AI classifications constitute a NADCAP audit finding in the quality system records reviewed during annual or surveillance audits. Aerospace prime contractors — Boeing, Airbus, Lockheed Martin, Raytheon Technologies — increasingly require NADCAP AM accreditation as a mandatory supplier qualification requirement; a NADCAP suspension triggered by falsified AI quality records has supply-chain-level consequences for the affected AM supplier.

4. Material certification and powder traceability document image injection (ITAR 22 CFR §121.11, AS9100D Clause 8.4)

Additive manufacturing quality AI processes scanned document images as part of material qualification and traceability workflows: material test report (MTR) scans recording the certified chemistry composition and mechanical properties of each powder lot used in a qualified LPBF or DED build, powder lot certificate of conformance (CoC) display images recording the particle size distribution, flowability measurements, and lot-specific qualification data, and ITAR compliance and export licence document display images recording the classification determination for the material and any associated export control authorisation. Sigma Labs, Materialise, and EOS AI platforms each incorporate document processing AI that reads these scanned certification images to extract chemistry composition values, powder lot identifiers, and compliance classification fields for automated comparison against the approved material specification and build job requirements. AS9100D Clause 8.4 control of externally provided processes, products, and services requires that purchased materials — including metal powders — be verified against specification before use, with documented objective evidence of conformance. The AI-assisted document processing workflow that reads MTR and CoC scans provides the automated verification layer for this AS9100D requirement at high-volume AM facilities where manual MTR review would be a throughput bottleneck.

The adversarial injection surface is the document image submission pathway. AM quality engineers scan incoming powder lot documentation using document scanners or mobile capture devices and submit the scanned images through the Sigma Labs, Materialise, or EOS quality management portal for AI-assisted extraction and verification. An adversarially crafted MTR scan image in which pixel-level perturbations are applied to the chemistry composition table — altering the apparent oxygen content, nitrogen content, or alloying element percentages in the AI-readable fields — can cause the AI document extraction to read values that are within the approved specification range when the physical powder lot’s actual composition is out-of-specification. An adversarially perturbed powder particle size distribution plot — in which the displayed D10/D50/D90 distribution curves have been shifted to appear within the qualified size range when the lot’s actual distribution is outside the process qualification envelope — similarly causes the AI to approve a powder lot that should be rejected. The threshold for adversarial detection in this context is 55: document image AI is assigned the most sensitive threshold because the consequences of a successful bypass include both quality (AS9100D Clause 8.4 nonconformance) and legal (ITAR 22 CFR Part 121 export violation) dimensions.

The ITAR dimension is particularly acute for AM materials and software AI. ITAR 22 CFR Part 121 Category VIII (aircraft and related articles) and Category XV (spacecraft and related articles) both include additive manufactured components for defence applications. ITAR 22 CFR §121.1 prohibits unlicensed export of US Munitions List articles; an AI system that processes ITAR control classification field content in export licence document scans and has been adversarially manipulated to suppress an ITAR export licence requirement flag can enable unlicensed export of controlled AM components or materials by generating a compliance record that incorrectly classifies the article as EAR99 rather than ITAR-controlled. EAR 15 CFR Part 774 ECCN 2B352 controls on additive manufacturing equipment for certain biological and chemical agent applications add a further export control layer. NADCAP AC7110/7 material traceability requirements mandate that the complete powder lot certification chain be retained as auditable records for AM builds performed under NADCAP accreditation — records that adversarially corrupted document AI classifications render unreliable as audit evidence.

Integration: additive manufacturing AI image ingestion with Glyphward pre-scan

Additive manufacturing AI image ingestion flows from in-situ sensor systems, CT scan workstations, structured light scanner software, and document scanner portals into AI quality classification queues. Insert Glyphward’s pre-scan at the ingestion boundary — particularly before melt pool monitor display images, CT scan deviation colormaps, surface finish point cloud renders, and material certification document scans reach the AI quality classification system:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Thresholds per additive manufacturing AI injection surface.
# Melt pool / porosity: in-situ record — missed porosity leads to structural failure.
THRESHOLD_MELT_POOL_POROSITY = 65
# CT scan dimensional: internal defect acceptance — Class III medical implant consequences.
THRESHOLD_CT_SCAN_DIMENSIONAL = 60
# Surface finish / geometric accuracy: colormap deviation — ITAR parts tolerance compliance.
THRESHOLD_SURFACE_FINISH_GEOMETRIC = 70
# Material certification / traceability: document AI — ITAR export violation risk.
THRESHOLD_MATERIAL_CERTIFICATION = 55


class AdditiveMfgAIContext(str, Enum):
    MELT_POOL_POROSITY = "melt_pool_porosity"          # EOS EOSTATE, Sigma Labs, Nikon SLM
    CT_SCAN_DIMENSIONAL = "ct_scan_dimensional"        # Materialise AI, 3D Systems DMP AI
    SURFACE_FINISH_GEOMETRIC = "surface_finish_geometric"  # ATOS AI, Keyence IM-8000 AI
    MATERIAL_CERTIFICATION = "material_certification"  # MTR / CoC / ITAR export doc AI


_CONTEXT_THRESHOLDS = {
    AdditiveMfgAIContext.MELT_POOL_POROSITY: THRESHOLD_MELT_POOL_POROSITY,
    AdditiveMfgAIContext.CT_SCAN_DIMENSIONAL: THRESHOLD_CT_SCAN_DIMENSIONAL,
    AdditiveMfgAIContext.SURFACE_FINISH_GEOMETRIC: THRESHOLD_SURFACE_FINISH_GEOMETRIC,
    AdditiveMfgAIContext.MATERIAL_CERTIFICATION: THRESHOLD_MATERIAL_CERTIFICATION,
}


class AdversarialAdditiveMfgAIImageError(Exception):
    """Raised when an additive manufacturing AI image exceeds the adversarial threshold."""
    pass


async def scan_additive_mfg_ai_image(
    image_path: str | Path,
    context: AdditiveMfgAIContext,
    part_entity_hash: str,     # SHA-256 of part serial / entity ID (not raw)
    build_job_ref: str,        # build job identifier (non-ITAR — e.g. internal build UUID)
    quality_record_id: str,    # QMS record identifier for this image submission
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan an additive manufacturing AI image for adversarial injection payloads
    before forwarding to melt pool porosity detection, CT scan dimensional
    verification, surface finish inspection, or material certification AI.

    part_entity_hash: SHA-256 of the part serial number or entity identifier.
    build_job_ref: internal build job UUID — must NOT contain raw ITAR-controlled
                   design data, CAD file names, or export-controlled identifiers.
    quality_record_id: QMS record ID linking this scan to the build quality record.
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())
    threshold = _CONTEXT_THRESHOLDS[context]

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "am_context": context.value,
                "part_entity_hash": part_entity_hash,
                "build_job_ref": build_job_ref,
                "quality_record_id": quality_record_id,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "am_context": context.value,
        "part_entity_hash": part_entity_hash,
        "build_job_ref": build_job_ref,
        "quality_record_id": quality_record_id,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": threshold,
        "action": "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_additive_mfg_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialAdditiveMfgAIImageError(
            f"AM AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"build={build_job_ref} record={quality_record_id}"
        )
    return result


async def write_additive_mfg_audit_record(record: dict) -> None:
    """Persist audit record to your AS9100D / 21 CFR Part 820 compliant QMS (stub)."""
    import json, sys
    # Route to your QMS audit trail; for ITAR contexts do NOT log raw design data.
    print(json.dumps(record), file=sys.stderr)

The build_job_ref field uses an internal build UUID rather than a raw part number or CAD file path to avoid transmitting ITAR-controlled design identifiers outside the facility’s export-controlled data perimeter. The quality_record_id field links the Glyphward scan_id and image_sha256 integrity hash to the specific QMS record in your AS9100D or FDA 21 CFR Part 820-compliant quality management system, enabling the complete provenance chain required for NADCAP AC7110/7 audit and FDA inspection. For melt pool porosity contexts, a blocked image should immediately halt the build job and route to an engineering hold — the layer implicated cannot be re-inspected non-destructively after subsequent layers are deposited. Get early access

Coverage matrix

Related questions

Further reading

• FigStep adversarial image detection — the FigStep attack encodes instructions in image regions that AI models read as visual content; the same pixel-level manipulation technique applies to melt pool monitor display and CT scan colormap injection in AM quality AI.
• Vision-language model security — VLM security reference covering multimodal AI attack surfaces relevant to next-generation AM quality platforms combining visual inspection with LLM-generated quality report and non-conformance narrative drafting.
• Free tier — 10 scans/day, no card required — start scanning additive manufacturing AI images at development volumes before committing to a production plan.
• Manufacturing quality inspection AI prompt injection — broader manufacturing inspection AI surface covering PCB defect detection, pharmaceutical tablet inspection, and automotive body panel inspection AI with overlapping industrial computer vision attack patterns.
• Aerospace and defence AI prompt injection — aerospace AI injection surface covering Boeing Insight AI NDT inspection and Airbus Skywise predictive maintenance; directly relevant to AM quality AI deployed in aerospace MRO and prime contractor supply chains under the same AS9100D and NADCAP regulatory frameworks.