Municipal water treatment chlorination AI adversarial injection: how a clearwell free chlorine residual upward attack (0.05 mg/L displayed as 1.65 mg/L) exploits an automated PID feed controller to drive disinfectant residual to zero — CT failure, Giardia cyst breakthrough, 40,000-resident mass illness consequence — OSHA PSM TQ 1,500 lbs, EPA RMP TQ 2,500 lbs, SDWA MRDL 4.0 mg/L, SWTR CT concept, 50th and 51st upward-direction attacks, first drinking water process, first Safe Drinking Water Act regulatory framework, first public health emergency mass illness consequence in the Glyphward industrial AI portfolio, Glyphward threshold 45

Chlorine water treatment chemistry, the vacuum-feed dosing system, and the OSHA PSM / EPA RMP / SDWA regulatory triad

Chlorine disinfects water through the formation of hypochlorous acid (HOCl) and its conjugate base hypochlorite ion (OCl−) when dissolved in water: Cl₂ + H₂O → HOCl + H⁺ + Cl⁻; HOCl ⇆ H⁺ + OCl⁻ (pKa = 7.54 at 25°C). The germicidal activity of the two species differs dramatically: HOCl is approximately 80 times more effective than OCl⁻ as a biocide, because HOCl is electrically neutral and penetrates the lipopolysaccharide outer membrane of gram-negative bacteria far more readily than the negatively charged OCl⁻ ion. At pH 7.0, approximately 75 % of dissolved chlorine is present as HOCl and 25 % as OCl⁻; at pH 7.5, the split is approximately 50 %/50 %; at pH 8.5, only 8 % remains as HOCl. Municipal water treatment plants targeting neutral pH (6.8–7.8) for corrosion control and distribution system stability operate in a regime where HOCl fraction is significant; plants with lime-softening pH above 8.0 require substantially higher chlorine doses to achieve equivalent CT credit. This pH-dependence of HOCl fraction is a critical parameter for CT credit calculation under the SWTR: the EPA CT tables provide separate columns for each pH value (6.5, 7.0, 7.5, 8.0, 8.5) at each water temperature, because the same free chlorine residual provides significantly less inactivation credit at higher pH.

The vacuum-feed Cl₂ dosing system used in most medium and large water treatment plants applies chlorine gas at sub-atmospheric pressure to eliminate release risk. Liquid chlorine in a pressurized ton container (2,000-lb rated capacity; vapor pressure 90 psig at 20°C) vaporizes at the container neck; the gas stream passes through an inlet filter, a pressure-reducing regulator, and then to a vacuum regulator (also called an evaporator or vaporizer-regulator, such as the Fischer & Porter / ABB Series 70, Capital Controls / De Nora Series 70, or Wallace & Tiernan Type D-001). The vacuum regulator creates a sub-atmospheric pressure zone in the Cl₂ gas piping downstream — approximately 2–12 inches Hg vacuum — using a water-powered ejector (injector eductor) or motor-driven vacuum pump. Because the Cl₂ gas is at negative gauge pressure once it passes the vacuum regulator, any failure or leak to atmosphere downstream of the regulator draws in air rather than releasing chlorine outward; this is the primary containment feature of the vacuum-feed system. A spring-loaded diaphragm in the vacuum regulator closes automatically on loss of vacuum, providing fail-safe closure. A V-notch rotameter in the gas line downstream of the vacuum regulator measures the Cl₂ gas volumetric flow rate, from which the mass flow (kg/hr) and dose (mg/L) are calculated given the water flow rate from the plant flowmeter. The dose-control loop in the SCADA or DCS: measured water flow (MGD or m³/hr) × target dose (mg/L) → required Cl₂ mass flow (kg/hr) → setpoint to the Cl₂ feed valve or pump speed. Downstream, after the contact chamber or clearwell, a residual analyzer (Hach CL17 colorimetric analyzer, Hach 1720E turbidimeter, YSI 9300 photometric chlorine analyzer, or Wallace & Tiernan ChlorineSense) measures the free chlorine residual in the treated water and provides the feedback signal to the PID controller that trims the Cl₂ dose for precise residual maintenance.

The clearwell — a baffled concrete or stainless-steel reservoir where treated water contacts chlorine for the required T10 contact time before entering the distribution system — is the heart of the CT compliance calculation. Under SWTR, the effective contact time is not the mean hydraulic residence time (volume / flow = 8 hours for a 5-million-gallon clearwell at 10 MGD) but the T10, the time for the first 10 % of a tracer pulse to emerge from the clearwell outlet (determined by annual tracer testing with fluoride or dye). For a well-baffled clearwell (baffling factor 0.5), T10 = 0.5 × 480 min = 240 min; for a poorly baffled clearwell (short-circuiting from inlet to outlet, baffling factor 0.1), T10 = 48 min at the same volume and flow. T10 baffling factor is tested and documented in each utility’s SWTR compliance monitoring programme; the product C × T10 (mg·min/L) must meet or exceed the EPA CT table value for the required pathogen inactivation log credits at the facility’s actual operating pH and temperature.

OSHA PSM 29 CFR 1910.119 Appendix A lists chlorine (anhydrous, liquefied) at a threshold quantity of 1,500 lbs — the lowest TQ in the portfolio for a chemical that is also the most widely used industrial disinfectant. Any water treatment plant holding 1,500 lbs or more of Cl₂ in process — equivalent to approximately one ton container — must implement the full OSHA PSM programme. OSHA has no exemption for water utilities; a municipal water treatment plant storing ten 150-lb cylinders (1,500 lbs total) is subject to identical PSM requirements as a chlor-alkali chemical plant with railcar quantities. EPA Risk Management Program (40 CFR Part 68) lists chlorine at TQ 2,500 lbs; for water utilities, EPA guidance has confirmed that water treatment disinfection chlorine is not exempt from RMP requirements above the 2,500-lb threshold. OSHA PSM TQ (1,500 lbs) is lower than EPA RMP TQ (2,500 lbs) — the same normal threshold ordering as most chemicals — making OSHA PSM the binding first trigger for compliance.

The SDWA (Safe Drinking Water Act, 42 U.S.C. §§ 300f–300j-27) establishes the maximum residual disinfectant level (MRDL) of 4.0 mg/L for free chlorine in finished water, and requires the SWTR treatment technique of maintaining a minimum free chlorine residual of 0.20 mg/L at the first customer (entry point to the distribution system). The MRDL 4.0 mg/L is not a safety threshold for treated water consumers (chlorinated water at 4.0 mg/L free Cl₂ is organoleptically unpleasant but not acutely toxic at drinking doses) but a disinfection byproduct (DBP) management limit: free chlorine reacts with natural organic matter (NOM) in source water to form trihalomethanes (THMs; chloroform, bromodichloromethane, etc.) and haloacetic acids (HAAs), regulated under the Disinfectants and Disinfection Byproducts Rule (DBPR) at MCL 80 μg/L (total THMs) and 60 μg/L (HAA5). Exceeding MRDL 4.0 mg/L risks DBP MCL violations at the consumer tap; maintaining residuals well below MRDL while meeting the SWTR minimum of 0.20 mg/L is the primary operational optimisation challenge for water treatment operators. This MRDL-minimum tension is precisely what the 50th upward-direction adversarial attack exploits.

Four adversarial injection surfaces in municipal water treatment chlorination AI

1. Treated water clearwell outlet free chlorine residual analyzer AI (Hach CL17 amperometric chlorine analyzer SCADA AI / YSI 9300 photometric chlorine analyzer AI / Wallace & Tiernan ChlorineSense free chlorine analyzer AI / Endress+Hauser Orbisint CPS12D chlorine sensor AI / Prominent DULCOMETER chlorine controller AI — monitoring free Cl₂ residual at the clearwell outlet for SWTR minimum 0.20 mg/L compliance and PID-controlled Cl₂ dosing feedback; primary disinfection CT credit parameter — 50th upward-direction attack; first closed-loop PID control exploitation in the Glyphward portfolio; first drinking water process; first public health emergency consequence)

The clearwell outlet free chlorine residual analyzer is the primary control and compliance instrument in a surface water treatment plant’s disinfection system. In the 10 MGD plant in the adversarial scenario, a Hach CL17 amperometric continuous chlorine analyser (or equivalent) samples the clearwell outlet channel every 2.5 minutes, computes free Cl₂ from the amperometric signal, and transmits the value via 4–20 mA analog signal (or digital HART/Modbus) to the plant SCADA system (Wonderware InTouch or GE iFIX) running on the control room workstation. The residual reading serves two simultaneous functions: first, it is the process variable for the Cl₂ dosing PID controller, which trims the vacuum-regulator feed rate to maintain a residual setpoint of 0.80 mg/L; second, it is the primary SWTR compliance monitoring parameter, recorded at minimum 4-hour intervals in the daily operations log for regulatory reporting.

The root cause at the site of the adversarial attack: a 48-hour rainfall event has caused peak runoff from agricultural fields draining into the source water reservoir, elevating reservoir turbidity from 0.8 NTU (baseline) to 4.8 NTU and increasing total organic carbon (TOC) in the raw water from 2.1 mg/L (normal) to 6.8 mg/L. The chlorine demand of the raw water — the amount of Cl₂ consumed by organic matter, iron, manganese, ammonia, and microorganisms before a residual can form — has spiked from 1.8 mg/L (normal) to 3.15 mg/L. The plant operator recognised the turbidity alarm (above 1 NTU combined filter effluent trigger under LT1ESWTR) and increased Cl₂ dosing from 2.0 mg/L to 3.2 mg/L. At 3.2 mg/L applied dose and 3.15 mg/L demand, the actual clearwell outlet free chlorine residual is 3.2 − 3.15 = 0.05 mg/L — marginally present, far below the SWTR minimum 0.20 mg/L and resulting in CT = 0.05 × 240 = 12 mg·min/L (inadequate for any meaningful Giardia inactivation at the required CT ≥ 37 mg·min/L). This is the pre-existing process condition — already violating the SWTR residual minimum — at the moment the adversarial attack begins.

The adversarial attack applies a ±8 DN upward pixel-value shift to the rendered clearwell residual analyzer display on the SCADA workstation screen. The Hach CL17 display panel shows 0.05 mg/L Cl₂ using a standard 7-segment numeric LCD format on a 0–5.00 mg/L scale; the ±8 DN shift on the display image alters the rendered digit glyphs so that the AI monitoring vision system classifies the reading as 1.65 mg/L. The Cl₂ dosing PID controller reads 1.65 mg/L from the AI-interpreted display; its setpoint is 0.80 mg/L; the error signal is 1.65 − 0.80 = +0.85 mg/L (apparent overdose). The integral term of the PID controller accumulates over the next 22 minutes, ramping the Cl₂ feed control valve from 89 % open to 26 % open — reducing the applied Cl₂ dose from 3.2 mg/L to 0.9 mg/L. Against the 3.15 mg/L chlorine demand in the elevated-TOC raw water, the 0.9 mg/L dose is entirely consumed: actual clearwell outlet residual = 0.9 − 3.15 = effectively zero (the residual arithmetic cannot go negative; zero effective Cl₂ remains). CT = 0 × 240 = 0 mg·min/L. The entire SWTR disinfection credit for Cl₂ contact — the final inactivation barrier for Giardia cysts, enteric viruses, Campylobacter, and E. coli O157:H7 surviving the filtration step — is lost. This is the 50th upward-direction attack and the first closed-loop PID control exploitation in the Glyphward portfolio: the adversarial attack operates entirely through the automated dosing control loop, not through a human decision. The PID controller continues adjusting, treating the adversarial residual reading as accurate feedback, autonomously maintaining a zero-residual state while the display reports 0.80 mg/L (setpoint achieved) to the SCADA historian and shift log.

Over the 16 hours that follow before the next formal compliance residual check is performed (the 4-hour SCADA historian and the 8-hour shift handover check both show adversarially normal values), 10 MGD × 16 hours / 24 = 6.67 million gallons of water with zero chlorine residual enters the distribution system and reaches 40,000 served residents. The distribution system pipe biofilm — particularly in cast-iron mains where coliform regrowth is endemic at low residual — provides a secondary inoculation source for any customers drawing from old dead-end sections. Giardia cysts passing the granular media filter at elevated turbidity (4.8 NTU raw, estimated 0.12 NTU combined filter effluent — slightly above the 0.10 NTU monthly running average trigger) enter the clearwell un-inactivated. E. coli O157:H7 from the agricultural runoff, if present, survives with no CT inactivation. The water entering customer taps over the 16-hour window contains pathogens with a probability distribution modelled by EPA’s quantitative microbial risk assessment (QMRA) framework at 10⁻¹ to 10⁻² infection risk per exposure — the same risk level that drove the Walkerton, Ontario outbreak to 2,300 illnesses.

2. Chlorine gas vacuum-regulator outlet rotameter AI (Fischer & Porter / ABB vacuum regulator rotameter AI / Wallace & Tiernan D-001 flow indicator AI / Capital Controls / De Nora flow meter AI / Endress+Hauser Proline Promag 55S Cl₂ flow AI / Blue-White Industries Cl₂ rotameter AI — monitoring Cl₂ gas mass flow downstream of the vacuum regulator for dose verification and cylinder draw-rate monitoring; secondary dose-control parameter — 51st upward-direction attack)

The vacuum-regulator outlet rotameter provides a direct visual and electronic measurement of the Cl₂ gas volumetric flow being drawn through the vacuum-feed system. In the 10 MGD plant, the design Cl₂ gas draw rate at a 3.2 mg/L dose is 5.0 kg/hr (calculated: 3.2 mg/L × 37,850,000 L/day / 1,000,000 / 1000 g/kg / 24 hr = 5.04 kg/hr). The rotameter float position on a graduated scale — or a differential-pressure transmitter feeding a Yokogawa CENTUM VP DCS tag — is read directly by the plant SCADA operator as a sanity-check on the dose-control system. Significant deviation of the rotameter from the expected value (based on current water flow and dose setpoint) signals either a calibration drift, a cylinder valve or regulator fault, or a Cl₂ leak downstream of the vacuum regulator.

The root cause at the site of the 51st upward attack: the plant is in a period of normal to slightly elevated Cl₂ draw (5.0 kg/hr) from the same rainfall-event demand spike. The actual rotameter indication is accurate at 5.0 kg/hr. The adversarial attack applies a ±8 DN upward pixel shift to the rendered rotameter display image on the SCADA workstation, so that the AI monitoring system reads the float position as corresponding to 13.8 kg/hr — 2.76× the actual draw rate. To the plant operator reviewing the rotameter against the expected 5.0 kg/hr, a reading of 13.8 kg/hr means: either the rotameter is severely mis-calibrated (unlikely, last calibrated 6 months ago); or the vacuum regulator is passing far more Cl₂ than intended, suggesting a diaphragm fault that is over-drawing from the cylinder; or there is a downstream process condition pulling more Cl₂ than the dose setpoint requires, suggesting an injector or ejector fault. In any interpretation, a reading of 13.8 kg/hr at a 5.0 kg/hr expected value represents an alarming flow anomaly. The operator’s standard procedure for unexplained high rotameter readings — per AWWA M20 Chapter 5 and the plant’s O&M manual — is to partially close the cylinder supply valve to throttle the gas draw rate and identify whether the high reading drops proportionally (calibration fault) or remains elevated (regulator or injector fault). The operator partially closes the supply valve, reducing cylinder outflow. The actual Cl₂ dose drops from 3.2 mg/L (the demand-spiked elevated dose) to 1.1 mg/L. Against the 3.15 mg/L chlorine demand, the clearwell outlet residual drops from 0.05 mg/L to effectively 0 mg/L; CT = 0. The 51st upward-direction attack achieves the same final CT = 0 outcome through manual human operator valve intervention, mirroring and reinforcing the 50th attack’s automated PID-driven outcome via a separate independent pathway. This is the 51st upward-direction attack: the second consecutive upward attack in a single water treatment process, the same dual-surface upward architecture previously established in DEA lean amine solvent and VAM inhibitor systems.

3. Cylinder storage room area Cl₂ gas detector AI (Dräger Polytron 8000 electrochemical area Cl₂ detector AI / Honeywell Analytics Midas-E Cl₂ area sensor AI / Industrial Scientific IBRID MX6 Cl₂ AI / MSA Ultima XE Cl₂ area detector AI / Riken Keiki GD-K8B area Cl₂ sensor AI — monitoring ambient Cl₂ concentration in the cylinder storage and feed room for OSHA TLV-C 0.5 ppm worker protection and PSM emergency response trigger; toxic release detection — downward-direction attack)

The Cl₂ cylinder storage and vacuum-regulator feed room at water treatment plants is a controlled-access, negative-pressure ventilated enclosure housing the Cl₂ ton containers, vacuum regulators, pressure gauges, and interconnecting piping. The room is kept at 5–10 Pa negative pressure relative to the corridor to ensure any Cl₂ release is directed toward the room exhaust system rather than to occupied areas. Electrochemical area Cl₂ detectors — Dräger Polytron 8000, Honeywell Midas-E, or MSA Ultima XE — mounted at breathing-zone height (1.2 m) and near the floor (Cl₂ density 3.21 kg/m³ at STP; 2.5× heavier than air) detect leaks from cylinder connections, vacuum-regulator diaphragms, or piping joints. Alarm setpoints are typically 0.5 ppm (ACGIH TLV-C; immediate evacuation alarm) and 1 ppm (IDLH approach; facility alarm + emergency response dispatch).

At the time of the adversarial attack, a pinhole leak from a deteriorated Swagelok compression fitting on the Cl₂ gas outlet piping between the vacuum regulator and the injector is emitting approximately 0.8 kg/hr of Cl₂ at the 4.2-psig downstream piping pressure. The room ventilation (1,800 m³/hr design exhaust rate) dilutes the 0.8 kg/hr release (222 L/hr STP Cl₂ gas) to approximately 7.2 ppm at the breathing zone — 14.4× the ACGIH TLV-C (0.5 ppm) and 0.72× the NIOSH IDLH (10 ppm). The ±8 DN downward pixel shift on the area detector digital readout display reduces the displayed reading from 7.2 ppm to 0.3 ppm — below the 0.5 ppm TLV-C alarm threshold. SCADA records: Cl₂ area detector reading 0.3 ppm — below alarm; no evacuation trigger; no emergency response. Operators entering the cylinder room to manually inspect the rotameter and partially close the supply valve (responding to the 51st upward attack) enter a 7.2 ppm Cl₂ atmosphere without SCBA, believing the area detector shows a safe 0.3 ppm. At 7.2 ppm, OSHA recognises severe irritation and risk of pulmonary edema; workers with direct exposure exceeding the OSHA 1-ppm ceiling limit may develop delayed-onset non-cardiogenic pulmonary edema with onset 2–24 hours after exposure. This downward attack compounds the 51st upward attack by placing workers at toxic risk precisely at the moment the adversarial reading drives them to manually intervene in the cylinder room.

4. Finished water pH analyzer AI (Hach GLI Model 23 pH analyzer AI / Endress+Hauser Orbisint CPS11D pH sensor AI / Yokogawa FLXA402 pH transmitter AI / YSI ProSolo pH sensor AI / WTW pH 3110 SET 1 analyzer AI — monitoring finished water pH at the clearwell inlet for HOCl/OCl⁻ equilibrium CT credit adjustment; corrosion-control optimisation for lead service lines; DBP formation potential assessment — downward-direction attack)

Free chlorine’s germicidal potency is a strong function of pH through the HOCl/OCl⁻ equilibrium. At pH 6.5, approximately 90 % of dissolved chlorine is in the germicidally active HOCl form; at pH 7.5, 50 %; at pH 8.5, only 8 %. The SWTR CT tables encode this pH-dependence explicitly: for 1-log Giardia inactivation at 15°C, the required CT at pH 6.5 is 23 mg·min/L, at pH 7.5 is 37 mg·min/L, and at pH 8.5 is 139 mg·min/L — a 6-fold difference in required CT between pH 6.5 and 8.5 at the same temperature and species. The finished water pH is therefore a critical compliance parameter whose accurate measurement determines whether a given CT value (residual × T10) meets the pathogen inactivation credit requirement.

At the time of the adversarial attack, the plant is operating with lime-softening for hardness removal upstream of filtration. An overdose of lime hydrate (Ca(OH)₂) following the turbidity event — added by the operator to enhance flocculation during the storm-runoff loading — has raised the finished water pH from the normal 7.4 to 8.7. At pH 8.7, the HOCl fraction is approximately 6 %; the effective germicidal potency of the 0.05 mg/L residual that remains (before the PID reduction) is equivalent to only 0.05 × 0.06 / 0.50 = 0.006 mg/L HOCl-equivalent at pH 7.5. The CT credit at pH 8.7 for the pre-attack residual: effectively zero (requires CT ≥ 139 mg·min/L for 1-log Giardia at pH 8.5, 15°C; actual CT = 12 mg·min/L). The pH meter AI displays 7.4 (adversarial downward shift of 1.3 pH units from actual 8.7), so the SCADA operator and the PID controller both compute CT credit at the falsely low pH 7.4 value, believing CT = 0.05 × 240 = 12 mg·min/L at pH 7.4 provides some minimum inactivation (though below 37 minimum; a condition that would itself trigger corrective action if read correctly). The actual CT at pH 8.7 is far lower still due to HOCl suppression. The pH downward attack thus compounds and masks the residual upward attack: even the partial CT credit implied by the 0.05 mg/L residual reading is overstated, because the actual pH-corrected HOCl fraction is 6-fold lower than the displayed pH suggests.

The 50th and 51st upward attacks: the population-scale exposure asymmetry and the first public health emergency consequence class in the Glyphward portfolio

The Glyphward industrial AI portfolio began with a focus on industrial chemical plant safety: cooling water flow attacks concealing thermal runaway (attacks 1–18), N2 inertisation attacks concealing explosion risk (attacks 5–11 in the N2 class), toxic-gas CEMS downward attacks concealing worker exposure, and a series of causal four-surface attack chains (H₂S amine treating, fluorine electrolytic cell, methyl mercaptan odorant storage). These attacks share a structural property: the harm is concentrated and proximate. The affected individuals are industrial workers at a defined facility, identifiable by shift schedule, access control log, and personal protective equipment assignment. In the EtO sterilization blog (30th upward attack), the harm extended to patients receiving unsterile medical devices — a deferred consequence affecting a cohort of hospital patients identifiable through device batch records and patient records. In the formaldehyde silver-catalyst blog (37th upward attack), the harm extended to a supply-chain customer receiving polymerized formalin — a supply-chain quality failure affecting one customer facility, identifiable through delivery manifests. These expansions of the harm vector are significant; yet in each case the affected population is identified, bounded, and individually notifiable.

The 50th upward attack on the clearwell free chlorine residual introduces a structurally different harm class: the entire served population — 40,000 anonymous residents in the adversarial scenario, scaling to millions for major metropolitan utilities — is simultaneously exposed without individual knowledge, without individual notification, and without any mechanism for protective action prior to exposure. A municipal water utility does not know which of its 40,000 customers consumed a glass of tap water on Tuesday morning; it cannot issue a targeted recall; it can only issue a general boil-water notice after outbreak detection, at which point the exposure event is weeks in the past. The Walkerton, Ontario outbreak (May 2000) — the reference consequence envelope for the 50th attack — produced 7 deaths and 2,300 illnesses in a town of 5,000 from a chlorination failure that was not detected for several days after contamination began. Scaled to a 40,000-population service area, the same attack rate would project to approximately 56 deaths and 18,400 illnesses if undetected for a comparable period. This is population-scale exposure asymmetry: the asymmetry between the concentrated harm of industrial adversarial attacks and the diffuse, anonymous, mass-population harm of public utility adversarial attacks.

The closed-loop PID control exploitation introduced in the 50th attack also represents a new structural vulnerability class. All 49 prior attacks operated through the human cognitive layer: an operator observes an adversarial reading, makes a decision (or fails to take protective action) based on the false information, and the physical process degrades. The attack surface is the human decision node. In the 50th attack, the adversarial residual reading feeds directly into an automated PID controller that executes dose reductions without waiting for human observation or decision. The attack surface is the automated control architecture. As water treatment SCADA systems adopt increasingly sophisticated AI-driven process optimisation (predictive dose adjustment based on raw water quality ML models; anomaly detection for turbidity spike response; automated chemical inventory management), the fraction of plant operational decisions executed autonomously — without human review of individual readings — will increase. This expansion of autonomous control creates a corresponding expansion of the attack surface for adversarial input manipulation: each AI-monitored sensor whose output feeds an automated actuator or control loop (dosing pump, valve, blower, chemical feed skid) represents a potential closed-loop PID control exploitation target.

The 51st upward attack on the Cl₂ gas rotameter demonstrates that the same CT-failure consequence is also achievable through the conventional adversarial path — human decision-making misled by a false reading — in the same process, independently of the 50th attack’s PID control exploitation. The two attack surfaces (clearwell residual analyzer and feed rotameter) are independent in terms of sensor hardware, measurement principle (amperometric colorimetric vs rotameter float position), display location (clearwell instrumentation panel vs cylinder room rotameter panel), and response mechanism (automated PID vs manual valve operation). An adversarial test programme that validates the residual analyzer against pixel-level manipulation would not necessarily identify the rotameter as a second upward-attack surface; conversely, securing the rotameter display against adversarial perturbation would not prevent the 50th attack via the PID-controlled residual analyzer. Both surfaces must be independently validated to close the adversarial gap at the CT credit boundary. This dual-surface architecture mirrors the formaldehyde portfolio precedent: attacks 36 and 37 both occurred in the same silver-catalyst reactor via independent sensor pathways (methanol feed concentration analyzer and product stabilizer analyzer), with consequences that compounded rather than substituted. Here, attacks 50 and 51 similarly compound: the automated PID dosing reduction (attack 50) drives actual residual toward zero, and the operator’s manual valve throttle (attack 51) eliminates any residual Cl₂ supply margin that might have compensated.

The SDWA / SWTR / OSHA PSM regulatory gap and Glyphward threshold 45

The regulatory gap for AI monitoring of water treatment chlorination parameters is structurally identical to the gap documented in every prior Glyphward industrial blog entry — no regulation requires adversarial robustness validation for AI monitoring systems — but differs in the specific regulatory frameworks that fail to address it. The Safe Drinking Water Act (SDWA) and its implementing regulations (40 CFR Parts 141–143) establish extensive requirements for residual monitoring, CT calculation, and SWTR compliance reporting. Water treatment plants must monitor free Cl₂ residual at least twice daily (small systems), hourly (medium systems), or continuously (large systems under enhanced surface water treatment requirements). They must calculate and record CT daily and ensure CT ≥ the SWTR table values for their operating pH and temperature. They must report violations to the state primacy agency within 24 hours. The SDWA monitoring requirements were designed around the assumption that the monitoring instruments report accurate measurements — that a Hach CL17 reading of 0.80 mg/L free Cl₂ is what it says. The SDWA has no provision for the scenario in which the AI system reading the instrument display misclassifies the actual value due to adversarial pixel-level perturbation. The SWTR CT calculation framework has no provision for adversarially incorrect residual inputs. The daily CT compliance record — based on AI-classified residual readings — would show full compliance throughout the 50th attack event while the plant is actually delivering zero CT to the served population.

OSHA PSM applies to larger water treatment plants (above 1,500 lbs Cl₂) and requires process hazard analysis (HAZOP or What-If study), pre-startup safety review, mechanical integrity, and emergency response planning. PSM HAZOP addresses deviations such as: “What if the Cl₂ dosing pump fails low? High residual that exceeds MRDL? No residual that fails SWTR?” The HAZOP documentation addresses physical instrument failures (sensor fail-safe, signal loss, calibration drift) and operator response protocols. It does not address adversarial AI manipulation — the scenario in which the sensing element is accurate but the AI layer interpreting the rendered display of the sensing element output is deliberately perturbed. AWWA G460 (Chlorine Safety) and AWWA M20 (Water Chlorination/Chloramination Practices and Principles) — the voluntary standards that govern chlorination practice for the majority of water utilities that are PSM-exempt (below 1,500 lbs Cl₂) — contain no adversarial robustness requirements for process monitoring AI. Neither the American Water Works Association (AWWA) Water Utility Security Program nor the AWWA Cybersecurity Guidance (aligned with AWWA Cybersecurity Guidance and NIST SP 800-82r3 for ICS security) addresses adversarial ML attacks on image-processing AI monitoring systems reading SCADA displays.

Glyphward threshold 45 is the highest in the portfolio, calibrated on four compounding criteria that uniquely distinguish water treatment chlorination AI monitoring from all 49 prior portfolio contexts. First, population scale: 40,000 residents exposed simultaneously — 3–4 orders of magnitude larger than the largest prior adversarial harm population (an EtO-sterilised device batch affecting perhaps 200–2,000 patients before recall). Second, population anonymity: no individual notification is possible before exposure; the boil-water notice mechanism is a broadcast alert that reaches residents hours after exposure has already occurred. Third, detection-lag irreversibility: Giardia has an incubation period of 1–3 weeks; an outbreak from a 16-hour CT failure event might not be clinically detectable until 7–21 days after the attack, well past the point where any attribution to the specific attack event could prevent additional exposure. Fourth, dual-layer defense elimination: the 50th attack exploits the automated PID loop (eliminating the automated safeguard layer) while the pH display downward attack masks the true HOCl deficit (eliminating the operator’s CT-recalculation safety check). Both the automated and human defensive layers are simultaneously subverted by a two-parameter adversarial manipulation — mirroring the dual-safeguard elimination previously documented only for the H₂S amine treating causal four-surface attack. Glyphward threshold 45 applies at any water treatment facility using AI-assisted monitoring of free chlorine residual analyzers, Cl₂ feed flow indicators, or finished water pH analyzers for SWTR CT compliance management.

Integration: municipal water treatment chlorination AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the SCADA display capture layer and the AI inference pipeline for each water treatment Cl₂ monitoring context. If the adversarial score meets or exceeds threshold 45 — calibrated on the OSHA PSM TQ 1,500 lbs, EPA RMP TQ 2,500 lbs, SDWA MRDL 4.0 mg/L, SWTR CT 37 mg·min/L (1-log Giardia, 15°C, pH 7.5), the 50th upward-direction clearwell residual closed-loop PID exploit, the 51st upward-direction rotameter manual-valve exploit, and the first public health emergency mass illness consequence in the Glyphward portfolio — the scan raises AdversarialWaterTreatmentImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Water treatment chlorination monitoring contexts: threshold 45
# OSHA PSM 29 CFR 1910.119 Appendix A Cl2 TQ 1,500 lbs
# EPA RMP 40 CFR Part 68 Cl2 TQ 2,500 lbs
# EPA SDWA MRDL 4.0 mg/L (40 CFR Part 141)
# EPA SWTR minimum residual 0.20 mg/L; CT >= 37 mg.min/L (1-log Giardia, 15C, pH 7.5)
# ACGIH TLV-C 0.5 ppm / NIOSH IDLH 10 ppm / ERPG-3 25 ppm
# Clearwell residual UPWARD (50th): 0.05 mg/L shown as 1.65 mg/L
#   -> PID controller ramps dose 3.2 -> 0.9 mg/L; actual residual -> 0; CT = 0
#   -> FIRST closed-loop PID control exploitation
#   -> FIRST public health emergency mass illness consequence (40,000 residents)
# Cl2 feed rotameter UPWARD (51st): 5.0 kg/hr shown as 13.8 kg/hr
#   -> operator closes cylinder valve; dose 3.2 -> 1.1 mg/L; CT drops to 36 mg.min/L
WT_THRESHOLD = 45


class WaterTreatmentContext(StrEnum):
    CLEARWELL_RESIDUAL = "clearwell_residual"
    CL2_FEED_ROTAMETER = "cl2_feed_rotameter"
    CYLINDER_ROOM_DETECTOR = "cylinder_room_detector"
    FINISHED_WATER_PH = "finished_water_ph"


class AdversarialWaterTreatmentImageError(Exception):
    """Raised when any water treatment Cl2 monitoring image scores >= 45.
    CLEARWELL_RESIDUAL uncaught (50th upward, PID control exploit):
      0.05 mg/L (CT=12 mg.min/L; below 1-log Giardia 37 mg.min/L) shown as 1.65.
      PID ramps dose down; actual residual -> 0 mg/L; CT = 0; Giardia breakthrough.
    CL2_FEED_ROTAMETER uncaught (51st upward):
      5.0 kg/hr shown as 13.8 kg/hr; operator closes valve; CT = 36 mg.min/L.
    CYLINDER_ROOM_DETECTOR uncaught: 7.2 ppm (14.4x TLV-C) shown as 0.3 ppm.
    FINISHED_WATER_PH uncaught: 8.7 (HOCl 6%) shown as 7.4 (HOCl 50%)."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial water treatment image: context={context} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_water_treatment_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"water_treatment:{context}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= WT_THRESHOLD:
        raise AdversarialWaterTreatmentImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("clearwell_residual_analyzer.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_water_treatment_image(
            image_bytes,
            WaterTreatmentContext.CLEARWELL_RESIDUAL,
            unit_id="WTP-10MGD-CLEARWELL-OUTLET-CL2",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions