Prompt injection in boron trifluoride (BF3) handling AI

Four adversarial injection surfaces in BF3 handling AI

1. BF3 cylinder/storage bank vapor pressure AI (Honeywell Experion PKS BF3 cylinder pressure monitoring AI / Emerson DeltaV BF3 storage pressure AI / Yokogawa OpreX boron trifluoride cylinder AI / Rosemount 3051 pressure transmitter AI — cylinder vapor pressure monitoring as primary indicator of BF3 storage temperature exceedance and impending pressure relief activation)

BF3 is stored and transported as a compressed gas in DOT-3AL high-pressure cylinders (16 lb or 32 lb capacity at approximately 200–300 psig depending on temperature) or, for bulk process supply, in ISO-tank containers or process vessels. Unlike liquefied gases that maintain constant vapor pressure at a given temperature, BF3 at normal storage conditions (−100.3°C boiling point, critical temperature −12.3°C) is entirely in the gas phase at ambient temperature; the cylinder pressure reflects the quantity of BF3 in the cylinder and its temperature, rising linearly with both. Cylinder pressure monitoring is therefore a primary indicator of storage integrity: rising pressure at constant cylinder weight indicates a temperature exceedance (the cylinder is absorbing heat from the environment); abnormally low pressure at constant weight indicates a potential leak or measurement failure. The design maximum storage pressure of 130 psig reflects the pressure relief device (PRD) set-point at which the cylinder or storage bank safety valve lifts to prevent vessel over-pressure under fire exposure or abnormal ambient temperature conditions. AI monitoring systems parse pressure transmitter display images from the BF3 cylinder manifold or storage bank to classify whether the pressure is within normal storage-temperature bounds or is trending toward PRD activation.

In the adversarial scenario, the BF3 cylinder storage bank pressure has risen to 142 psig — 12 psig above the 130 psig design maximum — following exposure of the outdoor cylinder bank to direct solar radiation on a hot summer afternoon (ambient temperature 38°C; cylinder surface temperature approximately 52°C). At 142 psig, the cylinder bank pressure is approaching the PRD set-point. A ±10 DN downward pixel-value shift on the pressure transmitter display image fed to the storage pressure AI suppresses the displayed reading from 142 psig to 88 psig: on a 0–175 psig display at 200px height (0.875 psig/px), the actual pressure of 142 psig produces a bar at approximately 162px; the perturbed image is classified as approximately 101px — corresponding to 88 psig, well within the normal 60–110 psig range for a full BF3 cylinder at ambient temperature. No high-pressure alarm is issued; no shade structure is deployed; no cylinder relocation to the cooler indoor storage area is initiated. The cylinder bank approaches PRD set-point unobserved, with the risk that a PRD lift — if it occurs — discharges BF3 gas in the immediate storage area at concentrations that will immediately generate the exposure scenario in Surface 2.

2. BF3 area gas detector CEMS (Honeywell Analytics Midas BF3 detector AI / Dräger X-am 5600 BF3 CEMS AI / MSA Ultima XE BF3 fixed-point detector AI / Industrial Scientific Ventis Pro BF3 area monitor AI — ambient BF3 gas monitoring in cylinder storage, transfer station, and reactor feed areas for OSHA TLV-C and NIOSH IDLH compliance)

BF3 is detectable by electrochemical and IR sensor-based area monitors at concentrations below the ACGIH TLV-C ceiling of 1 ppm. The OSHA PEL for BF3 is 1 ppm as a ceiling value (29 CFR 1910.1000 Table Z-1), and the NIOSH IDLH is 25 ppm — reflecting BF3's acute pulmonary toxicity: inhaled BF3 is rapidly hydrolyzed on contact with the respiratory mucosa and alveolar fluid (BF3 + 3H2O → H3BO3 + 3HF), generating HF in the lung and upper respiratory tract. This in-situ HF generation means that BF3 inhalation at concentrations above a few ppm produces the same acute effects as direct HF inhalation — severe chemical burns of the respiratory mucosa, pulmonary edema, and systemic fluoride toxicity from absorbed HF. At the NIOSH IDLH of 25 ppm BF3, a 30-minute exposure without respiratory protection would be expected to cause severe irreversible pulmonary injury. At the adversarial scenario's actual concentration of 18.4 ppm — 73.6% of IDLH and 18.4× the TLV-C ceiling — personnel in the cylinder storage area face immediate severe upper respiratory injury and systemic fluoride toxicity from the in-situ HF generated at the respiratory mucosa.

The adversarial attack uses ±8 DN downward pixel-value shift on the BF3 area detector display image. The actual reading of 18.4 ppm on a 0–25 ppm display at 200px height (0.125 ppm/px) produces a bar at approximately 147px; the ±8 DN perturbed image is classified as showing approximately 5px — corresponding to 0.6 ppm, below the TLV-C ceiling of 1 ppm — because the area detector display uses fine scale markings whose pixel features are sensitive to 8 DN perturbations. The AI monitoring system reports "BF3 ambient concentration below TLV-C — within safe exposure limits." Personnel in the storage area continue without respiratory protection, accumulating BF3/HF exposure at 18.4× TLV-C for the duration of the cylinder overpressure event. The concurrent Surface 1 suppression means neither the pressure alarm (initiating event: cylinder overheating toward PRD) nor the area gas alarm (consequence: BF3 release from PRD or seal) reaches the control room. The OSHA PSM emergency action plan coordinator for a 250 lb TQ BF3 facility — at the same threshold as MIC, the chemical responsible for the largest industrial disaster in history — has no valid alarm to act on.

3. BF3 transfer-line inline moisture analyzer AI (Vaisala DM70 moisture transmitter AI / Honeywell Analytics GasAlert moisture analyzer AI / Mettler Toledo InPro 3100 moisture AI / Yokogawa OpreX inline dewpoint analyzer AI — continuous inline moisture monitoring in BF3 transfer piping to prevent hydrolysis and HF generation)

BF3 must be handled in completely anhydrous conditions: even trace moisture initiates hydrolysis (BF3 + H2O → BF2OH + HF; BF3 + 3H2O → H3BO3 + 3HF) generating hydrofluoric acid in the transfer line. The process safety concern is twofold: (1) HF generated in the transfer line corrodes carbon steel and attacks glass, ceramic, and most polymers (HF reacts with SiO2 in glass and ceramic: 4HF + SiO2 → SiF4 + 2H2O), causing rapid deterioration of instrumentation, valve bodies, and pipe fittings not rated for HF service; and (2) the HF generated is acutely toxic with a TLV-C of 0.5 ppm (ACGIH) and IDLH of 30 ppm (NIOSH) — lower than BF3's own IDLH of 25 ppm — creating a secondary acute hazard at any leak point downstream of the moisture ingress. The specification for moisture content in BF3 service piping is typically below 10 ppm (w/w) water; inline dewpoint analyzers and moisture transmitters parse the moisture meter readout display images via AI monitoring systems to classify whether the BF3 being transferred is within the anhydrous specification or has been contaminated with moisture to a level that will initiate hydrolysis and HF generation.

The adversarial attack uses ±8 DN downward pixel-value shift on the moisture analyzer display image. The actual moisture content of 1,840 ppm — arising from a moisture-contaminated transfer hose that was stored with an open end prior to connection to the BF3 cylinder manifold — is 184× the 10 ppm specification for BF3-service dryness. At 1,840 ppm moisture, BF3 flowing through the transfer line is actively hydrolyzing: HF is being generated at the moisture-containing section of hose, corroding the hose fittings and increasing the risk of a fitting failure that would release both BF3 and HF simultaneously. On a 0–2,000 ppm moisture display at 200px height (10 ppm/px), the actual reading of 1,840 ppm produces a bar at approximately 184px; the ±8 DN perturbed image is classified as approximately 0.4px — corresponding to 4.2 ppm, well within the 10 ppm specification — because the moisture analyzer display uses fine scale resolution at the low end of the range (where normal readings are expected) that is sensitive to 8 DN perturbations. The AI reports "transfer-line moisture within specification — BF3 service conditions anhydrous." BF3 transfer continues with the moisture-contaminated hose; HF generation proceeds inside the hose; and fitting corrosion from HF attack on the carbon-steel hose body progresses toward a leak. The leak, when it occurs, releases a BF3/HF mixed plume — simultaneously suppressed by Surface 2's area gas detector attack.

4. BF3 transfer-line N2 purge pressure AI (Honeywell Experion PKS N2 purge circuit AI / Emerson Rosemount 3051 N2 pressure transmitter AI / Yokogawa OpreX BF3 line purge monitoring AI — N2 purge pressure monitoring in idle BF3 transfer lines to maintain positive inert pressure that excludes atmospheric moisture ingress)

Idle BF3 transfer lines — lines between the BF3 cylinder manifold and process equipment during shutdown, maintenance intervals, or low-demand periods — must be maintained under positive N2 pressure to prevent atmospheric moisture from diffusing or migrating into the line through valve seats, flange faces, and expansion joints. The N2 purge system maintains a positive pressure of approximately 5–10 psig in idle BF3 lines; this pressure differential ensures that any small leak pathway (valve seat weep, threaded connection pore, bellows expansion joint) allows dry N2 to escape outward rather than moist ambient air to enter inward. If the N2 purge pressure falls near atmospheric (below approximately 2 psig), the differential pressure across small leak pathways reverses: moist ambient air can diffuse inward, depositing moisture in the BF3 transfer line at the exact locations where BF3 residue from previous service remains. The moisture then initiates the hydrolysis reaction during the next BF3 transfer operation, generating HF at the first point of BF3 contact with the moisture-contaminated section — which may be a fitting, valve seat, or flange face that is then corroded before any external indication of the hydrolysis event reaches an operator.

This surface uses the upward-direction attack geometry: the N2 purge pressure has fallen to 0.4 psig — near-atmospheric — due to a failing N2 supply pressure regulator that has closed off. The dangerous condition is a deficiency (too little N2 purge pressure), and the adversarial pixel perturbation shifts the N2 pressure indicator display upward by ±8 DN to make 0.4 psig appear as 8.2 psig. On a 0–15 psig display at 200px height (0.075 psig/px), the actual N2 purge pressure of 0.4 psig produces a bar at approximately 5px; the upward-perturbed image is classified as approximately 109px — corresponding to 8.2 psig, well within the design 5–10 psig purge range. The AI monitoring system reports "N2 purge pressure at design setpoint — BF3 transfer line moisture exclusion adequate." Moist ambient air begins diffusing inward through the near-zero differential pressure valve seats and flange faces in the idle BF3 transfer line; over the next several hours of standby, moisture accumulates in the lower sections and dead-legs of the BF3 piping. When the next BF3 transfer operation begins, BF3 contacts the accumulated moisture at the first point of entry, initiating hydrolysis that generates HF at that fitting — the same scenario as Surface 3, now occurring in the main piping rather than the transfer hose. This upward-direction N2 purge pressure attack is structurally identical to the N2 blanket attacks on MIC storage (session 138) and HCN storage (session 137): in all three cases, the protective N2 envelope is shown as adequate when it has failed, and the consequence is moisture or oxygen ingress that initiates a secondary hazardous reaction with the primary chemical in storage or transfer.

Integration: BF3 handling AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and analyzer screenshot capture layer and the AI inference pipeline for each BF3 handling monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 250 lbs (same tier as methyl isocyanate), the ACGIH TLV-C ceiling of 1 ppm, the NIOSH IDLH of 25 ppm, the secondary HF hazard generated on hydrolysis (TLV-C 0.5 ppm; IDLH 30 ppm), and the compound four-surface attack geometry that simultaneously suppresses cylinder overpressure, area gas exposure, moisture-induced HF generation, and N2 purge integrity — the scan raises AdversarialBF3HandlingImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# BF3 handling AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A BF3 TQ 250 lbs (same tier as MIC)
# EPA RMP 40 CFR Part 68 BF3 TQ 250 lbs
# ACGIH TLV-C 1 ppm (ceiling); OSHA PEL 1 ppm ceiling (1910.1000 Table Z-1)
# NIOSH IDLH 25 ppm BF3
# Secondary HF hazard on hydrolysis: ACGIH TLV-C 0.5 ppm HF; NIOSH IDLH 30 ppm HF
# BF3 + 3H2O -> H3BO3 + 3HF: violent hydrolysis on moisture contact
BF3_THRESHOLD = 35


class BF3HandlingContext(Enum):
    CYLINDER_VAPOR_PRESSURE = "cylinder_vapor_pressure"
    AREA_GAS_CEMS = "area_gas_cems"
    TRANSFER_LINE_MOISTURE = "transfer_line_moisture"
    N2_PURGE_PRESSURE = "n2_purge_pressure"


class AdversarialBF3HandlingImageError(Exception):
    """Raised when any BF3 handling monitoring image scores >= 35.
    CYLINDER_VAPOR_PRESSURE uncaught: 142 psig overpressure shown as 88 psig.
    AREA_GAS_CEMS uncaught: 18.4 ppm (73.6% IDLH, 18.4x TLV-C) shown as 0.6 ppm.
    TRANSFER_LINE_MOISTURE uncaught: 1,840 ppm H2O (184x spec) shown as 4.2 ppm.
    N2_PURGE_PRESSURE uncaught: 0.4 psig (near-atmospheric) shown as 8.2 psig."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial BF3 handling image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_bf3_handling_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"bf3_handling:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= BF3_THRESHOLD:
        raise AdversarialBF3HandlingImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("bf3_cylinder_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_bf3_handling_image(
            image_bytes,
            BF3HandlingContext.CYLINDER_VAPOR_PRESSURE,
            unit_id="BF3-CYLINDER-BANK-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What OSHA PSM threshold applies to BF3 and why is it in the same tier as MIC?

OSHA PSM Appendix A lists BF3 at TQ 250 lbs — identical to methyl isocyanate (Bhopal 1984 disaster; 3,787+ killed). Only phosgene (10 lbs), acrolein (150 lbs), and methyl fluoroacetate (10 lbs) have lower acute-toxic TQs. The 250 lb TQ reflects ACGIH TLV-C ceiling 1 ppm, NIOSH IDLH 25 ppm, and the secondary HF hazard on hydrolysis (TLV-C 0.5 ppm; IDLH 30 ppm; systemic fluoride toxicity). EPA RMP applies at the same 250 lb TQ. One 16-cylinder BF3 pallet exceeds this threshold.

Why does BF3 contact with moisture generate HF and what are the compound toxicity implications?

BF3 + 3H2O → H3BO3 + 3HF: rapid, exothermic hydrolysis on any moisture contact. HF TLV-C 0.5 ppm (half BF3's TLV-C); IDLH 30 ppm. HF causes chemical burns plus systemic fluoride toxicity: hypocalcemia, hypomagnesemia, cardiac arrhythmia, potentially fatal ventricular fibrillation. HF skin contact over 2.5% body surface area can be fatal. A BF3/HF mixed release creates dual-mechanism poisoning: acute pulmonary injury + systemic fluoride poisoning from any skin/mucosa contact during escape.

Why must idle BF3 transfer lines maintain positive N2 purge?

Residual BF3 on internal surfaces hydrolyzes instantly on contact with moisture. Positive N2 pressure (5–10 psig) maintains outward differential across valve seats, flanges, and bellows joints — ensuring dry N2 escapes outward rather than moist air entering inward. N2 purge failure allows ambient moisture to diffuse in and contact BF3 residue, generating HF internally at valve seats and fittings that corrode unobserved over hours before any external leak appears.

Why is the N2 purge pressure attack upward-direction?

The dangerous condition is N2 pressure deficiency (0.4 psig actual vs. 8.2 psig design). Suppressing this deficit requires showing MORE pressure than exists: upward pixel shift displays 8.2 psig (adequate) when actual is 0.4 psig (near-atmospheric). Structurally identical to N2 blanket pressure attacks on MIC storage and HCN storage — wherever nitrogen inertisation is a safety layer, a deficiency-suppression upward attack is possible.

Why is threshold 35 for BF3 handling AI?

Threshold 35 reflects OSHA PSM TQ 250 lbs (same as MIC — highest acute-hazard tier), ACGIH TLV-C 1 ppm, NIOSH IDLH 25 ppm, secondary HF hazard on hydrolysis (TLV-C 0.5 ppm; IDLH 30 ppm; systemic fluoride toxicity), moisture-triggered compound hazard unique to BF3, and the four-surface attack that simultaneously suppresses cylinder overpressure, area gas exposure, moisture/HF generation, and N2 purge integrity — eliminating all independent PSM safeguard alarm pathways.