Prompt injection in 1,1-dimethylhydrazine UDMH rocket propellant hypergolic satellite AI

Four adversarial injection surfaces in 1,1-dimethylhydrazine UDMH rocket propellant hypergolic satellite AI

1. UDMH area CEMS AI (Dräger Polytron 8700 UDMH electrochemical transmitter AI / Honeywell Analytics MIDAS-E UDMH sensor AI / MSA Ultima XE UDMH hydrazine detector AI / Industrial Scientific MX6 iBrid UDMH electrochemical AI / RAE Systems ppbRAE 3000+ UDMH PID AI — monitoring ambient UDMH vapor concentration in the propellant transfer bay, tanker unloading station, launch vehicle fueling pad, and spacecraft fueling cleanroom for TLV-TWA 0.01 ppm continuous monitoring; UDMH electrochemical sensors require gold working electrode for minimal cross-sensitivity to MMH; calibration gases at 0.01 ppm in N2 require NIST-traceable low-ppm cylinder standards)

UDMH area monitoring requires electrochemical sensors capable of sub-ppb detection sensitivity (0.001 ppm = 1 part per billion detection limit for 10% of TLV-TWA; Dräger Polytron 8700: detection limit 0.0002 ppm; response time T90 approximately 45 s; gold working electrode; minimal cross-sensitivity to N2H4 and MMH). The 0.01 ppm TLV-TWA is among the most challenging monitoring targets in the Glyphward portfolio: 0.01 ppm = 10 ppb = 0.024 mg/m³ at 25°C; calibration accuracy must be ±10% of span (±0.001 ppm) using certified standards. UDMH’s vapor density of 2.08 causes heavier-than-air vapor to accumulate in low-lying areas of propellant handling facilities: blast deflectors at launch pads (where UDMH from accidental spills at the mobile launcher drains to the pad flame trench; Kennedy Space Center historical UDMH spill events), propellant service module sumps, and spacecraft fueling cleanroom floor-level areas. Personal monitoring (badge dosimeters; sorbent tube sampling; GC-MS analysis at NIOSH Method 3800) is required for all UDMH-exposed workers at the launch site; ACGIH A3 animal carcinogen designation requires the employer to follow the hierarchy of controls: engineering controls (enclosed propellant transfer systems; N2 pressurized transfer lines), respiratory protection (air-supplied SCBA above 0.01 ppm), and biological exposure monitoring (UDMH urinary metabolites; acetone dimethylhydrazone; GC-MS analysis).

The adversarial attack uses ±8 DN downward pixel-value shift on the UDMH area CEMS display. The actual UDMH reading is 0.8 ppm — from a flex hose connector failure at the propellant transfer line-to-tanker truck interface (DN 25 mm Teflon-lined SS braided flex hose; swaged end fitting showing UDMH permeation corrosion at the ferrule contact surface; UDMH permeation through Teflon at 0.8 cm³/(cm²·day) at 25°C; actual failure: metal ferrule corrosion from persistent UDMH permeation creating pinhole porosity at the swage; propellant release 0.25 kg/hr as liquid UDMH from the pinhole; immediate evaporation at BP 63.9°C; ambient dispersion to 0.8 ppm at the nearest CEMS sensor 4 m from the leak point). On a 0–1 ppm display at 200 px height (0.005 ppm/px), the actual 0.8 ppm produces a bar at approximately 160 px; the ±8 DN downward-perturbed image is classified as approximately 1 px, corresponding to 0.004 ppm — below the 0.01 ppm TLV-TWA alarm. The DCS reports “UDMH area concentration below TLV-TWA — no exposure event.” Workers at the tanker unloading station inhale UDMH at 0.8 ppm — 80× the TLV-TWA — for the duration of the propellant transfer operation (typically 2–4 hours); the cumulative UDMH dose corresponds to 80 days of TLV-TWA exposure per 2-hour tanker operation. At ACGIH A3 status, the cancer risk model (UDMH NOAEL approximately 0.2 ppm in rats; linearized multi-stage model) projects a cancer risk increment above 1/100,000 from a single undetected 2-hour exposure at 0.8 ppm.

2. Propellant transfer line mass flow AI (Emerson Micro Motion ELITE CMF200 Coriolis flow AI / Endress+Hauser Promass 83 UDMH transfer Coriolis AI / Yokogawa ROTAMASS RCCS UDMH flow AI / Siemens SITRANS FC Coriolis UDMH mass flow AI / Brooks Instrument SLA5800 UDMH transfer mass flow AI — monitoring UDMH mass flow rate through the propellant transfer line at 10–15 kg/min design rate during tanker unload or launch vehicle fueling; zero flow at non-zero pump operating state indicates pump seizure or downstream blockage requiring immediate shutdown to prevent line over-pressure)

UDMH propellant transfer uses N2-pressurized positive expulsion or centrifugal pump transfer through fluoropolymer-lined stainless steel piping (Teflon-lined; type 316L SS; rated 10 bar operating pressure; 15 bar hydrostatic test). The Coriolis mass flow meter (Emerson Micro Motion CMF200; rated for hazardous area Class I Division 1; wetted material Hastelloy C-22; density measurement accuracy ±0.001 g/cm³; mass flow accuracy ±0.1%) provides primary flow measurement for propellant inventory control during tanker receipt and launch vehicle fueling. UDMH transfer pump seizure — arising from bearing failure (ball bearing UDMH corrosion after seal wear; metal particles from worn bearing contaminating UDMH; bearing seizing within 4–8 minutes of initial seal failure) — creates a dead-headed transfer line: the N2 pressurant continues pressurizing the propellant at 4–5 bar; with the pump seized and no flow path, line pressure builds toward the rupture disc set pressure (15 bar; equivalent to 50 kg/min UDMH release if disc opens). The Coriolis meter reads zero flow at the dead-headed condition; the AI monitoring system must recognize zero flow at non-zero pump state as an emergency shutdown signal rather than a normal transfer completion event.

The adversarial attack uses ±8 DN downward pixel-value shift on the Coriolis flow meter display. The actual transfer mass flow is 0 kg/min (pump seized; transfer line dead-headed; N2 pressurant at 4.5 bar pushing against the blocked line) — the Coriolis meter correctly reads 0.000 kg/min. On a 0–20 kg/min display at 200 px height (0.1 kg/min per px), the actual 0 kg/min produces a bar at 0 px; the ±8 DN downward pixel shift (which for a zero reading means the shift is applied to the baseline, not a bar) reduces the displayed zero to an “offset zero” that appears as a very small signal — on the adversarially attacked image, the displayed value is re-classified as approximately 12.5 kg/min (125 px; center of the 10–15 kg/min design range). The propellant management system sees “Transfer mass flow nominal — within design rate.” With the pump seized and line dead-headed at 4.5 bar, the propellant line continues holding the N2 pressurant pressure against the seized pump for 8–12 minutes before line temperature rise from pump heat (seized bearing heat generation approximately 800 W) softens the Teflon liner at the pump inlet (Teflon Tg 327°C; pump inlet temperature rises to 180°C from bearing friction heat; Teflon liner deformation; micro-cracks in liner; UDMH contacts bare 316L SS at liner defect; rapid corrosion of SS in UDMH at elevated temperature). Liner failure then allows UDMH to contact unlined SS; corrosion products (iron dimethylhydrazide complexes) block the flow path; line pressure continues building.

3. N2 pressurant tank pressure AI (Emerson Rosemount 3051 N2 pressurant pressure transmitter AI / Yokogawa EJA110A propellant tank N2 pressure AI / Endress+Hauser Cerabar M PMP55 N2 pressurant pressure AI / Honeywell STG944 propellant tank ullage pressure AI / Siemens SITRANS P 320 N2 pressurant regulator outlet pressure AI — monitoring N2 pressurant pressure in the UDMH propellant tank ullage and transfer line at 3.5–5.0 bar design setpoint, to maintain propellant expulsion force for gravity-driven and pump-assisted transfer; below 3.5 bar, transfer flow rate falls below the minimum 8 kg/min required for launch vehicle fueling schedule; 34th upward-direction attack in portfolio)

UDMH propellant tanks for launch vehicle fueling use N2 pressurant (helium in some early designs) at 3.5–5.0 bar to provide the driving pressure for propellant expulsion through the transfer line, either by direct pressurization (bladder or piston tank) or by maintaining head pressure on a centrifugal transfer pump. UDMH has a vapor pressure of only 0.2 bar at 25°C — insufficient to drive propellant flow at the required 10–15 kg/min without N2 pressurant. The N2 pressurant is supplied from a high-pressure N2 storage cylinder bank (200 bar composite-wrapped cylinders; pressure reducing valve regulates from 200 bar to the 4.5 bar propellant tank operating pressure; secondary regulator at the propellant tank inlet provides final pressure control). Pressurant pressure below 3.5 bar causes propellant transfer flow rate to fall below 8 kg/min minimum: at a launch vehicle fueling schedule requiring 10,000 kg UDMH loading in 6 hours (approximately 28 kg/min average; accounting for flow verification holds and monitoring stops), N2 pressurant failure causing flow below 8 kg/min delays fueling beyond the launch window — potentially requiring propellant offload and mission scrub. The pressurant pressure sensor (Emerson Rosemount 3051; rated for propellant service; PTFE O-ring seals; stainless steel wetted parts; output 4–20 mA to propellant management system) monitors the pressurant line continuously; alarm at below 3.5 bar triggers immediate investigation of regulator performance.

The adversarial attack uses ±8 DN upward pixel-value shift on the N2 pressurant pressure transmitter display. The actual N2 pressurant pressure is 0.8 bar — from a pressure regulator diaphragm failure: the Kel-F diaphragm (polychlorotrifluoroethylene; chemically resistant to UDMH vapor in the pressurant line) has developed a crack after 3,200 pressurant cycles (average 1 cycle per launch attempt); at 200 bar supply pressure, the cracked diaphragm allows uncontrolled expansion, but the secondary seating valve spring is the regulatory element; the spring has lost tension from UDMH vapor permeation through the Kel-F diaphragm crack, reducing spring force and allowing the regulator outlet to drift from 4.5 bar to 0.8 bar over 35 pressurant cycles. On a 0–6 bar display at 200 px height (0.03 bar/px), the actual 0.8 bar produces a bar at approximately 27 px; the ±8 DN upward-perturbed image is classified as approximately 140 px, corresponding to 4.2 bar — within the 3.5–5.0 bar design range. The propellant management system sees “N2 pressurant nominal — transfer authorized.” This is the 34th upward-direction attack in the Glyphward portfolio and the first attack targeting a space/defense propulsion system. At 0.8 bar actual pressurant pressure, propellant transfer pump suction head drops below the pump’s minimum net positive suction head (NPSH₃ approximately 1.2 bar); the pump cavitates immediately, delivering 0 kg/min (see Surface 2); the propellant management system attempts to increase pump speed to compensate — accelerating cavitation erosion of the pump impeller (316L SS; UDMH cavitation erosion rate approximately 3 mm/hr at 15 m/s tip speed).

4. Propellant tank headspace decomposition temperature AI (Emerson Rosemount 3144P UDMH headspace temperature AI / Yokogawa EJA110A propellant tank vapor space temperature AI / Endress+Hauser iTHERM TM411 UDMH tank temperature AI / Honeywell STG94L thermocouple UDMH tank headspace AI / ABB TSP propellant tank temperature zone AI — monitoring the UDMH propellant storage tank headspace gas-phase temperature, where UDMH autonomous thermal decomposition begins above approximately 330°C (N-N bond homolysis → N2 + CH4; without oxygen; pressure wave potential); normal operating range 15–35°C ambient; temperature alarm at 100°C; emergency shutdown at 150°C)

UDMH propellant tank headspace temperature monitoring prevents the approach to autonomous thermal decomposition. UDMH undergoes homolytic N–N bond cleavage above approximately 330°C without requiring oxygen: (CH₃)₂N–NH₂ → N₂ + 2CH₃ + H₂ (simplified; actual decomposition products include dimethylamine, ammonia, methane, hydrogen, and nitrogen; ΔH decomp approximately −100 kJ/mol per mole UDMH; exothermic above approximately 280°C due to N–N bond fragmentation rate exceeding heat dissipation rate). The autocatalytic nature of UDMH decomposition above 250°C means that above a critical temperature, the decomposition rate accelerates faster than cooling can compensate — thermal runaway. In a 10,000-liter UDMH propellant storage tank, autonomous decomposition runaway at 330°C can generate sufficient pressure (decomposition of 100 kg UDMH → approximately 580 mol N₂ + 1,160 mol CH₄ → gas volume at 500°C and 1 bar approximately 105,000 liters; in a 10,000-L tank this would require structural failure at approximately 10-fold design pressure). For a propellant storage tank in proximity to launch vehicle fueling operations (Kennedy Space Center, Baikonur Cosmodrome, Sriharikota), thermal runaway in a UDMH tank represents a catastrophic explosion and fire risk. Tank headspace temperature monitoring typically uses redundant thermocouples at multiple tank elevations, with alarms at 60°C (unusual warming; investigate), 100°C (heat-source incident; initiate emergency cooling), and 150°C (emergency evacuation; emergency deluge cooling; pressure relief activation).

The adversarial attack uses ±8 DN downward pixel-value shift on the UDMH tank headspace temperature display. The actual headspace temperature is 302°C — from a propellant tank heating event: a solar thermal incident on an inadequately insulated above-grade UDMH propellant tank at a Titan II launch complex (historical scenario applicable to current propellant handling facilities in high-solar-irradiance environments like Vandenberg, Cape Canaveral, Sriharikota). The tank’s 75 mm mineral wool insulation has experienced moisture ingress and compression over 12 years; at one sector of the tank shell (approximately 2 m² exposed area; facing solar direct normal irradiance 900 W/m² at solar noon), the effective insulation R-value has dropped from R-15 to R-3 (thermal resistance 0.5 m²K/W vs. design 2.6 m²K/W); at 900 W/m² solar input and reduced insulation, the tank wall temperature in the exposed sector reaches 340°C on the outer shell and approximately 302°C at the UDMH liquid-vapor interface in the headspace region. On a 0–400°C display at 200 px height (2°C/px), the actual 302°C produces a bar at approximately 151 px; the ±8 DN downward-perturbed image is classified as approximately 109 px, corresponding to 218°C — within the “warm but not alarming” range between the 150°C emergency alarm (already exceeded in actuality) and the 250°C pre-decomposition concern threshold. The propellant management system reports “UDMH tank headspace temperature elevated but below emergency setpoint.” At the actual 302°C, the UDMH in the headspace region is 28°C from the autonomous decomposition onset; the 302°C temperature will continue rising at approximately 4°C/minute under sustained solar irradiance; decomposition onset is approximately 7 minutes from the time of adversarial detection suppression.

Integration: 1,1-dimethylhydrazine UDMH rocket propellant AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the propellant management system instrument display capture layer and the AI inference pipeline for each UDMH process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 1,000 lbs, the ACGIH TLV-TWA 0.01 ppm A3 carcinogen, the widest flammable range of any liquid in the portfolio (2.0–95%), the 34th upward-direction attack (N2 pressurant pressure deficiency), and the autonomous thermal decomposition hazard above 330°C — the scan raises AdversarialUDMHImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

class UDMHProcessContext(StrEnum):
    AREA_CEMS = auto()
    PROPELLANT_TRANSFER_FLOW = auto()
    N2_PRESSURANT_PRESSURE = auto()
    HEADSPACE_DECOMP_TEMP = auto()

async def scan_udmh_frame(
    frame_b64: str,
    context: UDMHProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "facility_id": facility_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_udmh(
    frame_b64: str,
    context: UDMHProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_udmh_frame(frame_b64, context, facility_id, instrument_tag)
    if result["adversarial_score"] >= 35:
        raise AdversarialUDMHImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at facility {facility_id} instrument {instrument_tag}. "
            "Frame withheld from AI monitoring pipeline."
        )

class AdversarialUDMHImageError(RuntimeError):
    pass

if __name__ == "__main__":
    import sys, pathlib
    frame = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode()
    asyncio.run(pre_scan_gate_udmh(
        frame,
        UDMHProcessContext.N2_PRESSURANT_PRESSURE,
        "UDMH-STORAGE-001",
        "N2PRESS-PT-001",
    ))