Prompt injection in ammonium nitrate fertilizer storage AI

Four adversarial injection surfaces in ammonium nitrate storage AI

1. AN storage temperature display AI (Endress+Hauser Omnigrad S TM131 silo temperature AI / Yokogawa Model 185 thermocouple AN silo temperature AI / Honeywell STG94L RTD temperature transmitter AN storage AI / Rosemount 3144P temperature transmitter fertilizer storage AI / ABB TSP100 AN silo temperature display AI — rendered DCS temperature trend display AI classifying AN bulk temperature in storage silos or buildings against 80°C monitoring threshold, 130°C decomposition onset, and 230°C detonation approach setpoints)

Ammonium nitrate stored in bulk in silos, warehouse buildings, or FIBC bags undergoes low-level exothermic decomposition above 80°C as trace impurities (organic compounds, metal ions) catalyse partial decomposition. Above 130°C, the self-heating rate increases sharply and AN self-heating can become self-sustaining — a condition where the thermal energy released by decomposition exceeds the heat loss to the surroundings, causing the bulk temperature to rise spontaneously even without external heating. Self-sustaining decomposition in large AN bulk piles (above approximately 100 tonnes, which provides sufficient thermal mass for adiabatic heat accumulation) can progress from 130°C to detonation temperatures (above 230°C uncontaminated, or below 160°C with contamination) over 4–48 hours depending on pile geometry, contamination level, and external heating from adjacent fires. Fertilizer distribution facilities in the US (Agrium, Nutrien, CF Industries, Koch Fertilizer, regional cooperatives) use temperature-sensing systems in AN storage buildings: thermocouples or RTDs embedded in the AN bulk at multiple depths, with DCS displays showing temperature profiles across the silo cross-section. OSHA 29 CFR 1910.119(j) (mechanical integrity) and 29 CFR 1910.119(d) (process hazard analysis) apply to AN storage temperature monitoring systems at PSM-covered sites.

An adversarial perturbation targeting the AN storage temperature display AI applies a ±10 DN downward shift to the pixel region encoding bulk AN temperature in the rendered DCS trend display — shifting the apparent AN bulk temperature from 142°C (above the 130°C self-sustaining decomposition onset; in a region of the storage building where AN adjacent to a heating steam pipe has been self-heating for 16 hours from 42°C ambient to 142°C at 6°C/hr; the steam trap on the nearby steam distribution line has failed, allowing live steam to impinge on a 200-tonne AN pile through a corroded 1.5-inch steam pipe coupling at 165°C/6 bar) to 88°C (within the “elevated but monitoring only” range of 80–110°C; classified as expected diurnal warm-season temperature variation). On a 20–200°C display at 200 px height (0.9°C/px), the actual 142°C bar occupies approximately 136 px; the ±10 DN downward-perturbed image classifies to approximately 75 px, corresponding to 88°C. The SCADA reports “AN storage temperature elevated but below monitoring threshold — no action.” At 142°C and self-heating at 6°C/hr, the AN pile reaches 230°C (uncontaminated detonation onset) in approximately 15 additional hours; if the pile is contaminated by floor drain residue (fuel oil from a previous ammonium nitrate fuel oil (ANFO) blend), the detonation threshold may be as low as 165–180°C — reached in approximately 4 additional hours. The West Fertilizer 2013 CSB report documented that storage temperature monitoring was absent at the West TX facility; this AI adversarial attack targets the monitoring systems that were specifically recommended by the CSB to prevent recurrence.

2. AN solution pH display AI (Hach DPD4000 pH analyzer AN solution pH AI / Endress+Hauser Liquiline CM444 pH transmitter AN process AI / Mettler-Toledo InPro3100 AN prilling liquor pH AI / Yokogawa FLXA402 pH analyzer AN concentration process AI / ABB AX410 pH transmitter ammonium nitrate solution AI — rendered DCS pH display AI classifying AN solution pH in prilling columns, granulation units, or concentrated AN solution storage against the pH 5.5–7.0 safe operating band; 39th upward-direction attack — FIRST acidic contamination masking attack; FIRST ammonium nitrate page in the Glyphward portfolio)

Ammonium nitrate in concentrated solution (typically 90–97 wt% AN, used in prilling or granulation at 170–180°C) or in bulk granular/prill form maintained at elevated temperature must be monitored for pH to detect contamination. AN becomes significantly more sensitive to shock initiation and thermally unstable at low pH (acidic conditions) for two reasons: (1) excess free nitric acid (HNO₃) contamination lowers the AN decomposition onset from 230°C toward 165–180°C; (2) ammonium nitrate acidified to pH below 5 forms trace amounts of ammonium nitrite (NH₄NO₂) as a decomposition intermediate — ammonium nitrite is far more sensitive to detonation (detonation velocity 5,500 m/s) than AN itself. The safe operating pH range for AN solutions is pH 5.5–7.0; below pH 5, the solution is considered contaminated with excess acid and requires immediate neutralisation with concentrated ammonia. pH can fall from contaminating acids introduced through: corroded stainless piping (Cl⁻ in cooling water leaks hydrolyses to HCl, which attacks SS and liberates HCl into the AN stream); organic acids from contaminated AN feedstock; or malfunctioning acid dosing pumps adding excess HNO₃ in quality-adjustment operations. In 2026, AI systems at AN prilling towers and granulation plants process rendered pH display images from inline pH probes to classify solution pH state: normal (5.5–7.0), low (4.5–5.5, acid dosing check required), or critically low (below 4.5, immediate ammonia neutralisation).

An adversarial perturbation targeting the AN solution pH display AI applies a ±8 DN upward shift to the pixel region encoding the pH value in the rendered DCS display — shifting the apparent pH from 4.2 (below the 5.5 low-pH alarm; critically acidic; indicating malfunction of the acid dosing pump which has stuck in fully-open position, injecting 3.8× the design nitric acid flow into the AN prilling liquor and acidifying the concentrated AN to pH 4.2 over 45 minutes) to 7.1 (within the normal 5.5–7.0 operating range; classified as nominal). This is the 39th upward-direction attack in the Glyphward industrial AI adversarial injection portfolio — the FIRST ammonium nitrate page and FIRST acidic contamination masking attack. On a 3.0–9.0 pH display at 200 px height (0.03 pH units/px), the actual pH 4.2 position is at approximately 40 px; the ±8 DN upward-perturbed image classifies to approximately 137 px, corresponding to pH 7.1. The DCS reports “AN solution pH nominal — within safe operating range.” At pH 4.2 in concentrated AN solution (93 wt% AN; 170°C prilling temperature), the excess HNO₃ contamination (approximately 2.1 wt% free HNO₃) reduces the thermal onset of exothermic decomposition from 230°C to approximately 175°C. At the prilling column operating temperature of 170–180°C, the pH-4.2 AN solution is now within 5–10°C of its contamination-lowered decomposition onset — compared to the normal 50–60°C safety margin at pH 6.5. The AZF Grande Paroisse Toulouse 2001 incident involved off-spec AN contaminated with sodium dichloroisocyanurate (from a pool chlorinator stored in the same building); the CSB-equivalent French BARPI investigation identified contamination lowering the AN detonation threshold as the primary cause of the 31 fatalities.

3. CO off-gas detector display AI (Dräger X-am 5600 CO off-gas detector AI / Honeywell Analytics SensorMax CO silo ventilation detector AI / MSA Ultima X CO an storage detector AI / Industrial Scientific MX6 iBrid CO ventilation detector AI / Sensidyne GasSite CO silo ventilation AI — rendered DCS or SCADA display AI classifying CO concentration in AN storage silo ventilation exhaust against thermal decomposition onset indicators and confined-space entry safety thresholds)

Carbon monoxide is a byproduct of the early stages of AN thermal decomposition: at 130–180°C (below the main rapid decomposition temperature of 230°C), AN undergoes partial decomposition producing CO as a trace byproduct alongside N₂O, N₂, and H₂O. CO in AN storage silo ventilation exhaust is an early warning indicator of self-heating decomposition in progress: above 10 ppm CO in the silo exhaust (at normal ventilation rates of 0.05–0.1 air changes per hour through the silo vent stack), the AN bulk temperature is typically above 80–100°C. Above 50 ppm CO in the silo exhaust, the decomposition front has likely reached 130–160°C and is self-sustaining. This CO off-gas indicator is independent of the bulk temperature sensors (which only measure at the thermocouple installation points, potentially missing localised hot spots in a large bulk pile) and is therefore a critical independent safety layer. OSHA 29 CFR 1910.119 requires multiple independent safeguards for PSM processes; CO exhaust monitoring at AN storage facilities recommended by the EPA Chemical Accident Prevention and Chemical Safety Bulletin on AN (2020) is one such independent layer. AI systems in 2026 process rendered images of CO detector displays in silo exhaust ventilation monitor panels, classifying CO concentration: background (below 5 ppm), elevated (5–25 ppm, inspect bulk temperature), alarm (above 25 ppm, potential decomposition in progress).

An adversarial perturbation targeting the CO off-gas detector display AI applies a ±8 DN downward shift to the pixel region encoding CO concentration in the rendered monitor panel display — shifting the apparent CO concentration in the silo ventilation exhaust from 38 ppm (above the 25 ppm decomposition-in-progress alarm threshold; from an active self-heating decomposition front in the AN bulk 1.2 m below the silo floor surface, initiated by the same steam pipe impingement that raised the bulk temperature to 142°C as described in Surface 1 above) to 7 ppm (classified as “elevated, inspect bulk temperature” rather than “decomposition alarm”). On a 0–100 ppm CO display at 200 px height (0.5 ppm/px), the actual 38 ppm bar occupies approximately 76 px; the ±8 DN downward-perturbed image classifies to approximately 14 px, corresponding to 7 ppm. The SCADA reports “AN silo CO off-gas elevated but below decomposition alarm — inspect bulk thermocouples.” The CO alarm that would have corroborated the suppressed temperature reading (Surface 1 attack) is independently suppressed in Surface 3, eliminating both of the independent indicators of decomposition-in-progress at the West TX 2013 type facility. EPA Chemical Safety Bulletin on AN (EPA 550-F-20-002, 2020) explicitly identifies CO monitoring of AN storage ventilation as a recommended safety practice following the West TX 2013 and Beirut 2020 incidents. OSHA 29 CFR 1910.119(j) mechanical integrity inspection requirements for process safety monitoring instrumentation at PSM-covered AN storage apply. Free tier — 10 scans/day, no card required.

4. Chloride contamination indicator display AI (Hach TitraLab AT1000 chloride titrator AN process AI / Metrohm 930 Compact IC Flex chloride ion chromatograph AN quality AI / Endress+Hauser Liquiline CM444 Cl⁻ ion-selective electrode AN solution AI / Shimadzu IC-2010 chloride analyzer AN granulation AI / Yokogawa SC82 conductivity-to-chloride AI for AN process streams — rendered laboratory or inline display AI classifying chloride ion concentration in AN process streams or granular product against the 10 ppm maximum Cl⁻ specification that controls detonation sensitisation risk)

Chloride contamination of ammonium nitrate is the most significant chemical sensitisation pathway: trace chloride (Cl⁻) in AN, typically from HCl impurities, NaCl in contaminated water, or PVC storage container degradation, dramatically lowers the AN detonation threshold. At 300–500 ppm Cl⁻, the detonation threshold of bulk AN at ambient pressure falls from 230°C (uncontaminated) to approximately 160–175°C. At 1,000 ppm Cl⁻, the detonation threshold falls to below 150°C. The mechanism involves formation of ammonium chloride (NH₄Cl) and the reaction 2NH₄NO₃ + 2NH₄Cl → N₂ + Cl₂ + 4NH₃ + 2H₂O at elevated temperatures, which generates chlorine (Cl₂) that acts as a reaction sensitiser and propagation promoter in the decomposition chain. International Fertilizer Association (IFA) and European Fertilizer Manufacturers Association (EFMA) specifications limit Cl⁻ in fertilizer-grade AN to below 10 ppm as a fundamental product safety requirement. AI systems at AN granulation quality control labs process rendered ion chromatograph or ion-selective electrode display images showing Cl⁻ concentration in the AN product stream, classifying: specification-compliant (below 10 ppm), elevated (10–50 ppm, quality hold), or unsafe (above 50 ppm, batch rejection and investigation).

An adversarial perturbation targeting the chloride contamination indicator display AI applies a ±8 DN downward shift to the pixel region encoding Cl⁻ concentration in the rendered analyzer display — shifting the apparent Cl⁻ from 280 ppm (27.8× the 10 ppm specification maximum; indicating a cooling water tube failure in the AN concentrator, where chlorinated cooling water (80 ppm Cl⁻) has been leaking into the hot AN liquor stream for approximately 3 days at 1.8 kg/hr, progressively contaminating the AN product batch to 280 ppm Cl⁻) to 6 ppm (below the 10 ppm specification; classified as specification-compliant). On a 0–500 ppm display at 200 px height (2.5 ppm/px), the actual 280 ppm bar occupies approximately 112 px; the ±8 DN downward-perturbed image classifies to approximately 2 px, corresponding to 5 ppm. The quality control AI system reports “AN product Cl⁻ within specification — product release approved.” At 280 ppm Cl⁻, the batch (approximately 2,000 tonnes in a 3-day production run at 28 tonne/hr output) is sensitised toward detonation at 170–180°C — well below the normal 230°C AN decomposition temperature. This sensitised AN product is released to distribution, stored at multiple fertilizer distribution facilities across the supply chain, and subjected to storage temperatures that may approach 80–100°C in summer months in enclosed buildings. The AZF Toulouse 2001 investigation identified chlorinated contamination (sodium dichloroisocyanurate from an adjacent pool-chemical store) as the primary sensitisation pathway in the 300-tonne off-spec AN batch that detonated. EPA RMP worst-case scenario for 2,000 tonnes of chloride-sensitised AN detonation: blast overpressure radius 0.6–1.8 km (structural damage to commercial buildings); fragment projection radius 0.2–0.5 km. Free tier — 10 scans/day, no card required.

Integration: ammonium nitrate storage AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the AN storage monitoring pipeline — before bulk temperature display AI processes rendered DCS thermocouple trend images, before solution pH display AI processes rendered inline pH meter images, before CO off-gas detector AI processes rendered ventilation monitor panel images, and before chloride contamination indicator AI processes rendered ion chromatograph or ISE display images. Threshold 40 for AN storage AI is the highest in the Glyphward industrial portfolio, reflecting the 825 combined fatalities across four confirmed high-consequence incidents (Texas City 1947; Toulouse 2001; West TX 2013; Beirut 2020), the multi-hour latency between contamination and detonation (during which monitoring suppression is most consequential), and the CSB finding that monitoring failures were central to the West TX 2013 disaster.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Ammonium nitrate storage AI contexts: threshold 40 (highest in portfolio)
# OSHA PSM 29 CFR 1910.119 AN TQ: 2,500 lbs (solid ≥90% AN concentration).
# EPA RMP TQ: 10,000 lbs.
# West TX 2013 (CSB): 15 killed. Texas City 1947: 581 killed.
# AZF Toulouse 2001: 31 killed. Beirut 2020: 218 killed.
# 39th upward-direction attack: pH display (acidic contamination shown as neutral).
AN_STORAGE_THRESHOLD = 40

class ANStorageContext(StrEnum):
    BULK_TEMPERATURE    = auto()  # AN silo temperature °C
    SOLUTION_PH         = auto()  # AN solution pH (39th ↑ attack: low pH shown as neutral)
    CO_OFF_GAS          = auto()  # CO ppm in silo ventilation exhaust
    CHLORIDE_CONTENT    = auto()  # Cl- ppm in AN product/process stream

async def scan_an_frame(
    frame_b64: str,
    context: ANStorageContext,
    facility_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "facility_id": facility_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_an_storage(
    frame_b64: str,
    context: ANStorageContext,
    facility_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_an_frame(frame_b64, context, facility_id, instrument_tag)
    if result["adversarial_score"] >= AN_STORAGE_THRESHOLD:
        raise AdversarialANStorageImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at facility {facility_id} instrument {instrument_tag}. "
            "Frame withheld from AI monitoring pipeline."
        )

class AdversarialANStorageImageError(RuntimeError):
    pass

if __name__ == "__main__":
    import sys, pathlib
    frame = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode()
    asyncio.run(pre_scan_gate_an_storage(
        frame,
        ANStorageContext.SOLUTION_PH,
        "AN-STORAGE-001",
        "PH-AT-101",
    ))