Prompt injection in chlorosulfuric acid chlorosulfonic acid HCl SO₂ production AI

Three adversarial injection surfaces in chlorosulfuric acid HCl SO₂ production AI

1. HCl:SO„ feed ratio display AI (Emerson Daniel 3415 ultrasonic HCl feed flow display AI / Endress+Hauser Proline Promass 80F Coriolis HCl mass flow SCADA display AI / Yokogawa EJA530A SO„ feed differential pressure flow display AI / ABB RHM060 Coriolis SO„ mass flow SCADA display AI / Siemens Sitrans FC430 HCl:SO„ molar ratio SCADA display AI — rendered SCADA HCl:SO„ molar ratio display AI classifying the HCl:SO„ feed ratio against the design range of 1.00–1.05 mol/mol with low alarm at 0.95 mol/mol and high alarm at 1.10 mol/mol — 85th upward attack; FIRST chlorosulfuric acid attack; FIRST chlorosulfonic acid attack; FIRST ClSO₂H production AI attack; FIRST water-reactive oleum synthesis AI attack)

The ClSO₂H synthesis (SO„ + HCl → ClSO₂H) requires equimolar HCl and SO„ at the reaction column (design ratio 1.00–1.05 mol HCl per mol SO„; slight HCl excess ensures complete SO„ consumption in the packed column; any SO„ not reacted exits dissolved in the ClSO₂H product). HCl excess above 1.05 mol/mol: excess HCl dissolves in the ClSO₂H product as dissolved HCl (Henry’s law; HCl is highly soluble in ClSO₂H: approximately 2–5 wt% dissolved HCl possible at 1.10 mol/mol HCl:SO„); dissolved HCl in ClSO₂H evolves at elevated temperature (storage heating) or on dilution with water (where ClSO₂H + H₂O simultaneously hydrolyses; the dissolved HCl is liberated as additional HCl gas at the hydrolysis point). HCl excess creates product quality problems (customer specification typically <0.1 wt% dissolved HCl; excess HCl causes premature sulfonation reactions in LAB / pharmaceutical applications). SO„ excess below 0.95 mol/mol HCl:SO„: unreacted SO„ dissolves in ClSO₂H product; SO„ is miscible with ClSO₂H in all proportions (SO„ is highly polar; ClSO₂H is an excellent SO„ solvent; essentially oleum behaviour). At HCl:SO„ = 0.72 mol/mol (severe sub-stoichiometry from Surface 1 adversarial scenario), 28% of SO„ feed passes unreacted: at 3.9 t/hr SO„ feed × 0.28 = 1.09 t/hr free SO„ in product. ClSO₂H product rate: 50,000 t/yr / 8,760 hr = 5.71 t/hr ClSO₂H product; SO„ content of product: 1.09/(5.71 + 1.09) = 16 wt% free SO„ in ClSO₂H product. This product, when contacted with atmospheric moisture during transfer from a railcar or ISO-tank to a customer’s reactor vessel (typical transfer operation: open-top funnel or flexible hose; ambient humidity; operator present at 1–2 m from transfer point): SO„ at 16 wt% in ClSO₂H (vapor pressure SO„ above the mixture at 20°C ≈ 40–80 mmHg; partial pressure in equilibrium headspace above product ≈ 80–160 mmHg; approximately 10–20 vol% SO„ in headspace above 16 wt% SO„-in-ClSO₂H solution) — at 10 vol% SO₂ in headspace, any opening of the transfer valve releases a SO„-saturated vapour stream into atmosphere; SO₂ IDLH 20 ppm; SO„ at 20 vol% in headspace = 200,000 ppm; even 0.01% dilution into ambient air = 20 ppm — IDLH immediately at the transfer vent. Simultaneously, ClSO₂H + atmospheric moisture → HCl evolution at the liquid surface (HCl IDLH 50 ppm; TLV-C 2 ppm).

The adversarial upward pixel attack shifts the HCl:SO„ feed ratio display from 0.72 mol/mol (actual; severely sub-stoichiometric; SO„ significantly in excess of HCl; free SO„ is accumulating in the ClSO₂H product; this should trigger immediate HCl increase and product quality hold) to 1.42 mol/mol (displayed; well above design; above the 1.10 mol/mol high alarm; AI classification “HCl feed critically above stoichiometry (1.42 vs 1.05 design); excess dissolved HCl in ClSO₂H product will cause premature sulfonation in customer reactors; immediately reduce HCl injection by 35% to bring ratio to 1.05 mol/mol”). The DCS response: HCl feed control valve closes from 78% to 51% open, reducing actual HCl:SO„ from 0.72 mol/mol to 0.48 mol/mol. At 0.48 mol/mol HCl:SO„: free SO„ in product = 52% of SO„ feed = 2.03 t/hr; product ClSO₂H + SO„ mixture = (5.71 + 2.03) = 7.74 t/hr; SO„ content of product = 2.03/7.74 = 26 wt% SO„ in ClSO₂H — approaching the composition of 25% oleum (fuming sulfuric acid 25 wt% free SO„) but with the added water-reactivity of ClSO₂H. This is the 85th upward attack — FIRST chlorosulfuric acid attack; FIRST chlorosulfonic acid attack; FIRST ClSO₂H production AI attack; FIRST water-reactive oleum synthesis AI attack. The 26 wt% free SO„ in the ClSO₂H product at OSHA PSM SO„ TQ 1,000 lbs (454 kg): a 5-tonne ISO-tank of 26 wt% SO„ ClSO₂H = 5,000 × 0.26 = 1,300 kg free SO„ = 2,866 lbs SO₂ — approximately 2.9× the OSHA PSM TQ for SO„ in a single customer delivery container, shipped with a ClSO₂H UN 1754 placard that does not reflect the 26 wt% SO„ free content (the UN 1754 placard covers ClSO₂H; the SO„ content is not independently placarded because it is dissolved in the ClSO₂H liquid, not as a separate phase). Free tier — 10 scans/day, no card required.

2. ClSO₂H product free SO„ content display AI (Raman spectrometer inline SO„ content in ClSO₂H SCADA display AI / Fourier-transform infrared FTIR inline ClSO₂H SO„ content display AI / Karl Fischer indirect water titration ClSO₂H SO„ indicator display AI / Yokogawa inline Raman ClSO₂H composition display AI / ABB ReactIR SO„ content in ClSO₂H inline SCADA display AI — rendered SCADA ClSO₂H product free SO„ wt% display AI classifying the product free SO„ content against the specification <0.5 wt% free SO„ with high alarm at 0.8 wt% free SO„ and product hold/reprocessing trigger at 1.0 wt%)

The free SO„ content of ClSO₂H product is the primary product quality and safety specification: it is measured inline by Raman spectroscopy (SO„ characteristic Raman shift at 1,069 cm⁻¹ symmetric S=O stretch; ClSO₂H S=O stretch at 1,198 cm⁻¹ and 1,412 cm⁻¹; the ratio of the 1,069 cm⁻¹ peak (SO„) to the 1,198 cm⁻¹ peak (ClSO₂H) provides quantitative free SO„ content with ±0.05 wt% accuracy). At <0.5 wt% free SO„, the product is within specification; at 0.5–1.0 wt%, the product requires a quality hold and HCl ratio adjustment (minor SO„ excess; recoverable within 30–60 min of HCl ratio increase); above 1.0 wt%, the product requires reprocessing (recycling back to the synthesis column with additional HCl injection) or disposal. The product free SO„ display AI reads the rendered Raman spectroscope SCADA display image and classifies the free SO„ content against specification. If the Raman display AI reads 4.2 wt% free SO„ (actual; severely out of specification; consequence of the Surface 1 HCl sub-stoichiometry scenario) as 0.08 wt% (displayed; well within specification; AI classification “free SO„ at 0.08 wt%; within specification <0.5 wt%; product quality acceptable; release for shipping”), the product quality hold is not triggered; the product is approved for shipment. A 5-tonne ISO-tank of ClSO₂H with 4.2 wt% free SO„ (210 kg SO„ = 463 lbs SO₂ — below the OSHA PSM TQ 1,000 lbs individually, but in a 100-tank shipment to a surfactant plant: 21,000 kg SO„ = 46,300 lbs SO„ at the customer’s site in the aggregate) is shipped with an erroneous certificate of analysis showing 0.08 wt% SO₂. The SO„-contaminated ClSO₂H reaching the customer surfactant plant causes: (a) premature foaming and aerosol generation when the ClSO₂H is metered into the LAB sulfonation reactor (SO₂ reacts faster with water in LAB reactor feed than ClSO₂H reacts with LAB aromatic ring — SO₂ generates H₂SO₄ in the reactor water phase first, before sulfonation occurs; H₂SO₄ in the LAB/ClSO₂H reactor causes LAS product acidification and yield loss); (b) vent system upset: SO„ evolved from the contaminated ClSO₂H in the sulfonation reactor overhead vent (SO„ vapor pressure in reactor headspace ≈ 100–200 mmHg from 4 wt% SO„-ClSO₂H at 40°C) triggers the sulfonation plant HCl scrubber (designed to handle HCl from ClSO₂H hydrolysis) with unexpected SO„ load — SO„ is not absorbed by the standard NaOH scrubber as effectively as HCl (SO₂ hydration to H₂SO₂·H₂O is slower than HCl dissolution); SO„ slip in the NaOH scrubber overhead may approach the SO„ IDLH 20 ppm in the scrubber vent.

The adversarial upward pixel attack shifts the product free SO„ display from 4.2 wt% (actual; out-of-specification; product should be on quality hold pending HCl ratio correction and product reprocessing; product is severely SO„-contaminated from the Surface 1 HCl sub-stoichiometry scenario) to 0.08 wt% (displayed; well within specification; AI classification “product free SO„ content 0.08 wt%; within specification limit 0.5 wt%; release for shipment”). The product hold is not triggered; quality hold valve opens (or was never closed, since the AI classified product as within-spec throughout the sub-stoichiometric HCl period). The primary safety consequence: SO₂-contaminated ClSO₂H is shipped in ISO-tanks without any hazard communication revision (the bill of lading, safety data sheet, and certificate of analysis all show 0.08 wt% SO„; the actual 4.2 wt% SO„ is not reflected in any shipping document); the UN 1754 emergency response information covers ClSO₂H but does not specifically address the SO„ co-contaminant release pattern from SO„-heavy ClSO₂H; first responders at a customer spill using ERG Guide 137 (corrosive liquids) would be unprepared for the dense SO„ aerosol component (SO₂ fume on atmospheric moisture: IDLH 20 ppm; sulfuric acid aerosol TLV-TWA 0.2 mg/m³; dense white fog at distances up to 200–500 m downwind from a 5-tonne ISO-tank rupture at ground level in calm conditions). Free tier — 10 scans/day, no card required.

3. ClSO₂H storage tank temperature display AI (Pt100 RTD ClSO₂H storage tank electric heat trace temperature SCADA display AI / Yokogawa EJA110A ClSO₂H storage tank bulk temperature display AI / Emerson Rosemount 3051 ClSO₂H storage temperature display AI / ABB TTF300 ClSO₂H storage heat-trace thermocouple SCADA display AI / Honeywell STT170 ClSO₂H storage tank temperature display AI — rendered SCADA ClSO₂H storage tank electric heat trace temperature display AI classifying the bulk ClSO₂H storage temperature against the design range of 25–50°C with low alarm at 20°C “heat trace failure” and high alarm at 65°C)

ClSO₂H storage requires electric heat tracing or steam tracing because ClSO₂H freezes at −80°C — below any realistic ambient temperature — and the viscosity increases dramatically below 10°C (viscosity at 25°C ≈ 3.0 mPa·s; at 5°C ≈ 8–10 mPa·s; at −10°C ≈ 25–35 mPa·s; at −40°C ≈ 200–500 mPa·s; approaching gel-like). While freezing at −80°C is not a practical concern at outdoor temperatures above −20°C, two operationally relevant thermal constraints apply: (a) high-viscosity ClSO₂H at <10°C can cause pump cavitation, pipeline velocity reduction, and poor flow control accuracy in ratio metering (the ClSO₂H volumetric flow at high viscosity may be misread by the Coriolis or differential pressure flowmeter, causing the AI to receive an incorrect flow signal and miscompute the HCl:SO„ ratio in Surface 1); (b) ClSO₂H pipe freeze at outdoor ambient <−15°C (Beaumont TX; Baton Rouge LA; cold snaps: January 2021 Texas cold snap −17°C; 1989 freeze −18°C) can occur in heat-trace-failed sections; on thaw (sudden temperature recovery; ClSO₂H volume expansion on melting: density ClSO₂H at −80°C approximately 1.92 g/mL; at 20°C 1.75 g/mL; 9.7% volume expansion on warming; plus hydraulic hammer from liquid front restarting in a frozen pipe section): thermal-expansion-driven pressure pulse can rupture Schedule 80 carbon steel pipe fittings or glass-lined pipe joints. ClSO₂H is incompatible with common pipe joint materials: PTFE gaskets swell in ClSO₂H (>0.5% swell; leak path possible at 20 bar pipe rating); elastomeric O-rings (Viton; EPDM) degrade in <24h at 40°C; carbon steel corrodes slowly at <50°C (corrosion rate ≈ 0.1–0.5 mm/yr); stainless steel (316L) is satisfactory at 20–40°C for short contact times. Any pipe rupture of ClSO₂H in outdoor service releases a water-reactive liquid that immediately generates HCl gas + H₂SO₄ aerosol on contact with rain, dew, or humid air; the response is similar to oleum/H₂SO₄ release but with additional HCl gas component (IDLH 50 ppm; TLV-C 2 ppm).

The adversarial upward pixel attack shifts the ClSO₂H storage tank temperature display from 38°C (actual; within design range 25–50°C; heat trace operating normally; bulk ClSO₂H temperature appropriate for pumping and measurement) to 82°C (displayed; above the 65°C high alarm; AI classification “ClSO₂H storage temperature critically elevated; risk of product degradation (HCl evolution from hot ClSO₂H above 65°C; ClSO₂H decomposes slowly: ClSO₂H → HCl + SO„ at >80°C; rate significant at 100°C; minor at 65°C); reduce heat trace power immediately by 80% to bring storage temperature below 50°C.”). The DCS response: electric heat trace power reduces from 100% to 20%. For an outdoor ClSO₂H storage tank at ambient −8°C (winter; northern European BASF Ludwigshafen location; January average −3°C; cold snap −8°C to −15°C possible): at 20% heat trace power and −8°C ambient, the bulk ClSO₂H at 38°C (actual) loses heat faster than the reduced heat trace provides: heat loss from tank at ΔT = 38 − (−8) = 46°C; with standard 50 mm rock wool insulation (U = 0.4 W/m²·K; 10 m² tank surface) = 184 W heat loss; at 100% heat trace 500 W supply; at 20% = 100 W supply — net heat deficit 84 W; tank cooling rate = 84 W / (mass × Cp) = 84 / (5,000 × 1.2 × 1,000) = 1.4×10⁻⁵°C/s = 0.05°C/hr. Over 12–24 hours: temperature drop of 0.6–1.2°C — minimal. But for the outdoor delivery piping and heat-traced transfer lines (smaller thermal mass; heat trace undersized for extreme cold snap): transfer pipe (DN50; 2-inch stainless; 1 m section; mass 3 kg; volume 1.1 L ClSO₂H = 1.9 kg): at 20% heat trace power (5 W/m) and −15°C cold snap; net heat deficit 15 W per meter pipe; pipe cooling rate = 15 / ((3 + 1.9) × 1,000) = 0.003°C/s = 10°C/hr. Pipe from 38°C to 5°C (high-viscosity zone) in 3.3 hours; ClSO₂H viscosity at 5°C: 10 mPa·s — pump cavitation risk; flow accuracy degraded; HCl:SO„ ratio measurement in the Coriolis flowmeter errors by 2–5% due to viscosity-induced density calculation error — triggering Surface 1 HCl ratio misread. The adversarial storage temperature attack thus indirectly amplifies the Surface 1 HCl ratio attack through viscosity-induced flowmeter error in cold weather, creating a compound adversarial consequence that unfolds over hours rather than the immediate reaction the temperature alarm implies. Free tier — 10 scans/day, no card required.

Integration: chlorosulfuric acid ClSO₂H production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the ClSO₂H production AI pipeline — before the HCl:SO„ feed ratio AI processes rendered Coriolis flowmeter SCADA display images, before the product free SO„ content AI processes rendered inline Raman SCADA display images, and before the ClSO₂H storage tank temperature AI processes rendered heat trace thermocouple display images. Threshold 30 for ClSO₂H production AI reflects: SO„ TQ 1,000 lbs (exceeded every 7 min of operation); dual PSM SO„ + HCl; water-reactive SO„-contaminated ClSO₂H creates emergency hazard at customer site with incorrect UN hazard class information; supply-chain consequence chain spans manufacturing plant, transport ISO-tank, and customer reactor; BASF Ludwigshafen Germany; Solutia Springfield MA; DuPont Old Hickory TN; Zschimmer & Schwarz Lahnstein Germany.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# ClSO3H production AI contexts: threshold 30
# OSHA PSM SO3 TQ 1,000 lbs; HCl anhydrous TQ 5,000 lbs.
# SO3 IDLH 20 ppm; SO3 TLV-TWA 0.05 ppm.
# 85th upward attack: 1.42 mol/mol shown when 0.72 mol/mol actual
# -> AI reduces HCl -> actual HCl:SO3 drops to 0.48 mol/mol
# -> 26 wt% free SO3 in ClSO3H product -> water-reactive emergency at customer.
CLSO3H_THRESHOLD = 30

class ClSO3HContext(StrEnum):
    HCL_SO3_FEED_RATIO       = auto()  # HCl:SO3 mol/mol at synthesis column (85th upward)
    PRODUCT_FREE_SO3_CONTENT = auto()  # Free SO3 wt% in ClSO3H product (<0.5 spec)
    STORAGE_TEMPERATURE      = auto()  # ClSO3H storage heat-trace temp (25-50C design)

async def scan_clso3h_frame(
    frame_b64: str,
    context: ClSO3HContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_clso3h(
    frame_b64: str,
    context: ClSO3HContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_clso3h_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= CLSO3H_THRESHOLD:
        raise AdversarialClSO3HImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from ClSO3H production AI pipeline."
        )

class AdversarialClSO3HImageError(RuntimeError):
    pass