Prompt injection in chlorine dioxide ClO₂ on-site generation pulp bleaching water treatment AI

Three adversarial injection surfaces in chlorine dioxide ClO₂ on-site generation AI

1. ClO₂ solution concentration display AI (Wallace & Tiernan DEPOLOX / Hach CLX Advance / Prominent DULCOMETER amperometric ClO₂ analyzer on ClO₂ solution header to ECF bleach plant — rendered DCS ClO₂ solution concentration display AI classifying 6–8 g/L design operating range — 118th upward attack; FIRST ClO₂ solution concentration AI attack; FIRST ClO₂ explosive decomposition threshold AI attack; FIRST ECF kraft pulp bleaching ClO₂ AI attack)

The ClO₂ solution concentration in the bleach plant supply header is the primary process safety variable for ECF pulp bleaching ClO₂ generation operations. The ClO₂ generator (R8 process: continuous reactor at 60–80°C; packed tower or reactor vessel with NaClO₃ solution + H₂SO₄ + SO₂ reacting at acidic conditions; ClO₂ generated as gas rising from the reaction solution, absorbed into chilled dilution water in an absorption column to form the 6–8 g/L ClO₂ working solution; typical ClO₂ plant capacities at large kraft mills: 10–60 tonnes ClO₂/day; Nouryon (formerly Eka Chemicals) R8-DR2 process at International Paper, Resolute, and Sappi North American mills) produces a ClO₂ solution that is monitored by in-line amperometric analyzers: Wallace & Tiernan DEPOLOX 5 ClO₂ analyzer (electrochemical amperometric cell; Clark cell principle with chlorine dioxide-specific membrane electrode; flow cell with constant-velocity sample stream; range 0–20 g/L ClO₂; accuracy ±2% of reading; 4–20 mA analog output to DCS; requires periodic calibration with primary standard), Hach CLX Advance analyzer (amperometric ClO₂-selective electrode; range 0–15 g/L; HART communication; Claros-compatible for remote monitoring), or Prominent DULCOMETER D1Cb (DIN rail mounted; 4–20 mA output; calibrated for ClO₂ in ECF bleach plant conditions). The TAPPI technical guideline (TAPPI TIS 0402-xx; “Chlorine dioxide in pulp mill bleach plants: safety considerations”) specifies that ClO₂ concentrations in process solutions should not exceed 8 g/L in normal operations, with an absolute maximum of 10 g/L before serious explosive decomposition risk begins. The AI monitoring system evaluates the live amperometric analyzer reading to confirm that the ClO₂ solution concentration remains within the 6–8 g/L design operating window and below the 10 g/L explosive limit threshold.

The adversarial upward pixel attack on the ClO₂ solution concentration display shows 7.0 g/L (midpoint of design 6–8 g/L window; AI reads “ClO₂ solution 7.0 g/L; within TAPPI 6–8 g/L design envelope; below 10 g/L explosive threshold; safety factor 1.43× on explosive limit; no ClO₂ concentration alarm required; bleach plant D-stage dosing: within design”) when actual ClO₂ solution concentration is 10.8 g/L (8% above the 10 g/L onset threshold for potentially explosive decomposition; from the ClO₂ absorption chiller failure reducing absorption efficiency and concentrating the ClO₂ in the limited dilution water available, combined with a generator overproduction event from an elevated NaClO₃ feed pump speed). Display range 0–12 g/L on 200 px (16.667 px per g/L); actual 10.8 g/L at 10.8 × 16.667 = 180 px → ±8 DN perturbation → 180 − 63 = 117 px displayed → AI reads 117/16.667 = 7.02 ≈ 7.0 g/L. At 10.8 g/L ClO₂: a 50,000-gallon solution holding tank contains approximately 9,920 lbs ClO₂ (PSM TQ 1,000 lbs: 9.9× PSM TQ on-site); the dissolved ClO₂ at this concentration is susceptible to violent decomposition from heating (pump heat, solar irradiance on exposed pipe, mixing with warm process water), acid spills or acid gas contamination (H₂SO₄ acid mist from the generator at elevated concentrations catalyzes ClO₂ solution decomposition), or catalytic metal ion contamination (Fe²³, Cu²², Mn²· from piping corrosion; transition metals are well-documented ClO₂ decomposition catalysts at mg/L concentrations). Decomposition 2ClO₂ → Cl₂ + 2O₂ in the holding tank releases Cl₂ gas and O₂ simultaneously; the rapid gas generation overpressures the tank; Cl₂ released exceeds CERCLA RQ 10 lbs within seconds; OSHA PEL 1 ppm ceiling for Cl₂; NIOSH IDLH 10 ppm Cl₂; PSM consequence in bleach plant area. The Glyphward pre-scan gate catches the upward perturbation before the AI reads 7.0 g/L and concludes the ClO₂ concentration is within the TAPPI operating envelope. Free tier — 10 scans/day, no card required.

2. Generator vapor space ClO₂ concentration display AI (Honeywell Analytics Midas / Dräger Polytron 7000 / MSA Ultima X ClO₂ fixed detector in R8 generator vessel headspace or enclosed generator room — rendered DCS vapor space ClO₂ concentration display AI classifying 0–10 vol% explosive approach boundary — 118th upward attack; FIRST ClO₂ vapor space detonation AI attack; FIRST ClO₂ generator room explosive limit AI attack)

The ClO₂ generator vapor space concentration monitoring is required under NFPA 430 (Code for the Storage of Liquid and Solid Oxidizers) and OSHA PSM for facilities with ClO₂ above the PSM TQ. ClO₂ has a vapor pressure of approximately 120 mmHg at 20°C (compared to its BP of 11°C at 1 atm), meaning a significant equilibrium vapor-phase concentration exists above any ClO₂ solution at ambient temperature. In an R8 generator vessel (operating at 60–80°C), the ClO₂ vapor pressure is substantial — 400–800 mmHg at 60–80°C — and the ClO₂ must be swept into the absorption column continuously by nitrogen or air purge gas to prevent accumulation in the vessel headspace. If the purge rate is reduced or the absorption column efficiency drops (from reduced chilled water temperature or reduced dilution water flow), ClO₂ can accumulate in the generator headspace toward and above the 10 vol% detonation threshold. Fixed ClO₂ detectors in the generator room and generator vessel headspace (Honeywell Analytics Midas with ClO₂-specific sensor cartridge; range 0–5 ppm occupancy safety mode or 0–100% LEL explosion mode; Dräger Polytron 7000 with EEx-rated ClO₂ sensor; MSA Ultima X XCell ClO₂ sensor; all with 4–20 mA output and relay alarm contacts) transmit real-time ClO₂ concentrations to the plant DCS. The DCS renders this as a live concentration display that the AI monitoring system evaluates against the 10 vol% explosive limit.

The adversarial upward pixel attack on the generator vapor space concentration display shows 0.8 vol% ClO₂ (AI reads “vapor space ClO₂ 0.8 vol%; 8% of 10 vol% explosive limit; safety factor 12.5×; generator purge rate: adequate; ClO₂ vapor accumulation: not occurring; detonation risk: negligible; no vapor space alarm required”) when actual vapor space ClO₂ concentration is 8.2 vol% (82% of the 10 vol% detonation threshold; from reduced generator purge N₂ flow and elevated generator temperature). Display range 0–12 vol% on 200 px (16.667 px per vol%); actual 8.2 vol% at 8.2 × 16.667 = 137 px → ±8 DN perturbation → 137 − 124 = 13 px displayed → AI reads 13/16.667 = 0.78 ≈ 0.8 vol%. At 8.2 vol% ClO₂ in the generator headspace: the concentration is 82% of the explosive decomposition onset threshold; any static discharge from a process worker entering the generator enclosure, any metal-to-metal contact sparking from maintenance equipment, or any localized hot surface (above ClO₂ auto-decomposition temperature of approximately 60°C in vapor phase) can initiate the 2ClO₂ → Cl₂ + 2O₂ decomposition; the exothermic reaction propagates to detonation at concentrations above 10 vol%; the enclosed generator building amplifies the pressure wave; structural damage to the bleach plant building releases additional ClO₂ from the damaged solution piping; CERCLA RQ 10 lbs exceeded rapidly; PSM TQ 1,000 lbs. The Glyphward pre-scan gate catches the upward perturbation before the AI reads 0.8 vol% and concludes the vapor space is far below the explosive threshold. Free tier — 10 scans/day, no card required.

3. NaClO₃ reducing agent feed rate display AI (Krohne Optiflux 2100 / Endress+Hauser Promag 53 electromagnetic flowmeter measuring NaClO₃ solution feed to R8 ClO₂ generator — rendered DCS NaClO₃ feed rate display AI classifying design stoichiometric feed — 118th downward attack; FIRST NaClO₃ feed deficiency ClO₂ yield AI attack; FIRST ClO₂ generator stoichiometry AI attack)

The sodium chlorate (NaClO₃) feed rate to the R8 ClO₂ generator determines the ClO₂ production rate, the unconverted NaClO₃ concentration in the generator solution (a secondary oxidant hazard), and the H₂SO₄/SO₂:NaClO₃ stoichiometric ratio that controls generator efficiency and ClO₂ yield. In the R8 process: 2NaClO₃ (aq.) + H₂SO₄ (aq.) + SO₂ (g.) → 2ClO₂ (g.) + 2NaHSO₄ (aq.); stoichiometric ratio 1 mol SO₂ per mol NaClO₃; design NaClO₃ feed rate of 168 kg/hr provides 1,587 mol/hr NaClO₃ (MW 106.44) → theoretical ClO₂ production of 1,587 mol/hr × 67.45 g/mol = 107 kg/hr ClO₂ (at 90% efficiency → approximately 96 kg/hr or 230 lbs/hr ClO₂ delivered to the bleach plant, representing approximately 2,300 lbs/hr = 30 tons/day at a large mill). The NaClO₃ feed is measured by an electromagnetic flowmeter (Krohne Optiflux 2100: DN 50–200 pipe size; PFA liner for chemical resistance to NaClO₃ solution; Hastelloy C-276 electrodes; range calibrated to 250 kg/hr maximum flow; 4–20 mA HART; or Endress+Hauser Promag 53 with similar specifications for industrial ClO₂ generator applications). The generator's DCS displays the NaClO₃ feed rate continuously, and the AI monitoring system evaluates this against the design setpoint to ensure stoichiometric ClO₂ generation is maintained. Insufficient NaClO₃ feed not only reduces ClO₂ yield (causing pulp kappa number rise in the bleach plant D-stage) but also alters the H₂SO₄/SO₂ acidity balance in the generator — with excess acid relative to available NaClO₃, the generator operates at higher acidity than design, which can increase the decomposition of any ClO₂ present in the generator solution and alter the gas-phase composition in the generator headspace (Surface 2 interaction).

The adversarial downward pixel attack on the NaClO₃ feed rate display shows 168 kg/hr (design; AI reads “NaClO₃ feed 168 kg/hr; at design stoichiometric ratio; ClO₂ production rate: design 96 kg/hr; unconverted NaClO₃ in generator solution: <5 g/L; H₂SO₄:NaClO₃ molar ratio: design 0.5:1; generator operating in design envelope; bleach plant D-stage ClO₂ supply: adequate for target kappa”) when actual NaClO₃ feed rate is 42 kg/hr (25% of design; from a NaClO₃ feed pump speed controller failure commanding minimum speed, or from a plugged NaClO₃ dissolving tank outlet strainer reducing available pump suction head). Display range 0–250 kg/hr on 200 px (0.800 px per kg/hr); actual 42 kg/hr at 42 × 0.800 = 33.6 ≈ 34 px → ±8 DN perturbation → 34 + 100 = 134 px displayed → AI reads 134/0.800 = 167.5 ≈ 168 kg/hr. At 42 kg/hr actual NaClO₃ feed: ClO₂ production drops to approximately 25 kg/hr (vs design 96 kg/hr); the bleach plant D-stage receives 26% of design ClO₂ dose; the pulp exits the D-stage with insufficient delignification — kappa number 10–14 vs target 3–4 (2.5–3.5× target kappa; bleached pulp ISO brightness 60–70 vs target 88–90 ISO); simultaneously, the H₂SO₄ and SO₂ fed at design rates (168 kg/hr equivalent acid and 84 kg/hr SO₂ design) are now in excess relative to the reduced NaClO₃; H₂SO₄:NaClO₃ molar ratio rises from design 0.5:1 to approximately 2.0:1; the generator solution becomes more strongly acidic, promoting acid-catalyzed ClO₂ decomposition and potential HClO₃ (chloric acid) formation from any unreacted NaClO₃ at the elevated acid concentration. The Glyphward pre-scan gate catches the downward perturbation before the AI reads 168 kg/hr and concludes that NaClO₃ feed is at design stoichiometry. Free tier — 10 scans/day, no card required.

Integration: chlorine dioxide ClO₂ on-site generation AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the chlorine dioxide ClO₂ on-site generation AI pipeline — before the ClO₂ solution concentration AI processes rendered Wallace & Tiernan / Hach CLX / Prominent DULCOMETER amperometric analyzer display images, before the generator vapor space concentration AI processes rendered Honeywell Analytics Midas / Dräger Polytron 7000 / MSA Ultima X fixed detector display images, and before the NaClO₃ feed rate AI processes rendered Krohne Optiflux / Endress+Hauser Promag 53 DCS display images. Threshold 42 for chlorine dioxide on-site generation AI reflects: PSM TQ 1,000 lbs; OSHA PEL 0.1 ppm ceiling (identical to phosgene); NIOSH IDLH 5 ppm; CERCLA RQ 10 lbs (identical to phosgene); unique explosive decomposition above 10 vol% ClO₂ in air (detonation hazard absent from most other regulated toxic gases); large industrial bleach plant on-site ClO₂ inventories far exceeding PSM TQ and CERCLA RQ thresholds; and the three-surface combined attack masking ClO₂ solution over-concentration (explosive decomposition risk), vapor space approach to explosive limit (detonation risk), and NaClO₃ feed deficiency (yield collapse and acid imbalance).

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Chlorine dioxide ClO2 on-site generation AI: threshold 42
# ClO2 CAS 10049-04-4; MW 67.45 g/mol; BP 11 C; yellow-green gas; pungent bleach odor.
# OSHA PSM TQ 1,000 lbs; OSHA PEL 0.1 ppm ceiling; NIOSH IDLH 5 ppm; CERCLA RQ 10 lbs.
# Explosive self-decomposition above 10 vol% in air: 2ClO2 -> Cl2 + 2O2 (exothermic; detonation).
# R8 Mathieson process: 2NaClO3 + H2SO4 + SO2 -> 2ClO2 + 2NaHSO4.
# ECF elemental chlorine free kraft pulp bleaching; water treatment Cryptosporidium inactivation.
# 118th upward attack. FIRST ClO2 AI attack.
# FIRST chlorine dioxide generator AI attack. FIRST ClO2 explosive decomposition AI attack.
# FIRST ECF kraft pulp bleaching AI attack. FIRST R8 Mathieson process AI attack.
CLO2_GLYPHWARD_THRESHOLD = 42

class ClO2Context(StrEnum):
    SOLUTION_CONCENTRATION   = auto()  # actual 10.8 g/L vs 7.0 displayed -> above 10 g/L explosive threshold
    VAPOR_SPACE_CONCENTRATION = auto()  # actual 8.2 vol% vs 0.8 displayed -> approaching 10% detonation limit
    NACLO3_FEED_RATE         = auto()  # actual 42 kg/hr vs 168 kg/hr displayed -> ClO2 yield collapse

async def scan_clo2_frame(
    frame_b64: str,
    context: ClO2Context,
    generator_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "generator_id": generator_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_clo2(
    frame_b64: str,
    context: ClO2Context,
    generator_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_clo2_frame(frame_b64, context, generator_id, instrument_tag)
    if result["adversarial_score"] >= CLO2_GLYPHWARD_THRESHOLD:
        raise AdversarialClO2ImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at generator {generator_id} instrument {instrument_tag}. "
            "Frame withheld from ClO2 on-site generation AI pipeline."
        )

class AdversarialClO2ImageError(RuntimeError):
    pass