Prompt injection in chlor-alkali chlorine production AI

Four adversarial injection surfaces in chlor-alkali chlorine production AI

1. Membrane cell electrolyzer thermal camera AI (FLIR Systems electrolyzer AI, ABB thermal monitoring AI, Honeywell Experion PKS electrolyzer AI)

Ion-exchange membrane chlor-alkali electrolyzers consist of multiple electrode cell units (50–200 bipolar cell elements per electrolyzer unit) arranged in a filter-press configuration, with titanium-coated dimensionally stable anodes (DSA) in the anode compartment and nickel cathode screens in the cathode compartment, separated by Nafion or Flemion ion-exchange membranes (typically 0.2–0.3 mm thick). The electrolyzer operates at 80–90°C, 0.1–0.3 bar differential pressure between cathode and anode compartments, and DC current densities of 3–6 kA/m2. The membrane is the most critical component: it must maintain ionic conductivity for Na+ transport from anode to cathode while preventing chlorine gas crossover from anode to cathode compartment (which would contaminate the hydrogen product and create a Cl2/H2 explosive mixture) and preventing NaOH backflow from cathode to anode compartment (which would reduce current efficiency and damage the anode coating). Membrane degradation — caused by contamination of the brine feed (Ca2+, Mg2+, heavy metal ions that deposit in the membrane pores and reduce conductivity), mechanical damage (membrane puncture or delamination), or thermal stress (local overheating from current maldistribution) — causes progressive loss of membrane selectivity and eventual membrane perforation. A perforated membrane allows direct gas-phase communication between the anode compartment (containing 90–95% Cl2 gas) and the cathode compartment (containing 99%+ H2 gas), creating a Cl2/H2 mixture that is explosive at concentrations of 5–89% Cl2 in H2 (hydrogen chloride flame range) and detonable at concentrations of 25–80% Cl2 in H2 in the gas phase within the electrolyzer or gas header. Infrared thermal cameras monitor the electrolyzer surface temperature to detect developing hot spots: a membrane perforation in a cell element creates an exothermic reaction at the Cl2/H2 mixing point, which is detectable as a localised temperature elevation on the electrolyzer surface thermal image. AI processes rendered FLIR thermal camera images — false-colour temperature maps of the electrolyzer cell stack surface — to classify electrolyzer condition: normal (uniform surface temperature, no hot spots), warm spot (localised elevated temperature, investigation required), hot spot (significant temperature anomaly exceeding threshold, membrane perforation investigation and cell isolation required), and critical (hot spot at explosion risk level, immediate electrolyzer shutdown and gas system isolation required).

An adversarial perturbation on a rendered electrolyzer thermal camera image that suppresses a developing hot spot — applying a ±10 DN downward shift to the false-colour pixel values in the thermal map in the region encoding the cell element temperature anomaly (shifting the false-colour representation from the hot-spot range — typically rendered in red-orange for temperatures 5–15°C above the nominal 80–90°C electrolyzer surface temperature — to the normal operating range — rendered in yellow-green for the baseline surface temperature) — causes the electrolyzer thermal AI to classify a developing membrane perforation event as normal electrolyzer surface temperature, suppressing the membrane investigation and cell isolation that a hot spot classification would require. With the membrane perforation undetected, the Cl2/H2 mixing point continues to generate localised heat and to produce an expanding gas pocket of Cl2/H2 mixture within the affected cell element. The Cl2/H2 mixture can propagate through the gas header connections shared between cell elements — a common manifold design in modern bipolar electrolyzers — creating a distributed Cl2/H2 explosive mixture in the electrode gas header. Ignition can occur from electrical spark (the electrolyzer is energised at high DC current with multiple cells in series), from thermal ignition at the hot-spot location, or from static discharge during gas purge operations. The resulting Cl2/H2 detonation in the electrolyzer gas system generates both a pressure wave that can fragment the electrolyzer pressure vessel and releases chlorine gas from the ruptured anode compartment into the plant atmosphere.

2. Chlorine drying column sulfuric acid level camera AI (AMETEK SITRANS level AI, Endress+Hauser Gammapilot AI, Yokogawa drying tower AI)

Wet chlorine gas leaving the electrolyzer anode compartments (saturated with water vapour at 80–90°C, containing 0.2–0.4% chlorine water vapour in equilibrium) must be dried before compression, liquefaction, or further processing, because wet chlorine is extremely corrosive to most metals (forming HCl and HClO in the presence of water), will destroy compressor equipment, and creates disposal and safety challenges if present in liquefied chlorine product. Chlorine gas drying is performed by contacting the gas stream countercurrently with concentrated sulfuric acid (H2SO4, 98–96% wt concentration, fed from the top of the drying column) in a packed tower or tray column, which absorbs the water from the chlorine gas stream while the acid concentration dilutes from ~98% to ~78% (the spent acid is then concentrated in a vacuum evaporator and recycled). The sulfuric acid level in the drying column sump (the level of spent dilute acid collected at the bottom of the drying tower) must be maintained within a specified range: too low, and the acid distribution to the packing or trays may be impaired, reducing drying efficiency and allowing wet chlorine to pass into the compression system; too high, and the acid sump level approaches the gas inlet level, potentially blocking the gas flow or causing acid carryover into the chlorine gas outlet. Critically: if the drying column sulfuric acid level falls to zero (the acid supply pump fails or the acid inventory is depleted), undried wet chlorine gas bypasses the drying tower and enters the titanium or glass-lined chlorine compression system, where it causes rapid metal corrosion, compressor seal failure, and ultimately chlorine gas release at the compression discharge. AI systems process rendered level instrument images — digital level gauge renders, sight-glass camera images, or radar level transmitter output renders — to classify drying column acid level: normal (acid level within operating range, adequate drying coverage), low (acid level below minimum, acid supply investigation required), very low (acid level critically low, drying efficiency impaired, compression system isolation required), and zero (acid level at minimum, immediate chlorine gas bypass protection).

An adversarial perturbation on a rendered drying column acid level gauge or sight-glass camera image that artificially elevates the displayed acid level — applying a ±8 DN per-channel upward shift to the pixel region encoding the acid level indicator position or meniscus in the rendered sight-glass image (shifting the apparent acid level from the very-low or zero range — rendered as an empty sight-glass or a gauge needle in the red critical zone — to the normal operating range — rendered as an acid-filled sight-glass or gauge needle in the green operating band) — causes the drying column AI to classify a critically low or zero acid level as normal, suppressing the compression system isolation and acid supply investigation that a critically-low classification would require. Wet chlorine passing the failed drying column enters the titanium compression system: titanium piping and compressor casings are resistant to dry chlorine but corrode rapidly in the presence of moisture at elevated temperature (>150°C) generated by compression. A titanium fire — where titanium metal ignites in a chlorine-moist environment — can occur spontaneously at the compression discharge, releasing titanium chloride fumes and chlorine gas simultaneously and damaging compression equipment in a way that is very difficult to control. The combination of compression system damage and chlorine gas release creates the potential for a major uncontrolled chlorine release of the type documented in the DPC Industries Festus MO 2002 incident.

3. Chlorine liquefaction cold separator level AI (Yokogawa CENTUM VP liquefaction AI, Emerson DeltaV chlorine liquefaction AI, ABB 800xA liquefaction AI)

Liquefied chlorine (LCl2) for storage and transportation is produced in chlor-alkali plants by cooling compressed chlorine gas below its condensation temperature at the operating pressure (typically −30 to −45°C at 3–6 bar, or −15 to −25°C at 7–8 bar) using ammonia refrigeration or other indirect refrigerant systems. The chlorine liquefaction process involves: (1) chlorine gas compression to the liquefaction pressure; (2) cooling in a brine-cooled or refrigerant-cooled condenser-liquefier vessel; (3) collection of liquid chlorine in a cold separator vessel or receiver, where the liquid chlorine accumulates at the bottom and non-condensable gases (primarily nitrogen and oxygen) accumulate at the top and are periodically vented (“sniff gas” venting to scrubber). The cold separator liquid chlorine level is a critical operating parameter: if the level is too low, non-condensable gases may be entrained in the liquid chlorine withdrawal stream, causing gas-lock in the liquid product transfer pumps or creating pressure spikes in the liquid chlorine distribution system; if the level is too high, liquid chlorine may be carried over into the non-condensable gas vent line, allowing liquid chlorine droplets to enter the vent scrubber — if the scrubber is not designed for liquid chlorine entry, this can cause scrubber flooding and bypass of untreated chlorine gas to atmosphere. Separator level is monitored by differential pressure transmitters, cryogenic radar level instruments, or sight-glass level gauges on the cold separator vessel. AI systems process rendered level indicator images to classify cold separator status: normal (liquid chlorine level within operating range, balanced condensation and withdrawal), low (level below minimum, compressor rate reduction and withdrawal rate check), high (level above maximum, withdrawal rate increase required, vent scrubber monitoring), and critically high (level at overflow threshold, vent line isolation required to prevent liquid carryover).

An adversarial perturbation on a rendered cold separator level gauge or sight-glass camera image that suppresses a high-level condition — applying a ±10 DN downward shift to the pixel region encoding the liquid chlorine level indicator (rendering the level as in the normal or low range when actual level is in the high or critically-high range) — causes the liquefaction AI to classify a high-level or overflow condition as normal operating level, suppressing the withdrawal rate increase and vent scrubber protective isolation that a high-level classification would require. Liquid chlorine entering the vent gas scrubber through the non-condensable vent line creates a scrubber overflow condition where liquid chlorine exits the scrubber through its gas outlet: a typical sodium hydroxide vent scrubber is designed to neutralise gaseous chlorine (Cl2 + 2NaOH → NaCl + NaOCl + H2O) but cannot handle the surge of liquid chlorine without flooding, and liquid chlorine exiting through the scrubber gas outlet vents untreated chlorine gas directly to the atmosphere at the scrubber stack. At chlorine production rates of 50–500 tonnes per day, a cold separator overflow event can release hundreds of kilograms of chlorine gas in a short time — far exceeding the OSHA IDLH of 10 ppm at distances of hundreds of metres downwind of the release point. The Chlorine Institute’s Pamphlet 74 (Emergency Response Recommendations for Chlorine Facilities) identifies separator level control loss as a credible major release scenario, and EPA RMP worst-case release analysis for 1-ton chlorine release specifies a toxic endpoint distance of 1.3 miles — applicable to a community within that radius of the chlor-alkali plant.

4. Brine dechlorination residual chlorine analyser AI (Hach cl17 residual chlorine AI, YSI chlorine analyser AI, Nouryon brine purification AI)

The brine effluent from the chlor-alkali electrolyzer anode compartment — depleted brine (containing NaCl at 200–210 g/L, down from the 300 g/L feed brine) — contains dissolved chlorine gas (dissolved Cl2) and hypochlorite (OCl−) at concentrations of 2–8 g/L Cl2 equivalent from the anodic chlorination reaction. This depleted brine must be fully dechlorinated before it can be resaturated with fresh salt (in a brine resaturation dissolving pit) and recycled to the electrolyzer feed, because residual chlorine in the brine feed would damage the Nafion membrane — chlorine oxidises the carboxylic acid functional groups in the membrane sulfonate layer, causing irreversible loss of ion selectivity and current efficiency reduction. Brine dechlorination is performed in two stages: (1) vacuum dechlorination, in which the depleted brine is heated to 85–90°C and passed through a vacuum vessel where dissolved chlorine is stripped from solution and recycled to the chlorine gas header; (2) chemical dechlorination, in which sodium sulfite (Na2SO3) or hydrogen peroxide (H2O2) is added to the partially dechlorinated brine to chemically reduce any remaining dissolved chlorine (Cl2 + Na2SO3 → 2NaCl + SO3 or H2O2 + Cl2 → 2HCl + O2). Residual chlorine in the dechlorinated brine is measured by online amperometric chlorine analysers (Hach CL17, YSI 9300, Capital Controls Series 71) and must be below 0.5 mg/L Cl2 equivalent before the brine is returned to the resaturation circuit. AI systems process rendered analyser output images — digital reading displays or strip-chart trend renders showing residual Cl2 concentration against time — to classify brine quality: acceptable (residual Cl2 below 0.5 mg/L, brine cleared for recycle), elevated (residual Cl2 0.5–2.0 mg/L, additional dechlorination treatment required before recycle), high (residual Cl2 above 2.0 mg/L, brine hold required, dechlorination system investigation needed), and critically high (residual Cl2 above 5 mg/L, membrane damage risk if brine recycled, immediate process shutdown of affected brine circuit).

An adversarial perturbation on a rendered brine dechlorination residual chlorine analyser display or trend image that artificially reduces the displayed residual Cl2 concentration — applying a ±8 DN downward shift to the pixel region encoding the analyser digital reading or the trend trace height (reducing the apparent residual Cl2 from the elevated or high range — rendered as a numerical value above 0.5 mg/L on the digital display or a rising trace in the upper band of the trend chart — to the acceptable range — rendered as a value below 0.5 mg/L or a stable trace in the lower normal band) — causes the brine dechlorination AI to classify inadequately dechlorinated brine as acceptable for recycle, suppressing the additional dechlorination treatment and brine hold that elevated residual Cl2 requires. Brine with 2–5 mg/L residual Cl2 recycled to the electrolyzer feed causes progressive membrane degradation at a rate proportional to the chlorine exposure: even at 2 mg/L residual Cl2, membrane lifetime may be reduced from the design lifetime of 3–5 years to 1–2 years, with progressive loss of current efficiency and increasing membrane permeability to chlorine. At 5 mg/L residual Cl2, membrane damage is accelerated significantly, with possible perforation within weeks to months — the same perforation event that creates the Cl2/H2 mixing hazard in the electrolyzer described under the membrane thermal camera AI surface above. The brine dechlorination AI suppression scenario is therefore a multi-step attack path: suppressing the residual Cl2 AI classification allows contaminated brine to damage the membrane, creating the membrane perforation that makes the electrolyzer thermal camera AI suppression scenario consequential.

Integration: chlor-alkali chlorine production AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for chlor-alkali chlorine production AI belongs at every rendered-image ingestion boundary in the chlor-alkali monitoring pipeline — before membrane electrolyzer thermal AI processes rendered FLIR camera images, before chlorine drying column acid level AI processes rendered level instrument images, before chlorine liquefaction separator level AI processes rendered separator level images, and before brine dechlorination residual chlorine AI processes rendered analyser output images. Threshold 35 for chlor-alkali AI contexts reflects the OSHA PSM and EPA RMP consequence envelope of a major chlorine release — in which adversarial suppression of any one of these AI monitoring functions can allow a process upset to progress to a chlorine emission event at a facility producing 50–500 tonnes of chlorine per day, with toxic endpoint distances reaching miles downwind of the facility.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Chlor-alkali chlorine production AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 (chlorine TQ 1,500 lb);
# EPA RMP 40 CFR Part 68 (worst-case Cl2 endpoint 1.3 mi at 1 ton);
# Chlorine Institute Pamphlet 74 (emergency response recommendations);
# ANSI/CGA G-2 (chlorine, anhydrous).
CHLORALKALI_THRESHOLD = 35


class ChlorAlkaliAIContext(Enum):
    ELECTROLYZER_THERMAL    = "electrolyzer_thermal"    # Membrane cell thermal camera AI
    DRYING_ACID_LEVEL       = "drying_acid_level"       # Sulfuric acid level camera AI
    SEPARATOR_LEVEL         = "separator_level"         # Liquefaction separator level AI
    BRINE_DECHLORINATION    = "brine_dechlorination"    # Residual Cl2 analyser AI


class AdversarialChlorAlkaliImageError(Exception):
    """Raised when Glyphward detects adversarial content in a chlor-alkali
    chlorine production AI rendered image above threshold 35.

    Consequence if not raised:
    - ELECTROLYZER_THERMAL: membrane perforation hot spot not detected →
      Cl2/H2 mixing in electrolyzer gas header → detonation; Cl2 release
      from ruptured anode compartment into plant atmosphere.
    - DRYING_ACID_LEVEL: zero acid level not detected → wet Cl2 enters
      compression → titanium fire → Cl2 release at compressor.
    - SEPARATOR_LEVEL: high separator level not detected → liquid Cl2
      carryover to vent scrubber → scrubber overflow → Cl2 atmosphere
      release. EPA RMP worst-case: 1-ton Cl2, 1.3-mile toxic endpoint.
    - BRINE_DECHLORINATION: residual Cl2 in brine not detected →
      contaminated brine recycled to electrolyzer → membrane degradation
      → membrane perforation → ELECTROLYZER_THERMAL scenario above.
    Fail-safe: halt chlor-alkali AI classification; require manual
    instrument verification and OSHA PSM corrective action before
    resuming AI-driven chlor-alkali monitoring decisions.
    """

    def __init__(self, scan_id: str, score: int,
                 context: ChlorAlkaliAIContext,
                 plant_id: str, unit_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_id = plant_id
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial chlor-alkali image: "
            f"context={context.value} score={score} "
            f"plant={plant_id} unit={unit_id} scan_id={scan_id}"
        )


async def scan_chloralkali_image(
    image_bytes: bytes,
    context: ChlorAlkaliAIContext,
    plant_id: str,
    unit_id: str,
    cl2_production_rate_tpd: float | None,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a chlor-alkali production AI rendered image for adversarial content.

    Fail-safe contract: AdversarialChlorAlkaliImageError or httpx error →
    halt chlor-alkali AI classification for the affected unit; require manual
    instrument reading and OSHA PSM corrective action documentation. For
    ELECTROLYZER_THERMAL: isolate the affected electrolyzer gas system and
    require manual cell inspection before resuming electrolysis operation.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"chloralkali:{context.value}:{plant_id}:{unit_id}",
        "metadata": {
            "plant_id": plant_id,
            "unit_id": unit_id,
            "context": context.value,
            "cl2_production_rate_tpd": cl2_production_rate_tpd,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > CHLORALKALI_THRESHOLD:
        raise AdversarialChlorAlkaliImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_id=plant_id,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_chloralkali_image at each chlor-alkali monitoring AI rendered-image ingestion boundary: before membrane electrolyzer thermal AI (threshold 35), before drying column acid level AI (threshold 35), before liquefaction separator level AI (threshold 35), and before brine dechlorination residual chlorine AI (threshold 35). On AdversarialChlorAlkaliImageError for ELECTROLYZER_THERMAL context: immediately isolate the affected electrolyzer gas system and initiate cell inspection per Chlorine Institute Pamphlet 74 emergency procedures before resuming electrolysis. See also: ammonia refrigeration cold storage AI prompt injection (related toxic gas release AI monitoring context) and chemical plant process safety AI prompt injection (related OSHA PSM compliance gap context). Get early access

Related questions