Prompt injection in chlorine dioxide (ClO2) generation AI

Four adversarial injection surfaces in ClO2 generation AI

1. ClO2 generator reaction chamber temperature AI (Honeywell Experion PKS ClO2 generator temperature AI / Yokogawa OpreX water treatment ClO2 AI / Siemens Simatic PCS 7 ClO2 process AI — continuous temperature monitoring of the generator reaction column where NaClO3 + H2SO4 + H2O2 or equivalent precursor reactions produce aqueous ClO2 solution)

In the SVP-PURE and R8 commercial ClO2 generation processes — both widely used in kraft pulp bleaching and increasingly in municipal water treatment — chlorine dioxide is produced by the reaction of sodium chlorate (NaClO3) with a reducing acid (typically sulfuric acid or methanol with H2SO4) under carefully controlled temperature and acid concentration conditions. The reaction: 2NaClO3 + H2SO4 + H2O2 → 2ClO2 + O2 + Na2SO4 + 2H2O (SVP-PURE) proceeds at approximately 35–45°C in an evaporative crystallizer where sodium sulfate (salt cake) precipitates and ClO2 is stripped from solution into the gas phase by a combination of vacuum and heating. Generator temperature is the primary process variable controlling ClO2 production rate, yield selectivity, and thermal safety margin. Above approximately 45–50°C, the decomposition rate of dissolved ClO2 in the aqueous phase increases substantially, generating additional heat in a potentially self-amplifying cycle; above approximately 60°C, the equilibrium ClO2 vapor pressure in the generator headspace can exceed the safe concentration threshold for the inert gas dilution system, potentially reaching explosive concentrations. AI monitoring systems on Honeywell Experion PKS and Yokogawa OpreX platforms analyze generator temperature display trend images to classify whether the reaction chamber is within the normal 35–45°C operating window or approaching the thermal safety margin.

In the adversarial scenario, the generator reaction chamber temperature display reads 52°C — driven by a partial failure of the evaporator vacuum system that has reduced the latent-heat cooling available from solution evaporation, allowing the reaction exotherm to accumulate. At 52°C, the ClO2 decomposition rate in solution has increased to a level that generates a positive feedback: decomposing ClO2 releases heat that further raises temperature, increasing the decomposition rate further. A ±10 DN downward pixel-shift attack on the generator temperature trend display image fed to the temperature AI suppresses the displayed reading to 38°C — within the lower portion of the normal operating window — causing the AI to classify the generator as "within normal operating temperature — no alarm." The vacuum system continues without intervention; the actual generator temperature climbs from 52°C toward 60°C over the following 20–30 minutes; the ClO2 vapor concentration in the generator headspace increases; and if the inert gas (nitrogen) dilution system does not compensate — which it cannot, because it has not received an alarm trigger — the headspace ClO2 concentration approaches the 10% v/v detonation threshold.

2. Facility area ClO2 gas detector CEMS (Honeywell Analytics Midas ClO2 detector AI / Dräger Polytron 8900 ClO2 CEMS AI / Industrial Scientific MX6 iBrid ClO2 monitoring AI — area gas detection network covering the ClO2 generation room and adjacent utility spaces at water treatment and pulp bleaching facilities)

ClO2 generation rooms at water treatment plants and pulp mills are equipped with fixed-point electrochemical or photoionization ClO2 area gas detectors at multiple elevations and locations, continuously monitored by AI-integrated systems from Honeywell Analytics Midas and Dräger Polytron platforms. These detectors serve as the primary personnel protection system: any leak from the generator vessel, connecting piping, or product solution distribution system that produces ambient ClO2 concentrations above the ACGIH TLV-C of 0.1 ppm triggers an audible/visual alarm and initiates the emergency OSHA PSM response protocol for ClO2 release — area evacuation, process isolation, and emergency notification to the water utility emergency coordinator. The NIOSH IDLH of 5 ppm represents the concentration at which a 30-minute exposure may cause irreversible injury; at 4.2 ppm, unprotected workers are at 84% of IDLH — acute effects include severe eye and respiratory irritation, methemoglobin formation at sustained exposures, and pulmonary edema at high concentrations. Because ClO2 is significantly denser than air (molecular weight 67.5 g/mol vs. 28.97 g/mol for air), it tends to settle at floor level in enclosed generator rooms, creating pockets of elevated concentration that may be missed by high-mounted detectors but will be registered by the floor-level AI monitoring network.

The adversarial attack uses a ±8 DN downward pixel-shift on the area gas detector display readout image fed to the ambient monitoring AI. The actual sensor reading of 4.2 ppm — arising from a pinhole leak in a ClO2 solution distribution pipe fitting, slowly accumulating in the partially enclosed generator room over approximately 45 minutes — is suppressed to a displayed 0.06 ppm, below the ACGIH TLV-C 0.1 ppm and consistent with the normal background near-zero reading during routine operation. The AI ambient monitoring system returns "within normal background — no alarm," no evacuation is ordered, and the maintenance technician performing a routine valve check in the generator room is not warned of the 4.2 ppm ambient ClO2. At 4.2 ppm (42× the TLV-C and 84% of IDLH), the technician experiences immediate severe eye irritation and lacrimation, rhinorrhea, and the characteristic greenish tint visible in the air near the leak source — but the AI monitoring system shows no alarm, no area warning light has activated, and the technician must rely on personal sensory warning alone. The dense ClO2 cloud settling at floor level is not immediately visible and its characteristic sharp odor — described as resembling chlorine — may be mistaken for residual chlorine from the nearby liquid chlorine dosing system at the same facility, delaying recognition of the correct hazard.

3. Generator process solution pH AI (Yokogawa FLXA202 pH analyzer AI / Mettler Toledo M800 pH transmitter AI / Honeywell Experion PKS ClO2 process chemistry AI — continuous online pH monitoring of the ClO2 generator reaction solution to control acid concentration and yield efficiency)

The ClO2 generation reaction yield and selectivity depend critically on the acid concentration of the generator process solution. In acid-reduced processes (SVP-PURE, R8), the pH of the concentrated reaction solution is maintained between approximately 3.5–7.0 by controlling the relative feed rates of NaClO3 solution and H2SO4 feed. If the acid feed rate drops (H2SO4 pump failure, feed line blockage), the solution pH rises above the target range; at high pH, the chlorate-to-ClO2 conversion efficiency drops, unreacted NaClO3 accumulates in the generator solution, and the elevated chlorate inventory creates a secondary explosion hazard — because concentrated NaClO3 above approximately 40% by mass at elevated temperature is a recognized shock-sensitive oxidizer. Conversely, if the acid feed rate increases excessively (pH too low, below approximately 2.5), free chlorine (Cl2) byproduct formation increases, producing a mixed ClO2/Cl2 gas stream with different ACGIH and NIOSH limits than pure ClO2 and degrading the product solution quality for water disinfection applications. AI monitoring systems on Yokogawa FLXA202 and Mettler Toledo M800 pH transmitter platforms analyze pH display trend images to classify whether the generator chemistry is within the normal operating pH band.

The adversarial attack uses a ±8 DN downward pixel-shift on the pH display trend image — reducing the actual displayed pH of 9.4 to a displayed 6.8. At actual pH 9.4, the generator acid feed has failed (H2SO4 dosing pump seal leak has depleted the acid feed tank, cutting off H2SO4 supply), and the reaction solution pH has risen steadily over 3 hours toward the high-alkaline regime where ClO2 generation has essentially ceased and NaClO3 is accumulating. The displayed pH of 6.8 is within the normal operating range of 3.5–7.0, causing the AI chemistry monitor to classify the process solution as "within normal operating pH — ClO2 generation nominal." In reality, NaClO3 concentration in the generator has increased from its normal design level to approximately 55% by mass as acid supply has ceased and the recirculation pump continues to concentrate the solution. At 55% NaClO3 by mass, the solution is approaching the concentration range where shock sensitivity becomes significant; this condition — undisclosed by the pH falsification — means that any mechanical shock to the generator vessel (pump cavitation, sudden pressure change, or vibration from adjacent equipment) could initiate NaClO3 decomposition with explosive force. The combined effect of Surface 1 (elevated temperature suppressed) and Surface 3 (high-alkaline, high-chlorate chemistry suppressed) represents a generator that is simultaneously overheating and accumulating shock-sensitive oxidizer while the AI monitoring shows both parameters as normal.

4. Generator tail gas ClO2 CEMS (Thermo Fisher model ClO2 analyzer AI / Honeywell Analytics Midas tail gas monitoring AI / Dräger CMS chip measurement system ClO2 AI — continuous monitoring of the ClO2 generator vent/tail gas stream after the tail gas scrubber, before atmospheric discharge)

ClO2 generator systems produce a tail gas stream from the generator headspace that must be scrubbed before atmospheric release. The tail gas typically contains ClO2, O2, nitrogen (from inert dilution), and water vapor; the scrubber (typically packed with sodium bisulfite or sodium thiosulfate solution to reduce ClO2 to chloride) must maintain a post-scrubber ClO2 concentration below the ACGIH TLV-C of 0.1 ppm. AI monitoring systems analyze the tail gas CEMS readout from instruments positioned after the scrubber to verify that the scrubber is performing within its design efficiency and that the stack discharge meets the required emission limit. This tail gas CEMS also serves as a secondary generator health indicator: rising tail gas ClO2 concentration — even if still within the scrubber's reduction capacity — indicates that generator ClO2 production rate has increased (possibly from temperature excursion in Surface 1) or that the generator headspace ClO2 concentration is approaching the explosive range and generator isolation should be initiated.

The adversarial attack uses a ±10 DN downward pixel-shift on the tail gas CEMS trend display image to suppress an actual post-scrubber reading of 3.8 ppm — arising from scrubber sodium bisulfite depletion and simultaneous generator ClO2 generation rate increase from the Surface 1 temperature excursion — to a displayed 0.04 ppm, consistent with normal scrubber-outlet near-zero performance. At 3.8 ppm (76% of NIOSH IDLH), the tail gas discharge represents an acute hazard to any personnel downwind of the generator building roof discharge point, and the elevated reading is the secondary indication — after the area gas detector in Surface 2 — that the generator system has entered a runaway scenario. With both tail gas CEMS (Surface 4) and area detector (Surface 2) suppressed to below-TLV-C displayed values, neither the stack emission monitoring nor the area safety system provides a valid alarm. The generator temperature (Surface 1) and process chemistry pH (Surface 3) are simultaneously falsified. The complete four-surface compound attack achieves a situation where a ClO2 generation system approaching explosive-range headspace concentration, accumulating shock-sensitive chlorate, and discharging near-IDLH tail gas to the atmosphere is simultaneously presenting all four AI-monitored channels as within normal operating range. Glyphward pre-scans all four ClO2 generation monitoring contexts before AI inference output is logged — try the free scanner to test your pipeline's resilience to these attacks.

Integration: ClO2 generation AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the HMI screenshot capture layer and the AI inference pipeline at each ClO2 generation monitoring point. Each image is submitted to the Glyphward API before the ClO2 generation monitoring AI receives it; if the adversarial score meets or exceeds threshold 35 — chosen to reflect the OSHA PSM TQ of 1,000 lbs, the ACGIH TLV-C ceiling of 0.1 ppm, the NIOSH IDLH of 5 ppm, and the unique dual-hazard profile of ClO2 generation systems combining acute toxic release risk with explosive-range concentration risk in the same process unit — the scan raises AdversarialClO2GenerationImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# ClO2 generation AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A ClO2 TQ 1,000 lbs
# EPA RMP 40 CFR Part 68 Appendix A ClO2 TQ 1,000 lbs
# ACGIH TLV-C 0.1 ppm (ceiling, never to be exceeded)
# NIOSH IDLH 5 ppm
# OSHA PEL 0.1 ppm ceiling (29 CFR 1910.1000 Table Z-1)
# ClO2 detonation: >10% v/v in air; partial pressure >0.1 bar
# NaClO3 shock-sensitivity above ~40% by mass at elevated temperature
CLO2_THRESHOLD = 35


class ClO2GenerationContext(Enum):
    GENERATOR_TEMPERATURE = "generator_temperature"
    AREA_GAS_DETECTOR = "area_gas_detector"
    PROCESS_SOLUTION_PH = "process_solution_ph"
    TAIL_GAS_CEMS = "tail_gas_cems"


class AdversarialClO2GenerationImageError(Exception):
    """Raised when any ClO2 generation monitoring image scores >= 35.
    GENERATOR_TEMPERATURE uncaught: 52 C shown as 38 C -> decomposition/explosion.
    AREA_GAS_DETECTOR uncaught: 4.2 ppm (84% IDLH) shown as 0.06 ppm.
    PROCESS_SOLUTION_PH uncaught: pH 9.4 (acid depletion+NaClO3 accumulation) shown as 6.8.
    TAIL_GAS_CEMS uncaught: 3.8 ppm (76% IDLH) shown as 0.04 ppm."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial ClO2 generation image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_clo2_generation_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"clo2_generation:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= CLO2_THRESHOLD:
        raise AdversarialClO2GenerationImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("clo2_generator_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_clo2_generation_image(
            image_bytes,
            ClO2GenerationContext.GENERATOR_TEMPERATURE,
            unit_id="CLO2-GEN-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why must chlorine dioxide always be generated on-site?

ClO2 detonates above approximately 10% v/v in air (at atmospheric pressure) without ignition, making bulk transport impossible. Every commercial ClO2 application uses an on-site generator producing dilute ClO2 from precursor chemicals (sodium chlorate + acid, or sodium chlorite + acid/chlorine). On-site generation means the system is always in reactive mode: any control failure immediately affects generator headspace ClO2 concentration in real time, with no stable intermediate storage as a buffer.

What are the OSHA and EPA regulatory requirements for ClO2 at water treatment facilities?

OSHA PSM lists ClO2 at TQ 1,000 lbs (29 CFR 1910.119 Appendix A), requiring full PSM compliance including Process Hazard Analysis, Mechanical Integrity, and Emergency Planning. EPA RMP applies an identical 1,000 lb toxic TQ (40 CFR Part 68). The Safe Drinking Water Act sets a maximum residual disinfectant level of 0.8 mg/L ClO2 in drinking water and a chlorite MCL of 1.0 mg/L, creating the broader regulatory context for water utility ClO2 operations.

What are the health consequences of ClO2 exposure at near-IDLH concentrations?

At 4.2 ppm (84% of NIOSH IDLH 5 ppm), ClO2 causes severe lacrimation, rhinorrhea, pharyngeal and bronchial irritation, chest tightness, and possible methemoglobin formation. Unlike phosgene, ClO2's sharp chlorine-like odor is detectable at 0.5–1.0 ppm, but at 4.2 ppm the upper respiratory tract irritation can prevent orderly self-evacuation. The ACGIH TLV-C of 0.1 ppm — 42× below IDLH — reflects that any exceedance produces measurable acute pulmonary irritation.

How does chlorate accumulation in a ClO2 generator create a secondary explosion risk?

When acid feed fails and generator pH rises above the normal range, NaClO3 conversion to ClO2 is suppressed and chlorate accumulates in the evaporating generator solution. Concentrated NaClO3 above approximately 40% by mass at elevated temperature is shock-sensitive: mechanical shock (pump cavitation, pressure surge) can initiate NaClO3 decomposition (→ NaCl + O2) producing a deflagration capable of rupturing the generator vessel.

Why is threshold 35 for ClO2 generation AI monitoring?

Threshold 35 reflects the OSHA PSM TQ of 1,000 lbs, the ACGIH TLV-C ceiling of 0.1 ppm (zero tolerance for any exceedance), the NIOSH IDLH of 5 ppm, and the unique dual-hazard profile: ClO2 generation systems simultaneously risk acute toxic release (area CEMS) and explosive concentration (generator headspace). No other Glyphward process combines a TLV-C ceiling with detonation risk achievable by normal equipment malfunction, justifying the highest AI monitoring sensitivity.