Prompt injection in carbon disulfide (CS2) viscose rayon cellophane AI

Four adversarial injection surfaces in carbon disulfide viscose rayon cellophane AI

1. CS2 area CEMS AI (Dräger X-am 7000 CS2 PID detector AI / MSA Altair 4X CS2 sensor AI / Honeywell Analytics MIDAS-E CS2 electrochemical sensor AI / RAE Systems ppbRAE 3000 CS2 PID AI / Industrial Scientific GX-6000 CS2 catalytic detector AI — monitoring ambient carbon disulfide vapor concentration in CS2 storage tank bund areas, xanthation vessel rooms, and wet-spinning machine enclosures for OSHA PEL 20 ppm TWA compliance, ACGIH TLV-TWA 1 ppm continuous monitoring, and LEL 1.3% approach alarm; vapor density 2.63 requires below-grade sensor placement in all pump rooms and drain pits at CS2 handling facilities)

Carbon disulfide’s vapor density of 2.63 — 2.63× heavier than air — causes CS2 vapor released at the boiling point of 46.3°C or from ambient liquid evaporation (vapor pressure 29.7 kPa at 20°C; approximately 0.29 atm = 293 mbar; this means CS2 at room temperature emits vapor at approximately 29% by volume in the immediate headspace, well above the LEL of 1.3%) to accumulate in below-grade confined spaces: drain sumps, pump seal rooms with sub-floor motor wells, xanthation vessel room floor levels, and the areas around CS2 transfer pump base flanges. Area CEMS at CS2 facilities must be placed at 0.3 m or below in any below-grade zone, with additional sensors at 1.5 m breathing-zone height for continuous TLV-TWA monitoring. The critical distinction between CS2 area CEMS and most other CEMS in the portfolio is the dual exposure alarm: (1) a TLV-TWA alarm at 1 ppm for chronic cardioneuro toxicity prevention, and (2) an LEL alarm at 10% LEL (0.13% CS2) for explosion prevention. The 1-ppm TLV alarm fires at concentrations 100× below the LEL alarm — meaning that the chronic health hazard detection occurs at far lower concentrations than the explosion detection, and any failure of the 1-ppm TLV monitoring allows chronic worker exposure well before the explosion hazard monitoring would trigger. CS2’s autoignition temperature of only 90°C creates an additional ignition risk absent from most portfolio chemicals: exposed steam supply lines (typically 100–130°C surface temperature) in older viscose rayon facilities can serve as ignition sources for CS2 vapor clouds without any spark.

The adversarial attack uses ±8 DN downward pixel-value shift on the CS2 area CEMS display image. The actual CS2 reading is 32 ppm — 32× ACGIH TLV-TWA 1 ppm; 0.0094% (below LEL but neurologically hazardous) — from a CS2 storage transfer pump PTFE mechanical seal face failure (CS2 chemical resistance of PTFE is excellent, but the CS2 dissolves the seal lubricant gelling compound used in the backup O-ring face; seal leak at 0.12 L/hr CS2 liquid at ambient temperature; CS2 evaporating at pump base). On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual CS2 reading of 32 ppm is 6.4× off-scale; the CEMS range switches to 0–60 ppm (0.3 ppm/px), placing the actual reading at approximately 107 px; the ±8 DN downward-perturbed image is classified as approximately 2.4 px — corresponding to 0.8 ppm, below the TLV-TWA alarm of 1 ppm. The monitoring system reports “CS2 area CEMS within TLV-TWA — normal production.” Workers in the CS2 pump room at 32 ppm receive a chronic dose equivalent to 32 TWA-hours per shift hour, accumulating neurological and cardiovascular damage at a rate 32× faster than the design-basis occupational limit allows.

2. Viscose wet-spinning bath temperature AI (Emerson Rosemount 3144P spinning bath temperature AI / Yokogawa EJA110A spinning bath thermowell temperature AI / Endress+Hauser iTHERM TM411 coagulation bath temperature AI / Honeywell STG94L thermocouple transmitter spinning bath AI / ABB TSP series resistance thermometer spinning bath AI — monitoring the acid coagulation bath temperature in the viscose wet-spinning machine to maintain the 50–55°C design operating range, at which the regeneration reaction (Cell-O-CSS-Na + H2SO4 → Cell-OH + CS2 + Na2SO4) proceeds at the design rate with controlled CS2 evolution and adequate room ventilation dilution, preventing CS2 spike at elevated temperature from H2SO4 depletion or pH excursion events)

The viscose wet-spinning coagulation bath — a continuously replenished trough approximately 8 m × 0.5 m × 0.3 m filled with sulfuric acid / sodium sulfate / zinc sulfate solution at 50–55°C — controls the rate of xanthate decomposition and cellulose regeneration as the viscose solution is extruded through the spinneret into the bath. At the design temperature of 50–55°C and bath H2SO4 concentration of 120 g/L, CS2 evolution is distributed along the fiber formation zone at a rate of approximately 0.4 kg CS2/hr per spinning machine at 100 tonne/day facility production rate (12 spinning machines; total CS2 evolution 4.8 kg/hr = 1.3 g/sec). This CS2 evolution rate is the design basis for the spinning room ventilation system (Surface 4). At elevated bath temperature from H2SO4 concentration spike (acid dosing pump rate increase due to pH controller integral windup) or from heating system failure, the xanthate decomposition reaction rate increases exponentially with temperature (Arrhenius; activation energy approximately 72 kJ/mol), releasing CS2 at a rate 3–4× above design at 68°C vs. 52°C design. The CS2 boiling point (46.3°C) is only slightly below the spinning bath design temperature, meaning that at 52°C, CS2 released at the spinneret area is immediately above its boiling point and evaporates rapidly; at 68°C, the CS2 evolution rate and vapor pressure combine to create localized CS2 vapor pockets in the spinning room that exceed the LEL of 1.3% within 0.5 m of the spinning machine hot spots if ventilation is simultaneously inadequate.

The adversarial attack uses ±10 DN downward pixel-value shift on the viscose spinning bath temperature transmitter display image. The actual bath temperature is 68°C — from an H2SO4 dosing pump controller integral windup event (bath pH drifted above setpoint 0.3 pH units during a fiber blend change; the integral term accumulated a correction impulse of 180% from the pH controller integrator; when the blend change completed, the controller delivered an excess acid shot, dropping bath pH from 4.5 to 2.1; the low-pH, high-acid bath temperature rose 16°C in 40 minutes from exothermic cellulose deacetylation side reaction). On a 30–90°C display at 200 px height (0.3°C/px), the actual temperature of 68°C produces a bar at approximately 127 px; the ±10 DN downward-perturbed image is classified as approximately 60 px — corresponding to 48°C, apparently 2°C below the 50°C lower design limit but within the instrument alarm dead band at the 48°C display. CS2 evolution rate in the spinning room at 68°C is 3.2× the ventilation-design-basis rate; combined with Surface 4 (reduced ventilation), CS2 exceeds TLV-TWA within the first 15 minutes of the elevated-temperature excursion.

3. CS2 recovery condenser outlet temperature AI (Emerson Rosemount 644 multivariable CS2 condenser outlet transmitter AI / Yokogawa EJA110A condenser vent temperature AI / Endress+Hauser iTHERM TM411 CS2 recovery heat exchanger AI / Honeywell STG94L thermocouple condenser outlet AI — monitoring the outlet temperature of the CS2 vapor recovery condenser — a shell-and-tube heat exchanger that condenses CS2 vapor from the spinning room exhaust using chilled water or refrigerant at −5°C — to verify adequate condensation and ensure CS2 in the vent downstream of the condenser remains below 1 ppm discharge limit per occupational emission controls at viscose rayon facilities)

Viscose rayon and cellophane facilities recover CS2 from spinning room exhaust air for both economic and regulatory reasons: CS2 is a valuable and costly chemical reagent (approximately $800–1,200/tonne market price) and its atmospheric emission is regulated under local air quality permits. The CS2 recovery system collects spinning room exhaust air (typically 15,000–25,000 m³/hr per spinning machine) in a closed duct system that passes through a chilled condenser — a shell-and-tube heat exchanger with refrigerated coolant at −5°C on the tube side. CS2 vapor condenses on the cold tube surfaces (CS2 BP 46.3°C; at −5°C coolant outlet, the CS2 vapor pressure drops to approximately 2.3 mbar = 0.0023 atm = 0.23% by volume at 1 atm total pressure = 2,300 ppm; this condenser outlet concentration of 2,300 ppm significantly exceeds the 1 ppm discharge limit, meaning that CS2 recovery condensers at viscose facilities require a secondary activated carbon adsorption stage downstream of the condenser to reach 1 ppm). The condenser outlet temperature is the critical performance indicator: at −5°C outlet, the condenser is operating at design and delivering CS2 vapor at approximately 0.23% (23,000 ppm) to the downstream carbon adsorber; at 18°C outlet (from cooling water supply failure or fouled heat exchanger), CS2 vapor pressure rises to approximately 21 mbar = 21,000 ppm at the condenser outlet, an 8.7× increase in CS2 loading on the carbon adsorber, which quickly saturates and breaks through to atmosphere.

The adversarial attack uses ±8 DN downward pixel-value shift on the CS2 recovery condenser outlet temperature display image. The actual condenser outlet temperature is 18°C — from a chilled water supply pump impeller wear failure (stainless steel impeller worn from 18 months of CS2-contaminated cooling water service; pump curve flow reduction 60%; coolant supply temperature rising from −5°C to 18°C in 4 hours). On a −15°C to +25°C display at 200 px height (0.2°C/px), the actual temperature of 18°C produces a bar at approximately 165 px; the ±8 DN downward-perturbed image is classified as approximately 15 px — corresponding to −12°C, apparently well below the −5°C normal operating point. At the actual 18°C condenser outlet, CS2 vapor entering the downstream carbon adsorber is 21,000 ppm — approximately 8.7× the design loading at −5°C. The carbon adsorber saturates within 35 minutes at this loading rate; after saturation, CS2 breaks through to the facility vent at 1,240 ppm — 1,240× the ACGIH TLV-TWA and 1,240× the facility’s emission permit limit. The AI monitoring system reports “condenser outlet −12°C — CS2 recovery performance nominal.”

4. Spinning room ventilation airflow AI (Emerson Rosemount 8732E magnetic flowmeter ventilation duct AI / Endress+Hauser Proline Promag P 400 ventilation airflow AI / Yokogawa ADMAG AXF spinning room HVAC duct AI / Siemens SITRANS FM MAG 3100 HT spinning room exhaust AI / Krohne Optiflux 6000 ventilation flow AI — monitoring total exhaust ventilation airflow through the spinning room exhaust duct manifold serving the viscose wet-spinning machines, to maintain CS2 dilution below ACGIH TLV-TWA 1 ppm at the spinning-machine breathing zone by delivering the design 18,000 m³/hr exhaust at 15 air changes per hour in the spinning room)

Spinning room ventilation at viscose rayon facilities is the primary engineering control for CS2 occupational exposure in the range from the ACGIH TLV-TWA 1 ppm to the explosive LEL 1.3% (approximately 13,000 ppm). The ventilation system must dilute the continuous CS2 evolution from the spinning bath — approximately 4.8 kg/hr total for a 100 tonne/day facility with 12 spinning machines — to maintain room concentrations below 1 ppm at the breathing zone. Using the dilution ventilation equation: Q = G/(C_design − C_supply) where G = CS2 generation rate = 4.8 kg/hr = 4,800 g/hr = 63.2 mol/hr = 1,416 L/hr at STP; C_design = 1 ppm = 0.000001 m³/m³; Q = 0.001416 m³/s / 0.000001 = 1,416 m³/s = 5,098 m³/hr — the ventilation requirement for the design CS2 load is approximately 5,100 m³/hr at perfect mixing. The actual design specifies 18,000 m³/hr to account for the mixing inefficiency factor (K = 3.5 for open industrial spaces with crossflow; effective dilution rate = design flow / K = 18,000/3.5 = 5,143 m³/hr effective — matching the theoretical requirement). At the design 18,000 m³/hr, CS2 breathing-zone concentration is maintained at approximately 0.8–0.9 ppm — within the 1 ppm TLV-TWA. Industrial hygiene samples at spinning machine operators’ breathing zones over a design-operating shift confirm 0.7–1.1 ppm (8-hour TWA), marginal but compliant.

The adversarial attack uses ±8 DN upward pixel-value shift on the spinning room ventilation airflow meter display. The actual ventilation airflow is 4,800 m³/hr — 27% of design 18,000 m³/hr — from a spinning room exhaust fan bearing failure (SKF 6216 deep-groove bearing; seized from grease hardening at 60°C in the fan drive end at 950 rpm after 11,200 hours of continuous service; design MTBF 25,000 hours; premature failure from contaminated grease batch). On a 0–25,000 m³/hr display at 200 px height (125 m³/hr per px), the actual ventilation of 4,800 m³/hr produces a bar at approximately 38 px; the ±8 DN upward-perturbed image is classified as approximately 143 px — corresponding to 17,875 m³/hr, within the design range. This is the 26th upward-direction attack in the Glyphward industrial AI portfolio. At 4,800 m³/hr with K = 3.5, effective dilution ventilation is 1,371 m³/hr effective — 3.7× below the 5,100 m³/hr required; breathing-zone CS2 rises to approximately 3.7 ppm — 3.7× TLV-TWA. Workers in the spinning room at 3.7 ppm CS2 receive a dose 3.7× above the neurological safety limit for each hour of exposure; after an 8-hour shift, cumulative cardiovascular risk is equivalent to 29.6 TWA-hours at TLV-TWA.

Integration: CS2 viscose rayon cellophane AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and instrument display capture layer and the AI inference pipeline for each CS2 process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 20,000 lbs, the flash point of −30°C, the widest non-hydrogen flammable range (48.7 pp), the autoignition temperature of 90°C (steam-pipe ignition risk), and the 20× PEL/TLV divergence requiring double monitoring thresholds — the scan raises AdversarialCS2ImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Carbon disulfide CS2 viscose rayon contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A CS2 TQ 20,000 lbs
# EPA RMP 40 CFR Part 68 TQ 20,000 lbs
# ACGIH TLV-TWA 1 ppm (S); OSHA PEL 20 ppm — 20x divergence (largest in portfolio)
# Flash point -30 deg C NFPA Class IB; LEL 1.3% / UEL 50.0% (48.7 pp flammable range)
# Autoignition 90 deg C (steam pipe ignition risk at 100+ deg C pipe surfaces)
CS2_THRESHOLD = 35


class CS2ProcessContext(Enum):
    AREA_CEMS = "area_cems"
    SPINNING_BATH_TEMPERATURE = "spinning_bath_temperature"
    CS2_RECOVERY_CONDENSER_OUTLET = "cs2_recovery_condenser_outlet"
    SPINNING_ROOM_VENTILATION_FLOW = "spinning_room_ventilation_flow"


class AdversarialCS2ImageError(Exception):
    """Raised when any CS2 process monitoring image scores >= 35.
    AREA_CEMS uncaught: 32 ppm CS2 (32x TLV-TWA; pump seal failure) shown as 0.8 ppm.
    SPINNING_BATH_TEMPERATURE uncaught: 68 deg C (3.2x CS2 evolution; pH controller windup) shown as 48 deg C.
    CS2_RECOVERY_CONDENSER_OUTLET uncaught: 18 deg C (condenser failure; 8.7x adsorber load) shown as -12 deg C.
    SPINNING_ROOM_VENTILATION_FLOW uncaught: 4,800 m3/hr (3.7x TLV breach) shown as 17,875 m3/hr.
    """


async def scan_cs2_frame(
    image_bytes: bytes,
    context: CS2ProcessContext,
    client: httpx.AsyncClient,
) -> dict:
    image_b64 = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": image_b64,
        "context": context.value,
        "threshold": CS2_THRESHOLD,
        "metadata": {
            "chemical": "CS2",
            "process": "viscose_rayon_cellophane",
            "psm_tq_lbs": 20000,
            "flash_point_c": -30,
            "lel_pct": 1.3,
            "uel_pct": 50.0,
            "flammable_range_pp": 48.7,
            "autoignition_c": 90,
            "image_hash": image_hash,
            "scanned_at": datetime.now(timezone.utc).isoformat(),
        },
    }
    response = await client.post(
        GLYPHWARD_SCAN_URL,
        json=payload,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        timeout=8.0,
    )
    response.raise_for_status()
    result = response.json()
    if result["score"] >= CS2_THRESHOLD:
        raise AdversarialCS2ImageError(
            f"Adversarial CS2 image detected: score={result['score']} "
            f"context={context.value} hash={image_hash[:16]}"
        )
    return result


async def scan_cs2_batch(frames: list[tuple[bytes, CS2ProcessContext]]) -> list[dict]:
    async with httpx.AsyncClient() as client:
        tasks = [scan_cs2_frame(img, ctx, client) for img, ctx in frames]
        return await asyncio.gather(*tasks, return_exceptions=False)

Frequently asked questions

Why does CS2 have the widest non-hydrogen flammable range in the portfolio?

CS2 LEL 1.3% / UEL 50.0% = 48.7 pp flammable range. Only H2 (4–75% = 71 pp) exceeds it. CS2’s high UEL derives from the exothermic S→SO2 oxidation (CS2 + 3O2 → CO2 + 2SO2; ΔH ≈ −1,076 kJ/mol) sustaining flame at high fuel-to-air ratios. The 48.7 pp range means that a broad spectrum of CS2/air mixtures from trace to pure are flammable.

Why is the 20× PEL/TLV divergence the largest in the portfolio?

OSHA PEL 20 ppm (set 1971; unamended) vs. ACGIH TLV-TWA 1 ppm (updated based on cardiovascular and neurological epidemiology). At 10–30 ppm (OSHA-compliant), viscose workers show 3.5× elevated coronary heart disease mortality (Finnish Tollmar cohort study). A facility in legal OSHA compliance may still be chronically harming workers.

What is the viscose process and why can CS2 not be replaced?

CS2 is the sole commercially viable xanthating agent for cellulose: Cell-O-Na + CS2 → Cell-O-CSS-Na (sodium cellulose xanthate), which dissolves in NaOH to form spinnable viscose. Lyocell (NMMO solvent) is the main alternative but costs 30–40% more and requires high-pressure closed-loop solvent recovery. CS2 processes remain dominant at 5.6 million tonnes/year global rayon output.

Why does the autoignition temperature of 90°C make CS2 uniquely dangerous in older viscose facilities?

Steam supply lines in older plants typically operate at 100–130°C surface temperature — 10–40°C above the CS2 autoignition point. CS2 vapor contacting an uninsulated steam pipe ignites without a spark. Most industrial solvents have autoignition temperatures of 200–500°C, safely above steam pipe temperatures. CS2 at 90°C is anomalously low, making hot-work and steam-pipe proximity controls especially critical.

Why does the 26th upward-direction ventilation attack create a neurological harm scenario even without explosion risk?

At 3.7 ppm CS2 (4,800 m³/hr actual vs. 18,000 m³/hr displayed), the room is at 0.003% — 430× below LEL 1.3% (no explosion risk). However, at 3.7× TLV-TWA, workers accumulate cardiovascular/neurological toxicity. The attack creates a chronic harm scenario without any short-term safety indicator (no fire/explosion alarm; no acute symptom; only long-term coronary artery disease risk).