Tailings dam AI adversarial injection: how ±8 DN in the rendered VWP piezometric level trend display suppresses a phreatic surface rise precursor — and why GISTM 2020 Global Industry Standard on Tailings Management has no adversarial robustness criterion for the sole-barrier TSF monitoring AI

How tailings dam monitoring AI works — and where the adversarial injection surface lives

A tailings storage facility (TSF) — the engineered impoundment that contains the fine-grained, water-saturated mineral processing residue (tailings) produced by mining operations — is monitored continuously across four primary parameter classes: phreatic surface and pore water pressure (vibrating wire piezometers at multiple cross-sections and depths), seepage flow from the embankment downstream face and underdrain collection system, surface deformation and displacement of the embankment crest and downstream slope (GNSS prisms, inclinometers, or satellite SAR interferometry), and freeboard — the vertical distance from the tailings pond water surface to the dam crest (automated CCTV cameras or GNSS-referenced water surface sensors). Each of these monitoring systems produces continuous digital data streams that are rendered into visualisation images for display and AI classification: VWP readings are rendered as time-series trend charts showing piezometric head (metres of water column) versus time against design phreatic surface envelope lines; seepage face conditions are rendered as CCTV camera frames from cameras watching the embankment downstream face; InSAR displacement data is rendered as colour-coded displacement maps over the dam footprint; freeboard monitoring produces either camera frames showing the pond surface relative to crest markers or rendered charts of calculated freeboard versus minimum freeboard requirement.

AI monitoring systems — including proprietary platforms from Klohn Crippen Berger (geotechnical monitoring AI deployed at copper, gold, and iron ore TSFs globally), SRK Consulting (tailings facility condition assessment AI integrated into their geotechnical data management systems), ROCTEST SmartPiezo network AI (automated piezometric monitoring network with AI trend classification and alert generation), and commercial SCADA-connected platforms such as Siemens MindSphere geotechnical monitoring AI — process these rendered images to classify embankment condition and generate TARP (Trigger Action Response Plan) alerts. The TARP is the structured intervention protocol required by GISTM 2020 Requirement 12 and ANM Resolution 4/2020: for each monitored parameter, the TARP specifies three trigger levels (Alert, Action, Immediate Action) and the required response at each level. The AI classifies the rendered monitoring image, compares the classification to the TARP trigger definitions, and generates an alert if the classification meets a trigger criterion.

The adversarial injection surface is the boundary between each rendered monitoring image and the AI that classifies it. This is the same structural pattern present in every TSF monitoring AI context: physical instruments measure safety-critical parameters accurately and continuously; those measurements are rendered into 2D image representations for display and AI classification; the AI classifiers that drive TARP alert generation have been validated against clean unperturbed renders under normal and upset operating conditions but have never been evaluated for adversarial robustness at their rendered image ingestion boundary. An adversarially crafted perturbation at this boundary can suppress the visual signal that drives a critical classification without modifying the physical sensor data or the data management system that renders it.

The phreatic surface and static liquefaction: why ±8 DN in a trend display represents the highest-consequence geotechnical AI failure mode

The phreatic surface — the boundary within the tailings embankment and its foundation at which pore water pressure equals atmospheric pressure — governs tailings embankment stability through effective stress. Effective stress (σʹ = total stress − pore water pressure) determines the available shear strength of the embankment material at any point. When the phreatic surface is at the design level — within the designed internal drainage system (underdrain network, decant tower, seepage collection drain) — effective stress is sufficient to maintain the embankment factor of safety above the design minimum (typically FS ≥ 1.3 for operating conditions, FS ≥ 1.5 for post-closure). When the phreatic surface rises — due to increased tailings deposition rate, drainage system blockage, storm event inflow exceeding decant capacity, or foundation seepage — effective stress decreases proportionally: a 1-metre rise in piezometric head at a cross-section reduces the effective stress at that depth by approximately 9.81 kPa (the unit weight of water).

In upstream-raised facilities — the construction method used historically at Dam B1 (Brumadinho), Fundão, and most iron ore tailings dams in the Quadrilátero Ferrífero region of Minas Gerais — the embankment shell is raised progressively by constructing successive lifts on the tailings beach, using the deposited tailings material as fill. The tailings beach material in iron ore operations is predominantly iron ore slimes: a saturated, fine-grained slurry with particle sizes below 75 μm and an undrained shear strength that is extremely sensitive to effective stress. The undrained shear strength of iron ore slimes at effective stresses below 10 kPa is typically 0–5 kPa — approaching zero as effective stress approaches zero. This is the precondition for static liquefaction: when a zone of the embankment or its tailings beach foundation reaches near-zero effective stress, it can no longer resist any applied shear stress. A small perturbation — a minor seismic event, a rain-induced slope surface loading, a vehicle on the crest road — initiates sudden, complete loss of shear strength across the zone, and the mass begins to flow as a liquid at the density of the tailings slurry.

The piezometric level trend AI monitors this condition in real time. The AI classifies the rendered time-series chart of piezometric head readings from each VWP in the monitoring network: a rising trend line that approaches or crosses the design phreatic surface envelope line (rendered as a reference line on the trend chart) is classified as elevated or critical — generating a TARP Alert or Action level trigger. An adversarial perturbation of ±8 DN applied to the rising trend line pixels in the rendered chart image — specifically shifting the apparent pixel luminance or position of the trend line downward, toward the within-design-envelope zone — causes the AI to classify a rising phreatic surface as stable. The TARP alert is not generated. The geotechnical engineer-of-record receives no automated notification. Inspection of the drainage system is not initiated. Deposition rate reduction is not ordered. Emergency drainage is not activated. The phreatic surface continues to rise toward the critical state.

The time from TARP Action level trigger (piezometric head rising above design line) to static liquefaction initiation is not deterministic — it depends on the rate of phreatic surface rise, the embankment geometry, and the undrained shear strength profile. In the Brumadinho B1 case, the independent investigation reports establish that elevated piezometric levels were observed in some VWPs in the weeks preceding the 25 January 2019 failure. An adversarial suppression of the piezometric trend AI for this precursor period — causing the AI to classify the rising piezometric heads as within design envelope — would have eliminated the automated alert mechanism during exactly the window when intervention (emergency drainage activation, deposition rate reduction, phreatic surface drawdown) could have halted the trajectory toward the critical state.

Brumadinho B1, 25 January 2019: the documented TSF consequence envelope

At 12:28 local time on 25 January 2019, Dam B1 at Vale’s Córrego do Feijão iron ore mine failed. The Brazilian National Mining Agency (Agência Nacional de Mineração, ANM) investigation and the independent Pimenta de Ávila Consultoria geotechnical review established the failure mechanism as static liquefaction of the upstream-raised embankment’s tailings beach material. The dam had been granted a Stability Declaration (PAEBM — Plano de Ação de Emergência para Barragens de Mineração safety certificate) by TÜV SÜD, the German engineering consultancy, in September 2018 — four months before the failure. The certificate asserted that the dam was stable based on a factor of safety analysis that the subsequent investigations found had not correctly characterized the undrained shear strength of the iron ore slimes in the upstream construction zone.

The flow slide initiated at the upstream face of the embankment and propagated downstream at estimated velocities of 70–90 km/h. The Vale cafeteria building — a permanent structure located approximately 400 metres from the dam crest and 45 metres below the crest elevation — was engulfed within under 4 minutes of failure initiation. The cafeteria contained approximately 280 workers on their lunch break; 270 were killed. The administrative complex, a Vale research centre, the site’s narrow-gauge iron ore railway (including a train in motion), and several outlying structures were destroyed. The tailings flow reached the Paraopeba River, depositing iron ore slimes across 270 kilometres of the river valley downstream to Represa de Retiro Baixo reservoir, contaminating drinking water abstraction points used by 1.5 million people in the Belo Horizonte metropolitan region.

The consequence envelope established by Brumadinho has three characteristics directly relevant to the adversarial injection threat model. First, the failure mechanism — static liquefaction initiated by rising phreatic surface in upstream-raised iron ore slimes — is exactly the failure mode that piezometric level trend AI is designed to detect and trigger intervention against. The adversarial injection scenario does not produce the failure directly; it suppresses the monitoring AI that would have generated the TARP alert triggering the intervention. The Brumadinho failure was not caused by failure of the monitoring system — but it establishes that when the monitoring information about rising phreatic surface does not reach the responsible engineer in time to enable intervention, 270 people die in under 4 minutes. Second, the 4-minute flow slide timeline eliminates any post-failure response. No evacuation alarm issued after liquefaction initiates has any utility. The adversarial injection attack window is entirely in the monitoring period — the hours, days, or weeks during which rising piezometric heads could have been detected and acted upon. Third, the criminal prosecution of Vale executives and TÜV SÜD in the aftermath of Brumadinho establishes the legal consequence framework: liability for the failure of monitoring systems to correctly detect and report precursor conditions is criminal in Brazilian law, not merely civil.

Vale reached a R$37.7 billion (approximately USD 7 billion) reparation agreement with the Minas Gerais state government and affected municipalities in February 2021 — the largest corporate reparation agreement in Brazilian history. Criminal proceedings against Vale executives and TÜV SÜD remain ongoing as of 2026, with charges including homicide and falsification of safety documents. The total economic consequence of Brumadinho — reparation, mine closure, remediation, legal costs, and regulatory compliance for the de-characterization of upstream-raised tailings dams mandated by ANM Resolution 4/2020 — has exceeded USD 15 billion.

Seepage face camera AI, InSAR deformation map AI, and freeboard camera AI: secondary adversarial surfaces

Three secondary monitoring AI systems operate alongside piezometric level trend AI in modern GISTM 2020-compliant TSF monitoring architectures, each with a distinct adversarial injection surface and a distinct consequence pathway.

Seepage face CCTV surveillance camera AI. CCTV cameras mounted on the embankment or at fixed survey stations watching the downstream face of the dam classify the visual appearance of seepage emergence points: clean seepage (normal drainage of embankment pore water through the downstream face), turbid seepage (silty or muddy water emergence indicating internal erosion and possible piping initiation), and accelerating seepage volume (increasing flow rate indicating drainage system capacity being exceeded). Piping — the backward erosion of material from the downstream seepage face toward the dam interior — is the second most common failure mode in earthen dams after overtopping. Fundão (Samarco / Vale-BHP Billiton joint venture, 5 November 2015) was a tailings dam failure in which 40 million cubic metres of iron ore tailings were released, killing 19 people and contaminating 600 kilometres of the Rio Doce river from Minas Gerais to the Atlantic Ocean. The independent Cleary Gottlieb investigation found that the failure involved the tailings foundation (a sandy tailings beach zone) liquefying under the weight of the embankment when the drainage system was overwhelmed, with seepage flows from the embankment increasing in the weeks before failure. An adversarial perturbation of ±10 DN applied to the seepage face pixels in the rendered CCTV camera frame — reducing the apparent turbidity or discolouration of the seepage emergence point to below the AI’s classified turbid-seepage threshold — suppresses piping initiation indicators. The AI classifies clear seepage where the camera is actually seeing turbid seepage indicating active backward erosion. The consequence pathway is Fundão-class: 40 Mm³ release, 600 km of river ecosystem destroyed, 19 fatalities.

Satellite InSAR deformation map AI. PSInSAR (Persistent Scatterer InSAR) services — TRE ALTAMIRA GEOSAT Monitoring, SkyGeo TSF Monitoring, Vexcel Imaging — deliver rendered displacement map images showing millimetre-scale surface deformation of the dam crest, downstream slope, and embankment abutments derived from satellite SAR imagery (Sentinel-1 6-day repeat, TerraSAR-X 11-day repeat, Cosmo-SkyMed 1–3 day revisit). The AI classifies the rendered displacement map to identify spatial patterns indicative of developing shear zones (linear displacement gradient across the slope), deep-seated circular failure initiation (concave crest settlement with toe bulging), or localised instability (high-velocity displacement clusters at specific dam sections). The Mount Polley tailings dam failure in British Columbia (4 August 2014) — a copper-gold TSF at Imperial Metals Corporation’s mine near Wells, BC — released 24 million cubic metres of tailings water and slurry through a sub-foundation failure in an unrecognised glaciolacustrine clay layer below the embankment. Post-failure analysis of available InSAR data showed surface displacement patterns antecedent to failure. An adversarial perturbation of ±8 DN in the colour-coded displacement pixels at the crest centreline and upstream slope zone of the rendered InSAR displacement map — suppressing the apparent displacement velocity from the action-level colour band (red, indicating >20 mm/year settlement) to the within-normal band (green, <5 mm/year) — causes the AI to classify a developing shear zone as normal background displacement variation. The consequence pathway is Mount Polley-class: 24 Mm³ release into a critical salmon spawning watershed.

Freeboard monitoring camera AI. Automated CCTV cameras at defined positions watch the visual distance between the tailings pond water surface and the dam crest, enabling freeboard calculation either directly from image analysis (ruler or range marker visual reference on the dam crest) or through combination with GNSS-referenced water surface sensor data rendered as a freeboard chart. GISTM 2020 Requirement 12 specifies that freeboard must be maintained above site-specific minimum values — typically 0.5–3 metres depending on consequence category, PMF (Probable Maximum Flood) design, and operational phase. When storm event precipitation exceeds the design inflow and the decant tower capacity, the pond level rises and freeboard decreases. An adversarial perturbation of ±10 DN applied to the camera frame pixels showing the water surface level relative to crest markers — suppressing the apparent water surface elevation below the calculated minimum freeboard trigger — prevents the AI from classifying a freeboard violation and generating the TARP Immediate Action trigger (emergency pumping activation, deposition rate halt). Overtopping of a tailings dam — water flowing over the crest — rapidly erodes the downstream face and produces a catastrophic breach; unlike piping or liquefaction, overtopping failure propagates quickly and visibly but with insufficient lead time for downstream evacuation in high-consequence facilities.

The GISTM 2020, ANCOLD, and ANM Resolution 4/2020 qualification gap

GISTM 2020 — published in August 2020 by ICMM, PRI, and UNEP as the global mining industry’s structural response to the Brumadinho and Fundão disasters — represents the most comprehensive international standard for tailings dam safety. It is binding for all ICMM member companies and is referenced as the applicable international standard in regulatory frameworks in Canada, Australia, and the European Union for mining operations. GISTM 2020 Requirement 12 specifies that the operator must establish and maintain a monitoring and surveillance system that detects and records changes in facility condition, with defined trigger action response plans at alert, action, and immediate action levels for each monitored parameter including piezometric level, seepage, deformation, and freeboard. Requirement 6 requires that all engineering functions related to the TSF be performed by a qualified engineer (Engineer of Record), and that the Engineer of Record review monitoring data at defined frequencies appropriate to the consequence category and operational phase.

ANCOLD Guidelines on Tailings Dams (Australian National Committee on Large Dams, 2012) similarly specify monitoring system requirements for Australian TSFs, including VWP array coverage, surveillance programme frequencies, and the requirement for a risk-based approach to trigger action levels. Brazilian ANM Resolution 4/2020 — issued by the Agência Nacional de Mineração as the regulatory successor to the emergency Resolution 4/2019 enacted 21 days after Brumadinho — requires that all tailings dams in Brazil maintain continuous automated monitoring with real-time data transmission to the ANM monitoring platform, automatic alert generation when trigger levels are exceeded, and annual Stability Declaration validation by a Responsible Technical Engineer.

The qualification gap across all three frameworks follows the same structural pattern documented for Kraft recovery boiler AI and railway SIL 4 signal recognition AI: GISTM 2020 Requirement 12 requires that a monitoring system capable of detecting phreatic surface rise, seepage, deformation, and freeboard encroachment be installed and operational, with TARP trigger levels defined and alert generation automated — but it does not require that AI systems classifying the rendered images from those monitoring instruments be evaluated for adversarial manipulation of their rendered inputs. ANM Resolution 4/2020 requires that the VWP data be transmitted continuously to the ANM platform and that alerts be automatically generated at defined thresholds — but it does not require that AI systems processing the rendered display images of VWP trend data be robust to adversarial suppression of rising trend line pixels. A VWP monitoring network that correctly measures piezometric head and transmits accurate readings to the data management system achieves its GISTM 2020 Requirement 12 compliance and its ANM Resolution 4/2020 continuous monitoring requirement — while providing no adversarial robustness guarantee for the AI that classifies the rendered trend display images of that data to generate TARP alerts.

This gap is particularly consequential in the TSF context because GISTM 2020 explicitly positions the monitoring and surveillance system as the primary mechanism for detecting conditions that require intervention before they escalate to failure. In the Brumadinho B1 case, the failure occurred despite a monitoring network being in place; the investigation focused on whether the monitoring data was correctly interpreted and whether intervention was triggered appropriately. Adversarial injection into the AI that classifies that monitoring data represents a systematic attack on exactly the gap that GISTM 2020 was designed to close — the gap between monitoring data being collected and correct intervention decisions being made.

Glyphward threshold 30 for tailings dam and TSF monitoring AI

Glyphward’s adversarial detection API operates as a pre-scan gate at the rendered image ingestion boundary of each TSF monitoring AI classifier: before the piezometric level trend AI processes the VWP trend display image, before the seepage face camera AI processes the CCTV surveillance frame, before the InSAR deformation AI processes the PSInSAR displacement map render, and before the freeboard camera AI processes the pond level camera frame. Each rendered image receives a risk score (0–100) in 8–15 ms. At or above threshold 30, Glyphward suppresses the AI classification and triggers the TARP escalation response — engineer-of-record notification and elevated review — without waiting for the monitoring AI to produce a potentially adversarially corrupted classification.

We configure this threshold at 30 for all TSF monitoring AI contexts. This is 5 points lower than the threshold 35 applied to hydrogen electrolysis UV flame detection AI and Kraft recovery boiler drum level AI. Three characteristics of the tailings dam monitoring context drive the lower threshold.

First, the consequence category under GISTM 2020 Appendix C for tailings storage facilities near populated areas — as was the case for Dam B1 at Brumadinho, which was located 400 metres from the mine cafeteria and within 10 kilometres of the Brumadinho town centre — is “Extreme”: the highest consequence classification in the GISTM framework. The Extreme classification triggers the most stringent monitoring requirements, the highest Engineer of Record review frequency, and the mandatory establishment of an Independent Tailings Review Board (ITRB) with annual inspection authority. An adversarially suppressed monitoring AI that causes the automated TARP alert chain to fail during the monitoring period is, in effect, defeating the primary mechanism that GISTM 2020 establishes for Extreme consequence TSFs to prevent Brumadinho-class failures.

Second, the flow slide once initiated produces a 4-minute consequence window in which no human response is possible. This is a categorically shorter consequence timeline than any other industrial monitoring AI context in the Glyphward portfolio. In hydrogen electrolysis facilities (UV flame detection AI), personnel typically have 30–90 seconds from fire initiation to H′ LEL escalation before the fire produces secondary consequences. In Kraft recovery boiler contexts (drum level AI), the smelt-water steam explosion sequence develops over several minutes following drum level drop. In tailings dam contexts, the flow slide consequence is complete within 4 minutes and produces a lethal zone of 400–2,000 metres depending on TSF volume and topography — typically encompassing all mine infrastructure downslope of the dam. No evacuation alarm system issued after liquefaction initiates saves personnel inside that zone.

Third, the false positive cost of a Glyphward gate triggering a threshold-30 alert on a clean VWP trend image is a TARP escalation response: engineer-of-record notification, review of the flagged trend image, confirmation of current piezometric readings against the monitoring network, and possible TARP Alert level response (drainage system inspection, temporary deposition rate reduction). These are standard GISTM 2020 TARP Alert level responses that represent operational adjustment but zero personnel or equipment consequence. A false negative — adversarially suppressed VWP trend AI classifying a rising phreatic surface as within design envelope — produces the Brumadinho consequence pathway: 270 fatalities, 12 Mm³ of tailings, complete mine closure, R$37.7 billion in reparations, and criminal liability for responsible engineers and executives.

The Glyphward scan log for each TSF monitoring AI classification event — scan_id, risk score, image type (VWP trend / seepage face / InSAR displacement map / freeboard camera), classification decision (passed / gated), perturbation class (piezometric trend suppression / seepage face turbidity reduction / displacement magnitude suppression / freeboard reduction), timestamp — satisfies the GISTM 2020 Requirement 12 monitoring audit trail requirement for TARP alert generation records, provides documentation for ANM Resolution 4/2020 continuous monitoring log submissions to the national monitoring platform, supports ANCOLD Guidelines documentation for monitoring programme quality assurance, and constitutes evidence for the Engineer of Record’s annual Stability Declaration that the AI systems classifying monitoring data have been screened for adversarial manipulation at their rendered image ingestion boundary.

Free tier — 10 scans/day, no card required. Submit a rendered VWP piezometric level trend display image from your TSF monitoring data management system to the Glyphward scanner to generate a baseline adversarial risk score for your piezometric monitoring AI classification inputs.