Adversarial Injection · Industrial Chemical AI Monitoring · Attack #124

Ammonium Perchlorate (AP) Solid Rocket Propellant Oxidizer Drying: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST AP Dryer AI Attack, PEPCON Henderson NV 1988 Anchor

Ammonium perchlorate (NH₄ClO₄; CAS 7790-98-9) decomposes exothermically at 200 °C (low-temperature route) and above 300 °C (rapid decomposition), is shock- and friction-sensitive when milled to <200 µm, and carries a CERCLA reportable quantity of just 10 lbs under 40 CFR Part 302.4 — making any release a mandatory NRC notification event. The PEPCON disaster (Pacific Engineering and Production Company of Nevada, Henderson, NV, May 4, 1988) converted approximately 8.5 million lbs of AP inventory into a detonation series measuring magnitude 3.0 and 3.5 on seismographs, killed two people, injured 372, caused more than $100 million in damage, disrupted NASA Space Shuttle SRB supply for over a year, and remains the most destructive peacetime industrial accident in Nevada history. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image is sufficient to make an over-wet AP batch appear dry (triggering premature milling), to conceal a dryer running at 118 °C — only 82 °C below the decomposition onset — or to hide a 143% dryer overload that creates the localized AP hotspots that precede deflagration-to-detonation transition (DDT). Glyphward detects all three attack surfaces at threshold 48 before any image reaches a downstream AI inference call.

Ammonium perchlorate is the oxidizer component in composite solid rocket propellants (approximately 68–72 wt% AP in a typical Space Shuttle SRM formulation; the balance being aluminum powder fuel (~16 wt%) and HTPB binder (~12 wt%)). The Space Shuttle SRBs consumed approximately 450 tonnes of AP per launch; military solid rocket motors (Minuteman III ICBM, Trident II D5 SLBM, AIM-120 AMRAAM) depend on AP as the primary oxidizer. PEPCON (Henderson, NV) and Kerr-McGee Chemical (now represented by Chemours AP capacity in Bryan, TX) were the two primary US AP suppliers until the 1988 explosion; EURENCO (Sweden/France, formerly a Chemring subsidiary) now supplies European defense AP demand. AP is listed as an explosive substance under EPA RMP Rule (40 CFR Part 68 Appendix A) and under SARA Title III; it qualifies under OSHA PSM via the "highly hazardous chemicals" general provision (29 CFR 1910.119) because of its explosive decomposition potential. AP thermal decomposition above 450 °C generates chlorine species — HCl, Cl₂ — in addition to N₂, O₂, and H₂O; HCl has a CERCLA RQ of 5,000 lbs, and the perchlorate ion (ClO₄⁻) is an EPA-regulated drinking water contaminant with a proposed MCL of 15 ppb. All three of these regulatory dimensions — RMP explosive classification, PSM general provision, and perchlorate MCL — are triggered by process conditions that the adversarial pixel attacks described here are specifically designed to conceal from AI monitoring systems.

Why AP Dryer Operations Are Disproportionately Vulnerable to Pixel Manipulation

Three structural features of ammonium perchlorate drying make it exceptionally susceptible to adversarial DCS image attacks. First, the drying process operates between two dangerous failure modes: under-drying (leaving AP above the 0.1 wt% H₂O specification, causing caking in milling operations and subsequent friction/impact events) and over-drying (driving AP temperature too close to the 200 °C decomposition onset). The process window between these failure modes is determined entirely by the combination of three instrumented variables — outlet moisture, dryer gas temperature, and batch mass — whose DCS displays are the exact attack surfaces targeted here. AI-based process monitoring systems that classify rendered instrument displays must correctly interpret all three simultaneously; manipulating any one of them can force the AI into the wrong failure mode while appearing to maintain safe operation.

Second, AP's deflagration-to-detonation transition (DDT) kinetics are strongly influenced by confinement and particle size. Fine AP (<200 µm, the post-mill specification for rocket propellant grade) in a confined rotating drum — the rotary dryer itself — provides the combination of fine particle size, confinement, and thermal excitation that defines the DDT pathway. The PEPCON investigation found that initial ignition in a relatively localized warehouse area escalated to full detonation within seconds because the AP inventory provided both the fuel (oxidizer self-contains the oxygen required for decomposition) and the confinement (warehoused sacks and building walls) that enabled DDT. An AI dryer monitoring system that misses an overtemperature or overload condition is not merely failing to prevent a fire — it is failing to prevent a DDT event in a vessel containing several hundred to over one thousand kilograms of fine AP.

Third, AP moisture measurement is technically challenging. Karl Fischer titration (the gold standard for moisture below 1 wt%) requires careful sample handling because AP is an oxidizer that can react with the Karl Fischer reagents if the sample temperature is elevated; moisture readings taken from samples at the wrong temperature can give false-low results. Online NIR moisture sensors (the more common DCS-connected instrument for AP dryers) are sensitive to particle size distribution changes as the drying cycle progresses: freshly milled AP with a narrow particle size distribution gives different NIR absorption curves than partially agglomerated AP. These measurement artifacts mean that AI monitoring systems that interpret rendered NIR moisture display images are processing measurements with inherent uncertainty — uncertainty that an adversarial pixel attack exploits by shifting the displayed value just enough to suppress alarms without generating a reading that appears obviously impossible.

Surface 1 — AP Product Moisture Content (Upward Attack)

The AP moisture content indicator spans 0 to 1.0 wt% H₂O on a 200 px vertical bar in the DCS drying bay overview tile. The pixel scale is 200 px ÷ 1.0 wt% = 200 px/wt%. At the actual moisture content of 0.38 wt%, the rendered pixel position is 0.38 × 200 = 76 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 60 px to position 16 px. The AI inference engine reads the moisture as 16 ÷ 200 = 0.08 wt% — a 4.75× underread. Actual (0.38 wt%) is well above displayed (0.08 wt%): this is an upward attack, suppressing the reading to conceal that moisture is nearly four times the target specification of 0.10 wt%.

The AP drying cycle (rotary drum dryer; inlet gas temperature 60–80 °C; design cycle time 90–150 minutes) is managed by an AI controller that monitors the outlet moisture reading and terminates the drying cycle when the displayed moisture reaches the target of ≤0.10 wt% H₂O. With the manipulated display showing 0.08 wt% — below the 0.10 wt% target — the AI controller concludes that drying is complete and initiates the discharge sequence: the dryer drum stops rotating, the outlet valve opens, and the AP batch is discharged by gravity into the collection hopper below the dryer. The actual moisture of 0.38 wt% means the discharged batch is substantially over-wet: AP at 0.38 wt% moisture has a tendency to cake (agglomerate into hard lumps) during the transfer from the dryer to the milling feed hopper, particularly if the batch temperature drops during transfer and residual moisture migrates to crystal contact points. Caked AP in the milling feed hopper requires mechanical breakup before it can be fed to the impact mill (pin mill or fluid energy mill) used for size reduction to the propellant specification particle size (<200 µm, D50). Mechanical breakup of caked AP — typically accomplished with a wooden or brass mallet (non-sparking) — introduces friction and impact energy to a material that is both shock-sensitive (when milled fine) and an oxidizer. The combined friction-plus-oxidizer scenario is exactly the initiation mechanism in historical AP handling incidents: the 1988 PEPCON explosion originated from a welding spark igniting AP in a processing building, but the subsequent investigation emphasized that the absence of sprinkler systems and the proximity of large AP inventory allowed the initial fire to cascade. A modern AI-monitored AP drying facility that discharges an over-wet batch due to a manipulated moisture display replicates the precursor condition — undetected AP in a state requiring hazardous manual intervention — that precedes many AP processing incidents.

Surface 2 — AP Dryer Outlet Gas Temperature (Upward Attack)

The AP rotary dryer outlet gas temperature indicator spans 30 °C to 130 °C on a 200 px vertical bar. The pixel scale is 200 px ÷ 100 °C = 2 px/°C. At the actual outlet gas temperature of 118 °C, the rendered pixel position is (118 − 30) × 2 = 88 × 2 = 176 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 100 px to position 76 px. The AI inference engine reads the temperature as 76 ÷ 2 + 30 = 38 + 30 = 68 °C — a 50 °C underread. Actual (118 °C) is far above displayed (68 °C): this is an upward attack, concealing that the dryer outlet gas is only 12 °C below the absolute maximum AP process temperature constraint of 130 °C (design margin below the 200 °C decomposition onset), and in practice only 82 °C below decomposition onset.

AP processing facilities apply a design constraint that the bulk AP temperature must not exceed 130 °C at any point in the drying cycle — a limit set with a 70 °C safety margin below the low-temperature decomposition onset at 200 °C. The dryer outlet gas temperature is the primary proxy for bulk AP temperature, because direct AP temperature measurement inside a rotating drum is mechanically challenging (rotating thermocouple assemblies introduce mechanical complexity and potential ignition sources); outlet gas temperature tracks bulk AP temperature with a lag of approximately 2–5 minutes. At a displayed outlet gas temperature of 68 °C, the AI monitoring system interprets the dryer as operating well within the safe range — deep in the 60–80 °C inlet temperature design band — and may actually respond by increasing the dryer inlet gas temperature to accelerate drying (an adaptive control response to what appears to be a sluggish drying cycle). This closed-loop AI action compounds the hazard: the actual outlet temperature of 118 °C, already near the 130 °C design limit, rises further as the AI increases inlet gas heat input. A temperature above 130 °C induces the first stage of AP thermal decomposition, an exothermic surface reaction that releases approximately 130–170 kJ/mol NH₄ClO₄: this exotherm is self-heating (raises the AP temperature further), and in the confined space of a rotating drum loaded with 800–1,200 kg of AP, the decomposition can transition to deflagration — a rapid surface combustion that produces large volumes of gaseous decomposition products (N₂, O₂, H₂O, HCl) at rates exceeding the drum vent capacity. Deflagration in a confined drum with AP inventory is the first step on the DDT pathway that the PEPCON 1988 event exemplified at scale.

Surface 3 — Batch Mass in Dryer Drum (Upward Attack)

The AP batch mass in the rotary dryer drum spans 0 to 1,200 kg on a 200 px vertical bar. The pixel scale is 200 px ÷ 1,200 kg = 0.1667 px/kg. At the actual batch mass of 1,140 kg, the rendered pixel position is 1,140 × 0.1667 = 190 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 112 px to position 78 px. The AI inference engine reads the batch mass as 78 ÷ 0.1667 = 467.9 kg, displayed as approximately 468 kg — a 2.44× underread. Actual (1,140 kg) is far above displayed (468 kg): this is an upward attack, concealing that the drum is loaded at 142.5% of its 800 kg design capacity while the display suggests only 58.5% loading.

The 800 kg design batch capacity for the AP rotary dryer is set by the requirements of adequate tumbling action (the drum fill fraction must remain below approximately 25% of drum internal volume for effective AP transport through the heated zone), fluidization of the bed by the drying gas flow (insufficient bed depth for the design gas velocity means inadequate particle-gas contact and uneven moisture removal), and heat transfer balance (the design inlet gas flow rate and temperature are sized for an 800 kg AP charge; a larger charge requires proportionally more heat input and longer residence time). At 1,140 kg — 342 kg above the design maximum — the drum fill fraction exceeds the design limit: AP is no longer freely tumbling but instead forms a plug-flow bed that channels drying gas along preferred pathways rather than distributing it uniformly through the entire particle bed. The consequence is severe non-uniformity in the drying result: AP in the gas-preferential flow paths dries rapidly (potentially over-drying and approaching temperature limits near the inlet gas entry), while AP in the stagnant zones of the overloaded bed retains moisture and may actually accumulate condensate if cool AP near the drum wall re-absorbs evaporated moisture from the drying gas as it passes through. This spatial non-uniformity — localized dry, hot AP adjacent to wet, cool AP — creates the thermal gradient conditions that precede AP decomposition: hot, dry AP at the high-temperature zone of the drum is closest to the 130 °C process limit, and the large inventory of AP in the drum (1,140 kg vs. the 800 kg design) means more total decomposition energy is available if the hot zone initiates exothermic decomposition. The AI monitoring system, reading 468 kg (58.5% of design capacity), has no basis to flag a capacity overload, to reduce inlet gas temperature for the larger-than-expected thermal mass, or to extend the drying cycle to account for the non-uniform bed — all of which would be triggered by the correct reading of 1,140 kg. The PEPCON investigation found that inadequate controls on the AP inventory in processing areas relative to the design fire protection capacity of those areas was a key enabling factor in the 1988 cascade. The Surface 3 attack replicates this failure: the AI-managed facility accumulates excess AP in the dryer drum without the AI monitoring system recognizing the overload condition.

Integrating Glyphward into AP Solid Propellant Drying AI Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the AP dryer AI monitoring pipeline — before the moisture content AI processes rendered NIR analyzer DCS display images, before the outlet temperature AI processes rendered thermocouple DCS display images, and before the batch mass AI processes rendered load cell DCS display images. All three scan calls execute in parallel via asyncio.gather, keeping total pre-scan latency under 200 ms for a three-channel frame bundle.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Ammonium perchlorate (AP) solid rocket propellant oxidizer drying — threshold 48
# NH₄ClO₄ decomposition onset 200 °C (low-temperature route); DDT risk.
# CERCLA RQ 10 lbs (40 CFR Part 302.4); RMP explosive substance (40 CFR Part 68 App. A).
# PEPCON Henderson NV, 4 May 1988: 8.5 million lbs AP; 2 killed; 372 injured; M3.5 seismograph.
# Attack #124: FIRST AP AI attack; FIRST PEPCON AI anchor; FIRST AP dryer temp AI attack;
# FIRST solid oxidizer rotary dryer AI attack.
AP_GLYPHWARD_THRESHOLD = 48

class AmmoniumPerchlorateContext(StrEnum):
    AP_MOISTURE_CONTENT  = auto()  # NIR dryer product moisture wt% H₂O (upward attack)
    DRYER_OUTLET_TEMP    = auto()  # rotary dryer outlet gas temperature °C (upward attack)
    DRYER_BATCH_MASS     = auto()  # load cell batch mass kg in drum (upward attack)

async def scan_ap_frame(
    frame_b64: str,
    context: AmmoniumPerchlorateContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_ap(
    moisture_frame_b64: str,
    temp_frame_b64: str,
    mass_frame_b64: str,
    plant_id: str,
) -> None:
    results = await asyncio.gather(
        scan_ap_frame(moisture_frame_b64, AmmoniumPerchlorateContext.AP_MOISTURE_CONTENT, plant_id, "AT-NIR-MOISTURE-001"),
        scan_ap_frame(temp_frame_b64,     AmmoniumPerchlorateContext.DRYER_OUTLET_TEMP,   plant_id, "TT-DRYER-OUTLET-001"),
        scan_ap_frame(mass_frame_b64,     AmmoniumPerchlorateContext.DRYER_BATCH_MASS,    plant_id, "WT-DRUM-LOAD-001"),
    )
    for result, context in zip(
        results,
        [AmmoniumPerchlorateContext.AP_MOISTURE_CONTENT,
         AmmoniumPerchlorateContext.DRYER_OUTLET_TEMP,
         AmmoniumPerchlorateContext.DRYER_BATCH_MASS],
    ):
        if result["adversarial_score"] >= AP_GLYPHWARD_THRESHOLD:
            raise AdversarialAPImageError(
                f"Adversarial injection detected in {context} "
                f"(score {result['adversarial_score']} >= threshold {AP_GLYPHWARD_THRESHOLD}) "
                f"at plant {plant_id}. "
                "Frame withheld from AP solid rocket propellant drying AI pipeline."
            )

class AdversarialAPImageError(RuntimeError):
    pass

Each Glyphward scan call returns an adversarial score, a perturbation hash, and a signed audit record within the 4-second HTTP timeout. For AP drying operations, the signed audit record satisfies both the OSHA PSM 29 CFR 1910.119 recordkeeping requirement and the ATF explosive material handling log requirements applicable to propellant-grade AP processing facilities. A score at or above threshold 48 immediately blocks the frame, halts the AI drying controller's automatic cycle-advance logic, and triggers a mandatory human operator review before any further automated action is taken on the AP batch.