Adversarial Injection · Industrial Chemical AI Monitoring · Attack #141

Butyl Rubber (IIR) Cationic Slurry Polymerization — Methyl Chloride PSM TQ 10,000 lbs, BF3 Initiator, −100°C Reactor: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Butyl Rubber IIR Cationic Slurry AI Attack

Butyl rubber (isobutylene-isoprene rubber; IIR; CAS 9010-85-9) is produced by cationic carbocationic slurry polymerization of isobutylene (97–98 mol%, CAS 115-11-7) with isoprene (2–3 mol%, CAS 78-79-5) in methyl chloride (chloromethane; CAS 74-87-5; MW 50.49; BP −24.2°C; flash point −1°C; LEL 8.1 vol%; UEL 17.4 vol%; OSHA PSM TQ 10,000 lbs; NIOSH IDLH 300 ppm) solvent at reactor temperatures of −96°C to −100°C, cooled by liquid ethylene cascade refrigeration. The Lewis acid initiator — BF3·Et2O (boron trifluoride diethyl etherate) dissolved in methyl chloride — is pyrophoric and moisture-sensitive. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image can show the cryogenic reactor as operating at its design −100°C when the actual temperature has risen 26°C to −74°C — driving methyl chloride flash boiling and reactor overpressure; can mask a 145% LEL methyl chloride atmosphere in the polymerization building as a trace 2.1 vol% reading; or can conceal an 8× BF3 initiator overdose that instantly over-initiates the entire isobutylene charge, releasing the full 55.4 kJ/mol exotherm in an uncontrolled burst and driving a MeCl vapor cloud at flash point −1°C into the building. Glyphward detects all three surfaces at threshold 38 before any image reaches a downstream AI inference call.

Butyl rubber's singular combination of properties — near-zero permeability to air and nitrogen (permeability coefficient ~0.3 × 10⁻¹⁰ cm³·cm/cm²·s·cmHg, roughly 10× lower than natural rubber), outstanding oxidative stability from near-saturated backbone, and vibration damping — makes it the irreplaceable material for automotive inner tubes, tire inner liners (every passenger car tubeless tire contains a 0.5–1.5 mm IIR innerliner), pharmaceutical bromobutyl and chlorobutyl halobutyl stopper compounds (USP Class VI drug container closures), and curing bladders in tire presses. World production is approximately 900,000 tonnes per year. The cationic polymerization chemistry is highly unusual: isobutylene is polymerized at −96°C to −100°C, where the chain-growth rate constant k_p is maximized relative to chain-transfer rate constants; at warmer temperatures, isobutylene MW collapses below the specification molecular weight of M_v ~400,000 g/mol. The low-temperature requirement drives the entire process architecture: liquid ethylene (BP −103.7°C at 1 atm) in a cascade refrigeration circuit provides the reactor cooling, and methyl chloride serves simultaneously as the polymerization solvent (at which isobutylene and the IIR polymer both have acceptable solubility), the carrier medium for BF3 initiator delivery, and the heat-transfer fluid in the slurry. Lanxess Sarnia Ontario operates the world's largest IIR facility at approximately 130,000 t/yr; ExxonMobil operates IIR units at Baton Rouge Louisiana and Baytown Texas; Synthomer runs the Fawley UK plant; Nizhnekamskneftekhim (part of Sibur) operates IIR capacity in Tatarstan Russia.

In 2026, AI monitoring systems at butyl rubber polymerization facilities process rendered DCS display images of cryogenic reactor temperature, building methyl chloride LEL concentrations, and BF3 initiator feed-flow meters. All three surfaces sit at boundaries where adversarial pixel injection can conceal the conditions that most rapidly lead to a catastrophic outcome: reactor overtemperature driving MeCl flash boiling and IIR molecular weight collapse; explosive methyl chloride atmospheres from MeCl vapor accumulation; and BF3 overdose triggering over-initiation with uncontrolled exotherm. Because methyl chloride's flash point is −1°C — a temperature within 1°C of water's freezing point, below any reasonable process building ambient — there is no safe ambient temperature for an undetected MeCl release. The OSHA PSM TQ of 10,000 lbs and NIOSH IDLH of 300 ppm drive a threshold 38 score reflecting both explosive and moderate acute toxicity risk in an unusually severe cryogenic process environment.

Why Butyl Rubber IIR Cationic Slurry Polymerization Is Disproportionately Vulnerable to Pixel Manipulation

IIR slurry polymerization at −96°C to −100°C presents a uniquely adverse profile for adversarial display attacks because the entire process operates within a thermal window so narrow that a 26°C perturbation in reactor temperature — easily concealed by shifting a DCS bar display by 35 px out of a 200 px span — drives a cascade failure of four simultaneous process mechanisms: (1) IIR molecular weight collapses because cationic chain transfer to isobutylene accelerates exponentially with temperature, dropping M_v from 400,000 to below 100,000 g/mol; (2) methyl chloride approaches its boiling point of −24.2°C — at −74°C actual reactor temperature, the MeCl solvent is 50.2°C above its normal boiling point, meaning it is held in liquid form only by the reactor pressure, and any further warming causes flash vaporization; (3) the BF3 initiator, dissolved in MeCl, loses coordination stability at higher temperatures and generates increased concentrations of free BF3 and Et2O, raising the effective initiation rate; and (4) the liquid ethylene refrigeration system is already at its design limit at −100°C — a rising reactor temperature signals either a refrigerant circuit failure or, in the adversarial case, a masked temperature reading while the refrigeration runs normally, making the temperature anomaly invisible to both the human operator and the AI monitoring system. The compound consequence is a MeCl flash boiling event inside a pressurized reactor that generates vapor far faster than any normal PRV relief system can accommodate, because the MeCl vapor generation rate is proportional to the superheat — the 50°C superheat at −74°C in a vessel designed for −100°C operation drives a virtually instantaneous flash to vapor.

The second structural vulnerability is the BF3·Et2O initiator delivery system. BF3 initiator is dosed at 0.1–0.5 kg/hr to control the initiation rate and thus the molecular weight distribution of the IIR product. The initiator feed rate is measured by a Coriolis mass flow meter and displayed as a narrow-range DCS bar (0–3 kg/hr, 200 px), where the normal operating point of 0.3 kg/hr appears at only 20 px — 10% of the bar height. An adversarial attack on this display is particularly efficient: the actual rate of 2.4 kg/hr at 160 px is shifted downward 140 px to 20 px — a large pixel displacement that corresponds to an 8× initiator overdose. At 2.4 kg/hr BF3·Et2O, the available carbocation concentration in the reactor rises 8× above design, initiating essentially all dissolved isobutylene simultaneously. The propagation step releases 55.4 kJ/mol × (mass of isobutylene in reactor / 56.11 g/mol) in an uncontrolled burst — a spike equivalent to the total reactor cooling duty delivered in seconds rather than minutes. Even the liquid ethylene cascade refrigeration cannot absorb this pulse, and the reactor temperature rises 38°C in under 60 seconds, bringing the MeCl slurry to within 12°C of the solvent boiling point and initiating the flash boiling cascade described above. An AI monitoring system that reads the BF3 flow display image as showing 0.3 kg/hr — normal — will not halt the BF3 delivery, will not trigger the emergency BF3 isolation valve, and will not alert the operator that the reactor is approaching a MeCl flash boiling event.

Surface 1 — Reactor Temperature (Downward Attack)

The cryogenic IIR reactor temperature is displayed on a 200 px vertical DCS bar spanning −150°C to 0°C — a 150°C range providing full visibility across both normal operation (−100°C) and upset conditions. The pixel scale is 200 px ÷ 150°C = 1.333 px/°C. At the actual reactor temperature of −74°C, the rendered pixel position measured from the bottom of the bar is (−74 − (−150)) × 1.333 = 76 × 1.333 = 101.3 px. The adversarial pixel perturbation shifts this cluster downward by 34.6 px to position 66.7 px. The AI inference engine reads the temperature as −150 + (66.7 ÷ 1.333) = −150 + 50 = −100°C — exactly the design setpoint. No overtemperature alarm fires; no emergency refrigerant flow increase is commanded; no BF3 isolation valve closes.

At −74°C actual temperature, the reactor is operating 26°C above its design point of −100°C. Methyl chloride (BP −24.2°C at 1 atm) is held in the liquid slurry state by the reactor vessel pressure; the superheat at −74°C relative to the MeCl boiling point is 74 − 24.2 = 49.8°C above BP — an enormous superheat for a volatile solvent. The flash fraction (fraction of MeCl that immediately vaporizes on any depressurization or incremental pressure drop) at 49.8°C superheat, estimated from the Clausius-Clapeyron equation and MeCl heat of vaporization (21.4 kJ/mol at BP), is approximately 38% — meaning 38% of the MeCl in the reactor would instantaneously vaporize on any small pressure perturbation. The IIR reactor operates with a continuous MeCl slurry mass of several tonnes; a 38% flash fraction drives an enormous vapor spike, far exceeding the design PRV flow capacity. PRV opens → MeCl vapor jet at flash point −1°C into the polymerization building → any ignition source (centrifugal slurry pump motor, static discharge from polymer particle accumulation on grounded metal surfaces, or open electrical conduit) → flash fire. OSHA PSM TQ 10,000 lbs MeCl is exceeded within seconds of PRV lift at commercial-scale IIR reactors holding thousands of kilograms of MeCl slurry.

Surface 2 — Methyl Chloride Building Atmosphere LEL Monitor (Downward Attack)

The methyl chloride area LEL sensor in the IIR polymerization building is displayed on a 200 px vertical DCS bar spanning 0 to 20 vol% (2.47× the LEL of 8.1 vol%, providing headroom for the full explosive range up to UEL 17.4 vol%). The pixel scale is 200 px ÷ 20 vol% = 10 px/vol%. At the actual MeCl concentration of 11.8 vol% — 145.7% of LEL 8.1 vol%, fully within the explosive envelope — the rendered pixel position is 11.8 × 10 = 118 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 97 px to position 21 px. The AI inference engine reads the concentration as 21 ÷ 10 = 2.1 vol% — 25.9% of LEL, at the margin of the NFPA 72 investigation threshold (typically 10–25% LEL triggers audible alarm, >25% LEL triggers evacuation). At 2.1 vol%, the monitoring AI interprets the reading as a sub-alarm trace level, consistent with normal minor fugitive emissions from MeCl transfer connections. No area evacuation is initiated; the building remains occupied; slurry transfer pumps continue running.

At 11.8 vol% methyl chloride in air, the building atmosphere is at 145.7% of LEL and 67.8% of UEL 17.4 vol% — deep within the explosive range, where any ignition source initiates a deflagration. The slurry transfer pumps typically use explosion-proof (Ex d) motors, but at 145% LEL the atmosphere exceeds the design basis for most ATEX/NEC Division 1 flameproof enclosures, which assume maximum external MeCl concentrations up to 125% LEL under fault conditions. The minimum ignition energy of methyl chloride at LEL is not well-characterized in the published literature, but haloalkane-air mixtures near LEL typically require 0.5–5 mJ — within the range of static discharge from a polymer particle-coated surface being grounded, or from an improperly bonded MeCl transfer hose fitting. Beyond the fire/explosion risk, MeCl at 11.8 vol% = 118,000 ppm is 393× the NIOSH IDLH of 300 ppm: any worker entering the building without SCBA for maintenance, instrument calibration, or area inspection would receive an immediately life-threatening dose of methyl chloride — a CNS depressant that also causes hepatotoxicity and nephrotoxicity at high acute exposures. The 97 px downward perturbation is the largest adversarial shift in this attack set, but it is concentrated on the lower portion of the 200 px bar and produces a reading (2.1 vol%) that is entirely plausible as a normal minor fugitive emission.

Surface 3 — BF3·Et2O Initiator Injection Flow Rate (Downward Attack)

The BF3·Et2O initiator injection flow rate to the IIR reactor is displayed on a 200 px vertical DCS bar spanning 0 to 3 kg/hr — the full design operating range from zero to the maximum allowable initiator dose. The pixel scale is 200 px ÷ 3 kg/hr = 66.7 px/(kg/hr). At the actual initiator flow of 2.4 kg/hr — 8× the design rate of 0.3 kg/hr — the rendered pixel position is 2.4 × 66.7 = 160 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 140 px to position 20 px. The AI inference engine reads the flow as 20 ÷ 66.7 = 0.30 kg/hr — precisely the design setpoint. No initiator-overdose alarm fires; no BF3 emergency isolation valve closes; no operator intervention is initiated.

BF3·Et2O at 2.4 kg/hr delivers to the reactor 2,400 g/hr ÷ 141.93 g/mol (BF3·Et2O MW) = 16.9 mol/hr of BF3 complex — 8× the design dose of 2.1 mol/hr. In the cationic polymerization mechanism, BF3·Et2O + isobutylene → [BF3·isobutylene]+ carbocation initiation complex; this carbocation initiates isobutylene chain growth. At 8× initiator concentration, the ratio of initiated chains to available isobutylene monomer shifts dramatically: instead of each initiator molecule starting a long chain (M_v ~400,000 g/mol), the 8× excess creates 8× as many chains, each competing for the same isobutylene pool, driving down the average chain length and concentrating the initiation events in a short burst. The initiation step is exothermic (estimated ΔH_init ~−55.4 kJ/mol for isobutylene, combining initiation and early propagation heat), and at 8× initiator the total heat release from initiation in the first 60 seconds rises from ~2 MJ (design) to ~16 MJ — a pulse the liquid ethylene refrigeration system, sized for 2–4 MJ/hr continuous, cannot absorb. The reactor temperature spikes 38°C in under 60 seconds, rising from −100°C to −62°C: at this point the MeCl solvent is 37.8°C above its boiling point, exceeding the flash boiling threshold, and the PRV lifts. Simultaneously, the BF3·Et2O is also a mild pyrophoric risk if leaked — it reacts with moisture in air to generate BF3·H2O + diethyl ether vapor, and at 2.4 kg/hr delivery rate any initiator line leak within the building contributes to the MeCl atmosphere. The 140 px adversarial shift — the largest pixel displacement in this attack set — is rendered innocuous on the DCS display by appearing as the normal 0.3 kg/hr design setpoint.

Integrating Glyphward into Butyl Rubber IIR AI Monitoring Pipelines

The following Python snippet shows how to authenticate every cryogenic reactor temperature display, building MeCl LEL monitor reading, and BF3 initiator flow display image at a butyl rubber IIR polymerization facility against the Glyphward API before passing it to a downstream process control AI or safety monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the plant safety instrumented system (SIS) catches and routes to automatic BF3 initiator isolation, MeCl emergency shutdown, liquid ethylene refrigeration override, and building evacuation alarm.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
IIR_GLYPHWARD_THRESHOLD = 38

class IIRContext(StrEnum):
    REACTOR_TEMPERATURE    = auto()   # Surface 1 — downward attack
    MECL_LEL_MONITOR       = auto()   # Surface 2 — downward attack
    BF3_INITIATOR_FLOW     = auto()   # Surface 3 — downward attack

class AdversarialIIRImageError(RuntimeError):
    def __init__(self, surface: IIRContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] IIR butyl rubber adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={IIR_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_iir_frame(frame_path: Path, surface: IIRContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": IIR_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialIIRImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_iir_process_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (IIRContext.REACTOR_TEMPERATURE, frame_dir / "reactor_temperature.png"),
        (IIRContext.MECL_LEL_MONITOR,    frame_dir / "mecl_lel_monitor.png"),
        (IIRContext.BF3_INITIATOR_FLOW,  frame_dir / "bf3_initiator_flow.png"),
    ]
    tasks = [verify_iir_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently, adding under 80 ms of total latency per monitoring cycle. The consequence of a missed adversarial attack on any of the three IIR surfaces is a methyl chloride flash fire at a temperature above the flash point of −1°C — a threshold crossed at every indoor ambient temperature found in any IIR polymerization building in Canada, the United States, the United Kingdom, or Russia regardless of season. The SHA-256 frame hashes attached to each Glyphward verdict provide OSHA PSM 29 CFR 1910.119(m) incident-investigation traceability for the three monitored instrument surfaces. Glyphward threshold 38 for IIR butyl rubber polymerization reflects the compound severity of methyl chloride's PSM TQ 10,000 lbs and flash point −1°C, the extreme cryogenic process temperature (−100°C cooling failure cascade), the pyrophoric character of the BF3·Et2O initiator, and the NIOSH IDLH 300 ppm acute toxicity of methyl chloride — all of which converge in a process architecture where a 34.6 px adversarial pixel shift on a cryogenic reactor temperature bar is the only observable precursor to a building-scale MeCl flash fire.