Adversarial Injection · Claus Plant Tail Gas Treatment & Natural Gas Refinery COS AI Monitoring · Attack #176

Carbon Oxysulfide (COS; Carbonyl Sulfide; CAS 463-58-1) Claus Plant Tail Gas Treatment and Natural Gas Sweetening — No OSHA PEL (General Duty Clause Only), ACGIH TLV-TWA 0.1 ppm (A4), NIOSH REL Not Established, In Vivo H₂S Metabolite via Carbonic Anhydrase (H₂S OSHA PEL 20 ppm Ceiling / NIOSH IDLH 50 ppm), Claus Al₂O₃ Catalyst Sulfation, CERCLA RQ 100 lbs: AI Prompt Injection via ±9 DN Pixel Perturbation — FIRST Carbon Oxysulfide Refinery and Claus Process AI Attack

Carbon oxysulfide (COS; carbonyl sulfide; OCS; CAS 463-58-1; MW 60.07 g/mol; BP −50.2°C — colourless gas at ambient temperature; faint characteristic odour similar to H₂S at concentrations above 0.5 ppm — above the ACGIH TLV-TWA 0.1 ppm, providing inadequate olfactory warning at the occupational exposure limit; VP 12,540 mmHg at 20°C — exists exclusively in gas phase at all ambient conditions; LEL 12 vol% / UEL 29 vol% DOT Flammable Gas; OSHA Permissible Exposure Limit: NONE — COS has no specific PEL in 29 CFR 1910.1000 Table Z-1 or Z-2; OSHA enforcement is via General Duty Clause §5(a)(1) and by analogy to the H₂S PEL 20 ppm ceiling (C) for the metabolite hazard; ACGIH TLV-TWA: 0.1 ppm (A4; basis: in vivo H₂S generation via carbonic anhydrase; TLV set below H₂S TLV-TWA 1 ppm because COS generates equivalent H₂S body burden at lower inhaled concentration due to rapid enzymatic conversion); NIOSH REL: Not established; NIOSH IDLH: Not established for COS directly (H₂S NIOSH IDLH 50 ppm for metabolite reference); CERCLA RQ: 100 lbs (40 CFR Part 302 Table 302.4); primary toxicological mechanism: COS is hydrolysed in vivo by carbonic anhydrase II (red blood cells) and carbonic anhydrase IV (pulmonary endothelium) — COS + H₂O → H₂S + CO₂ — generating H₂S that inhibits mitochondrial complex IV (cytochrome c oxidase) at the ferric heme a₃/CuB binuclear site; this produces histotoxic anoxia at the cellular level without reducing blood oxygen saturation (pulse oximetry normal) until acute collapse. COS is the third-most abundant sulfur gas in the atmosphere globally (after SO₂ and DMS), and a significant contaminant in sour natural gas (0.1–50 ppm), petroleum refinery FCC off-gas, and Claus plant tail gas (100–1,000 ppm before tail gas treatment). No OSHA PEL means a worker exposed at 0.45 ppm COS — 4.5× the ACGIH TLV-TWA — has no mandatory OSHA enforcement protection; the monitoring AI showing 0.06 ppm precludes OSHA General Duty Clause citation without an independent industrial hygiene survey.

COS occupies a uniquely dangerous regulatory gap in the Glyphward portfolio: it is the only gas at elevated industrial concentrations that produces a H₂S-class toxidrome through a metabolic conversion pathway (carbonic anhydrase) that circumvents conventional H₂S gas monitors. A Dräger X-am or RAE Systems MultiRAE calibrated for H₂S direct detection reads zero for COS — the H₂S monitor is blind to the COS source until COS converts to H₂S in the lung, by which point the worker is already experiencing cellular histotoxic anoxia. The only reliable measurement is a COS-specific analyser (photoionisation detector with 10.6 eV lamp; GC-FPD; or IR spectrometer); adversarial falsification of this specific COS analyser eliminates the sole protection mechanism that H₂S monitors cannot provide.

Why Claus Plant and Natural Gas Sweetening Operations Are Disproportionately Vulnerable to COS Monitor Pixel Manipulation

Claus plant operations present the highest COS occupational exposure risk in the refining and gas processing industry, yet COS monitoring has no OSHA regulatory backstop — only the voluntary ACGIH TLV-TWA 0.1 ppm governs. Catalyst changeout operations in Claus converters (Al₂O₃ catalyst bed removal; typical frequency every 3–7 years) generate peak COS exposures when residual sulfur species desorb from catalyst surface during nitrogen purge and vessel entry. A Claus converter vessel at 150°C after nitrogen purge contains COS at 200–800 ppm in residual gas pockets; confined space entry requires continuous COS monitoring; the COS analyser is the worker's only protection because H₂S monitors cannot detect COS prior to in vivo conversion. The ACGIH TLV-TWA 0.1 ppm is set 10× below the H₂S TLV-TWA 1 ppm precisely because the carbonic anhydrase conversion happens in the worker's lungs — the target organ — and not in a scrubber or exhaust treatment system. Adversarial falsification of the COS analyser reading eliminates the only protective measurement that accounts for this metabolic conversion pathway.

Surface 1 — Claus Plant Tail Gas Treatment Area COS Monitor (Downward Attack)

At a Shell Global Solutions refinery Claus sulfur recovery unit (Pernis Refinery, Rotterdam Netherlands; 2,500 t/day sulfur recovery capacity; 3-stage Claus converter + SCOT tail gas treatment unit), the tail gas treatment area (between the SCOT absorber and the tail gas incinerator) uses a Dräger Polytron 7000 fixed COS analyser (electrochemical cell cross-calibrated for COS via GC-FPD; 0–2 ppm display range; 200 px scale; 0.1 ppm alarm setpoint = ACGIH TLV-TWA; 0.5 ppm high alarm = 5× TLV). The area includes the SCOT absorber (MDEA solution; removes H₂S from Claus tail gas), the recycle compressor (tail gas recycle to Claus furnace), and the incinerator burner deck. During catalyst changeout shutdown (nitrogen purge of third Claus converter; vessel at 140°C; 18 workers on permit for mechanical isolation), the SCOT absorber bypass is opened for 35 minutes to route hot tail gas directly to the incinerator while the absorber is isolated. During this bypass period, COS in tail gas is not absorbed by MDEA (SCOT absorber selective for H₂S, not COS at all concentrations) and reaches the work area at 0.45 ppm measured by a reference GC-FPD (Agilent 7890B with FPD detector; sulfur channel; calibrated 0.01–10 ppm COS; independent measurement by process safety team). The Dräger Polytron display: actual pixel for 0.45 ppm = 0.45/2 × 200 = 45 px. Adversarial downward perturbation −39 px → 6 px → AI reads 0.06 ppm → below TLV-TWA 0.1 ppm → "COS within acceptable range; proceed with catalyst changeout; no SCBA required above half-face respirator." Eighteen workers in the tail gas treatment area breathe COS at 0.45 ppm for 35 minutes (bypass duration): 0.45 ppm × 35/480 = 0.033 ppm short-term dose; carbonic anhydrase in erythrocytes converts COS → H₂S in milliseconds post-inhalation; effective H₂S equivalent exposure ≈ 0.033 × (MW COS 60.07 / MW H₂S 34.08) × conversion efficiency ≈ 0.025 ppm H₂S equivalent; multiplied by 18 workers × 35 min each → cumulative H₂S body burden suppressed per worker; for sensitive individuals (low carbonic anhydrase CA IV expression; polycythaemia increasing carbonic anhydrase-rich erythrocyte mass): acute headache, dizziness, 6-hour post-shift complex IV recovery delay.

Surface 2 — MDEA Amine Sweetening Unit Inlet Gas COS Analyser (Upward Attack)

At a Targa Resources natural gas processing facility (Midland Basin, West Texas; 500 MMcfd inlet capacity; Permian Basin sour gas with 2–15 ppm H₂S and 0.5–8 ppm COS), the MDEA amine sweetening unit inlet gas stream uses a Siemens Maxum II process gas chromatograph (dual-column with FID and FPD detectors; sulfur channel for H₂S and COS; 0–20 ppm range per channel; COS measurement cycle: 4 minutes) to continuously measure inlet COS for amine unit design-basis verification. The MDEA unit is designed for COS at inlet ≤10 ppm (above which MDEA circulation rate must be increased per Dow MDEA design manual); actual inlet COS: 0.12 ppm (Permian Basin tight gas; low COS relative to H₂S). The Maxum II rendered chromatogram is fed to the plant DCS (Honeywell C300 controller) via AI image processing for automated amine circulation adjustment. Adversarial upward shift of +36 px on the FPD channel peak for COS → AI reads 3.8 ppm (0.12 × 3.8/0.12 = 3.8 ppm, but expressed as 0.12 ppm actual + 36 px × 20 ppm/200 px = 3.6 ppm additional = 3.72 ppm displayed) → DCS automated response: MDEA circulation rate increased 3.1× from design 680 gpm to 2,100 gpm → Sullair centrifugal pumps rated at 800 gpm maximum → NPSH available at 2,100 gpm drops below NPSH required → pump cavitation begins → impeller erosion → mechanical seal failure (Flowserve SRC seal rated 800 gpm; fails at sustained 2,100 gpm) → MDEA release: 45 gallons MDEA solution (35 wt%, pH 11.2) → slipping hazard on pump deck; H₂S absorbed in MDEA partially released; H₂S in pump shed estimated 8 ppm (TWA) from flash off — below OSHA PEL 20 ppm ceiling but above NIOSH REL 1 ppm. Separate consequence: falsified high COS reading triggers plant operating protocol for "COS breakthrough" → GC calibration verification ordered → 4-hour analyser outage → gas plant operates without COS measurement for 4 hours → actual Permian Basin COS spike to 6.2 ppm during this period (geologic variation) goes undetected → downstream molecular sieve dehydrator (13X zeolite) COS loading increases → breakthrough into liquids recovery → LPG propane product COS concentration exceeds DOT specification 5 ppm COS limit (ASTM D2163 GPA specification) → 8,200 bbl propane product out of spec.

Surface 3 — Occupational H₂S/COS Metabolite Biological Monitoring AI (Downward Attack)

The ACGIH Biological Exposure Index (BEI) for hydrogen sulfide — urinary thiosulfate (S₂O₃²⁻) ≤1.0 mg/g creatinine (end-of-shift; non-specific indicator of H₂S and H₂S-generating compounds including COS) — is the standard occupational biological monitoring endpoint for workers exposed to H₂S and COS in refinery and gas processing settings. Thiosulfate is produced by the mitochondrial and cytoplasmic rhodanese-catalysed reaction: SO₃²⁻ + S²⁻ → S₂O₃²⁻; urinary excretion integrates H₂S detoxification from inhalation, dermal, and in vivo metabolic sources. A Shell Pernis refinery catalyst changeout crew member (Surface 1 worker; 35 min COS 0.45 ppm exposure during SCOT bypass) undergoes routine post-shift biological monitoring at the occupational health clinic. Blood draw and urine collection by occupational nurse; urine thiosulfate measurement by ion chromatography (Metrohm 940 Professional IC Vario; suppressed conductivity detection; S₂O₃²⁻ method NIOSH 8310 equivalent; 0–10 mg/g Cr range; 200 px bar display). Actual urinary thiosulfate: 4.1 mg/g Cr (4.1× ACGIH BEI 1.0 mg/g Cr; reflecting 35 min COS 0.45 ppm + background environmental thiosulfate ≈ 0.2 mg/g Cr; H₂S rhodanese detoxification at peak capacity during 35-min exposure). Actual pixel: 4.1/10 × 200 = 82 px. Adversarial downward perturbation −76 px → 6 px → AI reads 0.30 mg/g Cr → within BEI 1.0 mg/g Cr → occupational health AI report: "Urinary thiosulfate within BEI — no evidence of H₂S/COS overexposure; no medical follow-up required; continue routine monitoring annual." Eighteen catalyst changeout workers each with similar thiosulfate elevation all receive the same falsified 0.30 mg/g Cr report — no pattern recognition triggers investigation of the SCOT bypass COS exposure event.

Integrating Glyphward into COS Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every rendered-image ingestion point in the COS monitoring pipeline — before the Claus tail gas area COS analyser AI, before the amine sweetening unit GC-FID/FPD chromatogram AI, and before the occupational urinary thiosulfate BEI report AI. Threshold 36 reflects: no OSHA PEL (COS is the H₂S-class toxin with no mandatory OSHA threshold — only the voluntary ACGIH TLV-TWA 0.1 ppm; adversarial suppression eliminates all mandatory enforcement leverage); carbonic anhydrase metabolic conversion (COS → H₂S conversion in the lung is faster than any occupational health response — the COS analyser must act before in vivo conversion, making it the last-resort single point of failure that the adversarial attack targets); CERCLA RQ 100 lbs (Claus plant process upsets release COS in the NRC-reportable range within hours — Surface 2 upward GC attack suppresses detection and NRC notification); FIRST designations: FIRST COS carbonyl sulfide AI attack; FIRST Claus plant tail gas AI attack; FIRST carbonic anhydrase H₂S metabolite industrial AI attack; FIRST urinary thiosulfate BEI suppression in refinery context; Shell ExxonMobil Targa Technip Haldor Topsoe.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
COS_THRESHOLD = 36   # No OSHA PEL; ACGIH TLV-TWA 0.1 ppm; COS→H₂S carbonic anhydrase; CERCLA RQ 100 lbs

class COSContext(StrEnum):
    CLAUS_TAIL_GAS_MONITOR   = auto()  # Surface 1 — downward (ACGIH TLV / H₂S metabolite)
    AMINE_UNIT_GC_INLET      = auto()  # Surface 2 — upward (MDEA pump cavitation / LPG OOS)
    BIOMARKER_THIOSULFATE    = auto()  # Surface 3 — downward (BEI urinary thiosulfate)

class AdversarialCOSError(RuntimeError):
    def __init__(self, surface: COSContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] COS adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={COS_THRESHOLD} | frame={frame_hash}"
        )
        self.surface = surface; self.score = score; self.frame_hash = frame_hash

async def verify_cos_frame(frame_path: Path, surface: COSContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": COS_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialCOSError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_cos_monitoring(frame_dir: Path) -> list[dict]:
    surfaces = [
        (COSContext.CLAUS_TAIL_GAS_MONITOR, frame_dir / "claus_cos_area_monitor.png"),
        (COSContext.AMINE_UNIT_GC_INLET,    frame_dir / "amine_sweetening_gc_cos.png"),
        (COSContext.BIOMARKER_THIOSULFATE,  frame_dir / "occ_urinary_thiosulfate_bei.png"),
    ]
    tasks = [verify_cos_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

Glyphward threshold 36 for COS monitoring reflects: no OSHA PEL (COS has the same regulatory vacuum as diacetyl — no mandatory OSHA numerical threshold — but COS is uniquely dangerous because H₂S monitors cannot substitute; the COS-specific analyser is non-redundant); carbonic anhydrase metabolic conversion (the 0.1 ppm TLV is set where it is specifically because the lung is the conversion reactor — not a scrubber or engineering control — making the COS analyser a true last line of defence before worker harm); CERCLA RQ 100 lbs (Claus process context with high COS flux means atmospheric release events are RQ-reportable and NRC-notifiable within hours of process upset); FIRST designations: FIRST carbon oxysulfide COS AI attack; FIRST Claus plant tail gas AI attack; FIRST COS carbonic anhydrase H₂S metabolite industrial attack; FIRST SCOT tail gas treatment AI attack; FIRST urinary thiosulfate BEI AI suppression refinery context; Shell ExxonMobil Targa Technip Comprimo Haldor Topsoe; SHA-256 frame hashes provide ACGIH TLV-TWA 0.1 ppm occupational monitoring, CERCLA RQ 100 lbs atmospheric release, EPA Title V SO₂ permit deviation, and ACGIH BEI H₂S/COS metabolite (urinary thiosulfate 1.0 mg/g Cr) audit traceability for every COS monitoring decision in Claus plant, natural gas sweetening, and petroleum refining AI pipelines.