Prompt injection in airfield runway foreign object detection AI

Four adversarial injection surfaces in airfield runway AI

1. FOD detection radar scan image AI (Xsight Systems FODetect, Trex Enterprises TARSYS, Stratech iFerret)

Foreign object debris detection systems deployed on runways use millimetre-wave radar (Xsight FODetect: 76–77 GHz, TARSYS: 9.4 GHz X-band) and high-resolution optical cameras to continuously scan the runway surface and taxiway edges. The radar backscatter data from the FOD scan is rendered into a false-colour overlay map — an aerial plan view of the runway surface with detected objects highlighted as coloured squares or blobs against the runway background texture, with object size, confidence score, and GPS coordinates displayed as annotation overlays. AI classification of the rendered FOD radar scan image determines: whether a detected radar return is a real FOD object (tool, tire fragment, bird) or a clutter return (runway surface texture variation, standing water, runway light fixture); the estimated size category of the FOD object (small: 2–10 cm, medium: 10–30 cm, large: >30 cm); and the urgency of the alert (immediate runway closure for objects >10 cm in the runway strip, advisory alert for objects near runway edges). The AI classification output drives the real-time runway status signal — if the AI classifies a scan as “no FOD detected,” the runway remains available for landing and take-off operations without interruption.

An adversarial perturbation on a rendered FOD radar scan overlay image that suppresses a medium-sized FOD object — blending the coloured detection blob for a 15 cm tire fragment against the runway surface texture by shifting the highlight colour toward the background grey within ±10 DN — causes the FOD AI to classify the radar scan as “clean runway, no FOD detected,” leaving a 15 cm tire fragment on an active runway without generating a closure alert. A tire fragment of this size is sufficient to cause serious structural damage to an aircraft tire on take-off or landing: the Air France Concorde accident (CDG, 25 July 2000, 113 fatalities) was initiated by a 43 cm titanium alloy strip (430g) that punctured a tire during take-off roll, sending rubber fragments into a fuel tank. ICAO Annex 14 Volume I Section 10.4 (“Aerodrome Ground Inspection”) requires runway inspections before operations and after significant events, but does not specify adversarial robustness requirements for automated FOD detection AI that supplements or replaces human runway inspection walks.

2. Runway visual range transmissometer AI (Vaisala PWD22 AI, Biral SWS-200 AI, ALL-WEATHER AWI AI)

Runway visual range (RVR) is the horizontal distance over which a pilot in an aircraft on the runway centreline can see runway surface markings, runway edge lights, or centreline lights — the primary meteorological parameter that determines whether an ILS approach can be commenced and continued under CAT I (RVR 550m), CAT II (RVR 300m), or CAT III (RVR 50m or 0m) authorisation. Automated RVR measurement systems use forward scatter transmissometers (Vaisala PWD22 present weather detector, Biral SWS-200, ALL-WEATHER ASOS present weather sensor) supplemented by AI analysis of rendered background luminance curve images — time-series plots of background luminance vs. time with transmissometer extinction coefficient overlaid — to compute real-time RVR values and predict whether RVR is above or below approach category minima. Vaisala’s AI-assisted RVR sensor outputs and the FAA’s ASOS (Automated Surface Observing System) AI transmissometer chain feed directly into the Runway Visual Range system (RVRS) that provides the official RVR values to ATC and the ATIS broadcast that pilots use to make approach/go-around decisions.

An adversarial perturbation on a rendered Vaisala PWD22 background luminance curve image that elevates the extinction coefficient curve by shifting the curve baseline upward — simulating a luminance condition associated with RVR 350m when actual RVR is 120m — causes the RVR AI to report an RVR value above CAT II minima when the actual runway visibility is below CAT III minima. A CAT II-equipped crew commencing an approach at RVR 350m+ (AI-reported) into actual RVR 120m conditions may break through the Decision Height (DH 30m / 100ft AGL for CAT III) without visual contact with the runway environment, producing a Controlled Flight Into Terrain (CFIT) event at a precision approach threshold. The 2001 Milan Linate airport collision (SAS Flight 686 with a Cessna Citation on an active runway in dense fog: 118 fatalities) and the 2005 TACA Airlines runway excursion at Tegucigalpa (MHTG: 5 fatalities after approach in sub-minima conditions) establish that airfield operations in visibility below published minima are a primary fatal accident risk category.

3. PAPI/VASI optical approach path monitoring AI (ADB SAFEGATE AI, Honeywell SmartPath AI, Jotron PAPI Monitor AI)

Precision Approach Path Indicators (PAPI) are arrays of four high-intensity lights installed 300m from the threshold on the left side of the runway that provide visual vertical guidance to approaching aircraft — the PAPI pattern (red/white ratio: 4 white = above glide path, 2 red 2 white = on glide path, 4 red = below glide path) is calibrated to the ILS glide slope angle (typically 3.0° for CAT II/III approaches) to within ±0.5° per ICAO Annex 14 Table 5-23. ADB SAFEGATE’s airfield lighting management AI, Honeywell SmartPath ILS monitoring AI, and Jotron PAPI optical monitor AI process rendered optical monitoring camera images of the PAPI bar — overhead or lateral camera views of the four PAPI lights showing the red/white illumination pattern — to verify that the PAPI system is functioning correctly (all four lights operating, correct angle calibration, correct intensity for ambient light conditions), generating NOTAM issuance alerts when PAPI degradation is detected. The AI classification output determines whether the PAPI system is certified as operational for CAT II/III precision approach operations — a misclassification of a degraded PAPI (wrong angle calibration, failed unit) as operational means approaching aircraft receive incorrect vertical guidance without a NOTAM warning.

An adversarial perturbation on a rendered PAPI optical monitoring camera image that shifts the red/white intensity ratio of one PAPI unit — brightening a red unit to appear white in the monitoring image by adding ±15 DN brightness to the red-channel pixels in the PAPI bar render — causes the PAPI monitoring AI to classify the PAPI bar as “4 white units operational, on-glidepath” when one unit has failed or is providing incorrect angle guidance. Approaching aircraft using a PAPI with one failed unit receive a degraded visual reference that does not match the ILS electronic glide slope — particularly critical during go-around decision-making in low-visibility conditions where the PAPI pattern is the primary visual reference for glide path assessment below Decision Height. ICAO Annex 14 Section 5.3.5 requires that PAPI systems be checked for accuracy after installation and at intervals not exceeding 12 months — but daily operational monitoring relies on the automated AI optical monitoring system to detect intermediate degradation.

4. Surface movement radar AI (ASDE-X AI, Saab MLAT/WAM AI, ERA Squid SMR AI)

Airport Surface Detection Equipment — Extended (ASDE-X) and equivalent surface movement radar systems combine X-band surface movement radar returns with multilateration (MLAT) and ADS-B transponder data to generate a fused aircraft and vehicle position picture of the entire airport movement area on the ATC ground movement controller’s screen. ASDE-X AI (deployed at 35 major US airports under FAA Order 6360.1), Saab MLAT/WAM fusion AI, and ERA Squid SMR AI process rendered ASDE-X fusion overlay map images — plan-view airport surface maps with aircraft and vehicle position symbols, speed vectors, runway strip highlighting, and runway incursion alert zones overlaid — to identify potential runway incursions (aircraft entering an active runway without clearance) and generate RI alerts to the ATC ground controller. The AI runway incursion alert is the automated last line of defence against simultaneous runway occupation by two aircraft, supplementing the ground controller’s visual scan of the ASDE-X screen.

An adversarial perturbation on a rendered ASDE-X fusion overlay image that suppresses an aircraft symbol from the active runway strip — blending the aircraft position icon against the runway surface background colour by shifting the icon fill colour toward the runway grey by ±12 DN — causes the ASDE-X AI to fail to generate a runway incursion alert for an aircraft that has entered the runway without clearance. The Santa Ana John Wayne Airport runway incursion incident (2007: Korean Air Cargo 6316 lined up on active runway while SkyWest regional turboprop landed) and the San Francisco International ASDE-X near-collision (2017: Air Canada 759 nearly landed on taxiway Charlie with four aircraft lined up) demonstrate that runway incursion situations develop within seconds and that the automated alert system is the critical detection mechanism when ground controller workload is elevated during multi-aircraft operations. ICAO Annex 14 and FAA Order 7110.65Z (Air Traffic Control procedures) require surface movement radar systems at major airports but do not specify adversarial robustness testing for the AI image classification layer.

Integration: airfield runway AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for airfield runway AI belongs at every rendered-image ingestion boundary — before FOD radar scan overlay AI processes detection maps, before RVR sensor AI processes transmissometer luminance curve renders, before PAPI monitoring AI processes optical camera images, and before surface movement radar AI processes ASDE-X fusion overlay maps. Threshold 35 for airfield runway AI reflects the fully closed-loop safety-critical architecture: all four AI outputs directly drive operational decisions (runway open/close, approach authorisation, PAPI NOTAM, runway incursion alert) with sub-second response requirements during active flight operations.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Airfield runway AI contexts: threshold 35
# FAA AC 150/5220-24 (FOD Detection); ICAO Annex 14 Vol. I; FAA Order 6360.1 ASDE-X.
AIRFIELD_AI_THRESHOLD = 35


class AirfieldAIContext(Enum):
    FOD_RADAR_SCAN       = "fod_radar_scan"      # Millimetre-wave FOD radar overlay AI
    RVR_LUMINANCE_CURVE  = "rvr_luminance_curve" # RVR transmissometer trend render AI
    PAPI_OPTICAL_MONITOR = "papi_optical_monitor" # PAPI bar optical monitoring AI
    SURFACE_RADAR_FUSION = "surface_radar_fusion" # ASDE-X/MLAT fusion overlay map AI


class AdversarialAirfieldImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an airfield
    runway AI rendered image above threshold 35.

    Consequence if not raised: FOD suppressed from active runway → aircraft
    tire strike; RVR misreported above CAT minima → below-minima approach →
    CFIT; PAPI degradation undetected → vertical guidance error; runway
    incursion unsuppressed → collision. All produce fatal consequences.
    Fail-safe: suppress AI runway status output; trigger immediate human
    runway inspection per FAA AC 150/5220-24 Section 4 operator protocols.
    """

    def __init__(self, scan_id: str, score: int,
                 context: AirfieldAIContext,
                 airport_icao: str, runway_designator: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.airport_icao = airport_icao
        self.runway_designator = runway_designator
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial airfield image: "
            f"context={context.value} score={score} "
            f"airport={airport_icao} runway={runway_designator} scan_id={scan_id}"
        )


async def scan_airfield_image(
    image_bytes: bytes,
    context: AirfieldAIContext,
    airport_icao: str,
    runway_designator: str,
    sensor_id: str,
    utc_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an airfield runway AI rendered image for adversarial content.

    Fail-safe contract: AdversarialAirfieldImageError or httpx error →
    suppress AI runway-status output; trigger manual human runway inspection
    per FAA AC 150/5220-24 Section 4. For RVR AI: revert to human observer
    RVR report. For PAPI AI: issue precautionary NOTAM pending physical check.

    Args:
        image_bytes: FOD radar scan overlay, RVR luminance curve render,
            PAPI optical monitoring image, or ASDE-X fusion map.
        context: AirfieldAIContext identifying the airfield sensor modality.
        airport_icao: 4-letter ICAO airport designator (e.g., KJFK, EGLL).
        runway_designator: Runway number/designator (e.g., 22L, 04R).
        sensor_id: Sensor station identifier.
        utc_timestamp: ISO 8601 UTC timestamp of the image scan.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialAirfieldImageError: if score exceeds threshold 35.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"airfield:{context.value}:{airport_icao}:{runway_designator}",
        "metadata": {
            "airport_icao": airport_icao,
            "runway_designator": runway_designator,
            "sensor_id": sensor_id,
            "utc_timestamp": utc_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=2.0,  # tight timeout: runway status is time-critical
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_airfield_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        airport_icao=airport_icao,
        runway_designator=runway_designator,
        utc_timestamp=utc_timestamp,
        flagged=result["score"] > AIRFIELD_AI_THRESHOLD,
    )

    if result["score"] > AIRFIELD_AI_THRESHOLD:
        raise AdversarialAirfieldImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            airport_icao=airport_icao,
            runway_designator=runway_designator,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_airfield_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: AirfieldAIContext, airport_icao: str,
    runway_designator: str, utc_timestamp: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": AIRFIELD_AI_THRESHOLD,
        "flagged": flagged,
        "airport_icao": airport_icao,
        "runway_designator": runway_designator,
        "utc_timestamp": utc_timestamp,
        "regulatory_refs": [
            "FAA AC 150/5220-24 (Foreign Object Debris Detection Equipment)",
            "FAA AC 150/5340-30J (Design and Installation Details for Airport Visual Aids)",
            "FAA Order 6360.1 (ASDE-X System Deployment and Operations)",
            "ICAO Annex 14 Volume I (Aerodrome Design and Operations, 9th ed.)",
            "ICAO Annex 3 (Meteorological Service for International Air Navigation)",
            "FAA Order 7110.65Z (Air Traffic Control, Chapter 3 Airport Control)",
            "FAA AC 150/5345-28 (Precision Approach Path Indicator Systems)",
        ],
    }
    audit_path = Path("/var/log/glyphward/airfield_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_airfield_image at each runway AI rendered-image ingestion boundary: before FOD radar scan AI (threshold 35), before RVR AI (threshold 35), before PAPI optical monitoring AI (threshold 35), and before ASDE-X fusion map AI (threshold 35). On AdversarialAirfieldImageError: suppress the AI runway status output immediately; initiate manual runway inspection per FAA AC 150/5220-24 Section 4 operator protocols; for RVR AI: revert to human observer RVR report; for PAPI AI: issue precautionary NOTAM pending physical inspection. Log all flagged events in the airport Safety Management System (SMS) per ICAO Annex 19. Get early access

Related questions

Further reading

• Prompt injection in air traffic control radar AI — SSR target suppression, TCAS RA adversarial attacks
• Prompt injection in airport security AI — checkpoint screening AI bypass, biometric adversarial attacks
• Prompt injection in jet engine borescope inspection AI — TBC spallation suppression, EASA AMC 20-16 gap
• Prompt injection in aerospace MRO AI — NDT inspection AI bypass, Part 145 maintenance adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required