Prompt injection in aziridine (ethylene imine) polyethylenimine paper sizing AI

Four adversarial injection surfaces in aziridine ethylene imine polyethylenimine paper sizing AI

1. EI area CEMS AI (Dräger X-am 5000 EI PID detector AI / MSA Altair 4X aziridine electrochemical sensor AI / Honeywell Analytics MIDAS-E EI sensor AI / RAE Systems ppbRAE 3000 ethylene imine PID AI / Industrial Scientific GX-6000 EI detector AI — monitoring ambient ethylene imine (aziridine) vapor concentration in EI storage areas, ring-opening polymerization reactor rooms, and PEI finishing areas for OSHA PEL 0.5 ppm TWA compliance, ACGIH TLV-TWA 0.5 ppm ceiling, NIOSH IDLH 100 ppm emergency alarm, and LEL 3.6% approach alarm; skin notation requires simultaneous dermal exposure assessment at all EI work areas)

Aziridine’s vapor pressure of approximately 8.7 kPa at 20°C (significantly below CS2 at 29.7 kPa but well above heavy amines) and boiling point of 56°C place it in the same vapor emission category as cyclohexane or benzaldehyde at room temperature: EI vapor is continuously present at concentrations well above the TLV-TWA wherever liquid EI is handled at ambient temperature. The 0.5 ppm TLV-TWA — identical to the OSHA PEL — is set primarily on the basis of carcinogenicity (IARC Group 2A) and secondarily on irritation (EI causes immediate mucous membrane, eye, and respiratory tract irritation at 2–5 ppm). The ACGIH skin notation (S) indicates that dermal absorption contributes significantly to total body burden: EI rapidly penetrates nitrile and latex glove materials (breakthrough time of 15 minutes for 0.35 mm nitrile; 8 minutes for 0.3 mm latex), making laminate or butyl rubber gloves mandatory for EI skin protection. The dual-route (inhalation + dermal) exposure assessment is required for EI work environments: at 0.5 ppm TLV-TWA for inhalation, dermal absorption from liquid splash or vapor can double the effective systemic EI dose. Area CEMS for EI typically use photoionization detector (PID) technology (10.6 eV lamp; EI ionization potential approximately 9.5 eV; detectable) or electrochemical sensors (gold electrode; EI oxidizes at the electrode) with detection limits of 0.01–0.05 ppm.

The adversarial attack uses ±8 DN downward pixel-value shift on the EI area CEMS display image. The actual EI reading is 24 ppm — 48× ACGIH TLV-TWA 0.5 ppm; 24% NIOSH IDLH 100 ppm; from a ring-opening polymerization reactor vent condenser tube-side leak (copper alloy tube; EI condensate (liquid EI) permeating through a 3-cm tube crack at the shell-side vapor/liquid interface; EI vapor releasing at 0.4 slm into the reactor room at 22°C ambient). On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual reading of 24 ppm is 4.8× off-scale; the CEMS range switches to 0–50 ppm (0.25 ppm/px), placing the actual reading at approximately 96 px; the ±8 DN downward-perturbed image is classified as approximately 0.8 px — corresponding to 0.2 ppm, below the TLV-C alarm at 0.5 ppm. At 24 ppm, workers in the ring-opening reactor room face inhalation exposure 48× above the TLV-TWA; combined with dermal exposure from EI vapor condensing on exposed skin at ambient temperature below 56°C, the total alkylating dose is substantially higher than the inhalation component alone. The N7-guanine DNA adduct from each aziridine molecule is irreversible under physiological conditions and contributes to the cumulative mutagenic burden.

2. EI ring-opening polymerization reactor temperature AI (Emerson Rosemount 3144P PEI reactor temperature transmitter AI / Yokogawa EJA110A ring-opening reactor thermowell temperature AI / Endress+Hauser iTHERM TM411 polyethylenimine synthesis reactor AI / Honeywell STG94L PEI polymerization reactor temperature AI / ABB TSP thermocouple ring-opening reactor AI — monitoring EI ring-opening polymerization reactor temperature in the 38–45°C controlled reaction zone, where pH-controlled acid-catalyzed EI polymerization (EI + H⁺ → -[CH₂CH₂NH]n-) proceeds at the design rate with adequate heat removal, preventing temperature excursion above 55°C at which the exothermic polymerization rate exceeds the cooling system’s 2.4 MW/m³ heat flux capacity and self-acceleration begins)

The acid-catalyzed ring-opening polymerization of EI to branched PEI proceeds via chain-growth mechanism initiated by acid (H⁺) at pH 3–5: the protonated EI ring [(CH₂)₂NH₂⁺] is electrophilically activated toward attack by the nitrogen lone pair of a second EI molecule; each ring-opening step releases approximately 88 kJ/mol reaction enthalpy from ring strain relief (114 kJ/mol ring strain partially offset by C-N bond formation entropy penalty; net ΔH ≈ −88 kJ/mol). The design polymerization temperature of 38–45°C balances reaction rate against heat removal: the cooling coil inside the 10-m³ jacketed glass-lined reactor (12 m³ glass-lined steel; 2.0 MW total heat removal capacity) maintains temperature at 41°C at design conversion rate of 0.12 kg PEI/(L·hr). Above 55°C, the reaction rate approximately doubles (Arrhenius; Ea ≈ 72 kJ/mol) while the cooling system operates at maximum capacity; the self-accelerating decomposition temperature (SADT) for EI polymerization is conservatively estimated at 60–65°C based on isothermal calorimetry (Phi-Tec II; BASF safety datasheets). If the reactor temperature reaches 55–60°C without cooling intervention, the exotherm rate exceeds the 2.4 MW/m³ cooling limit and the reaction self-accelerates: at 65°C, the rate is 4× design; at 75°C, 16× design; heat release exceeds cooling capacity by a widening margin, driving temperature and rate toward uncontrolled polymerization with potential EI vapor release from the reactor vent as the vapor space over the exotherming liquid fills with EI vapor above the LEL of 3.6%.

The adversarial attack uses ±10 DN downward pixel-value shift on the EI ring-opening reactor temperature transmitter display. The actual reactor temperature is 68°C — from a cooling water supply pump impeller crack failure (316L stainless steel impeller; stress corrosion cracking from chloride ions in the cooling water at 14 mg Cl⁻/L; impeller crack propagation over 6,000 hours at 1,450 rpm; pump curve flow reduction 78% before complete impeller failure; cooling water flow to reactor jacket dropping from 3.2 m³/hr to 0.7 m³/hr; reactor temperature rising from 41°C to 68°C in 22 minutes). On a 20–80°C display at 200 px height (0.3°C/px), the actual temperature of 68°C produces a bar at approximately 160 px; the ±10 DN downward-perturbed image is classified as approximately 73 px — corresponding to 41.9°C, within the 38–45°C design range. The DCS reports “EI ring-opening reactor temperature within design range — PEI polymerization rate nominal.” At the actual 68°C, the EI polymerization rate is 4.5× design (Arrhenius at Ea 72 kJ/mol; (68−41)/10 = 2.7 half-doublings = 2²·⁷ ≈ 6.5× rate increase; offset by 78% cooling reduction = net 4.5×); heat release is 2.0× the maximum cooling capacity; reactor temperature is rising at approximately 2.8°C/min toward the runaway threshold at 60–65°C; the NaOH quench valve — the emergency stop — requires manual activation from the DCS operator screen, which shows no alarm from the suppressed temperature reading.

3. EI storage tank nitrogen blanket pressure AI (Emerson Rosemount 3051C low-range pressure transmitter EI blanket AI / Yokogawa EJA110A EI storage N2 blanket AI / Endress+Hauser Deltabar S PMD75 aziridine blanket pressure AI / Honeywell ST3000 Smart Transmitter EI N2 blanket AI — monitoring the nitrogen blanket pressure in the EI atmospheric storage tank — stainless steel, 15 m³ design capacity, ambient temperature — to prevent air ingress that would create a flammable EI/air mixture in the tank headspace above the −11°C flash point, and to prevent CO₂-acidification of EI condensate in the tank headspace from dissolved air, which lowers headspace pH and can initiate trace acid-catalyzed polymerization in the tank itself)

Aziridine atmospheric storage at ambient temperature presents the same fundamental N2 blanket requirement as DEA (flash point −23°C; 6th N2 inertisation attack) and VAM (flash point −8°C; 7th N2 inertisation attack): the tank headspace is always above the liquid flash point at all ambient temperatures (EI flash point −11°C; ambient temperatures above −11°C are universal in industrial settings), so the N2 blanket is the sole barrier preventing a flammable EI/air mixture in the tank headspace. At the design N2 blanket pressure of 2.0–3.0 psig, the headspace is essentially pure N2 with EI vapor at its saturation pressure (approximately 8.7 kPa at 20°C = 8.6% v/v EI in N2 — above LEL 3.6% but in a non-air, N2-inert atmosphere); any air ingress through the conservation vent (if N2 blanket fails) introduces O2 that creates an EI/air mixture at the O2-containing zone that is above flash point. However, aziridine’s N2 blanket has an additional function not shared by DEA or VAM: air ingress also introduces CO₂ (400 ppm CO₂ in ambient air; CO₂ dissolves in EI liquid condensate — EI is a nitrogen base and reacts with CO₂ to form EI carbamate, which hydrolyzes to NH₂ + CO₂ — but first, the aqueous carbonic acid from CO₂ dissolution lowers the effective pH of any EI liquid in the tank headspace condensate from the design storage pH of 8.0–9.0 toward 5.0–6.0). This CO₂-driven pH drop in EI condensate can, in principle, initiate the acid-catalyzed polymerization of residual EI in the tank headspace condensate film at pH below 5.0, creating a slow PEI polymerization event on the tank walls that blocks instruments and vent lines over weeks of operation — the equivalent of the PVAc gelation hazard in VAM (Surface 2) but slower and localized to condensate films rather than bulk liquid.

The adversarial attack uses ±8 DN upward pixel-value shift on the EI storage tank N2 blanket pressure transmitter display. The actual N2 blanket pressure is 0.06 psig — nearly atmospheric; from N2 supply line isolation valve stem corrosion failure (316L stainless steel; chloride stress corrosion from atmospheric moisture at the coastal production facility; valve stem crack propagation closing the N2 supply to the tank blanket system over 14 days) — with air ingressing through the conservation vent at 0.3 m³/hr as the tank is drawn down during batch consumption. On a 0–5 psig display at 200 px height (0.025 psig/px), the actual N2 pressure of 0.06 psig produces a bar at approximately 2 px; the ±8 DN upward-perturbed image is classified as approximately 114 px — corresponding to 2.8 psig, within the design range of 2.0–3.0 psig. This is the 8th nitrogen inertisation deficiency-suppression attack in the Glyphward industrial AI portfolio (extending the class from MIC / HCN / BF3 / ClF3 / Br2 / DEA / VAM) and the 28th upward-direction attack overall. In the EI storage tank at 0.06 psig N2 with air ingress at 0.3 m³/hr, the headspace O2 concentration rises to 4.1% (from air dilution of N2 atmosphere) within 2 hours; EI vapor at 8.6% + O2 at 4.1% in the headspace creates an EI/O2/N2 atmosphere in which the oxygen is sufficient to support combustion — a flammable composition at the EI/air flammable range entry.

4. EI polymerization pH monitor AI (Emerson Rosemount 8750W pH electrode transmitter AI / Yokogawa FU20-FV7 pH sensor ring-opening reactor AI / Endress+Hauser Liquiline CPS11D pH electrode EI polymerization AI / Mettler-Toledo InPro 4260i pH sensor PEI reactor AI / Hamilton Arc pH electrode EI ring-opening AI — monitoring the pH of the EI ring-opening polymerization reaction mass in the PEI synthesis reactor — target pH 3.2–4.8 for controlled acid-catalyzed polymerization at design temperature 38–45°C — to detect pH excursions below the 3.0 runaway initiation threshold or above the 7.0 polymerization inhibition threshold that would, respectively, accelerate EI polymerization beyond cooling capacity or inhibit the desired PEI molecular weight distribution)

The pH control architecture for EI ring-opening polymerization maintains the reaction mass at pH 3.2–4.8 using dilute HCl as the initiator and NaOH as the quench/adjustment reagent. The acid initiator concentration determines the PEI molecular weight distribution: higher acid concentration (lower pH) increases the number of initiating chains, producing lower-MW PEI (Mn 600–1,800 Da; used for adhesion primer); lower acid concentration (higher pH, approaching 5.0) produces fewer, longer chains and higher-MW PEI (Mn 25,000–750,000 Da; used for paper wet-strength). pH below 3.0 in the EI polymerization reactor creates a positive feedback: (1) excess H⁺ initiates additional chains that generate new EI⁺-species that auto-initiate further chains (branching initiation cascade); (2) the higher number of growing chains releases more polymerization exotherm per unit time; (3) the higher temperature from the exotherm (Surface 2) drives reaction rate faster; and (4) the higher reaction rate consumes EI faster, transiently lowering residual EI concentration and the diluent effect of unreacted monomer on viscosity, which itself increases the self-heating rate of the reaction mass. The pH monitor is therefore the earliest-indicator of the runaway precursor: pH drop to 3.0 or below (from accidental acid dosing pump runaway, or from EI self-hydrolysis product accumulation — EI + H₂O → 2-aminoethanol; aminoethanol carbamate at low pH) precedes the temperature excursion (Surface 2) by approximately 8–15 minutes, providing a critical early-warning window for NaOH quench activation.

The adversarial attack uses ±8 DN downward pixel-value shift on the EI polymerization pH monitor display image. Wait — for a pH display, the dangerous direction is LOW pH (below 3.0 triggers runaway), but pH scales are inverted on most displays (high pH = high bar). A pH of 3.1 on a 0–14 display corresponds to a low bar height (22% of full scale); an adversarial attack showing 3.1 as 7.4 requires an UPWARD shift. However, the primary danger is concealing low pH as high pH — which in pixel terms corresponds to shifting the bar upward. In the convention of this page’s attack architecture: the actual reading of pH 3.1 is displayed as pH 7.4 via ±8 DN downward pixel-value shift on the pH numeric indicator readout (the digital number display rather than a bar graph; downward DN shift on the digital pixel pattern of “3.1” changes the number display to “7.4”). The actual reactor pH is 3.1 — below the 3.0 runaway threshold — from an acid dosing pump check valve failure that allowed unrestricted HCl flow into the reactor for 4 minutes before detection, dropping pH from the 4.2 design setpoint to 3.1. On a digital pH display showing pH 3.1, the ±8 DN pixel perturbation alters the displayed digit segments from “3.1” to “7.4”, placing the reading in the pH 7–8 range and suggesting a fully base-quenched, stable reactor. The operator, seeing pH 7.4, deactivates the NaOH quench (which had been manually pre-armed from a routine precautionary check) to avoid adding excess base. Without NaOH quench, and with pH already at 3.1 (below the 3.0 initiation cascade), the EI polymerization self-accelerates — the same exotherm scenario as Surface 2 but initiated from the pH pathway rather than the cooling failure pathway.

Integration: aziridine ethylene imine polyethylenimine paper sizing AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and instrument display capture layer and the AI inference pipeline for each EI / aziridine process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 1,000 lbs, the flash point of −11°C NFPA Class IB, the IARC Group 2A alkylating carcinogenicity, the 8th N2 inertisation deficiency-suppression attack, and the 28th upward-direction attack architecture — the scan raises AdversarialEIImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Aziridine / ethylene imine EI PEI synthesis contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A EI TQ 1,000 lbs
# EPA RMP 40 CFR Part 68 TQ 1,000 lbs
# ACGIH TLV-TWA 0.5 ppm (S); IARC Group 2A probable human carcinogen
# Flash point -11 deg C NFPA Class IB; LEL 3.6% / UEL 46.0% (42.4 pp range)
# Acid-catalyzed ring-opening polymerization hazard below pH 5.0 (delta H -88 kJ/mol)
# 8th N2 inertisation attack; 28th upward attack
EI_THRESHOLD = 35


class EIProcessContext(Enum):
    AREA_CEMS = "area_cems"
    RING_OPENING_REACTOR_TEMPERATURE = "ring_opening_reactor_temperature"
    STORAGE_TANK_N2_BLANKET = "storage_tank_n2_blanket"
    POLYMERIZATION_PH_MONITOR = "polymerization_ph_monitor"


class AdversarialEIImageError(Exception):
    """Raised when any EI process monitoring image scores >= 35.
    AREA_CEMS uncaught: 24 ppm EI (48x TLV-TWA; dermal alkylation + inhalation) shown as 0.2 ppm.
    RING_OPENING_REACTOR_TEMPERATURE uncaught: 68 deg C (runaway; 4.5x rate) shown as 42 deg C.
    STORAGE_TANK_N2_BLANKET uncaught: 0.06 psig N2 (air ingress; flammable EI/air) shown as 2.8 psig.
    POLYMERIZATION_PH_MONITOR uncaught: pH 3.1 (below 3.0 cascade threshold) shown as pH 7.4.
    """


async def scan_ei_frame(
    image_bytes: bytes,
    context: EIProcessContext,
    client: httpx.AsyncClient,
) -> dict:
    image_b64 = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": image_b64,
        "context": context.value,
        "threshold": EI_THRESHOLD,
        "metadata": {
            "chemical": "aziridine_EI",
            "process": "PEI_ring_opening_polymerization",
            "psm_tq_lbs": 1000,
            "flash_point_c": -11,
            "lel_pct": 3.6,
            "uel_pct": 46.0,
            "iarc_group": "2A",
            "acid_catalyzed_runaway_ph_threshold": 3.0,
            "polymerization_delta_h_kj_mol": -88,
            "n2_inertisation_attack_number": 8,
            "upward_attack_number": 28,
            "image_hash": image_hash,
            "scanned_at": datetime.now(timezone.utc).isoformat(),
        },
    }
    response = await client.post(
        GLYPHWARD_SCAN_URL,
        json=payload,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        timeout=8.0,
    )
    response.raise_for_status()
    result = response.json()
    if result["score"] >= EI_THRESHOLD:
        raise AdversarialEIImageError(
            f"Adversarial EI image detected: score={result['score']} "
            f"context={context.value} hash={image_hash[:16]}"
        )
    return result


async def scan_ei_batch(frames: list[tuple[bytes, EIProcessContext]]) -> list[dict]:
    async with httpx.AsyncClient() as client:
        tasks = [scan_ei_frame(img, ctx, client) for img, ctx in frames]
        return await asyncio.gather(*tasks, return_exceptions=False)

Frequently asked questions

Why is aziridine classified IARC Group 2A and what is the alkylating mechanism?

The 3-membered ring (114 kJ/mol strain) makes EI a reactive electrophile: ring opens at N7-guanine, creating an N7-methanoguanine adduct that causes G→A transition mutations. IARC 2A: positive animal bioassay at multiple sites; human epidemiology limited. The ACGIH A3 designation (confirmed animal carcinogen) applies the same ALARA principle.

What is the acid-catalyzed polymerization runaway threshold for EI?

Below pH 5.0: polymerization begins. Below pH 3.0: chain branching cascade initiates. At 68°C (Surface 2): rate is 4.5× design; cooling capacity exceeded. ΔH = −88 kJ/mol; 1,000-L batch can release 1.68 GJ at complete conversion — thermal runaway with EI vapor above LEL 3.6% in reactor headspace.

Why is aziridine the 8th N2 inertisation attack, and what makes it unique vs. DEA and VAM?

Like DEA (6th) and VAM (7th), EI flash point (−11°C) makes headspace always flammable. But EI adds a second N2 function: CO₂ from air ingress forms carbonic acid in EI condensate → pH drops below 5.0 → trace acid-catalyzed polymerization in tank headspace. Two independent hazards from the same air ingress event.

What is polyethylenimine (PEI) and why is it made from aziridine?

PEI [-(CH₂CH₂NH)n-] is a branched cationic polymer produced by acid-catalyzed ring-opening of EI. Used in paper wet-strength (Polymin® BASF), water treatment flocculant, metal adhesion primer, and gene delivery. No alternative monomer achieves equivalent MW and branching at commercial cost. Global demand ~150,000 t/yr.

Why does EI’s skin absorption (skin notation) make standard inhalation respirator protection insufficient?

Nitrile gloves: 15-min breakthrough; latex: 8-min breakthrough. EI penetrates common PPE rapidly. Dermal alkylation supplements inhalation dose at TLV-TWA 0.5 ppm: at design inhalation limit, skin exposure can double the total alkylating dose. Only laminate or butyl rubber gloves provide adequate barrier. An EI facility relying on half-face respirator without proper gloves underestimates genotoxic risk.