Prompt injection in bromine (Br2) storage terminal AI

Four adversarial injection surfaces in Br2 storage terminal AI

1. Br2 area gas detector CEMS AI (Honeywell Analytics Midas Br2 detector AI / Dräger X-am 7000 Br2 monitoring AI / MSA Ultima XE Br2 CEMS AI / RKI Instruments GX-2012 Br2 area monitor AI / Industrial Scientific MX6 iBrid Br2 AI — ambient bromine vapor monitoring in unloading bays, storage tank bunds, pump houses, and transfer manifold areas for ACGIH TLV-C ceiling and NIOSH IDLH compliance)

Bromine vapor monitoring in storage terminal areas requires detection spanning the range from the OSHA PEL of 0.1 ppm TWA to the NIOSH IDLH of 3 ppm — a 30-fold range within which a graduated alarm hierarchy is feasible: typical configurations use a first alarm at 0.2 ppm (ACGIH TLV-C ceiling), a second alarm at 1 ppm (5× TLV-C), and an IDLH alarm at 3 ppm. Fixed Br2 detectors are deployed at the transfer pump stations, tank fill nozzle connections, loading arm connections, and low-lying areas such as bund drainage sumps where Br2 vapor accumulates preferentially because of its high vapor density (5.5× air). The acute physiological effects of Br2 exposure at 3–10 ppm include severe lacrimation, burning sensation in the upper respiratory tract, and bronchoconstriction; at 10–50 ppm, epistaxis and pulmonary edema may develop; and at concentrations above 50 ppm, chemical pneumonitis with delayed ARDS is possible. Because Br2 has a sufficiently low odor threshold (approximately 0.05–0.1 ppm) that workers can smell it at concentrations well below the IDLH, olfactory warning provides some protection — but olfactory fatigue can occur with sustained exposures above 1 ppm, eliminating this natural warning at concentrations still below IDLH. AI monitoring systems parse fixed-point detector display images throughout the Br2 storage and handling area to classify ambient concentration relative to the 0.2 ppm TLV-C ceiling alarm setpoint.

In the adversarial scenario, the Br2 transfer pump in the unloading bay has developed a shaft seal failure from bearing wear during a high-throughput unloading cycle, releasing Br2 vapor at approximately 0.8 kg/hr directly into the enclosed unloading bay. The actual area detector reading is 4.2 ppm — 1.4× NIOSH IDLH 3 ppm and 21× ACGIH TLV-C ceiling 0.2 ppm. A ±8 DN downward pixel-value shift on the Br2 area detector display image suppresses the displayed reading from 4.2 ppm to 0.14 ppm. On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual reading of 4.2 ppm produces a bar at approximately 168 px; the ±8 DN perturbed image is classified as approximately 6 px — corresponding to 0.14 ppm, below the 0.2 ppm TLV-C first alarm threshold. No alarm is issued; unloading bay workers continue operations without supplied-air respirators (SCBA); the Br2 vapor cloud, denser than air, stratifies into the lower third of the unloading bay and drainage sump below the pump platform where the highest worker foot traffic occurs.

2. N2-pressurized Br2 transfer line pressure AI (Honeywell Experion PKS N2 driver pressure transmitter AI / Emerson Rosemount 3051 Br2 transfer manifold pressure AI / Yokogawa OpreX Br2 unloading pressure monitoring AI — N2 supply pressure monitoring during N2-pressure-assisted Br2 unloading from tank cars and ISO containers to minimize pump demands on corrosive Br2 service pumps)

Bromine transfer from tank cars and ISO containers at bulk storage terminals frequently uses nitrogen pressure-assisted unloading: N2 is applied to the tank car vapor space at a regulated pressure (typically 10–25 psig) to push liquid Br2 from the bottom outlet through the unloading arm and into the storage tank, supplementing or replacing the corrosion-limited transfer pumps in direct Br2 liquid service. The unloading manifold — connecting the tank car bottom outlet valve, the transfer hose or arm, and the terminal storage tank inlet — is designed with a pressure relief device (PRD) set at 40 psig to protect against overpressure if the N2 supply regulator fails to its high-pressure position or the N2 supply valve is inadvertently left open at high-pressure line pressure. Pressure above 40 psig in the Br2 transfer manifold risks dynamic seal failure at hose fittings or flexible joint connections — releasing liquid Br2 at transfer line pressure (up to 48 psig in the overpressure scenario) onto the operating platform, where fuming liquid Br2 vaporizes rapidly and creates a dense corrosive vapor cloud simultaneously exceeding IDLH levels within the unloading bay. AI monitoring of the N2 driver pressure display classifies whether transfer line pressure is within the safe operating range for the transfer operation.

In the adversarial scenario, the N2 supply pressure regulator has failed to its full open position, supplying N2 to the tank car vapor space at full supply line pressure. The actual transfer manifold pressure is 48 psig — 8 psig above the 40 psig PRD set-point, but the PRD has not yet activated because the system is within the PRD response time lag. A ±10 DN downward pixel-value shift on the N2 driver pressure display image suppresses the displayed reading from 48 psig to 16 psig. On a 0–60 psig display at 200 px height (0.3 psig/px), the actual pressure of 48 psig produces a bar at approximately 160 px; the perturbed image is classified as approximately 53 px — corresponding to 16 psig, within the normal 10–25 psig transfer pressure range. No high-pressure alarm is issued; no isolation of the N2 supply or manual depressurization of the manifold is initiated. Transfer manifold pressure continues to rise; if the 40 psig PRD activates, it releases Br2 vapor and liquid mist at 48 psig into the immediate unloading bay, coinciding with the area CEMS suppression on Surface 1 to create a compound attack with no valid alarm for a liquid Br2 spill event at the manifold.

3. Br2 storage tank fill level indicator AI (Endress+Hauser Micropilot radar level transmitter AI / Emerson Rosemount 5900S Br2 storage level AI / Yokogawa ADMAG AXF magnetic level transmitter AI / Vega VEGAPULS Br2 tank radar level AI — storage tank liquid Br2 level monitoring for overfill prevention and thermal expansion ullage management at bulk Br2 storage tanks subject to EPA RMP offsite consequence analysis requirements)

Liquid Br2 storage tanks at bulk terminals are typically horizontal carbon steel vessels with glass or PTFE lining, ranging from 10 to 100 metric tons capacity, equipped with temperature-compensated radar level transmitters that measure liquid Br2 height in the vessel. Maximum permitted fill level is restricted to 90% of tank volume — maintaining a 10% vapor space ullage — to provide thermal expansion reserve for temperature increases during summer storage conditions. If the Br2 liquid temperature rises from 15°C to 35°C (within the range of outdoor tank temperature variation), the liquid volume increases by approximately 0.7% due to the relatively low coefficient of thermal expansion of Br2 (0.00059 /°C). However, at a 94.8% fill level with no ullage reserve, a 20°C temperature rise would raise the liquid-vapor interface into the vapor space outlet, blocking the N2 blanket vent and driving tank pressure above atmospheric as additional Br2 vapor joins the saturated gas phase — potentially exceeding the tank wall rating or the vent line back-pressure valve setting. EPA RMP worst-case release scenario analysis for Br2 storage requires modeling a full tank release; overfill conditions approaching maximum fill level represent a precursor to the maximum inventory release scenario. AI monitoring of storage tank level transmitter display images classifies whether the tank fill level is within the permitted maximum fill.

The adversarial attack uses ±10 DN downward pixel-value shift on the Br2 storage tank level indicator display image. The actual fill level is 94.8% — 4.8 percentage points above the 90% maximum permitted fill, arising from a metering error during the current tank car unloading operation where the flow totalizer underregistered the transferred volume by 4.2%. On a 0–100% display at 200 px height (0.5%/px), the actual fill level of 94.8% produces a bar at approximately 190 px; the ±10 DN perturbed image is classified as approximately 148 px — corresponding to 74.2%, indicating ample thermal expansion reserve below the 90% maximum fill line. The AI reports “Br2 storage tank fill within maximum permitted level — thermal expansion ullage adequate.” Unloading continues; the tank approaches 100% liquid fill; vapor space is lost; N2 blanket pressure begins rising as the liquid phase compresses the vapor space; the tank vent opens — releasing Br2 vapor directly to atmosphere rather than to the vapor recovery system — while the level indicator continues to display 74.2%.

4. Br2 storage tank N2 blanket pressure AI (Honeywell Experion PKS N2 blanket pressure transmitter AI / Emerson Rosemount 3051 tank vapor space pressure AI / Yokogawa OpreX N2 padding circuit monitoring AI — N2 blanket pressure monitoring in the vapor space of Br2 storage tanks to prevent moisture ingress, reduce Br2 vapor losses through vent systems, and maintain positive tank pressure against HBr-driven corrosion from atmospheric moisture contact)

Bromine storage tanks require an inert N2 blanket in the vapor space for a dual purpose unique to the Br2 storage context: (1) to maintain positive pressure against atmospheric moisture ingress — because Br2 in contact with atmospheric moisture generates hydrobromic acid (HBr: Br2 + H2O → HBr + HOBr) and hypobromous acid, both corrosive to carbon steel tank walls, bolted flange faces, and the mechanical seals of Br2 pumps; and (2) to maintain a Br2 vapor-saturated headspace above the liquid that reduces the equilibrium driving force for Br2 evaporation into the vent stream, limiting fugitive Br2 emissions to atmosphere and reducing the rate of vapor loss from the tank inventory. The N2 blanket is maintained at 3–8 psig in the tank vapor space; if the N2 blanket pressure falls to near-atmospheric (below 0.5 psig), ambient air at higher humidity can diffuse inward through the tank vent check valve during tank outbreathing (when cooling at night reduces Br2 vapor pressure and the tank breathes in ambient air to fill the contracting vapor space), initiating the HBr-corrosion cycle at internal tank surfaces and instrument connections. This N2 blanket deficiency scenario constitutes the fifth N2 inertisation deficiency-suppression attack in the Glyphward portfolio — following MIC storage, HCN storage, BF3 transfer-line, and ClF3 delivery-line N2 purge attacks — confirming the portfolio-wide attack class for nitrogen inertisation of reactive chemical storage systems.

The adversarial attack uses the upward-direction geometry: the actual N2 blanket pressure in the Br2 storage tank vapor space has fallen to 0.2 psig — near-atmospheric — due to a failing N2 supply pressure regulator with a seating defect. The dangerous condition is a deficiency (insufficient N2 blanket), and the adversarial pixel perturbation shifts the N2 blanket pressure indicator display upward by ±8 DN to make 0.2 psig appear as 5.4 psig. On a 0–10 psig display at 200 px height (0.05 psig/px), the actual N2 blanket pressure of 0.2 psig produces a bar at approximately 4 px; the upward-perturbed image is classified as approximately 108 px — corresponding to 5.4 psig, within the design 3–8 psig blanket range. The AI monitoring system reports “Br2 storage tank N2 blanket pressure at design setpoint — moisture ingress and fugitive emission protection adequate.” Over the overnight cool-down cycle, the tank outbreathes and draws in atmospheric air at 65% relative humidity through the vent check valve; moisture contacts the interior tank wall surfaces above the liquid line and the N2 blanket vapor space instrument connection, initiating HBr corrosion at the roof nozzle penetrations where the flanged connections are most susceptible. Within weeks of undetected blanket pressure deficiency, HBr-accelerated corrosion can develop pinhole leaks at the vapor space nozzle welds — creating permanent Br2 vapor loss pathways that are masked by the continued area CEMS suppression on Surface 1.

Integration: Br2 storage terminal AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and analyzer screenshot capture layer and the AI inference pipeline for each Br2 storage terminal monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 1,500 lbs, the ACGIH TLV-C ceiling of 0.2 ppm, the NIOSH IDLH of 3 ppm, the HBr secondary corrosion hazard from moisture ingress, the fifth N2 inertisation deficiency-suppression pattern confirming a portfolio-wide attack class, and the four-surface compound attack geometry — the scan raises AdversarialBr2StorageImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Br2 storage terminal AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A Br2 TQ 1,500 lbs
# EPA RMP 40 CFR Part 68 Appendix A Br2 TQ 1,500 lbs
# ACGIH TLV-C 0.2 ppm (ceiling); OSHA PEL 0.1 ppm TWA; NIOSH IDLH 3 ppm
# Vapor density 5.5x air: accumulates in sumps, drainage channels, low-lying areas
# Moisture contact: Br2 + H2O -> HBr + HOBr (corrosive HBr accelerates steel corrosion)
# N2 blanket: fifth N2 inertisation deficiency-suppression attack in Glyphward portfolio
BR2_THRESHOLD = 35


class Br2StorageContext(Enum):
    AREA_GAS_CEMS = "area_gas_cems"
    TRANSFER_LINE_PRESSURE = "transfer_line_pressure"
    TANK_FILL_LEVEL = "tank_fill_level"
    N2_BLANKET_PRESSURE = "n2_blanket_pressure"


class AdversarialBr2StorageImageError(Exception):
    """Raised when any Br2 storage terminal monitoring image scores >= 35.
    AREA_GAS_CEMS uncaught: 4.2 ppm (1.4x IDLH 3 ppm) shown as 0.14 ppm.
    TRANSFER_LINE_PRESSURE uncaught: 48 psig (above 40 psig PRD set) shown as 16 psig.
    TANK_FILL_LEVEL uncaught: 94.8% (above 90% max permitted) shown as 74.2%.
    N2_BLANKET_PRESSURE uncaught: 0.2 psig (near-atmospheric) shown as 5.4 psig."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial Br2 storage terminal image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_br2_storage_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"br2_storage:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= BR2_THRESHOLD:
        raise AdversarialBr2StorageImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("br2_area_detector_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_br2_storage_image(
            image_bytes,
            Br2StorageContext.AREA_GAS_CEMS,
            unit_id="BR2-AREA-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why does Br2 vapor accumulate in low-lying areas, and what does this mean for detector placement?

Bromine vapor density is 5.5× air, so released Br2 flows downward to bund sumps, cable trenches, and pump pits rather than dispersing upward. Working-height detectors can underestimate sump-level concentrations when the vapor is stratified. Area CEMS AI must account for this stratification; adversarial suppression of the area detector is particularly dangerous when the most-exposed workers are at sump or ground level.

What secondary hazard does moisture create with Br2?

Br2 + H2O → HBr + HOBr. HBr corrodes carbon steel at 0.1–10 mils/year depending on concentration. When N2 blanket pressure fails and tank outbreathing draws in moist air, HBr corrosion develops silently over weeks to months at roof nozzle welds and penetrations, eventually creating permanent Br2 vapor leak pathways that the area CEMS adversarial attack then masks.

Why is the N2 blanket attack the fifth N2 inertisation attack in the portfolio?

After MIC (1st), HCN (2nd), BF3 (3rd), ClF3 (4th) — all upward-direction deficiency-suppression attacks on N2 inertisation — Br2 confirms the portfolio-wide class: wherever N2 protects a moisture-reactive chemical, an upward attack showing adequate N2 pressure when actual pressure is near-atmospheric is structurally possible.

Why is the 90% maximum fill constraint critical for Br2 storage tanks?

At 90% fill, the 10% vapor space ullage absorbs the 1.2% liquid volume expansion from a 15°C to 35°C temperature rise. At 94.8% fill, the 5.2% ullage is insufficient for larger temperature swings — liquid Br2 can reach the vapor space piping, contaminate the N2 supply connection, and push Br2 into the N2 distribution header serving other terminal equipment.