Adversarial Injection · Industrial Chemical AI Monitoring · Attack #121

Carbon Disulfide CS₂ Methane-Sulfur Synthesis & Viscose Rayon: AI Prompt Injection via ±8 DN Pixel Perturbation

Carbon disulfide (CS₂, CAS 75-15-0) holds the lowest autoignition temperature of any common bulk industrial solvent — 90 °C, barely above boiling water — while its primary synthesis route co-generates hydrogen sulfide (H₂S), an OSHA PSM-listed acutely toxic with a threshold quantity of 1,500 lbs. A single ±8 DN adversarial perturbation on a rendered SCADA display image is enough to make a furnace running at 688 °C appear to read 522 °C, to invert a depleted H₂S scrubber pH readout from 7.8 to 12.6, or to suppress a 3.8 vol% CS₂ vapor alarm to 0.6 vol%. Glyphward detects all three attack surfaces before the first byte reaches a downstream LLM inference call.

CS₂ is the solvent backbone of the global viscose rayon industry: cellulose is dissolved in CS₂ and NaOH to form sodium cellulose xanthate, then extruded into fiber. Annual global CS₂ demand exceeds 1 million tonnes, with major synthesis capacity at Arkema Lacq (France), Nouryon (Netherlands), Evonik (Germany), and several Chinese producers supplying rayon mills in Asia. The methane-sulfur route — CH₄ + 4S → CS₂ + 2H₂S at 500–700 °C over γ-alumina catalyst — dominates modern production. Both the flammability profile (flash point −30 °C; LEL 1.0 vol%; UEL 60 vol%) and the dual-hazard co-product stream make CS₂ synthesis one of the most pixel-attack-vulnerable processes in specialty chemical manufacturing.

Why CS₂ Synthesis Is Disproportionately Vulnerable to Pixel Manipulation

Three structural features of CS₂ synthesis make it exceptionally susceptible to adversarial SCADA image attacks.

First, the methane-sulfur furnace operates in a narrow 500–700 °C window. Below 500 °C, sulfur conversion collapses and elemental sulfur condenses in downstream condensers, plugging equipment. Above 700 °C, alumina catalyst sinters rapidly and downstream alloy piping (typically 310 SS) approaches its creep threshold. The 200 °C operating window is exactly the span where a ±8 DN perturbation — representing a ~6 px shift on a 200 px display scale spanning 400–800 °C — moves the apparent reading 166 °C off reality. AI-based process monitoring models trained on normal operations flag deviations of 20–30 °C as noteworthy; a manipulated reading that stays within that band passes undetected.

Second, H₂S scrubbing is the primary emission control boundary before the tail gas stream reaches atmosphere. Industrial scrubbers use 10–15 wt% NaOH solution. Once scrubber pH drops below 8.5, absorption efficiency collapses — but pH probes are typically sampled at 15-minute intervals, and the AI historian displays continuous interpolated pH from periodic readings. A downward pixel attack that makes pH appear adequate (12.6) when it has actually dropped to 7.8 suppresses the alarm that would trigger NaOH dosing. H₂S OSHA PEL ceiling: 20 ppm; NIOSH IDLH: 50 ppm; H₂S CERCLA reportable quantity: 100 lbs.

Third, CS₂ vapor accumulation in the storage tank header is monitored by a point detector whose 4–20 mA signal is rendered as a colored bar on the DCS overview screen. CS₂ autoignition at 90 °C is anomalously low — steam tracing on roof-mounted instruments, bearing heat from pumps, and even ambient summer pavement temperatures can approach this threshold. Suppressing the displayed vapor reading from 3.8 vol% to 0.6 vol% removes the pre-alarm at LEL/2 (0.5 vol%) and the action alarm at LEL (1.0 vol%), presenting the operator with a reading that appears safely sub-LEL in a space that is actually above it.

Surface 1 — Synthesis Furnace Outlet Temperature (Upward Attack)

The methane-sulfur synthesis furnace outlet temperature display spans 400 °C to 800 °C on a 200 px vertical bar in the DCS overview tile. The pixel scale is 200 px ÷ 400 °C = 0.5 px per °C. At the actual operating temperature of 688 °C, the rendered pixel position is (688 − 400) × 0.5 = 144 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 83 px to position 61 px. The AI inference engine reads the temperature as 61 ÷ 0.5 + 400 = 522 °C — a 166 °C underread.

At 688 °C — the actual furnace outlet — CH₄ conversion is 92–95%, well above the economic target, but alloy outlet piping is approaching short-term overtemperature limits. Catalyst aging at this temperature level proceeds 3–4× faster than at the design optimum of 620 °C. At 522 °C (the apparent reading), the AI model interprets the furnace as cold-side-biased and, if connected to a closed-loop APC layer, may actually increase methane feed to compensate — further elevating the true outlet temperature while the display continues to show 522 °C. Sulfur condensation in cold spots downstream would not be expected at the apparent temperature, so no preventive line warming is initiated.

Consequence pathway: Sustained operation at 688+ °C degrades alumina pellets via sintering, reducing surface area from ~250 m²/g (fresh) to below 50 m²/g within weeks. Catalyst bed pressure drop rises; undetected, a localized hot spot can trigger tube failure. Additionally, sulfur vapor breakthrough into the H₂S scrubber increases if conversion drops due to catalyst degradation — compounding the Surface 2 hazard. Glyphward flags this frame at threshold 32 via the perturbation hash, independent of downstream model output.

Surface 2 — H₂S Caustic Scrubber pH (Downward Attack)

The H₂S caustic scrubber pH indicator spans pH 6 to pH 14 on a 200 px vertical bar. The pixel scale is 200 px ÷ 8 pH units = 25 px per pH unit. At the actual pH of 7.8, the rendered pixel position is (7.8 − 6) × 25 = 45 px. The adversarial perturbation shifts this upward by 120 px to position 165 px. The AI system reads the pH as 165 ÷ 25 + 6 = 12.6 — a 4.8-unit overread that places the apparent reading deep inside the comfortable alkaline zone.

H₂S absorption in NaOH solution follows the reaction 2NaOH + H₂S → Na₂S + 2H₂O. As NaOH depletes, the solution pH drops. At pH 7.8, the scrubber has less than 10% of its original alkalinity remaining; H₂S removal efficiency drops from >99.9% at pH 12–13 to below 60% at pH 8, and below 20% at pH 7.8. The scrubber tail gas H₂S concentration can therefore rise from <1 ppm (design) to 15–30 ppm — below NIOSH IDLH (50 ppm) but well above OSHA PEL ceiling (20 ppm) — in minutes after the threshold is crossed.

Consequence pathway: The displayed pH of 12.6 suppresses the NaOH dosing alarm, the dosing pump auto-start, and the operator pH trend review at shift change. Meanwhile, H₂S slip accumulates in the scrubber effluent stream and the ambient air in the scrubber area. H₂S has an OSHA PSM threshold quantity of 1,500 lbs; a sustained 15–30 ppm leak from a large scrubber can release 10–20 lbs/hour into the scrubber bay — crossing CERCLA RQ (100 lbs) within a single 8-hour shift, triggering mandatory reporting obligations that the manipulated display has prevented operators from anticipating.

Surface 3 — CS₂ Vapor Concentration in Storage Header (Upward Attack)

The CS₂ vapor detector at the storage tank header displays concentration as a percentage of the lower explosive limit on a 200 px bar spanning 0 vol% to 5 vol% (the instrument range). The pixel scale is 200 px ÷ 5 vol% = 40 px per vol%. At the actual vapor concentration of 3.8 vol%, the rendered pixel position is 3.8 × 40 = 152 px. The adversarial perturbation shifts this downward by 128 px to position 24 px. The AI system reads the vapor as 24 ÷ 40 = 0.6 vol% — a 3.2 vol% underread.

CS₂ LEL is 1.0 vol%. The industry standard is to trigger a pre-alarm at LEL/2 (0.5 vol%) and an action alarm at LEL (1.0 vol%). The actual concentration of 3.8 vol% is 3.8× LEL — well within the explosive range (LEL 1.0% to UEL 60%). The manipulated display of 0.6 vol% sits just above the pre-alarm threshold, presenting the appearance of a slightly elevated but not-yet-actionable reading. No ventilation increase is triggered; no hot-work permit hold is issued; no ignition source survey is conducted.

Consequence pathway: CS₂ autoignition temperature of 90 °C is the critical factor. Steam-traced instrument impulse lines on the tank roof commonly operate at 100–120 °C. Bearing temperatures on circulating pumps regularly reach 80–90 °C. At 3.8 vol% CS₂ in air, any of these ignition sources — including a transient voltage arc from a non-Ex electrical fitting — can initiate a vapor cloud fire or deflagration. Historical CS₂ plant incidents include tank farm fires in Germany (1993) and China (2008) where vapor buildup was discovered only after ignition. Glyphward's frame-level hash verification detects the pixel shift before the APC or safety system has the opportunity to act on the suppressed reading.

Integrating Glyphward into CS₂ Synthesis AI Monitoring Pipelines

The following Python snippet shows how to authenticate every DCS frame against the Glyphward API before passing it to a downstream process-monitoring LLM. For CS₂ synthesis, three context labels map to the three attack surfaces above. The API returns clean, suspect, or adversarial; any non-clean result raises a typed exception that the process control layer can catch and route to operator alarm.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env
CS2_GLYPHWARD_THRESHOLD = 32

class CS2Context(StrEnum):
    SYNTHESIS_FURNACE_TEMP     = auto()   # Surface 1 — upward attack
    H2S_SCRUBBER_PH            = auto()   # Surface 2 — downward attack
    CS2_VAPOR_CONCENTRATION    = auto()   # Surface 3 — upward attack

class AdversarialCS2ImageError(RuntimeError):
    def __init__(self, surface: CS2Context, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] CS2 adversarial pixel detected on {surface.value}: "
            f"score={score} ≥ threshold={CS2_GLYPHWARD_THRESHOLD} | frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_cs2_frame(
    frame_path: Path,
    surface: CS2Context,
) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()

    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={
                "context": surface.value,
                "threshold": CS2_GLYPHWARD_THRESHOLD,
            },
        )
        resp.raise_for_status()
        result = resp.json()

    if result["verdict"] != "clean":
        raise AdversarialCS2ImageError(surface, result["score"], frame_hash)

    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_cs2_process_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (CS2Context.SYNTHESIS_FURNACE_TEMP,  frame_dir / "furnace_outlet_temp.png"),
        (CS2Context.H2S_SCRUBBER_PH,         frame_dir / "h2s_scrubber_ph.png"),
        (CS2Context.CS2_VAPOR_CONCENTRATION, frame_dir / "cs2_vapor_header.png"),
    ]
    tasks = [verify_cs2_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

The coroutines run concurrently via asyncio.gather, adding less than 80 ms of latency across all three surfaces on typical plant historian polling cycles (15 s or faster). The SHA-256 frame hash is logged to the plant historian alongside the verdict, giving incident investigators a cryptographic audit trail for each frame that passed or failed verification.