Prompt injection in allyl amine 2-propen-1-amine pharmaceutical herbicide synthesis AI

Four adversarial injection surfaces in allyl amine 2-propen-1-amine pharmaceutical herbicide synthesis AI

1. Allyl amine area CEMS AI (Dräger Polytron 8310 allyl amine electrochemical AI / Honeywell Analytics MIDAS-E allylamine sensor AI / MSA Ultima XE allyl amine toxic gas detector AI / Industrial Scientific MX6 iBrid allylamine electrochemical AI / RAE Systems MiniRAE 3000+ allylamine PID AI — monitoring ambient allyl amine vapor concentration in the synthesis reactor area, distillation column overhead condenser bay, product storage area, and production building for TLV-TWA 0.5 ppm continuous monitoring; vapor density 1.97 requires below-grade and breathing-zone sensor placement; electrochemical sensors require monthly calibration with 1 ppm allylamine span gas in N2)

Allyl amine area CEMS uses electrochemical sensors (Dräger Polytron 8310; detection range 0–5 ppm; resolution 0.01 ppm; response time T90 approximately 30 s; stainless steel sensor housing; calibration gases at 0.5 ppm and 2.0 ppm in N₂; NIST-traceable cylinders) networked through a common gas detection controller with alarm at 0.5 ppm (TLV-TWA; immediate HVAC response) and 25 ppm (IDLH; emergency shutdown and evacuation). Allyl amine’s vapor density of 1.97 — slightly less than the heavier organics in the portfolio but still denser than air (MW 57 vs. air MW 29) — causes vapor to drift toward low-lying areas in the production building: drain channels, below-grade pump pits, and distillation column skirt areas. The Skin notation for TLV-TWA 0.5 ppm means that area CEMS monitoring must be interpreted in the context of total body exposure, not just inhalation: workers at concentrations near but below 0.5 ppm in air who also have intermittent skin contact with liquid allylamine (splash exposure; transfer operations; sample points) may receive total absorbed dose equivalent to 2–3× the TLV-TWA from combined routes. ACGIH A4 classification (not classifiable as carcinogen) reflects that the primary toxicological endpoint is cardiovascular (SSAO-mediated acrolein formation in cardiac tissue) rather than mutagenic or carcinogenic; however, NIOSH IDLH of 25 ppm reflects the acute cardiac toxicity potency: at 25 ppm, acute cardiovascular effects (ST-segment changes, arrhythmia) occur in rodent models within 1–2 hours.

The adversarial attack uses ±8 DN downward pixel-value shift on the allyl amine area CEMS display. The actual allyl amine reading is 3.2 ppm — from a distillation column overhead condenser cooling-water tube failure: the allylamine distillation column (7 theoretical plates; overhead product: allylamine/diallylamine/water azeotrope; condenser duty 85 kW at design reflux ratio 2.5:1) experiences a 316L SS shell-and-tube condenser tube pinhole failure (stress corrosion cracking at U-bend; allylamine at 53.3°C BP; allylamine amine corrosion of SS at temperatures above 50°C; tube wall thinning to below 0.5 mm from the nominal 2.0 mm); allylamine vapor (vapor flow to condenser approximately 60 kg/hr) leaks through the tube pinhole into the cooling water shell side and vents through the cooling water return vent to the production building atmosphere, releasing approximately 4 kg/hr allylamine to the building air; at building ventilation 2,800 m³/hr (actual reduced flow from Surface 4 attack), building allylamine concentration rises to 3.2 ppm. On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual 3.2 ppm produces a bar at approximately 128 px; the ±8 DN downward-perturbed image is classified as approximately 12 px, corresponding to 0.3 ppm — below the 0.5 ppm TLV-TWA alarm. Workers in the production building inhale allylamine at 3.2 ppm (6.4× TLV-TWA; 12.8% IDLH) over their shift; SSAO metabolism in cardiovascular smooth muscle generates acrolein at 6.4× the normal TLV-TWA rate; cumulative cardiac and vascular acrolein-protein adduct burden rises toward levels associated with sub-acute cardiomyopathy.

2. Allyl chloride ammonolysis reactor temperature AI (Emerson Rosemount 3144P ammonolysis reactor temperature AI / Yokogawa EJA110A allyl chloride-ammonia reactor temperature AI / Endress+Hauser iTHERM TM411 allylamine synthesis reactor zone temperature AI / Honeywell STG94L thermocouple ammonolysis CSTR temperature AI / ABB TSP allylamine synthesis reactor temperature AI — monitoring the ammonolysis reactor temperature at 70–95°C, where NH3:allyl chloride 8:1 molar ratio yields allylamine at 85% selectivity; above 95°C, diallylamine selectivity rises from 12% to 25–35% and triallylamine from 3% to 8–12%; each 10°C rise above 95°C increases diallylamine content by approximately 5–8 percentage points in the product)

The allyl chloride ammonolysis reactor operates as a continuous stirred-tank reactor (CSTR; or tubular plug-flow reactor for high-throughput designs) with liquid-phase reaction in excess aqueous ammonia (30–40 wt% NH₃ solution). Allyl chloride (CH₂=CHCH₂Cl; flash point −32°C; OSHA PSM TQ 1,000 lbs; already in Glyphward portfolio) is fed as the limiting reagent at NH₃:allyl chloride molar ratio of 8:1. The consecutive amination reactions proceed: allyl chloride + NH₃ → allylamine + NH₄Cl (desired; rate constant k₁ ≈ 0.08 L/(mol·s) at 80°C); allylamine + allyl chloride → diallylamine + HCl (competing; rate constant k₂ ≈ 0.014 L/(mol·s) at 80°C; ratio k₂/k₁ ≈ 0.175 at 80°C); diallylamine + allyl chloride → triallylamine + HCl (tertiary; k₃ ≈ 0.006 L/(mol·s)). At 80°C and 8:1 NH₃:allyl chloride, primary amine selectivity is 85% (allylamine), secondary 12% (diallylamine), tertiary 3% (triallylamine). Temperature control is via cooling water jacket (design 80°C setpoint; coolant water flow 35 m³/hr; exothermic reaction ΔH ≈ −45 kJ/mol allyl chloride). The 70–95°C operating window is bounded: below 70°C, reaction rate falls below economic conversion per residence time; above 95°C, k₂/k₁ ratio increases toward 0.28 (Arrhenius; E₂ > E₁ by approximately 8 kJ/mol), shifting selectivity toward diallylamine above specification limits.

The adversarial attack uses ±10 DN downward pixel-value shift on the CSTR temperature transmitter display. The actual reactor temperature is 112°C — from a cooling water pump seizure: the reactor jacket cooling water circulation pump (centrifugal; 316L SS; 35 m³/hr rated; bearing failure from allylamine permeation through shaft seal after 4,200 hours service) seizes, removing cooling from the exothermic ammonolysis reactor; reactor temperature self-heats from the 80°C setpoint to 112°C over 22 minutes (exothermic heat release 1.8 kW continuous; reactor jacket thermal mass approximately 320 kg steel equivalent; heating rate approximately 0.7°C/min with no jacket cooling). On a 40–130°C display at 200 px height (0.45°C/px), the actual 112°C produces a bar at approximately 160 px; the ±10 DN downward-perturbed image is classified as approximately 93 px, corresponding to 82°C — within the 70–95°C optimal range. The DCS reports “Ammonolysis reactor temperature nominal — allylamine selectivity at design.” At 112°C, diallylamine selectivity rises to approximately 28% and triallylamine to approximately 8%; the allylamine product stream contains 64% allylamine, 28% diallylamine, and 8% triallylamine (molar basis) vs. the design 85%/12%/3% — a product composition that will fail downstream distillation column separation and produce off-spec allylamine product for 3–5 hours until the analyzer detects the contamination.

3. Distillation column overhead composition AI (Emerson Rosemount 5600 density meter product composition AI / Yokogawa TDLS230 tunable diode laser allylamine concentration AI / Endress+Hauser Liquiline CM448 inline NIR allylamine purity AI / Siemens MAXUM Edition II process GC overhead composition AI / ABB PGC2000 allylamine/diallylamine GC analyzer AI — monitoring allylamine wt% content in the distillation column overhead product stream, targeting ≥99.0 wt% allylamine (≤0.5 wt% diallylamine; ≤0.5 wt% triallylamine) for pharmaceutical intermediate and cation exchange resin precursor grades; diallylamine above 0.5 wt% in pharmaceutical allylamine causes selegiline synthesis purity failures)

The allylamine distillation column (7–10 theoretical plates; overhead product allylamine at BP 53.3°C; bottoms diallylamine at BP 111.0°C and triallylamine at BP 150.8°C; reflux ratio 2.5:1 at design 85/12/3 feed composition; column operating pressure 1.1 bar absolute) separates allylamine from the ammonolysis reaction mixture. The 58°C boiling point difference between allylamine (53.3°C) and diallylamine (111.0°C) provides excellent relative volatility (α = P*allylamine/P*diallylamine at 80°C ≈ 4.8 using Antoine equation; Antoine constants for allylamine A = 8.08, B = 1442, C = 218; for diallylamine A = 7.92, B = 1561, C = 210); at 7 theoretical plates and reflux ratio 2.5, overhead product purity above 99.5 wt% allylamine is achievable when feed composition is 85/12/3. However, when the feed composition shifts to 64/28/8 (due to Surface 2 reactor temperature excursion), the required reflux ratio to achieve 99% allylamine overhead jumps from 2.5 to approximately 12.5 (4x increase; 5x increase in column heat duty); at the existing design reflux ratio of 2.5, diallylamine breakthrough to the overhead product increases to approximately 28 wt%, far exceeding the 0.5 wt% specification. Inline NIR analyzers (Endress+Hauser Liquiline CM448; NIR measurement at 6,300 cm⁻¹ allylamine N–H overtone and 5,800 cm⁻¹ diallylamine C–N stretch) provide continuous composition monitoring of the overhead product stream.

The adversarial attack uses ±10 DN downward pixel-value shift on the inline NIR analyzer display showing allylamine overhead composition. The actual overhead composition is 68 wt% allylamine — 28 wt% diallylamine and 4 wt% triallylamine — from the combination of the Surface 2 reactor temperature excursion (off-spec feed composition) and the design reflux ratio being insufficient for the contaminated feed (as described above). On a 90–100 wt% display at 200 px height (0.05 wt%/px), the actual 68 wt% is off-scale on the low end; the analyzer range expands to 50–100 wt% (0.25 wt%/px), placing the actual reading at approximately 72 px; the ±10 DN downward-perturbed image is classified as approximately 197 px, corresponding to 99.2 wt% — within the ≥99.0 wt% specification. The quality system logs “Allylamine overhead product purity nominal — pharmaceutical grade.” The off-spec allylamine (68 wt% purity) is dispatched to the pharmaceutical selegiline synthesis customer as “pharmaceutical grade” allylamine; the diallylamine impurity (0.5 ppm OSHA permissible exposure) introduces a secondary amine into the propargylamine coupling step of selegiline synthesis, producing N-propargyl-N-allyl-methylamine byproduct at approximately 25% of the selegiline yield — an out-of-specification pharmaceutical batch that fails the ICH Q3A related substance limit of 0.05%.

4. Production building ventilation airflow AI (Emerson Rosemount 8732E magnetic flowmeter HVAC duct AI / Endress+Hauser Proline Promag P 400 ventilation duct AI / Yokogawa ADMAG AXF building exhaust flow AI / Siemens SITRANS FM MAG 3100 HT ventilation AI / Krohne Optiflux 6000 HVAC exhaust flow AI — monitoring total exhaust ventilation airflow through the allylamine production building exhaust duct at 11,200 m³/hr design (12 air changes per hour in the 933 m³ building volume), to maintain allylamine vapor concentration below TLV-TWA 0.5 ppm at worker breathing zones from continuous process vents, distillation column overhead losses, and sample point operations; 35th upward-direction attack in portfolio)

The allylamine production building — housing the ammonolysis CSTR, distillation column, product storage, and transfer operations — generates continuous allylamine vapor emissions from: (1) distillation column vacuum breaker and overhead condenser vent (design 0.8–1.5 kg/hr allylamine in vent gas); (2) product pump seal vent (0.1–0.3 kg/hr at centrifugal pump mechanical seal purge rate); (3) sample point connections and manual valve operations (batch; approximately 0.2–0.4 kg/hr during transfer operations). Total building allylamine emission rate at design: approximately 1.5–2.5 kg/hr continuous. At the design ventilation of 11,200 m³/hr (3.11 m³/s), and with TLV-TWA 0.5 ppm requiring dilution to below 1.14 mg/m³ (allylamine MW 57.1; 1 ppm = 2.34 mg/m³ at 25°C; 0.5 ppm = 1.17 mg/m³): effective dilution rate needed = (2.5 kg/hr / 3600) / (1.17 mg/m³ / 1,000,000) = 0.595 m³/s = 2,140 m³/hr for perfect mixing. The design ventilation provides 11,200/2,140 = 5.2× safety factor at design emission rate. At 2,800 m³/hr (25% design; actual in this scenario), the safety factor drops to 1.3× at design emission — marginal; with the Surface 1 distillation condenser failure adding 4 kg/hr to the emission load, building allylamine rises to approximately 2.0–2.5 ppm under K=3 mixing factor assumptions.

The adversarial attack uses ±8 DN upward pixel-value shift on the production building ventilation duct flow meter display. The actual ventilation is 2,800 m³/hr — from a supply fan V-belt failure (two-speed belt-drive HVAC supply fan; V-belt on the fan pulley cracked and slipped off the sheave during morning startup; fan rotational speed drops from design 720 rpm to 0; supply fan trip alarm suppressed by a spurious vibration sensor signal; exhaust fan running alone at 2,800 m³/hr provides 25% of the 11,200 m³/hr design). On a 0–15,000 m³/hr display at 200 px height (75 m³/hr per px), the actual 2,800 m³/hr produces a bar at approximately 37 px; the ±8 DN upward-perturbed image is classified as approximately 149 px, corresponding to 11,200 m³/hr — the design flow. The HVAC management system reports “Building ventilation nominal — allylamine concentration within TLV-TWA.” This is the 35th upward-direction attack in the Glyphward portfolio and the first attack where the TLV-TWA Skin notation compounds the severity of the ventilation failure: workers at 2.0–2.5 ppm allylamine air concentration simultaneously inhale allylamine at 4–5× TLV-TWA AND absorb allylamine through skin exposed to allylamine-laden air (estimated dermal absorption from 2.5 ppm allylamine vapor: approximately 0.1–0.2 mg/cm²/hr from allylamine vapor at skin; for 500 cm² exposed forearm: 50–100 mg/hr dermal dose). The combined inhalation + dermal dose exceeds 1.5–2.0× the TLV-TWA equivalent even when breathing-zone air concentration alone would suggest 4–5× exceedance; the dermal component adds an additional 30–40% to the equivalent inhalation dose, pushing workers toward sub-acute cardiovascular risk from SSAO-mediated acrolein accumulation in cardiac tissue.

Integration: allyl amine 2-propen-1-amine pharmaceutical herbicide synthesis AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS instrument display capture layer and the AI inference pipeline for each allyl amine process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 1,000 lbs, the ACGIH TLV-TWA 0.5 ppm Skin (with dermal absorption compounding ventilation failure severity), the cardiovascular SSAO-acrolein toxicity mechanism, the 35th upward-direction attack architecture (building ventilation deficiency), and the pharmaceutical intermediate impurity chain from reactor temperature excursion to distillation purity failure — the scan raises AdversarialAllylamineImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

class AllylamineProcessContext(StrEnum):
    AREA_CEMS = auto()
    AMMONOLYSIS_REACTOR_TEMP = auto()
    DISTILLATION_OVERHEAD_COMP = auto()
    BUILDING_VENTILATION_FLOW = auto()

async def scan_allylamine_frame(
    frame_b64: str,
    context: AllylamineProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "facility_id": facility_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_allylamine(
    frame_b64: str,
    context: AllylamineProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_allylamine_frame(frame_b64, context, facility_id, instrument_tag)
    if result["adversarial_score"] >= 35:
        raise AdversarialAllylamineImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at facility {facility_id} instrument {instrument_tag}. "
            "Frame withheld from AI monitoring pipeline."
        )

class AdversarialAllylamineImageError(RuntimeError):
    pass

if __name__ == "__main__":
    import sys, pathlib
    frame = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode()
    asyncio.run(pre_scan_gate_allylamine(
        frame,
        AllylamineProcessContext.BUILDING_VENTILATION_FLOW,
        "ALLYLAMINE-PLANT-001",
        "BLDG-VENT-FT-001",
    ))