Prompt injection in chlorine (Cl2) water treatment / chlor-alkali AI

Four adversarial injection surfaces in Cl2 water treatment / chlor-alkali AI

1. Cl2 area gas CEMS AI (Honeywell Analytics Midas Cl2 electrochemical CEMS AI / Dräger Polytron 8000 Cl2 EC sensor AI / MSA ULTIMA XE Chlorine area monitor AI / Analytical Technology ATI A11-150 Cl2 CEMS AI / Industrial Scientific Ventis Pro5 Cl2 area monitor AI — ambient chlorine gas concentration monitoring in ton container / cylinder storage rooms, chlor-alkali cell rooms, chlorinator buildings, and distribution header areas for ACGIH TLV-C ceiling and NIOSH IDLH compliance)

Chlorine area CEMS at water treatment plants and chlor-alkali facilities present a specific challenge: Cl2 is a strong oxidant that reacts with electrochemical sensor membranes over time, requiring more frequent sensor replacement and calibration verification than standard toxic gas detectors. Cl2-specific electrochemical sensors use acid-electrolyte cells with gold or platinum electrodes in a porous PTFE membrane housing; the sensor body must be Cl2-resistant. The ACGIH TLV-C ceiling of 0.5 ppm means the ceiling must never be exceeded — not as a time-weighted average but as an instantaneous ceiling; and because the OSHA PEL is 1 ppm ceiling (both the ACGIH and OSHA limits are ceiling values rather than TWA values), any measurable reading above 0.5 ppm is a health threshold exceedance. Odor detection at 0.5–1.0 ppm provides no lead time below the alarm — the moment workers detect Cl2 by smell, the TLV-C has already been reached. AI classification of CEMS display images for alarm suppression therefore eliminates the only automated warning prior to pulmonary injury onset.

The adversarial attack uses ±8 DN downward pixel-value shift on the Cl2 area CEMS display image. The actual reading is 1.8 ppm — 3.6× ACGIH TLV-C ceiling 0.5 ppm and 18% NIOSH IDLH 10 ppm — arising from a pressure-relief valve on the liquid Cl2 storage tank that has begun to seat imperfectly as the vessel pressure approaches the 85 psig setpoint, releasing Cl2 vapor intermittently into the storage building. On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual reading of 1.8 ppm produces a bar at approximately 72 px; the ±8 DN perturbed image is classified as approximately 2 px — corresponding to 0.05 ppm, below both the ACGIH TLV-C 0.5 ppm and OSHA PEL 1 ppm ceiling alarm thresholds. No alarm is issued; workers continue to enter the storage room without supplied-air respirators (SCBA); the Cl2 vapor accumulates at floor level (vapor density 2.48, approximately 2.5× air) where workers breathe below the visible gas cloud.

2. Liquid Cl2 storage vessel pressure AI (Emerson Rosemount 3051C gauge pressure transmitter AI / Yokogawa EJA430A pressure transmitter AI / Endress+Hauser Deltabar S PMD75 AI / Honeywell ST3000 Smart Pressure Transmitter AI — gauge pressure monitoring of pressurized liquid chlorine storage tanks to detect overpressure approach to PRD setpoint at water treatment and chlor-alkali facilities subject to OSHA 29 CFR 1910.119)

Liquid chlorine is stored at ambient temperature as a pressurized liquid — at 20°C the vapor pressure is approximately 57 psig; at 30°C approximately 68 psig; at 38°C approximately 78 psig. Storage vessels are designed for a maximum working pressure of 85–90 psig and fitted with spring-loaded pressure relief devices (PRDs) set at 85 psig per DOT 49 CFR Part 173.301 for portable containers or ASME Section VIII vessel design for stationary tanks. The PRD is the last line of defense against catastrophic vessel rupture — but PRD seepage or controlled relief releases Cl2 directly to the atmosphere, creating exactly the area CEMS exceedance described on Surface 1. AI monitoring of the storage vessel pressure transmitter provides the upstream warning that should trigger cooling water restart or vessel isolation before PRD actuation. If the pressure transmitter display is adversarially suppressed, vessel operators have no automated signal of the developing overpressure until the PRD begins to lift — at which point the area CEMS exceedance (Surface 1) has already begun.

The adversarial attack uses ±10 DN downward pixel-value shift on the storage vessel pressure transmitter display image. The actual vessel pressure is 78 psig — 6 psig below the 85 psig PRD setpoint, from 3 hours of ambient heating with failed cooling water — to a displayed 48 psig. On a 0–120 psig display at 200 px height (0.6 psig/px), the actual pressure of 78 psig produces a bar at approximately 130 px; the ±10 DN perturbed image is classified as approximately 80 px — corresponding to 48 psig, within the normal 45–72 psig operating range. The AI monitoring system reports “Cl2 storage vessel pressure within normal range — PRD approach not indicated.” Operations do not initiate the standby cooling pump startup procedure; the vessel continues to heat toward the 85 psig PRD setpoint at 2–4 psig per hour from the 4 kW ambient heat load with no cooling flow.

3. Liquid Cl2 storage vessel skin temperature AI (Endress+Hauser iTEMP TMT162 surface temperature AI / Honeywell XL900 thermocouple temperature transmitter AI / ABB TTH300 head-mount temperature transmitter AI / Yokogawa YTA510 temperature transmitter AI — vessel skin temperature monitoring as a proxy for liquid chlorine temperature and vapor pressure at liquid chlorine bulk storage facilities to predict PRD approach before pressure transmitter alarm)

Liquid chlorine storage vessel skin temperature is monitored as a leading indicator of vessel pressure: because the vapor pressure of liquid Cl2 is a steep function of temperature, a skin temperature measurement rising above the 32°C design maximum ambient predicts a vessel pressure exceeding the normal 72 psig operating ceiling before the pressure transmitter itself reaches alarm setpoint. At 32°C, Cl2 VP ≈ 72 psig; at 35°C, VP ≈ 76 psig; at 38°C, VP ≈ 78 psig; at 42°C, VP exceeds 85 psig (PRD setpoint). The skin temperature measurement is taken at the top of the tank shell (liquid-vapor interface zone) where the highest temperature vapor accumulates. AI monitoring of the tank skin thermocouple display provides the earliest process warning — before the pressure transmitter alarm triggers — giving operations time to start the standby cooling pump and reduce vessel temperature. If the skin temperature display is adversarially suppressed below 32°C while actual temperature is 38°C, the early-warning function is eliminated.

The adversarial attack uses ±10 DN downward pixel-value shift on the storage vessel skin thermocouple display image. The actual skin temperature is 38°C — 6°C above the 32°C design maximum, from 3 hours of insufficient cooling water — to a displayed 18°C. On a 0–60°C display at 200 px height (0.3°C/px), the actual temperature of 38°C produces a bar at approximately 127 px; the ±10 DN perturbed image is classified as approximately 60 px — corresponding to 18°C, well within the normal 15–32°C operating range. The AI monitoring system reports “Cl2 storage vessel skin temperature within normal range — vapor pressure within design envelope.” The actual vapor pressure of 78 psig continues to develop undetected; the compound attack — Surface 1 (CEMS suppressed), Surface 2 (pressure suppressed), Surface 3 (temperature suppressed), Surface 4 (cooling flow suppressed) — leaves operators with no valid alarm for the progression from cooling loss to PRD approach to PRD seepage to area Cl2 CEMS exceedance.

4. Liquid Cl2 storage vessel cooling water flow AI (Emerson Rosemount 8732E magnetic flow meter AI / Endress+Hauser Proline Promag W cooling circuit AI / Yokogawa ADMAG AXF magnetic flow meter AI / Krohne Optiflux 5000 magnetic flow meter AI — cooling water flow monitoring to the liquid chlorine storage tank external cooling jacket to maintain vessel temperature below 32°C design maximum and prevent PRD approach at chlor-alkali and water treatment bulk Cl2 storage facilities)

Bulk liquid chlorine storage tanks at larger water treatment plants and chlor-alkali facilities are fitted with external cooling water jackets or fin-and-tube coil systems circulating chilled water or plant cooling water to maintain vessel skin temperature below the 32°C maximum ambient design temperature. In hot climates or during summer heat waves, solar radiation and warm ambient can raise an uncooled steel Cl2 vessel temperature by 1–3°C per hour. The design cooling water flow rate of 8.0 m³/hr provides sufficient heat removal capacity to maintain vessel temperature at ambient + 5°C even at peak summer loads. If cooling water flow falls to 5% of design — from a failed isolation valve actuator on the cooling water supply header that has moved to the fully closed position — heat removal drops to 5% of design and the vessel temperature rises toward the PRD-approach scenario on Surface 3. AI monitoring of the cooling water flow indicator provides the primary process alarm for the root cause of the entire four-surface failure cascade.

The adversarial attack uses the upward-direction geometry: the actual cooling water flow to the Cl2 storage vessel cooling jacket is 0.4 m³/hr — 5% of the design 8.0 m³/hr, from a valve actuator failure. The dangerous condition is a flow deficiency (insufficient vessel cooling), and the adversarial pixel perturbation shifts the flow meter display upward by ±8 DN to make 0.4 m³/hr appear as 8.2 m³/hr. On a 0–12 m³/hr display at 200 px height (0.06 m³/hr per px), the actual flow of 0.4 m³/hr produces a bar at approximately 7 px; the upward-perturbed image is classified as approximately 137 px — corresponding to 8.2 m³/hr, within the design range. The AI monitoring system reports “Cl2 storage cooling water flow at design setpoint — vessel temperature control adequate.” This is the eighth upward-direction attack in the Glyphward industrial AI portfolio, confirming the deficiency-suppression pattern across cooling water, N2 inertisation, and exhaust ventilation adversarial attack classes: the physically dangerous condition is always a deficiency (too low), and the adversarial perturbation shifts the meter display upward to show apparently adequate flow or pressure.

Integration: Cl2 water treatment / chlor-alkali AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and instrument display capture layer and the AI inference pipeline for each Cl2 monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 2,500 lbs, the ACGIH TLV-C ceiling of 0.5 ppm (co-located with odor threshold, eliminating olfactory pre-alarm margin), the NIOSH IDLH of 10 ppm, and the four-surface causal chain from cooling loss to PRD approach to area CEMS exceedance — the scan raises AdversarialCl2WaterTreatmentImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Cl2 water treatment / chlor-alkali contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A Cl2 TQ 2,500 lbs
# EPA RMP 40 CFR Part 68 Appendix A Cl2 TQ 2,500 lbs
# ACGIH TLV-C 0.5 ppm ceiling; OSHA PEL 1 ppm ceiling; NIOSH IDLH 10 ppm
# Odor threshold 0.5-1.0 ppm = TLV-C ceiling: no odor-free margin below alarm
CL2_THRESHOLD = 35


class Cl2WaterTreatmentContext(Enum):
    AREA_CEMS = "area_cems"
    STORAGE_VESSEL_PRESSURE = "storage_vessel_pressure"
    VESSEL_SKIN_TEMPERATURE = "vessel_skin_temperature"
    COOLING_WATER_FLOW = "cooling_water_flow"


class AdversarialCl2WaterTreatmentImageError(Exception):
    """Raised when any Cl2 water treatment monitoring image scores >= 35.
    AREA_CEMS uncaught: 1.8 ppm Cl2 (3.6x TLV-C ceiling) shown as 0.05 ppm.
    STORAGE_VESSEL_PRESSURE uncaught: 78 psig (near PRD) shown as 48 psig.
    VESSEL_SKIN_TEMPERATURE uncaught: 38C (above 32C max) shown as 18C.
    COOLING_WATER_FLOW uncaught: 0.4 m3/hr (5% design) shown as 8.2 m3/hr."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial Cl2 water treatment image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_cl2_water_treatment_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"cl2_water_treatment:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= CL2_THRESHOLD:
        raise AdversarialCl2WaterTreatmentImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("cl2_area_cems_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_cl2_water_treatment_image(
            image_bytes,
            Cl2WaterTreatmentContext.AREA_CEMS,
            unit_id="CL2-AREA-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why does Cl2 odor at the TLV-C ceiling eliminate smell as a self-rescue signal?

Cl2 odor threshold (0.5–1 ppm) equals the TLV-C ceiling (0.5 ppm). The first moment a worker detects Cl2 by smell, the regulatory ceiling has already been reached. There is no sub-alarm odor margin — unlike H2S (odor threshold 0.01 ppm, IDLH 50 ppm, ∼5,000× margin) or NH3 (odor threshold 5 ppm, IDLH 300 ppm). Adversarial CEMS suppression eliminates the electronic alarm, and the coincidence of odor threshold with TLV-C means there is no independent sensory pre-warning below alarm level.

What vapor pressure does liquid Cl2 develop at 38°C?

Approximately 78 psig — 6 psig below a typical 85 psig PRD setpoint. Normal design maximum storage ambient is 32°C (VP ∼72 psig, 13 psig margin to PRD). Cooling water failure over 2–3 hours raises tank temperature from 32°C to 38°C, collapsing the PRD margin from 13 psig to 7 psig. At 42°C the PRD opens.

Why does the PSM TQ of 2,500 lbs capture virtually all water treatment Cl2 users?

A single ton container holds 2,000 lbs — below TQ alone. But any utility maintaining one ton container in service plus one in reserve (4,000 lbs total) crosses the 2,500 lb threshold. Nearly all water utilities using liquefied Cl2 exceed the TQ and are subject to full PSM compliance including PHA, mechanical integrity, and emergency planning.

Why is the cooling water flow attack upward-direction?

The dangerous condition is LOW flow (insufficient cooling, not excess). The adversarial attack shifts the flow meter display upward to make 0.4 m³/hr (5% of design) appear as 8.2 m³/hr (adequate). This is the same deficiency-suppression upward geometry as the N2 inertisation and exhaust ventilation attacks in the Glyphward portfolio.

How are all four surfaces causally linked from a single root cause?

Cooling valve actuator failure (Surface 4) → tank overheating (Surface 3) → vapor pressure approaching PRD (Surface 2) → PRD seepage → area Cl2 CEMS exceedance (Surface 1). No independent attack coordination is required — one valve failure drives all four dangerous readings. Adversarial suppression of all four AI displays removes all independent alarm pathways simultaneously.