Prompt injection in carbon capture and storage (CCS / CCUS) CO2 injection well AI

Four adversarial injection surfaces in CCS CO2 injection well AI

1. Wellhead pressure gauge and flow display AI (SLB WellD wellhead integrity AI, Emerson Fisher wellhead pressure display AI, Cameron NACE wellhead AI)

The CO2 injection wellhead — the assembly of valves, flanges, and pressure-containing components at the surface that controls the flow of supercritical CO2 into the wellbore — operates at pressures of 10–30 MPa (1,450–4,350 psi) during normal injection operations. The wellhead assembly must maintain pressure integrity across the full injection pressure range to prevent uncontrolled CO2 release: the Christmas tree (XMT) valves, tubing hangers, and wellhead body seals are qualified to the Maximum Allowable Surface Operating Pressure (MASOP) of the injection well, and EPA Class VI permit conditions (40 CFR 146.88(c)) require that the maximum injection pressure not exceed a calculated Maximum Injection Pressure (MIP) defined to maintain formation pressure below the fracture pressure of the caprock (the confining formation above the storage formation). If injection pressure exceeds the MIP, the formation pressure rises above the caprock fracture gradient, creating hydraulic fractures through the caprock that provide a migration pathway for CO2 from the storage formation to overlying formations — potentially including Underground Sources of Drinking Water (USDWs) protected under the Safe Drinking Water Act. AI systems monitor wellhead pressure and injection rate through continuous sensor readings rendered as digital gauge displays, trend charts, and DCS mimic screen displays, and classify the injection condition: within permit (wellhead pressure below MASOP, injection rate within permitted range), approaching MASOP (injection pressure within 10% of MASOP — injection rate reduction required), at MASOP (injection shut-in required per Class VI permit protocol), and overpressure (wellhead pressure above MASOP — emergency shut-in and well integrity investigation required).

An adversarial perturbation on a rendered wellhead pressure gauge display or DCS trend chart image that suppresses an overpressure indication — applying a ±10 DN downward shift in the pixel region encoding the gauge needle or digital readout value above the MASOP threshold (shifting the apparent pressure from the above-MASOP range to the within-permit range) — causes the wellhead pressure AI to classify an overpressured injection condition as within EPA Class VI permit parameters, suppressing the injection rate reduction and shut-in that an above-MASOP classification would require. Under sustained injection above the caprock fracture gradient, the formation pressure rise propagates laterally from the injection well at a rate determined by the formation permeability and the injected volume: in high-permeability sandstone formations (50–500 mD), the formation pressure front can propagate kilometres from the injection well within months, reaching the Area of Review (AoR) boundary defined in the Class VI permit (40 CFR 146.84) and potentially affecting legacy wellbores in the AoR that lack the integrity to prevent CO2 migration upward. A legacy wellbore with deteriorated cement (API Class G cement exposed to CO2-saturated brine at 800–3,000 m for 30–100 years carbonates at a rate of 0.1–1 mm/yr depending on brine chemistry) provides a preferential CO2 migration pathway directly from the storage formation to the surface. Uncontrolled CO2 surface release at the wellhead — from XMT seal failure at overpressure, or from a compromised casing annulus — produces a CO2 plume in the well cellar (an enclosed below-grade space 1–3 metres deep surrounding the wellhead) where CO2 concentrations above 10% develop rapidly, creating an asphyxiation hazard for personnel entering the well cellar for routine maintenance operations.

2. Microseismic event location and magnitude display AI (Nanometrics Paladin microseismic AI, OptaSense DAS microseismic AI, SLB Well Watcher microseismic AI)

CO2 injection into deep geological formations induces changes in formation pore pressure that alter the effective stress on pre-existing faults and fractures within and near the storage formation. When the effective stress reduction on a critically-stressed fault exceeds the fault’s friction resistance, the fault slips — generating a microseismic event (magnitude M -3 to M 3 for CCS-induced events) that is detected by a downhole microseismic monitoring array or a surface/shallow buried geophone network. Microseismic monitoring is required under EPA UIC Class VI (40 CFR 146.90(c)) as part of the operational monitoring plan, with the purpose of detecting unexpected fault activation that might indicate caprock integrity compromise — a fault slip event on a fault that intersects the primary confining zone can create a permeable pathway through the caprock for CO2 migration. The 2011 Youngstown, Ohio induced seismicity sequence (M 4.0 maximum) — associated with deep wastewater disposal injection (Class II wells) — resulted in the shutdown of the Northstar No. 1 injection well and established regulatory precedent for microseismic-triggered well shut-in. AI systems process rendered microseismic monitoring displays — map projections of event locations coloured by magnitude and depth, rendered magnitude-time history histograms, and cross-section views showing event clusters relative to the storage formation and primary confining zone — to classify microseismic activity: background (events within pre-injection seismicity rate and magnitude envelope), elevated (event rate or magnitude above threshold, increased monitoring and formation pressure review required), concern (event cluster near caprock or within confining zone — injection rate reduction and caprock integrity investigation required), and shut-in trigger (single event above M threshold defined in permit — immediate injection shut-in per Class VI permit traffic light protocol).

An adversarial perturbation on a rendered microseismic event location map or magnitude histogram that suppresses an elevated or concern-level microseismic cluster — applying a ±8 DN shift to the pixel region encoding the anomalous event cluster (reducing the rendered event marker colour from the concern range — typically red or orange for events at concern threshold magnitude or within the confining zone — to the background range rendered in blue-green for below-threshold events) — causes the microseismic monitoring AI to classify a developing induced seismicity sequence as background activity, suppressing the injection rate reduction and caprock integrity investigation that a concern-level classification would require. The EPA UIC Class VI programme requires that injection operators develop and implement a traffic light protocol defining injection rate reduction and shut-in triggers based on microseismic activity — the adversarial suppression of the microseismic event cluster display defeats the AI classification layer that feeds the traffic light protocol, allowing injection to continue above the caprock fracture threshold without triggering the regulatory-required response. A caprock integrity breach from induced seismicity — fault slip on a fault intersecting the primary confining zone — is not self-limiting: once a CO2 migration pathway is established through the caprock, the pressure differential between the storage formation and the overlying zones drives continuous CO2 migration upward through the pathway, potentially reaching USDWs and — in shallow cases — the surface, without further injection. DNV-RP-J203 (Geological Storage of Carbon Dioxide, 2021) requires that the caprock integrity assessment account for the maximum credible induced seismic event under the planned injection programme, but does not specify adversarial robustness requirements for the microseismic AI classifying the rendered event displays that feed the Class VI traffic light protocol.

3. CO2 plume saturation monitoring AI (SLB Petrel 4D seismic attribute AI, Schlumberger Eclipse reservoir simulation render AI, Equinor Sleipner CO2 plume monitoring AI)

The spatial extent and migration trajectory of the injected CO2 plume within the storage formation — the boundary of the zone in which CO2 saturation exceeds a minimum detectable threshold (approximately 5–10% pore volume saturation) — must be tracked continuously under EPA Class VI requirements (40 CFR 146.90(b)) to verify that the plume remains within the Area of Review (AoR) defined in the injection permit and does not migrate into zones not covered by the well integrity survey required by 40 CFR 146.84. Plume monitoring is accomplished primarily through periodic 4D seismic surveys (time-lapse difference of 3D seismic amplitude at the storage formation depth, which detects the acoustic impedance change from CO2 saturation — CO2-saturated sandstone has lower P-wave velocity and lower acoustic impedance than brine-saturated sandstone, producing a measurable amplitude increase in the time-lapse seismic difference), supplemented by downhole saturation monitoring at observation wells (resistivity, nuclear magnetic resonance, or distributed temperature sensing). AI systems process rendered 4D seismic attribute display images — false-colour maps of time-lapse seismic amplitude difference overlaid on base survey time slices at the storage formation depth, with colour scales mapped to CO2 saturation range (typically blue-green for background amplitude to red-orange for high CO2 saturation) — to classify plume condition: within AoR (plume boundary within Area of Review boundary as mapped in the Class VI permit), approaching AoR (plume edge within 10% of AoR boundary — injection rate review required), AoR exceedance (plume detected beyond AoR boundary — EPA UIC Class VI deviation notification required per 40 CFR 146.90(h)), and unexpected migration (plume detected in an unanticipated direction — possible fault conduit or legacy wellbore pathway — formation pressure and wellbore integrity audit required).

An adversarial perturbation on a rendered 4D seismic attribute display that suppresses an anomalous plume boundary extension — applying a ±10 DN shift to the pixel region encoding the plume-edge amplitude anomaly beyond the AoR boundary (reducing the apparent amplitude anomaly colour from the CO2-saturated range to the background range) — causes the plume monitoring AI to classify a CO2 plume that has migrated beyond the permitted Area of Review as within-AoR, suppressing the EPA deviation notification and injection rate suspension that AoR exceedance requires. CO2 plume migration beyond the AoR is particularly consequential when the migration direction reaches a zone with legacy wellbores (wells drilled before 2000 when Class VI requirements were not in effect) — deteriorated cement in legacy wellbores in the AoR is the primary pathway by which CO2 can migrate from the storage formation to a USDW at shallower depth. EPA Class VI permit requirements (40 CFR 146.84) require that operators identify all wells within the AoR and assess their integrity — but if the CO2 plume migrates beyond the AoR as identified at permit application, the legacy wellbore survey may not cover the actual plume extent, and the adversarially suppressed plume AI allows undetected CO2 to reach unreviewed legacy wellbores. Safe Drinking Water Act Section 1421 authorizes EPA to protect USDWs from underground injection that “may endanger drinking water sources” — undetected CO2 plume migration to a USDW constitutes an endangerment under this standard and can result in Class VI permit revocation and Superfund liability.

4. Above-zone monitoring interval (AZMI) sensor display AI (Honeywell downhole AZMI sensor AI, Baker Hughes FingerPrint AZMI AI, Weatherford Cora downhole monitoring AI)

The above-zone monitoring interval (AZMI) — a geological interval above the primary confining zone (caprock) and below any USDW, designated in the EPA Class VI permit as the monitoring interval for detecting CO2 migration above the primary seal — is monitored by pressure and temperature sensors in AZMI observation wells, or by distributed temperature sensing (DTS) in fibre-optic cables deployed in the storage formation annulus and through the confining zone into the AZMI. The AZMI is the critical “tripwire” detection layer in the Class VI monitoring architecture: if CO2 breaches the primary confining zone — through caprock fractures, fault pathways, or deteriorated legacy wellbores — the CO2 will accumulate in the AZMI, producing a detectable pressure anomaly (formation pressure rising above baseline in the AZMI) or temperature anomaly (CO2 in a thermo-neutral state relative to formation temperature provides a detectable temperature signal on DTS). EPA Class VI regulations (40 CFR 146.90(d)) require that operators monitor the AZMI throughout the injection period and for the duration of the post-injection site care (PISC) period (a minimum of 50 years after injection cessation). AI systems monitor AZMI sensor outputs through rendered trend display images of pressure and temperature time-series at each AZMI sensor location, classifying AZMI condition: baseline (pressure and temperature within pre-injection background envelope), anomalous pressure (pressure above background — AZMI formation pressure investigation required), CO2 presence (temperature anomaly consistent with CO2 in AZMI — immediate injection shut-in and EPA UIC deviation notification required), and confirmed breach (CO2 saturation confirmed in AZMI by geochemical sampling — 40 CFR 146.91 emergency response plan activation).

An adversarial perturbation on a rendered AZMI sensor pressure or temperature trend display that suppresses a CO2 breakthrough signature — applying a ±8 DN downward shift to the pixel region encoding the anomalous pressure or temperature trend above the pre-injection baseline (reducing the apparent AZMI sensor reading to within the background envelope) — causes the AZMI monitoring AI to classify an active CO2 leakage above the primary confining zone as baseline AZMI conditions, suppressing the injection shut-in and EPA UIC deviation notification that a CO2 presence classification would require. The AZMI is the last automated detection layer before CO2 reaches a USDW or the ground surface: once CO2 is confirmed in the AZMI (above the caprock but below any protected aquifer), there is still a limited window in which injection shut-in and emergency response measures — including pressure management in the AZMI, additional grouting of identified leakage pathways, and emergency monitoring of USDW wells — can prevent CO2 from reaching protected drinking water sources. Adversarial suppression of the AZMI AI output eliminates this detection window entirely, allowing CO2 that has already breached the primary confining zone to continue migrating upward without triggering the EPA-required emergency response protocol. Under 40 CFR 146.91, failure to comply with the emergency response plan on receipt of an AoR exceedance or AZMI CO2 presence indicator constitutes a permit violation subject to EPA enforcement under SDWA Section 1423 — adversarial suppression of the AZMI AI converts a detectable and manageable leakage event into an undetected permit violation with potentially irreversible USDW contamination consequences.

Integration: CCS CO2 injection well AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for CCS CO2 injection well AI belongs at every rendered-image ingestion boundary in the injection monitoring pipeline — before wellhead pressure display AI processes rendered gauge and DCS mimic images, before microseismic event map AI processes rendered event location and magnitude displays, before CO2 plume saturation AI processes rendered 4D seismic attribute maps, and before AZMI sensor display AI processes rendered pressure and temperature trend images. Threshold 35 for CCS CO2 injection AI contexts reflects the consequence envelope of CO2 asphyxiation (wellhead failure at 10–30 MPa), EPA UIC Class VI permit revocation (AoR exceedance without deviation notification), SDWA Section 1421 USDW endangerment (plume or AZMI breakthrough into protected aquifer), and EPA Subpart RR GHG monitoring failure (40 CFR Part 98 Subpart RR reporting non-compliance from undetected CO2 leakage).

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# CCS CO2 injection well AI contexts: threshold 35
# EPA UIC Class VI (40 CFR Part 146 Subpart H);
# EPA Mandatory GHG Reporting Rule Subpart RR (40 CFR Part 98 Subpart RR);
# DNV-RP-J203 (Geological Storage of Carbon Dioxide, 2021).
CCS_INJECTION_THRESHOLD = 35


class CCSInjectionAIContext(Enum):
    WELLHEAD_PRESSURE  = "wellhead_pressure"  # Wellhead pressure display AI
    MICROSEISMIC       = "microseismic"        # Microseismic event map AI
    PLUME_SATURATION   = "plume_saturation"    # CO2 plume saturation AI
    AZMI_SENSOR        = "azmi_sensor"         # Above-zone monitor sensor AI


class AdversarialCCSInjectionImageError(Exception):
    """Raised when Glyphward detects adversarial content in a CCS CO2
    injection well AI rendered image above threshold 35.

    Consequence if not raised:
    - WELLHEAD_PRESSURE: overpressure suppressed → injection above MIP →
      caprock fracture → CO2 plume migration to USDW; or wellhead seal
      failure → uncontrolled CO2 release → asphyxiation in well cellar.
    - MICROSEISMIC: induced seismicity cluster suppressed → caprock
      fracturing continues undetected → CO2 leakage above primary seal.
    - PLUME_SATURATION: AoR exceedance suppressed → unreviewed legacy
      wellbore pathway → USDW contamination; EPA SDWA §1421 violation.
    - AZMI_SENSOR: CO2 breakthrough above confining zone suppressed →
      USDW contamination; 40 CFR 146.91 emergency response plan bypassed.
    Fail-safe: halt CCS CO2 injection well AI classification; require
    manual sensor verification and EPA UIC program contact before
    resuming injection operations.
    """

    def __init__(self, scan_id: str, score: int,
                 context: CCSInjectionAIContext,
                 facility_id: str, well_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.facility_id = facility_id
        self.well_id = well_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial CCS injection image: "
            f"context={context.value} score={score} "
            f"facility={facility_id} well={well_id} scan_id={scan_id}"
        )


async def scan_ccs_injection_image(
    image_bytes: bytes,
    context: CCSInjectionAIContext,
    facility_id: str,
    well_id: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a CCS CO2 injection well AI rendered image for adversarial content.

    Fail-safe contract: AdversarialCCSInjectionImageError or httpx error →
    halt CCS injection well AI classification; require manual sensor
    verification (WELLHEAD_PRESSURE/MICROSEISMIC) or EPA UIC Class VI
    program contact (PLUME_SATURATION/AZMI_SENSOR) before resuming
    AI-driven injection management.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"ccs_injection:{context.value}:{facility_id}:{well_id}",
        "metadata": {
            "facility_id": facility_id,
            "well_id": well_id,
            "context": context.value,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > CCS_INJECTION_THRESHOLD:
        raise AdversarialCCSInjectionImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            facility_id=facility_id,
            well_id=well_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_ccs_injection_image at each CCS injection well AI rendered-image ingestion boundary: before wellhead pressure display AI (threshold 35), before microseismic event map AI (threshold 35), before CO2 plume saturation AI (threshold 35), and before AZMI sensor display AI (threshold 35). On AdversarialCCSInjectionImageError for WELLHEAD_PRESSURE context: immediately initiate injection shut-in and wellhead integrity inspection per EPA Class VI permit emergency response protocol (40 CFR 146.91) before resuming AI-driven injection management. See also: pipeline integrity inspection AI prompt injection (related CO2 pipeline transport AI adversarial surface) and oil refinery and petrochemical AI prompt injection (related high-pressure process AI adversarial injection context). Get early access

Related questions