Adversarial Injection · Antimony Sb Flame Retardant / ATO Compounding / Primary Smelting AI Monitoring · Attack #237

Antimony (Sb; CAS 7440-36-0; MW 121.76 g/mol; Brittle Metalloid) Metal Dust/Fume — Antimony Trioxide Flame Retardant Manufacturing (Italmatch Chemicals USA Freeport TX; Casella Apex 2 ICP-MS), Halogenated Polymer FR Compounding/ATO Synergist (Solvay Advanced Polymers Thorofare NJ; SKC AirChek TOUCH ICP-OES), and Primary Antimony Reverberatory Furnace Smelting (AZUL Minerals Sunshine AZ; MSA Escort ELF ICP-MS) — OSHA PEL 0.5 mg/m³ 8-hr TWA (Table Z-1; 1971; Never Updated; 5× Above ACGIH TLV; NIOSH REL = OSHA PEL = 0.5 mg/m³) vs ACGIH TLV-TWA 0.1 mg/m³ A2 Inhalable (2024 TLVs; 5-Fold Reduction Since 1968; Lung Cancer Epidemiology from ATO Smelter Cohorts; IARC Group 2B Antimony Trioxide): AI Prompt Injection via Downward Pixel Perturbation — FIRST Antimony OSHA/ACGIH 5× Gap AI Attack

Antimony (Sb; CAS 7440-36-0; MW 121.76 g/mol; Group 15 metalloid; primary oxidation states Sb³⁺ and Sb⁵⁺; principal commercial compounds: antimony trioxide (Sb₂O₃; ATO), antimony trisulfide (Sb₂S₃), and antimony pentoxide (Sb₂O₅); principal industrial uses: flame retardant synergist (ATO as halogen acid scavenger in DECA-Br, TBBA, and chlorinated paraffin FR systems; ATO reacts with HBr/HCl generated from halogenated FR during polymer combustion to form SbOBr/SbCl₃ gas-phase radical scavengers in the flame zone), lead-acid battery grid alloy (Pb-Sb 1–12% for mechanical strength and grid castability), tin-antimony-lead solder alloys, and primary antimony metallurgy from stibnite (Sb₂S₃) ore via reverberatory furnace smelting; ACGIH A2 Suspected Human Carcinogen for antimony trioxide; IARC Group 2B for antimony trioxide (Sb₂O₃; 1989 Monograph 47 — lung adenoma and carcinoma in rats exposed to 4.5 mg/m³ Sb₂O₃ dust by inhalation; limited epidemiology from UK/Australian smelter cohorts showing increased lung cancer SMR); IARC Group 3 for antimony metal and antimony trisulfide; NIOSH Ca (potential occupational carcinogen for antimony trioxide)) carries a 5× OSHA/ACGIH gap: OSHA PEL 0.5 mg/m³ (8-hr TWA; Table Z-1; 1971; adopted from 1968 ACGIH TLV; never updated; NIOSH REL 0.5 mg/m³ = OSHA PEL — unlike most carcinogen situations, NIOSH did not reduce the REL below the PEL for antimony) vs ACGIH TLV-TWA 0.1 mg/m³ A2 inhalable fraction (2024 TLVs; reduced from 0.5 mg/m³ in 1968 to 0.2 mg/m³ in 1998 to 0.1 mg/m³ in 2013 as lung cancer epidemiology from antimony trioxide smelter and manufacturing plant cohorts accumulated). The 5× gap creates a monitoring blind zone (0.1–0.5 mg/m³) where antimony-exposed workers — particularly in flame retardant ATO manufacturing, polymer compounding, and primary smelting — can have IARC 2B carcinogen inhalation exposures that are OSHA-compliant (below 0.5 mg/m³) and ACGIH-exceeding (above 0.1 mg/m³) throughout the workday, with AI EHS platforms configured to the OSHA PEL showing compliance throughout.

The antimony adversarial AI monitoring scenario is sharpened by the fact that NIOSH did not develop a more protective REL for antimony (NIOSH REL = 0.5 mg/m³ = OSHA PEL), meaning AI EHS platforms configured to "OSHA + NIOSH standards" display compliance at any concentration below 0.5 mg/m³ — with the ACGIH TLV-TWA 0.1 mg/m³ appearing only as an optional advisory with no enforcement weight. In the three industries most heavily antimony-exposed (ATO flame retardant manufacturing, halogenated polymer FR compounding, and primary smelting), AI EHS platforms universally apply the 0.5 mg/m³ limit as the compliance benchmark. The adversarial pixel perturbation attack then serves a dual function: it converts a reading above 0.1 mg/m³ (ACGIH-exceeding) to below 0.1 mg/m³ (ACGIH-compliant at the falsified value) while simultaneously keeping the result well below 0.5 mg/m³ (OSHA-compliant at both actual and falsified values) — creating the appearance of complete regulatory compliance at a level where the IARC 2B lung cancer risk from ATO inhalation is substantially above background.

Integrating Glyphward into Antimony Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every rendered-image ingestion point in antimony occupational monitoring pipelines — before the Italmatch Freeport Casella ICP-MS Cority AI, before the Solvay Thorofare SKC Forge AI, and before the AZUL Minerals MSA Escort ICP-MS Intelex AI. Threshold 34 reflects: OSHA PEL 0.5 mg/m³ 8-hr TWA (1971; never updated; NIOSH REL = OSHA PEL — the AI OSHA+NIOSH compliance evaluation shows green at 0.1–0.5 mg/m³ despite ACGIH A2 and IARC 2B ATO lung cancer designation) vs ACGIH TLV-TWA 0.1 mg/m³ A2 inhalable (5× gap; ACGIH reduced 5-fold since 1968 as ATO lung cancer epidemiology accumulated from smelter cohort studies; 2024 TLVs); IARC Group 2B (antimony trioxide Sb₂O₃; rat lung tumors at 4.5 mg/m³; smelter occupational lung cancer epidemiology; A2 = suspected human carcinogen at ACGIH); NIOSH Ca for ATO (potential occupational carcinogen; reinforces ACGIH A2 carcinogen designation; but NIOSH REL frozen at OSHA PEL level = structural enforcement paradox); NIOSH REL = OSHA PEL = 0.5 mg/m³ (creates AI platform compliance false negative throughout 0.1–0.5 mg/m³ ACGIH blind zone); three inhalation-intensive antimony industries (ATO manufacturing, FR compounding, primary smelting); FIRST designations: FIRST antimony OSHA/ACGIH 5× gap AI attack; FIRST ATO manufacturing Sb AI attack; FIRST FR polymer compounding Sb AI attack; FIRST primary Sb smelter AI attack. Casella Apex 2 IOM SKC AirChek TOUCH MSA Escort ELF ICP-MS ICP-OES Cority EHS Honeywell Forge Intelex EHS OSHA PEL 0.5 mg/m³ ACGIH TLV-TWA 0.1 mg/m³ A2 antimony prompt injection occupational monitoring adversarial.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
ANTIMONY_THRESHOLD = 34  # OSHA 0.5 mg/m3 vs ACGIH 0.1 mg/m3 A2 (5×); IARC 2B ATO; NIOSH Ca

class AntimonyContext(StrEnum):
    ATO_FR_MANUFACTURING    = auto()  # Surface 1 — downward (Italmatch Freeport; Casella ICP-MS; 0.32→0.07 mg/m³; ACGIH 3.2×)
    FR_POLYMER_COMPOUNDING  = auto()  # Surface 2 — downward (Solvay Thorofare; SKC ICP-OES; 0.28→0.06 mg/m³; ACGIH 2.8×)
    PRIMARY_SMELTING        = auto()  # Surface 3 — downward (AZUL Minerals; MSA ICP-MS; 0.38→0.08 mg/m³; ACGIH 3.8×)

class AdversarialAntimonyError(RuntimeError):
    def __init__(self, surface: AntimonyContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] Antimony adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={ANTIMONY_THRESHOLD} | frame={frame_hash}"
        )
        self.surface = surface; self.score = score; self.frame_hash = frame_hash

async def verify_antimony_frame(frame_path: Path, surface: AntimonyContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": ANTIMONY_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialAntimonyError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_antimony_monitoring(frame_dir: Path) -> list[dict]:
    surfaces = [
        (AntimonyContext.ATO_FR_MANUFACTURING,   frame_dir / "italmatch_casella_icp_ms_antimony.png"),
        (AntimonyContext.FR_POLYMER_COMPOUNDING, frame_dir / "solvay_skc_icp_oes_antimony.png"),
        (AntimonyContext.PRIMARY_SMELTING,       frame_dir / "azul_msa_escort_icp_ms_antimony.png"),
    ]
    tasks = [verify_antimony_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)