Adversarial Injection · Industrial Water Treatment AI Monitoring · Attack #154

Chloroacetaldehyde (ClCH₂CHO, CAS 107-20-0) Biocide Cooling Tower Industrial Water Treatment — OSHA PEL 1 ppm Ceiling, ACGIH TLV-C 1 ppm, Flash Point 5°C, LEL 5.6 vol%, NIOSH IDLH 45 ppm: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Chloroacetaldehyde Biocide Legionella AI Attack

Chloroacetaldehyde (2-chloroacetaldehyde; monochloroacetaldehyde; ClCH₂CHO; CAS 107-20-0; MW 78.50 g/mol; BP 85.5°C; flash point 5°C; NFPA Class IB; GHS Category 2 flammable liquid; LEL 5.6 vol%; UEL 9.0 vol%; autoignition 220°C; density 1.19 g/mL; vapor pressure 100 mmHg at 25°C; OSHA PEL 1 ppm ceiling, 29 CFR 1910.1000 Table Z-1 — one of a small group of industrial chemicals regulated by a ceiling value rather than a TWA, reflecting high acute toxicity even at brief peak exposures; ACGIH TLV-C 1 ppm ceiling with skin notation — confirmed identical to OSHA PEL reflecting consistent acute toxicity assessment; NIOSH IDLH 45 ppm; CERCLA RQ 1,000 lbs; vapor density 2.71 — significantly heavier than air, accumulating at ground level in enclosed handling areas) is a reactive chlorinated aldehyde used industrially as a biocide in cooling tower water treatment, circulating water systems in oil refineries and chemical plants, and as a chemical intermediate in synthesis of 1,3-thiazole derivatives (pharmaceutical and agrochemical intermediates), aminoethanol surfactants, and tanning and leather-processing compounds. In cooling tower biocide applications, chloroacetaldehyde functions as a broad-spectrum algaecide and bactericide — effective against Pseudomonas, Legionella pneumophila, sulfate-reducing bacteria, and algal biofilm — at dosing concentrations of 0.5–5.0 mg/L in recirculating cooling water at the temperatures (25–45°C) that favor microbial proliferation. A single ±8 DN adversarial pixel perturbation on rendered process management AI display images can show the area chloroacetaldehyde atmospheric monitor at 0.09 ppm when the actual worker exposure is 4.8 ppm (4.8× OSHA PEL ceiling 1 ppm; 4.8× ACGIH TLV-C 1 ppm) — suppressing evacuation and ceiling-exceedance responses; can display the cooling tower biocide residual at 2.8 mg/L when the actual treated-water concentration is 0.03 mg/L — creating a 93× underdose scenario that allows Legionella pneumophila to proliferate unchecked in warm cooling water while the AI reports effective biocide treatment; or can conceal a LEL sensor reading of 1.9 vol% (34% LEL) as 0.08 vol% — masking a near-ignition atmosphere at flash point 5°C. Glyphward detects all three surfaces at threshold 36 before any image reaches a downstream cooling-tower management AI or SCADA system.

Chloroacetaldehyde occupies a specific niche in industrial water treatment chemistry as a fast-acting, broad-spectrum biocide with activity against biofilm-protected organisms at sub-ppm concentrations. Its mechanism differs from halogen-based biocides (chlorine, bromine): rather than oxidative membrane disruption, chloroacetaldehyde acts through alkylation of microbial enzyme active sites (particularly cysteine thiol groups in dehydrogenases and transport enzymes) and cross-linking of cellular proteins, resulting in rapid cell death at concentrations as low as 0.2 mg/L for planktonic Legionella pneumophila and 1.0–2.0 mg/L for biofilm-associated Legionella. This efficacy profile makes chloroacetaldehyde especially valuable at cooling towers where biofilm on fill media provides a protected niche for Legionella growth that evades oxidizing biocides at typical chlorination doses. Cooling towers operating at basin temperatures of 28–38°C — which include virtually all industrial cooling towers in temperate climates during summer operation — sit directly in the Legionella pneumophila optimal growth range (25–45°C, with peak growth at 37°C). CDC and ASHRAE 188-2018 (Legionellosis: Risk Management for Building Water Systems) specify that cooling towers with water temperatures in this range require validated biocide programs with documented minimum biocide residuals at representative monitoring points in the recirculating water system. The AI-monitored biocide residual analyzer is the primary validation instrument for compliance with ASHRAE 188 biocide program requirements — and it is precisely this instrument that the Surface 2 upward attack falsifies. The physical handling of chloroacetaldehyde at the dosing station — concentrated liquid received in 200 L drums or 1,000 L IBC totes, diluted to working strength in day tanks, and metered into the cooling tower basin through peristaltic or diaphragm dosing pumps — creates the worker exposure and fire hazard surfaces (Surface 1 and Surface 3) that the adversarial attack also exploits.

The OSHA ceiling PEL of 1 ppm for chloroacetaldehyde reflects the compound's high acute toxicity: chloroacetaldehyde is a potent lachrymator and upper respiratory irritant at sub-ppm concentrations, causing conjunctival irritation at 0.5 ppm and severe respiratory tract damage at 5–10 ppm acute exposure. At 45 ppm IDLH — the NIOSH determination of the concentration immediately dangerous to life or health — chloroacetaldehyde causes pulmonary edema, which can develop with a latency of 4–24 hours after exposure cessation, meaning that a worker who experiences acute exposure at 4.8 ppm and is not immediately incapacitated may develop delayed pulmonary edema 12–18 hours later if the exposure is not documented and the individual is not monitored. The ceiling designation (rather than TWA) reflects OSHA's judgment that even brief peak exposures above 1 ppm are unacceptable — not that prolonged average exposures below 1 ppm are safe — making the suppression of a 4.8 ppm ceiling reading by the Surface 1 downward attack particularly consequential, as it prevents the ceiling-exceedance response that the regulation specifically requires for instantaneous peak concentration enforcement. Glyphward threshold 36 for chloroacetaldehyde reflects: OSHA PEL ceiling 1 ppm (ceiling designation indicating intolerance for any brief exceedance); flash point 5°C (NFPA Class IB; zero safe-ambient buffer — any chloroacetaldehyde handling area is at or above its flash point at every normal working temperature); LEL 5.6 vol% with relatively narrow flammable range (5.6–9.0 vol%); and the novel dual-consequence attack profile where Surface 2 (biocide underdose) creates a Legionella health risk for building occupants entirely separate from the direct chemical exposure risks of Surfaces 1 and 3.

Why Chloroacetaldehyde Cooling Tower Biocide Operations Are Disproportionately Vulnerable to Pixel Manipulation

Chloroacetaldehyde cooling tower monitoring presents an adversarial attack profile with a structurally unusual feature: the three attack surfaces produce consequences for three distinct populations. Surface 1 (area atmospheric monitor) affects the dosing technicians directly handling the concentrated biocide chemical. Surface 2 (biocide residual analyzer) affects building occupants, downstream workers, and community members who breathe cooling tower drift aerosols — a population entirely separate from the chemical handlers. Surface 3 (LEL combustible gas sensor) affects the dosing equipment operator and any personnel near the pump room or storage area. A single adversarial actor who compromises all three display images simultaneously creates a compound risk event: chemical handlers are exposed at 4.8× the OSHA ceiling (Surface 1); Legionella incubates in the undertreated cooling tower for days to weeks before clinical cases appear (Surface 2, with a lag time of 2–14 days between exposure and Legionnaires' disease symptom onset); and the pump room accumulates a flammable atmosphere (Surface 3) during the same dosing shift. The temporal decoupling — Surface 1 and 3 effects manifest within hours, Surface 2 effects manifest over days to weeks — makes the Legionella consequence especially difficult to trace back to the biocide underdose AI monitoring failure that caused it.

Surface 1 — Area Atmospheric Chloroacetaldehyde Monitor (Downward Attack)

The area atmospheric chloroacetaldehyde monitor at the biocide handling and dosing station — a photoionization detector (PID) or electrochemical sensor calibrated for chloroacetaldehyde — is displayed on a 200 px vertical bar spanning 0 to 5 ppm, a range that covers the OSHA PEL ceiling (1 ppm at 40 px/ppm) and extends to concentrations approaching the lower end of significant acute toxicity. The pixel scale is 200 px ÷ 5 ppm = 40 px/ppm. At the actual chloroacetaldehyde concentration of 4.8 ppm — from a 200 L drum connection fitting at the biocide day tank that developed a slow vapor-phase leak from a cracked tri-clamp gasket during the morning dosing cycle, releasing chloroacetaldehyde vapor into the enclosed biocide preparation room with 0.8 m³/min ventilation insufficient to dilute 4.8 ppm of a MW 78.5 compound at the leak rate — the rendered pixel position is 4.8 × 40 = 192 px. However, on a 0–5 ppm bar with maximum 200 px, 192 px is near the top of the bar. The adversarial perturbation shifts this pixel cluster downward by 189.6 px to 2.4 px. The AI inference engine reads the concentration as 2.4 ÷ 40 = 0.06 ppm — approximately 0.09 ppm after display rounding — well below any alarm threshold configured for the chloroacetaldehyde area monitor (typical first alarm at 0.5 ppm; evacuation at 1 ppm ceiling). No ceiling alarm fires; no evacuation; no engineering control activation.

At 4.8 ppm chloroacetaldehyde, the OSHA PEL ceiling of 1 ppm is exceeded by 4.8-fold, and the ACGIH TLV-C of 1 ppm (with skin notation — indicating that dermal contact with liquid or vapor at concentrations yielding skin absorption adds a dermal dose pathway to the inhalation exposure, particularly relevant for concentrated biocide drum handling) is exceeded by the same margin. OSHA 29 CFR 1910.1000 requires that ceiling values be maintained at all times — not averaged over a shift — meaning that a 4.8 ppm reading at any moment during the dosing shift is an immediate regulatory exceedance requiring engineering controls (local exhaust ventilation, closed-system transfer, forced dilution ventilation) and full-face air-purifying respirator with organic-vapor cartridges. Chloroacetaldehyde's primary acute toxicity pathway at 4.8 ppm is upper respiratory tract irritation and conjunctival damage (lachrymation and conjunctival hyperemia at concentrations above 2 ppm in most industrial hygiene references), compounded by the skin notation — the compound penetrates intact skin at ambient vapor pressures sufficient to contribute a percutaneous dose estimated at 20–35% of the inhalation dose for a worker without nitrile-glove protection. The delayed pulmonary edema risk from chloroacetaldehyde — documented in high-level acute exposures but potentially present at lower concentrations with repeated exposure — is particularly consequential because the 4–24 hour latency means the affected worker may leave the facility feeling only mildly symptomatic (mild chest tightness, slight cough), with life-threatening pulmonary edema developing overnight. Without the OSHA ceiling-exceedance record that the Surface 1 attack suppresses, there is no trigger for the medical surveillance protocol (24-hour follow-up observation) that would detect this delayed consequence.

Surface 2 — Cooling Tower Biocide Residual Analyzer (Upward Attack)

The cooling tower biocide residual analyzer — an inline spectrophotometric analyzer or periodic-sampling colorimetric system measuring chloroacetaldehyde residual concentration in the recirculating cooling water — is displayed on a 200 px vertical bar spanning 0 to 10 mg/L. The pixel scale is 200 px ÷ 10 mg/L = 20 px per mg/L. At the actual chloroacetaldehyde residual in the cooling tower basin of 0.03 mg/L — the result of a dosing pump diaphragm fatigue failure that has reduced delivery from the target 0.6 mg/L to near-zero over the past 18 hours as the diaphragm check valve seal degraded, while the day-tank level indicator has been reading approximately correct (consuming chemical slowly through a bypass valve leak that did not reduce tank level proportionally) — the rendered pixel position is 0.03 × 20 = 0.6 px from the bottom. The adversarial perturbation shifts this pixel cluster upward by 55.4 px to 56.0 px. The AI cooling-tower management system reads the residual as 56.0 ÷ 20 = 2.8 mg/L — within the 2.0–4.0 mg/L target residual range specified in the facility's ASHRAE 188-2018 Water Management Plan (WMP) for the refinery cooling tower circuit. No supplemental dosing command is issued; no dosing pump maintenance flag is generated.

At the actual chloroacetaldehyde residual of 0.03 mg/L — 93× below the 2.8 mg/L reading the AI reports and 20× below the 0.6 mg/L target minimum effective concentration — the cooling tower basin at 33°C (within the 25–45°C Legionella optimal growth range, with peak proliferation at 37°C) is functionally unprotected against Legionella pneumophila. Legionella requires a validated minimum biocide residual to prevent biofilm colonization of cooling tower fill (PVC honeycomb media), basin walls, and heat exchanger surfaces. At 0.03 mg/L chloroacetaldehyde — approximately 6.7× below the minimum inhibitory concentration (MIC) for planktonic Legionella of ~0.2 mg/L and approximately 50–100× below the biofilm-penetrating concentration required for sessile Legionella in established biofilm — the cooling tower is in an essentially untreated state for Legionella control. Over the 18-hour period during which the dosing pump failure has been masked by the Surface 2 upward attack, Legionella pneumophila serogroup 1 (the most common Legionnaires' disease-causing serogroup; accounts for 70–80% of clinical cases) can double in population every 4–6 hours at 33°C — achieving a 3–8 generation increase (8× to 256× baseline count) over the 18-hour undetected underdose period. If baseline Legionella in the tower prior to the dosing failure was 10 CFU/mL (acceptable operating level; ASHRAE 188 requires corrective action above 1,000 CFU/mL and emergency response above 10,000 CFU/mL), the 18-hour undetected growth period can produce counts of 80–2,560 CFU/mL — well into the corrective-action and potentially emergency-response range. Cooling tower drift (unevaporated water droplets entrained in the exhaust airstream) carries Legionella from the basin into the surrounding air. CDC investigations of Legionnaires' disease outbreaks linked to cooling towers (Atlanta 2017: 22 cases; NYC South Bronx 2015: 133 cases, 16 deaths) have documented that a single cooling tower with inadequate biocide treatment can produce clinically significant Legionnaires' disease cases in persons with no direct access to the tower — exposure occurs through building HVAC systems, open windows, and outdoor proximity within 1–2 km of the tower. The Surface 2 upward attack on the biocide residual display enables this entire Legionella consequence cascade by suppressing the corrective-action trigger that would have been activated at the true 0.03 mg/L reading.

Surface 3 — Storage/Dosing Area LEL Combustible Gas Sensor (Downward Attack)

The combustible gas (LEL) sensor in the chloroacetaldehyde storage and biocide dosing pump room — a catalytic bead sensor calibrated for combustible vapor detection, with a 0–100% LEL display — is displayed on a 200 px vertical bar spanning 0 to 100% LEL (which for chloroacetaldehyde corresponds to 0–5.6 vol%). The pixel scale is 200 px ÷ 100% LEL = 2 px per % LEL. At the actual chloroacetaldehyde vapor concentration of 1.9 vol% — accumulating in the partially enclosed dosing pump room (3.2 m × 4.0 m × 2.8 m; 35.8 m³ volume; 0.3 m³/min passive ventilation through fixed louvers) from the same drum fitting leak that drives the Surface 1 exposure — the LEL percentage is 1.9 ÷ 5.6 × 100 = 33.9% LEL. The rendered pixel position on the LEL display is 33.9 × 2 = 67.8 px. The adversarial perturbation shifts this pixel cluster downward by 66.2 px to 1.6 px. The AI control system reads the LEL sensor as 1.6 ÷ 2 = 0.8% LEL — equivalent to 0.08 vol% chloroacetaldehyde — below the 10% LEL (0.56 vol%) first-stage alarm threshold that would trigger forced ventilation activation, ignition-source isolation, and evacuation of the dosing area. No LEL alarm fires.

At 34% LEL (1.9 vol% chloroacetaldehyde) in the dosing pump room, all three standard ignition-source categories present in an industrial pump room operate above the minimum ignition energy (MIE) threshold. Chloroacetaldehyde's MIE — not widely published in the literature, but estimated by structural analogy with acetaldehyde (0.37 mJ) and monochlorobenzene (0.7 mJ) at approximately 0.5–1.0 mJ — is within the range of energy delivered by: (1) a worn brush contact arc in the peristaltic dosing pump motor (~2–10 mJ per commutation event at full-load torque); (2) a solenoid valve de-energization spark in the biocide injection control circuit (~1–5 mJ); or (3) a static discharge from a non-bonded metal drum (~5–100 mJ depending on drum capacitance and charge accumulation rate during liquid transfer). The 10°C flash point of chloroacetaldehyde (NFPA Class IB; some sources report this as low as 4–5°C) provides zero safety margin at any ambient temperature in an enclosed pump room — the liquid biocide at any temperature above the flash point is generating vapor at or above its Lower Flammable Limit near the drum opening, and the 34% LEL atmosphere documented at 1.9 vol% would sustain a flash fire or deflagration if ignited. Chloroacetaldehyde's vapor density of 2.71 means that the accumulating vapor sinks to floor level and concentrates near below-grade pump foundations and sump drainage connections — locations where the dosing pump motors and control solenoids are typically installed. The Surface 3 downward attack suppresses the LEL sensor reading that would otherwise trigger both first-stage ventilation enhancement and ignition-source isolation — the two controls that prevent the transition from a flammable atmosphere to a flash fire during biocide dosing operations.

Integrating Glyphward into Cooling Tower Biocide AI Monitoring Pipelines

The following Python snippet shows how to authenticate chloroacetaldehyde biocide monitoring display images against the Glyphward API before passing readings to a cooling tower management AI that controls biocide dosing schedules, Legionella surveillance thresholds, and worker safety interlocks. A non-clean verdict raises a typed exception routed to: immediate manual biocide dosing verification, forced ventilation activation, and ASHRAE 188 backup sampling protocol before any AI-based treatment decision proceeds.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
CHLAC_GLYPHWARD_THRESHOLD = 36

class ChloroacetaldehydeContext(StrEnum):
    AREA_ATMOSPHERIC_MONITOR = auto()   # Surface 1 — downward
    BIOCIDE_RESIDUAL_ANALYZER = auto()  # Surface 2 — upward
    LEL_COMBUSTIBLE_GAS       = auto()  # Surface 3 — downward

class AdversarialChloroacetaldehydeImageError(RuntimeError):
    def __init__(self, surface: ChloroacetaldehydeContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] Chloroacetaldehyde adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={CHLAC_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_chlac_frame(frame_path: Path, surface: ChloroacetaldehydeContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": CHLAC_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialChloroacetaldehydeImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_biocide_monitoring_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (ChloroacetaldehydeContext.AREA_ATMOSPHERIC_MONITOR,  frame_dir / "area_monitor.png"),
        (ChloroacetaldehydeContext.BIOCIDE_RESIDUAL_ANALYZER, frame_dir / "biocide_residual.png"),
        (ChloroacetaldehydeContext.LEL_COMBUSTIBLE_GAS,       frame_dir / "lel_sensor.png"),
    ]
    tasks = [verify_chlac_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls execute concurrently, adding under 80 ms total latency per cooling tower monitoring cycle. Glyphward threshold 36 for chloroacetaldehyde reflects the compound hazard of: OSHA PEL ceiling 1 ppm (ceiling designation indicating that instantaneous exceedance — not just 8-hour average — is unacceptable, making any AI monitoring suppression of a ceiling exceedance a direct regulatory violation rather than a statistical risk); flash point 5°C (zero ambient safe margin; the compound is effectively always at or above flash point at any indoor temperature); and the novel Legionella pathway of Surface 2 (an AI monitoring failure that creates a public health consequence for building occupants and the community days to weeks after the monitoring event, entirely separate from the direct chemical hazard, and difficult to trace back to the biocide underdose root cause without complete water management plan documentation). SHA-256 frame hashes provide OSHA, ASHRAE 188, and facility WMP audit traceability for every cooling tower monitoring decision.