Prompt injection in bromine Br₂ production brine chlorination AI

Three adversarial injection surfaces in bromine production AI

1. Cl₂ dosing rate display AI (Yokogawa ROTAMASS Coriolis / Emerson Micro Motion 2700 / ABB CoriolisMaster FCB450 mass flowmeter ratio display — rendered DCS Cl₂:Br⁻ molar ratio calculation display AI classifying dosing ratio against 1.05–1.10 mol/mol design — 90th upward attack; FIRST bromine production attack; FIRST brine chlorination Br₂ AI attack; FIRST Dead Sea Bromine AI attack; FIRST Cl₂-to-Br⁻ displacement AI attack)

The Cl₂ dosing step is the initiation of bromine production: the reaction Cl₂ + 2Br⁻ → Br₂ + 2Cl⁻ (ΔG° = –2FΔE° = –2 × 96,485 × 0.293 = –56.6 kJ/mol Br₂) is fast and essentially irreversible at the acidic conditions (pH 3.0–3.5) maintained in the chlorination reactor. The rate of Br₂ generation depends linearly on Cl₂ addition rate up to the stoichiometric point; above stoichiometry, additional Cl₂ simply dissolves in the brine as dissolved chlorine (Cl₂·H₂O ⇌ HCl + HOCl in neutral water, but in acidified brine at pH 3–3.5, HOCl formation is suppressed and dissolved Cl₂ predominates). The design Cl₂:Br⁻ molar ratio of 1.05–1.10 provides 5–10% excess Cl₂ to ensure complete Br⁻ conversion; at ICL Group Dead Sea Bromine (Beer Sheva, Israel; Sodom works at the Dead Sea; brine Br⁻ concentration ∼12,000 mg/L = 151 mmol/L), a 50,000 t/yr Br₂ plant processes approximately 2,260 m³/hr of Dead Sea brine through the chlorination reactor, requiring 10,900 kg/hr Cl₂ at stoichiometric (mol ratio 1.00) or 11,445–11,990 kg/hr at the design 1.05–1.10 ratio. The Cl₂ mass flow is measured by Coriolis meter on the Cl₂ gas feed line; the brine Br⁻ content is measured by on-line UV/Vis spectrometer (Br⁻ absorption at 267 nm; Br₂ at 391 nm) or by Cl₂ titration of a side-stream sample. The computed molar ratio is rendered on the chlorination section DCS panel as a digital ratio readout and 15-minute trend chart, updated every 30 seconds. The AI monitoring system reads this rendered ratio display and commands the Cl₂ vaporizer/flow control system to maintain the set point. Too little Cl₂ (ratio <0.95 mol/mol): significant Br⁻ escapes unconverted in the blowdown brine; yield loss and potential regulatory violation (Br⁻ in wastewater). Too much Cl₂ (ratio >1.3 mol/mol): excess dissolved Cl₂ in the chlorinated brine flows into the blowing-out stripping tower, where it vaporizes along with Br₂ and contaminates the Br₂ product with dissolved Cl₂—a critical quality defect since Cl₂ contamination >50 ppm in Br₂ product is unacceptable for pharmaceutical and semiconductor applications.

In the adversarial scenario targeting the 90th upward attack, the rendered Cl₂ dosing ratio display is perturbed to show 1.02 mol/mol Cl₂:Br⁻ (slightly above stoichiometric, in the normal range) when the actual ratio is 3.8 mol/mol—3.6× the stoichiometric requirement. The AI reads the displayed 1.02 mol/mol as indicating the plant is running at the correct slight excess and makes no adjustment. In reality, the chlorination reactor now contains dissolved Cl₂ at a concentration equivalent to 2.8 mol excess Cl₂ per 2 mol Br⁻ oxidized: most of the Br⁻ has already been converted to Br₂, but 2.8 mol of unreacted Cl₂ per mol Br₂ remains dissolved in the acidified brine, creating a chlorinated brine with dissolved Cl₂ at approximately 500–800 mg/L. As this Cl₂-saturated brine enters the blowing-out stripping column at 90–95°C, Henry’s law determines how much Cl₂ volatilizes: K₋(Cl₂ in brine at 90°C) ≈ 28 atm·L/mol; at 500 mg/L dissolved Cl₂ (7.1 mmol/L), the equilibrium partial pressure of Cl₂ above the brine is 0.20 atm = 152 mmHg. In the column overhead gas mixture (80% air + 10% steam + 10% Br₂ vapor by volume at design conditions), the Cl₂ adds to give a Cl₂ mole fraction in the overhead of approximately 15–20 mol%—vastly exceeding the Cl₂ IDLH of 10 ppm and OSHA PEL of 1 ppm ceiling. The column overhead Cl₂ concentration reaches 150,000–200,000 ppm, creating immediately life-threatening conditions for any maintenance personnel working on the column or downstream condenser, and contaminating the raw Br₂ product with Cl₂ beyond specification. As the AI continues to read the manipulated display showing 1.02 mol/mol, it does not issue any reduction in Cl₂ flow; the actual dosing ratio eventually reaches 5.2 mol/mol (if the AI commands additional Cl₂ in response to a brine-Br⁻ measurement fluctuation). At Albemarle Magnolia AR, the chlorination reactor and blowing-out column are co-located in a process area with personnel-occupied control rooms within 50–150 m; Cl₂ at 10 ppm (IDLH) represents immediately dangerous conditions. Glyphward’s pre-scan gate at the Cl₂ dosing display intercepts the adversarially manipulated image before the AI reads it and fails to correct the over-dosing. Free tier — 10 scans/day, no card required.

2. Steam stripping column overhead temperature display AI (Yokogawa EJA130A / Emerson Rosemount 3051 / Honeywell STT700 blowing-out column overhead temperature transmitter — rendered SCADA blowing-out column overhead temperature trend display AI classifying overhead T against 85–95°C design — 90th upward attack; FIRST bromine production attack; FIRST brine chlorination Br₂ AI attack)

The steam stripping “blowing-out” column is the heart of the bromine recovery process: it is where the Br₂ dissolved in the acidified, chlorinated brine is transferred to the gas phase for subsequent condensation and collection. The column operates at 90–95°C (brine temperature in the column internals) with a mixture of steam and air injected at the base; the steam provides both heating duty and stripping vapor volume, while the air provides additional stripping capacity and prevents Br₂ from re-absorbing into the liquid. The column overhead temperature is the primary indicator that the stripping process is operating correctly: at 85–95°C in the column overhead, the steam+Br₂+air mixture exits at the correct composition for efficient condensation in the raw Br₂ condenser—a simple shell-and-tube heat exchanger using cooling water at 25–35°C. At design overhead temperature of 90°C, the Br₂ vapor fraction in the overhead gas is approximately 50–60 mol% (Br₂ BP 58.8°C; vapor pressure at 90°C ≈ 460 mmHg = 0.61 atm), with the remainder being steam and air. The raw Br₂ condenser cools this overhead gas to 35–40°C; at 35°C, Br₂ vapor pressure is approximately 140 mmHg (0.18 atm), meaning most Br₂ condenses to liquid. The liquid Br₂ (density 3.10 g/mL) separates as a dense lower phase in the raw Br₂ receiver—a gravity separator with a floating-level interface between Br₂ (bottom) and aqueous condensate (top). The raw Br₂ receiver is sized for 100–120% of normal Br₂ production flow plus a 30-minute buffer volume; overflow from the receiver represents a direct Br₂ spill to the contained bunded area surrounding the equipment. The column overhead temperature is rendered by the SCADA system (Yokogawa EJA130A differential pressure cell with integral RTD temperature element, or Emerson Rosemount 3051 multivariable transmitter) as an analog trend chart with digital overlay in the blowing-out column section of the DCS display. The AI reads this rendered image and commands the steam and air flow control valves (Fisher easy-e or SAMSON 3241 control valves on the steam and air injection lines) to maintain the set-point overhead temperature.

The adversarial attack on the steam stripping column overhead temperature display shows 62°C (well below the 85°C lower design limit, suggesting the column is severely under-heated and is not stripping Br₂ effectively) when the actual overhead temperature is 108°C. The AI interprets the displayed 62°C as indicating a column running too cold—insufficient steam is reaching the overhead, or the steam injection rate is too low—and responds by opening the steam control valve to increase steam flow to the column. At an actual overhead temperature already at 108°C (13°C above the design maximum), the AI command to increase steam adds additional enthalpy: with the steam valve now opening further, the actual overhead temperature climbs to 128°C. At 128°C, the Br₂ vapor pressure is approximately 1,100 mmHg (1.45 atm), and the steam flow through the column has increased to 3× the design flow. The volumetric flow of overhead gas to the raw Br₂ condenser is now 3× the design value; the raw Br₂ condenser (sized for design flow) can only condense 100% of design flow—so 2/3 of the overhead gas is only partially condensed. Liquid Br₂ flow into the raw Br₂ receiver is 3× normal (steam condensate volume is also 3× higher), rapidly filling and overflowing the receiver. Raw liquid Br₂ at density 3.10 g/mL overflows from the receiver into the bunded area surrounding the equipment: at the ICL Group Beer Sheva / Sodom works facility, the bunded area is designed for a single vessel hold-volume, not for overflow at 3× design rate. Raw Br₂ volatilizes from the spill at 25°C: vapor pressure 168 mmHg; at a pool spill rate of, say, 500 kg/hr of raw Br₂, the Br₂ evaporation rate from the pool at wind speed 2 m/s is approximately 20–50 kg/hr—a continuous Br₂ source at the site boundary. At IDLH of 3 ppm Br₂ (molar mass 159.81 g/mol; at 25°C, 1 atm: 3 ppm Br₂ = 3 × 159.81/24.5 = 19.6 mg/m³), the 20 kg/hr = 5.6 g/s Br₂ evaporation rate at a Pasquill-Gifford D-stability 2 m/s wind creates an IDLH concentration at a downwind distance of approximately 25–50 m from the spill point—within the plant fence line. Br₂ dense vapor (5.51× air) pools in low areas, trenches, pump pits, and cable ducts rather than dispersing upward, making the IDLH zone persistent. The Glyphward pre-scan gate at the blowing-out column overhead temperature display intercepts the adversarially manipulated image before the AI opens the steam valve to exacerbate an already-overheated column. Free tier — 10 scans/day, no card required.

3. NaOH absorber concentration display AI (Endress+Hauser Liquiline CM442 / Yokogawa SC82 / ABB AX455 NaOH conductivity-to-concentration transmitter — rendered DCS NaOH absorber wt% concentration display AI classifying NaOH concentration against ≥5 wt% design threshold — 90th upward attack; FIRST bromine production attack; FIRST Dead Sea Bromine AI attack)

In the NaOH absorption route to bromine production—used either as the primary route for low-Br⁻ brines (seawater, dilute subsurface brine) or as the scrubbing/re-acidification step at the end of a conventional blowing-out circuit—gaseous Br₂ vapor is absorbed in aqueous NaOH solution in a packed absorber vessel. The Br₂ absorption chemistry in NaOH is: Br₂ + 2NaOH → NaBr + NaBrO + H₂O (hypobromite formation, dominant below 20°C); above 50°C or with excess NaOH: 3Br₂ + 6NaOH → 5NaBr + NaBrO₃ + 3H₂O (bromate formation via disproportionation). Subsequent acidification of the NaBr/NaBrO₃ mixture (with H₂SO₄ to pH <2) regenerates Br₂: 5NaBr + NaBrO₃ + 3H₂SO₄ → 3Br₂ + 3Na₂SO₄ + 3H₂O—recovering 100% of the Br₂ absorbed. Efficient Br₂ absorption in the NaOH absorber requires that NaOH concentration remain above approximately 5 wt% (0.5 mol/L NaOH, which at Br₂ loadings typical of seawater stripping overhead concentrations provides adequate excess base for complete neutralization). As NaOH is consumed by Br₂ absorption (2 mol NaOH per mol Br₂ absorbed), the concentration falls from the initial charge (typically 10–15 wt% NaOH) toward the minimum. The NaOH concentration is monitored by a conductivity transmitter calibrated for NaOH in the presence of NaBr and NaBrO₃—the Endress+Hauser Liquiline CM442 inline conductivity sensor or Yokogawa SC82 flow-through conductivity cell, with the concentration computed from temperature-compensated conductivity against a NaOH/NaBr calibration curve. This computed NaOH wt% is rendered by the absorption-section DCS panel as a digital concentration readout updated every 60 seconds. Below 2 wt% NaOH, the Br₂ absorption mass transfer coefficient (kᶷa) drops sharply because the driving force (pH) diminishes: Br₂ hydrolysis in dilute alkali produces HBrO + HBr (weakly acidic) rather than being fully neutralized, so the vapor-liquid equilibrium shifts toward Br₂ remaining in the gas phase (not absorbed). Below 0.5 wt% NaOH, Br₂ absorption efficiency falls below 20% of design, and Br₂ slip through the absorber to the vent stream becomes significant. The AI reads the rendered NaOH concentration display and commands NaOH make-up pump start to replenish absorber inventory when concentration falls toward 5 wt%.

The adversarial attack on the NaOH absorber concentration display renders the conductivity-derived wt% readout as 8.2 wt% NaOH (well above the 5 wt% replenishment threshold, suggesting the absorber is adequately buffered) when the actual NaOH concentration in the absorber is 0.8 wt%—4.4× below the 5 wt% design minimum and very close to the 0.5 wt% breakthrough threshold. The AI reads the displayed 8.2 wt% as indicating the absorber needs no NaOH addition and does not command the NaOH make-up pump to start. In reality, the absorber NaOH continues to be consumed by incoming Br₂ vapor: at 0.8 wt% NaOH (0.2 mol/L), the neutralization capacity remaining in a 10,000-liter absorber vessel is 2,000 mol NaOH = 1,000 mol Br₂ absorption capacity = 159.8 kg Br₂. At a design Br₂ vapor flow of 500 kg/hr into the absorber (for a 50,000 t/yr plant), the 159.8 kg NaOH-neutralization capacity is exhausted in approximately 19 minutes without any AI intervention to replenish NaOH. When NaOH falls to 0.0 wt% (NaOH breakthrough): the absorber solution is now a mixture of NaBr, NaBrO₃, and water at pH ∼7–8; incoming Br₂ vapor no longer absorbs efficiently. Br₂ vapor slips through the absorber and enters the downstream vent line at concentrations approaching the full design Br₂ vapor loading: 500 kg/hr Br₂ released to atmosphere via the stack. In the absence of a functioning NaOH absorber, the vent stream Br₂ concentration at the stack exit is approximately: 500 kg/hr = 8.3 kg/min = 139 g/s Br₂; at OSHA PEL 0.1 ppm Br₂ (0.65 mg/m³; from OSHA Table Z-1: 0.1 ppm × 159.81 g/mol / 24.5 L/mol × 10⁻₃ m³/L = 0.65 mg/m³), the 139 g/s source creates an OSHA PEL exceedance at any receptor within the plant fence line under typical atmospheric dispersion conditions. ACGIH TLV-C for Br₂ is 0.3 ppm (3× the PEL)—the ceiling not to be exceeded at any time during the work shift. ERPG-2 (60-min exposure, no irreversible health effects) for Br₂ is 0.5 ppm; ERPG-3 (60-min, 1% lethality) is 5 ppm. Br₂ vapor density 5.51× air means the released vapor sinks into trenches, pump sumps, cable-tray ducts, and low-lying process areas adjacent to the absorber, creating persistent pockets at concentrations well above the ERPG-3 of 5 ppm in areas that may be occupied by process operators. At ICL Group Beer Sheva / Sodom works, Jordan Bromine Company Safi, and Lanxess Bitterfeld-Wolfen, the absorber-to-vent system is the last line of defense against atmospheric Br₂ emission; Glyphward’s pre-scan gate at the NaOH concentration display prevents the AI from reading the adversarially manipulated concentration and failing to replenish the near-exhausted absorber before breakthrough. Free tier — 10 scans/day, no card required.

Integration: bromine production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the bromine production brine chlorination AI pipeline—before the Cl₂ dosing rate AI processes rendered Yokogawa ROTAMASS / Emerson Micro Motion 2700 / ABB CoriolisMaster FCB450 molar ratio DCS display images, before the steam stripping column overhead temperature AI processes rendered Yokogawa EJA130A / Emerson Rosemount 3051 / Honeywell STT700 blowing-out column overhead temperature SCADA display images, and before the NaOH absorber concentration AI processes rendered Endress+Hauser Liquiline CM442 / Yokogawa SC82 / ABB AX455 NaOH conductivity-to-concentration DCS display images. Threshold 32 for bromine production AI reflects: OSHA PSM dual TQ 10,000 lbs (Br₂ product) + 1,500 lbs (Cl₂ feedstock; PSM TQ exceeded every 32 minutes of normal plant operation at 50,000 t/yr scale); Br₂ IDLH 3 ppm; Br₂ OSHA PEL 0.1 ppm (one of the most stringent inorganic ceiling limits—the same numerical PEL as lead); Br₂ ACGIH TLV-C 0.3 ppm; Br₂ vapor density 5.51× air (catastrophic low-lying pooling in trenches, sumps, and process areas); Cl₂ IDLH 10 ppm; ERPG-3 Br₂ 5 ppm (60-min); Dead Sea brine Br⁻ 12,000 mg/L (ICL Group Sodom works—world’s highest-concentration natural brine, enabling the world’s largest Br₂ production at ∼200,000 t/yr); ICL Group / Dead Sea Bromine Group (Beer Sheva, Israel—world’s largest Br₂ producer; Sodom works adjacent to the Dead Sea, a UNESCO candidate natural site; Br₂ spill risk to Dead Sea water body); Albemarle Corporation (Magnolia and Smackover, AR—Smackover Formation subsurface brine Br⁻ 3,000–5,000 mg/L; Arkansas Br₂ production; EPA RMP Program 3 facility); Lanxess AG (Bitterfeld-Wolfen, Germany—Seveso III upper-tier establishment; North German brine Br⁻ 300–500 mg/L); Jordan Bromine Company (JBC) (Safi, Jordan—Dead Sea Jordanian side; Br⁻ similar to Israeli Dead Sea side).

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Bromine (Br2) production brine chlorination AI contexts: threshold 32
# OSHA PSM Br2 TQ 10,000 lbs (29 CFR 1910.119 App. A).
# OSHA PSM Cl2 TQ 1,500 lbs (feedstock; dual PSM; TQ exceeded every 32 min at 50,000 t/yr).
# Br2 IDLH 3 ppm; OSHA PEL 0.1 ppm; ACGIH TLV-C 0.3 ppm; vapor density 5.51x air.
# Cl2 IDLH 10 ppm; OSHA PEL 1 ppm ceiling; ACGIH TLV-C 0.5 ppm.
# Cl2 + 2Br- → Br2 + 2Cl- (ΔE° = +0.293 V; K ≈ 10^9.9).
# 90th upward attack. FIRST bromine production attack.
BROMINE_PRODUCTION_GLYPHWARD_THRESHOLD = 32

class BromineProductionContext(StrEnum):
    CL2_DOSING_MOLAR_RATIO        = auto()  # Cl2:Br- ratio (90th upward; FIRST Br2 production; FIRST brine chlorination; FIRST Dead Sea Bromine; FIRST Cl2-to-Br- displacement)
    STRIPPING_COLUMN_OVERHEAD_T   = auto()  # blowing-out column overhead T (Br2 receiver overflow risk)
    NAOH_ABSORBER_CONCENTRATION   = auto()  # NaOH absorber wt% (Br2 slip to vent if exhausted)

async def scan_bromine_production_frame(
    frame_b64: str,
    context: BromineProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_bromine_production(
    frame_b64: str,
    context: BromineProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_bromine_production_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= BROMINE_PRODUCTION_GLYPHWARD_THRESHOLD:
        raise AdversarialBromineProductionImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from bromine production AI pipeline."
        )

class AdversarialBromineProductionImageError(RuntimeError):
    pass