Prompt injection in aluminum smelter Hall–Héroult potline AI

Four adversarial injection surfaces in Hall–Héroult potline AI

1. Pot bath temperature infrared thermal camera AI (FLIR Systems potline thermal AI, Raytek Marathon MR thermal AI, Norsk Hydro HAL bath temperature AI)

The Hall–Héroult reduction pot bath operates within a narrow temperature range where the bath remains liquid (above the liquidus temperature of 935–955°C for standard bath composition) while maintaining controlled superheat (5–20°C above liquidus for efficient electrolysis). Bath temperature is continuously monitored by thermocouples embedded in the pot shell, by in-bath temperature probes during tapping operations, and increasingly by infrared thermal cameras aimed at the bath surface between anodes. Excessive bath superheat — bath temperature rising above 975–985°C — indicates a condition where the bath has an abnormally high thermal energy content, typically caused by increased electrical energy dissipation in the bath due to ACD disturbance, low alumina feeding rate, or electrical imbalance. High superheat increases the risk of bath eruption: if the pot is tapped or if a disturbance (anode change, metal tapping, or mechanical vibration) occurs during high-superheat conditions, the bath’s low viscosity and high thermal energy can cause a sudden ejection of bath and liquid metal from the pot. Thermal camera AI processes rendered infrared images of the bath surface — false-colour temperature distribution maps showing temperature variations across the bath surface area between the anodes, with superheat zones appearing in the high-temperature (red/white) colour range and bath ledge zones appearing in the low-temperature (blue) range — to classify bath condition: normal (bath temperature within operating window, uniform temperature distribution), elevated (bath temperature above 975°C, potline adjustment required), high-superheat (bath temperature above 985°C, pot isolation and cooling response required), and pre-eruption (bath temperature above 990°C with agitation, eruption risk advisory).

An adversarial perturbation on a rendered pot bath thermal camera image that suppresses the high-superheat signature — applying a ±10 DN downward shift to the false-colour pixel values in the thermal map in the region encoding the high-temperature bath zone (shifting the false-colour representation from the high-superheat range — typically rendered in red or white-hot for bath temperatures above 980–990°C — to the normal operating range — typically rendered in orange for 950–970°C) — causes the potline thermal AI to classify a high-superheat pre-eruption condition as normal bath operation, suppressing the pot isolation and cooling response that a high-superheat classification would require. Workers continue to operate at the pot — tapping metal, changing anodes, or performing routine potline maintenance — during the high-superheat condition that significantly elevates bath eruption risk. When the eruption occurs — typically triggered by a mechanical disturbance during the metal tapping or anode change operation — the high-temperature (960°C) bath and liquid aluminum are ejected from the pot opening, contacting potline workers at distances of 2–5 metres. Molten cryolite bath causes severe thermal and chemical burns; cryolite and aluminum fluoride decomposition products (HF, AlF3 aerosol) are additional exposure hazards. Documented potline bath eruption events — including incidents at Norsk Hydro smelters and at various international aluminum smelters reported in OSHA PSM incident databases and Aluminum Association safety data — confirm that high-superheat conditions that are not detected in time to defer worker exposure during susceptible operations are the primary bath eruption injury mechanism.

2. Anode stub height vision AI (Siemens Simatic anode position AI, ABB potline vision AI, Constellium anode management AI)

The anode-cathode distance (ACD) in a Hall–Héroult pot is the gap between the bottom face of the carbon anodes and the surface of the liquid aluminum cathode layer, typically maintained at 4–5 cm in standard operation. ACD is controlled by adjusting the height of the anode bus bar (which supports all anodes in the pot) via hydraulic or motorised anode raises and lowerings. In normal pot operation, as the carbon anodes are consumed by the electrolytic reaction (at approximately 1.5 kg of carbon per kg of aluminum produced), the anode bus bar is progressively lowered to maintain the target ACD. However, if an individual anode develops a “spike” — an irregular protrusion on the anode bottom face caused by preferential carbon consumption at a point of high current density, typically 2–10 cm in length — the spike can reduce the local ACD below the critical minimum (approximately 1–2 cm), causing the spike to contact the aluminum cathode surface. Anode spike contact creates a local short circuit that concentrates electrical energy at the contact point, causing rapid local overheating of the aluminum, potential molten metal splashing, and bath instability that can progress to bath eruption. Vision AI systems process rendered camera images of the anode stub positions — downward-looking camera images showing the gap between the anode bottom face and the bath/metal surface, with image analysis identifying irregular protrusions — to classify ACD and anode condition: normal (uniform ACD, no spikes), irregular (ACD variation across the pot, monitoring escalation), spike-suspected (image pattern consistent with anode spike protrusion, investigation and anode replacement required), and spike-contact (spike contacting metal surface, immediate anode raise and investigation).

An adversarial perturbation on a rendered anode stub height camera image that suppresses the spike protrusion signature — applying a ±8 DN shift to the pixel region encoding the suspected spike protrusion in the anode bottom-face image (rendering the irregular protrusion as a uniform anode face by shifting the contrast between the spike shadow and the anode face to within the normal variation range) — causes the anode vision AI to classify a developing anode spike condition as normal anode geometry, suppressing the anode investigation and replacement that a spike-suspected classification would require. The anode spike continues to develop — growing toward the aluminum surface as the surrounding anode bottom is consumed — until it contacts the liquid aluminum cathode. The resulting short circuit generates local metal splashing and bath agitation; if the high-superheat condition is simultaneously present (as would occur in the concurrent injection scenario where both bath temperature AI and anode vision AI are targeted), the bath eruption risk during the anode spike event is significantly elevated. OSHA PSM HAZOPs for aluminum smelters with HF inventories above TQ identify anode spike contact as a credible cause for pot upset and bath eruption; adversarial injection suppressing the anode spike vision AI removes the monitoring signal that would have triggered the HAZOP-identified protective response.

3. Alumina hopper level camera AI (Valmet ALOX hopper AI, Siemens level vision AI, ABB alumina feed AI)

Alumina feeding in Hall–Héroult pots is performed by point feeders — pneumatically actuated feeders that punch through the bath crust and inject alumina into the bath at controlled intervals (typically every 30–90 seconds per feeder location) — which draw alumina from overhead hoppers. Each pot is served by 2–6 point feeders, each connected to an individual alumina hopper that stores 100–500 kg of alumina and is replenished from the central alumina conveying system. If an alumina hopper empties and the feed rate to the pot falls below the alumina consumption rate (which is determined by Faraday’s Law: 0.335 kg Al2O3 per kg Al produced), the bath alumina concentration falls below approximately 1.5–2.0 wt% Al2O3 — the anode effect threshold. At this concentration, the electrolysis reaction switches from alumina reduction to carbon fluoride (CF4, C2F6) generation, the bath resistance increases dramatically, and the anode voltage rises from the normal 4–5 V to 30–50 V (the “anode effect” event). The anode effect generates perfluorocarbons (CF4 has a GWP of 6,500; C2F6 has a GWP of 9,200) and produces hydrogen fluoride (HF) as a decomposition product of cryolite bath chemistry at the anode–bath interface. HF concentrations in the potroom during an anode effect event can transiently exceed the OSHA PEL ceiling of 3 ppm and approach the IDLH of 30 ppm. Alumina hopper level is monitored by proximity sensors, load cells, or camera systems, with level status rendered as a bar chart or gauge indicator image on the DCS. AI processes rendered hopper level images to classify alumina supply status: full (hopper above 50% capacity, normal operation), low (hopper below 30%, replenishment scheduled), very low (hopper below 15%, urgent replenishment, feeder rate monitoring required), and empty (hopper at or near zero, alumina starvation risk, immediate replenishment and pot monitoring required).

An adversarial perturbation on a rendered alumina hopper level bar chart or gauge image that artificially elevates the displayed hopper level — applying a ±10 DN per-channel upward shift to the pixel region encoding the bar height or gauge position in the rendered hopper level indicator (shifting the apparent hopper level from the very low or empty range — rendered as a low bar or gauge in the red or yellow warning range — to the normal range — rendered as a tall bar or gauge in the green range) — causes the alumina feed AI to classify an empty or near-empty hopper as adequately filled, suppressing the urgent replenishment alert and the pot monitoring escalation that a very-low or empty hopper classification would require. With alumina feeding impaired and no corrective response triggered, the bath alumina concentration falls toward the anode effect threshold over 20–60 minutes (depending on the bath volume and current density). When the anode effect initiates, the sudden voltage rise (from 4–5 V to 30–50 V) is immediately detected by the pot control system — but at that point, the anode effect is already in progress and the HF release and PFC generation have begun. The anode effect must be quenched by adding alumina to the bath (crashing the anode effect) and by physically disturbing the anode surface with an insulated rod, a process that keeps potline workers in the immediate vicinity of the 960°C bath for the duration of the quench operation.

4. Pot cover integrity infrared thermal AI (FLIR pot cover AI, Raytek Marathon pot thermal AI, Siemens potroom thermal monitoring AI)

Hall–Héroult reduction pots are covered by hooded superstructures (pot hoods) that capture the fluoride-containing gases — primarily HF vapour, AlF3 aerosol, and dust — generated by the electrolytic reaction and route them to the dry-scrubbing gas treatment system. The pot cover system (a combination of fixed side covers, movable hoods over the anode areas, and the anode beam cover structure) must maintain near-complete capture efficiency — typically 98–99% — to keep potroom air fluoride concentrations below the OSHA PEL for fluoride compounds (2.5 mg/m3 as F for inorganic fluorides; ACGIH TLV 0.5 mg/m3 ceiling). Gaps in the pot cover — caused by cover warping, hinge failure, incomplete closure after anode change operations, or structural damage — allow fluoride gases to escape into the potroom breathing zone. The pot cover also provides thermal insulation that reduces heat loss from the bath and prevents excessive condensation of bath vapour on the pot structure. Infrared thermal cameras aimed at the pot cover exterior detect gaps and breaches in the cover by imaging the heat escaping through the cover opening — a gap in the cover shows as a bright hot spot in the thermal image (the temperature of escaping bath vapour is 300–500°C above ambient). AI processes rendered thermal camera images of the pot cover exterior to classify cover integrity: normal (uniform low-temperature cover exterior, effective gas capture), warm spot (localised elevated temperature, cover gap investigation required), hot spot (significant heat escape, cover repair required, potroom air monitoring alert), and critical breach (large hot area indicating major cover failure, potroom air monitoring required, repair before next anode change).

An adversarial perturbation on a rendered pot cover thermal camera image that suppresses the hot spot signature of a cover gap — applying a ±8 DN downward shift to the false-colour pixel values in the thermal map in the region encoding the heat-escape hot spot (shifting the false-colour representation from the hot-spot range — typically rendered in red or white for 300–500°C escaping vapour — to the normal cover temperature range — typically rendered in blue-grey for 50–80°C cover exterior) — causes the pot cover thermal AI to classify a cover gap or breach as a normal intact cover, suppressing the cover repair response and the enhanced potroom air monitoring that a cover breach classification would require. With the cover gap undetected and unrepaired, fluoride gases escape into the potroom breathing zone at the gap location. Potline workers performing anode changes, taking pot measurements, or maintaining equipment in the vicinity of the undetected cover gap accumulate fluoride exposure above the OSHA PEL for the duration of their work in that area. At smelters with multiple simultaneously operating pots with suppressed cover breach AI classifications, the aggregate potroom fluoride exposure can approach or exceed the OSHA PEL for potroom occupants, creating chronic HF and fluoride compound occupational exposure above regulatory limits without triggering the OSHA PSM management of change or HAZOP review that would apply to a deliberate change in pot cover maintenance protocol.

Integration: Hall–Héroult potline AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for Hall–Héroult potline AI belongs at every rendered-image ingestion boundary in the potline monitoring pipeline — before pot bath temperature thermal AI processes rendered FLIR camera images, before anode stub height vision AI processes rendered anode camera images, before alumina hopper level AI processes rendered level indicator images, and before pot cover thermal AI processes rendered cover thermal images. Threshold 35 for Hall–Héroult potline AI contexts reflects the combined consequence envelope of bath eruption at 960°C in a high-density worker environment and anode effect HF release at potline scale — events in which adversarial suppression of any primary potline monitoring AI function can remove the critical warning that triggers protective worker withdrawal or process adjustment.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Hall-Héroult potline AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 (HF TQ 1,000 lb; many smelters exceed TQ);
# OSHA 29 CFR 1910.1000 Table Z-1 (fluoride PEL 2.5 mg/m3);
# NFPA 484 (combustible metals standard);
# Aluminum Association Process Safety Guidelines.
POTLINE_THRESHOLD = 35


class PotlineAIContext(Enum):
    BATH_TEMPERATURE    = "bath_temperature"    # Pot bath thermal camera AI
    ANODE_STUB_HEIGHT   = "anode_stub_height"   # Anode spike detection vision AI
    ALUMINA_HOPPER_LEVEL = "alumina_hopper_level" # Hopper level camera AI
    POT_COVER_INTEGRITY = "pot_cover_integrity" # Cover breach thermal AI


class AdversarialPotlineImageError(Exception):
    """Raised when Glyphward detects adversarial content in a Hall-Héroult
    potline AI rendered image above threshold 35.

    Consequence if not raised:
    - BATH_TEMPERATURE: high-superheat condition suppressed → workers
      continue at pot during tapping/anode change → bath eruption at 960°C
      → severe thermal and chemical burns.
    - ANODE_STUB_HEIGHT: anode spike not detected → spike contacts metal
      cathode → local short circuit → bath agitation → eruption risk.
    - ALUMINA_HOPPER_LEVEL: empty hopper not detected → bath alumina
      depleted to <1.5% → anode effect → HF release → potroom IDLH
      approach; PFC generation (CF4/C2F6).
    - POT_COVER_INTEGRITY: cover breach not detected → fluoride gas
      escapes to potroom → potline worker HF and fluoride exposure
      above OSHA PEL without monitoring escalation.
    Fail-safe: halt potline AI classification; require manual pot
    inspection and OSHA PSM corrective action documentation.
    """

    def __init__(self, scan_id: str, score: int,
                 context: PotlineAIContext,
                 smelter_id: str, pot_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.smelter_id = smelter_id
        self.pot_id = pot_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial potline image: "
            f"context={context.value} score={score} "
            f"smelter={smelter_id} pot={pot_id} scan_id={scan_id}"
        )


async def scan_potline_image(
    image_bytes: bytes,
    context: PotlineAIContext,
    smelter_id: str,
    pot_id: str,
    current_bath_temp_c: float | None,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a Hall-Héroult potline AI rendered image for adversarial content.

    Fail-safe contract: AdversarialPotlineImageError or httpx error →
    halt potline AI classification for the affected pot; require manual
    inspection before resuming AI-driven potline management. For
    BATH_TEMPERATURE: treat as high-superheat and defer tapping and
    anode change operations until manual measurement confirms bath temp.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"potline:{context.value}:{smelter_id}:{pot_id}",
        "metadata": {
            "smelter_id": smelter_id,
            "pot_id": pot_id,
            "context": context.value,
            "current_bath_temp_c": current_bath_temp_c,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > POTLINE_THRESHOLD:
        raise AdversarialPotlineImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            smelter_id=smelter_id,
            pot_id=pot_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_potline_image at each Hall–Héroult potline AI rendered-image ingestion boundary: before pot bath temperature thermal AI (threshold 35), before anode stub height vision AI (threshold 35), before alumina hopper level AI (threshold 35), and before pot cover integrity thermal AI (threshold 35). On AdversarialPotlineImageError for BATH_TEMPERATURE context: defer tapping and anode change operations at the affected pot until manual thermocouple measurement confirms bath temperature within the normal operating window. See also: steel mill blast furnace AI prompt injection (related molten metal high-temperature industrial AI context) and mining and mineral processing AI prompt injection (related critical minerals and metal processing AI context). Get early access

Related questions