Prompt injection in dam safety monitoring AI

Four adversarial injection surfaces in dam safety monitoring AI

1. Seepage turbidity and internal erosion camera AI (sensemetrics, Geocomp DamWatch, smart monitoring cameras)

Internal erosion — also termed “piping” — is the leading cause of earthfill and rockfill dam failure, responsible for approximately 46% of dam failures globally (Foster, Fell, and Spannagle 2000, Canadian Geotechnical Journal). Piping initiates when water seeping through or beneath a dam embankment erodes fine-grained soil particles along a seepage flow path, progressively enlarging the erosion channel from the downstream discharge point backward (backward erosion piping) or from an internal defect outward (suffusion). Early detection of piping relies on monitoring the turbidity of seepage water at the downstream toe drainage system — turbid (cloudy) seepage indicates particle transport (erosion initiation) while clear seepage indicates internal stability. Closed-circuit turbidity monitoring cameras deployed at seepage collection points — weep holes, relief wells, drainage blanket outlets, and toe drains — generate continuous video that AI classifiers process to detect turbidity changes: classifying each camera frame as “clear seepage (no particle transport)”, “slightly turbid (monitor, possible seasonal fine migration)”, or “turbid seepage (elevated particle transport — potential piping initiation, activate EAP notification procedures).” sensemetrics AI (integrated into their structural monitoring platform, now Siemens Smart Infrastructure) and Geocomp DamWatch process seepage camera frames from IP cameras installed at monitored drainage points through turbidity classification CNNs trained on labelled seepage image libraries from earthfill dam monitoring programmes.

An adversarial perturbation on a rendered seepage camera JPEG frame that shifts the apparent turbidity of the water column — reducing the scattered-light pixel intensity in the water area of the frame from the brownish-grey of turbid suspended sediment to the blue-clear tone of clean seepage water using a targeted colour shift within JPEG compression artefacts — causes the turbidity AI to classify the frame as “clear seepage, no action” rather than escalating to “turbid seepage — notify dam safety engineer.” The consequence of delayed piping detection is a compressed response time for downstream evacuation: piping failure can progress from initial detection of turbid seepage to dam breach in as little as 4–6 hours (based on case histories from the 1976 Teton Dam failure and the 1959 Malpasset Dam failure), while a high-hazard dam’s Emergency Action Plan typically requires 1–3 hours of lead time for downstream notification and evacuation of flood inundation zones. Adversarial suppression of a seepage turbidity camera AI detection that eliminates the 4–6 hour early warning removes the margin needed for evacuation under the National Dam Safety Program’s EAP implementation requirement (FEMA P-64, “Federal Guidelines for Dam Safety: Emergency Action Planning for Dam Owners”).

2. Structural crack and deformation inspection AI (drone photogrammetry, Bentley AssetWise, AECOM dam inspection AI)

Concrete gravity dams, concrete arch dams, and concrete-faced rockfill (CFRD) dams develop structural cracks from thermal contraction (seasonal cooling), alkali-silica reaction (ASR — a long-term chemical expansion of reactive aggregate in the concrete), and seismic loading. AI classification of drone-acquired photogrammetric orthomosaic images of dam faces determines: crack location, orientation, and length; crack width at pixel scale (0.3–1mm at typical inspection standoff distances); crack pattern classification (transverse thermal contraction cracks vs. map cracking from ASR vs. diagonal shear cracking from seismic or foundation loading); and joint opening or offset (separation of the dam monolith contraction joints, indicating differential settlement or ASR expansion). Bentley AssetWise AI (deployed at multiple FERC-licensed hydro facilities), AECOM’s dam face inspection AI, and USACE’s dam safety inspection tools (AMSM — Advanced Modeling for Structures and Materials) process drone photogrammetric orthomosaics of dam faces at 1–3mm ground sampling distance into element condition ratings that feed Part 12D inspection reports.

An adversarial perturbation on a rendered dam face orthomosaic that suppresses a map cracking pattern from ASR — smoothing the network of fine polygonal cracks against the grey concrete surface texture — causes the dam inspection AI to classify the monolith face as “Condition 1 (new or like new)” rather than “Condition 3 (deteriorated, elevated monitoring frequency required).” ASR in dam concrete is a progressive expansion mechanism: a dam monolith undergoing accelerated ASR expansion generates increasing compressive stress on adjacent monolith joints, eventually producing diagonal shear cracking and joint crushing that requires costly concrete expansion mitigation (slot cutting, external prestressing). Adversarial suppression of ASR map cracking at an early expansion stage — when the cracking pattern is still fine-scale and within the AI’s detection threshold — delays intervention to a later stage when expansion damage has progressed to the point requiring more intensive corrective action. The Fontana Dam (TVA, NC), Stewart Mountain Dam (AZ), and Hoover Dam (NV) all have documented ASR monitoring programmes where early crack detection directly drives intervention timing decisions.

3. Spillway concrete erosion and cavitation AI (USACE REMR, Hydro Tasmania, BC Hydro inspection AI)

Spillway structures — the concrete-lined channels, chute walls, and flip-bucket energy dissipators that convey flood discharge safely over or around a dam — are subject to hydraulic erosion (surface abrasion by high-velocity sediment-laden water), cavitation damage (collapse of vapour bubbles at sub-atmospheric pressure regions on the concrete surface, creating pitting and progressive material removal), and uplift-induced slab displacement (hydrostatic pressure beneath spillway slabs that lifts and breaks the concrete slab). AI classification of high-resolution drone and ground photogrammetric images of spillway concrete surfaces determines: cavitation pitting extent and severity (surface roughness profile, pit diameter and depth estimated from photogrammetric 3D models); crack and joint sealant condition (perimeter slab cracks that admit pressure water under the slab, the primary uplift mechanism); and reinforcement exposure (concrete surface erosion revealing the steel reinforcement cage, indicating advanced material loss approaching structural failure). BC Hydro’s dam inspection AI, USACE’s Repair, Evaluation, Maintenance and Rehabilitation (REMR) programme inspection tools, and Hydro Tasmania’s asset inspection AI process rendered spillway surface imagery from periodic inspection campaigns into condition assessment reports that drive repair prioritisation and flood-event operational decisions (maximum release rate limits through a damaged spillway).

The 2017 Oroville Dam spillway failure is the reference event. The Oroville Dam main spillway developed a concrete slab failure due to undetected uplift pressure damage beneath the chute slab — a defect that had been observable in high-resolution aerial inspection imagery as a surface depression and crack pattern above the uplift-damaged section before the February 2017 flood event that initiated slab removal. AI-assisted spillway inspection that processes rendered drone orthomosaic images of spillway chute surfaces — using convolutional classifiers trained to detect uplift-indicative surface depressions, perimeter cracks, and drainage hole blockage — is exactly the detection capability that would have identified the pre-failure condition. An adversarial perturbation on a rendered spillway surface orthomosaic that suppresses the surface depression and crack signatures above an uplift-damaged slab zone causes the spillway AI to classify the chute surface as “No significant defects observed” rather than triggering an immediate hands-on inspection and potential flood release restriction. At Oroville Dam, the undetected spillway damage escalated from an initially localised slab failure to a full-channel erosion failure requiring 50 mph water cannon helicoptered materials to fill — and triggered the 188,000-person evacuation of downstream communities in Butte, Sutter, and Yuba counties.

4. Satellite InSAR deformation monitoring AI (Gamma Remote Sensing, SkyGeo, TRE ALTAMIRA)

Interferometric Synthetic Aperture Radar (InSAR) satellite monitoring measures millimetre-scale surface deformation of dam bodies and reservoir rim slopes by comparing the radar phase difference between repeated satellite passes over the same area at 6–12 day intervals (Sentinel-1A/1B constellation, ESA). InSAR deformation maps — rendered as colour-coded phase difference images (interferograms) where each colour fringe represents a 2.8cm range change (Sentinel-1 C-band radar wavelength), annotated with persistent scatterer velocity vectors overlaid on optical imagery — are processed by AI classifiers to detect: dam crest settlement (vertical displacement of the dam body, indicating internal consolidation or internal erosion progression); reservoir rim landslide movement (slope displacement in the reservoir basin, which can generate impact waves that overtop the dam — the failure mechanism of the 1963 Vajont Dam disaster, 1,917 fatalities); abutment rock movement (differential displacement of the dam-to-abutment interface, indicating abutment foundation instability); and seasonal dam body deformation (thermal expansion/contraction cycles that, if anomalous, indicate loss of structural continuity). Gamma Remote Sensing, SkyGeo (now part of Fugro), and TRE ALTAMIRA process Sentinel-1 and TerraSAR-X SAR interferograms through AI deformation classifiers that produce monthly persistent scatterer velocity (mm/year) and time-series deformation plots for dam owners under FERC and USACE monitoring programmes.

An adversarial perturbation on a rendered InSAR interferogram image that shifts the phase fringe pattern — replacing the anomalous concentric fringe pattern of a localised dam crest settlement anomaly (one fringe = 2.8cm range change, indicating 15–20mm surface displacement) with the uniform background fringe pattern of the surrounding stable bedrock — causes the InSAR AI to classify the deformation map as “No significant surface displacement detected, all persistent scatterers within seasonal variability bounds” rather than flagging the localised settlement anomaly for field investigation. A dam crest settlement rate exceeding 10mm/year that is not detected by InSAR AI review — and therefore not investigated by field installation of additional settlement monuments or piezometers — may represent an internal erosion progression that will produce a visible sinkhole at the dam crest only when the piping has already reached an advanced stage with insufficient time for controlled drawdown or EAP activation before a sudden breach.

Integration: dam safety monitoring AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for dam safety AI belongs at the rendered image ingestion boundary before each AI classification step — before seepage turbidity camera AI, before structural crack inspection AI, before spillway erosion AI, and before InSAR deformation AI. Threshold 40 for dam safety AI contexts reflects downstream life-safety consequence and the absence of fast-acting independent sensor backup for most AI-monitored dam parameters.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Dam safety monitoring AI contexts: threshold 40
# FERC 18 CFR Part 12, USACE Dam Safety Program, FEMA P-795 / P-64.
DAM_AI_THRESHOLD = 40


class DamAIContext(Enum):
    SEEPAGE_TURBIDITY  = "seepage_turbidity"  # Seepage camera turbidity AI
    CRACK_INSPECTION   = "crack_inspection"   # Drone structural crack mapping AI
    SPILLWAY_EROSION   = "spillway_erosion"   # Spillway concrete surface AI
    INSAR_DEFORMATION  = "insar_deformation"  # Satellite InSAR deformation AI


class AdversarialDamImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a dam
    safety monitoring AI rendered image above threshold 40.

    Consequence if not raised: piping seepage / crack / deformation suppressed
    → Emergency Action Plan not activated → downstream communities lack
    evacuation warning before potential dam breach flood wave.
    Fail-safe: suppress AI classification, notify dam safety engineer
    immediately per EAP notification procedures (FEMA P-64 Section 4).
    """

    def __init__(self, scan_id: str, score: int,
                 context: DamAIContext,
                 dam_id: str, monitoring_point: str | None,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.dam_id = dam_id
        self.monitoring_point = monitoring_point
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial dam image: "
            f"context={context.value} score={score} "
            f"dam={dam_id} point={monitoring_point} scan_id={scan_id}"
        )


async def scan_dam_image(
    image_bytes: bytes,
    context: DamAIContext,
    dam_id: str,
    monitoring_point: str | None,
    hazard_class: str,
    is_ferc_regulated: bool,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a dam safety monitoring AI image for adversarial content.

    Fail-safe contract: AdversarialDamImageError or httpx error →
    suppress AI condition assessment, notify dam safety engineer per
    EAP Section 4 procedures. Do not clear seepage turbidity, crack,
    or deformation anomalies based on adversarially flagged images.

    Args:
        image_bytes: Seepage turbidity camera frame, drone crack map,
            spillway surface orthomosaic, or InSAR interferogram render.
        context: DamAIContext identifying the monitoring modality.
        dam_id: NID (National Inventory of Dams) identifier.
        monitoring_point: Instrumentation point ID (toe drain, crest
            settlement monument, InSAR persistent scatterer cluster).
        hazard_class: "high", "significant", or "low" per FEMA P-795.
        is_ferc_regulated: True if dam is FERC Part 12 regulated.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialDamImageError: if score exceeds threshold 40.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"dam:{context.value}:{dam_id}:{monitoring_point}",
        "metadata": {
            "dam_id": dam_id,
            "monitoring_point": monitoring_point,
            "hazard_class": hazard_class,
            "is_ferc_regulated": is_ferc_regulated,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_dam_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        dam_id=dam_id,
        monitoring_point=monitoring_point,
        hazard_class=hazard_class,
        flagged=result["score"] > DAM_AI_THRESHOLD,
    )

    if result["score"] > DAM_AI_THRESHOLD:
        raise AdversarialDamImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            dam_id=dam_id,
            monitoring_point=monitoring_point,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_dam_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: DamAIContext, dam_id: str,
    monitoring_point: str | None, hazard_class: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": DAM_AI_THRESHOLD,
        "flagged": flagged,
        "dam_id": dam_id,
        "monitoring_point": monitoring_point,
        "hazard_class": hazard_class,
        "regulatory_refs": [
            "FERC 18 CFR Part 12 (Mandatory Dam Safety Inspection Program)",
            "USACE Dam Safety Program (ER 1110-2-1156)",
            "FEMA P-795 (Dam Safety Guide for Natural Hazard Mitigation)",
            "FEMA P-64 (Emergency Action Planning for Dam Owners, 2013)",
            "FEMA P-93 (Federal Guidelines for Dam Safety: Selecting and Accommodating Inflow Design Floods for Dams)",
            "ASDSO Levee Safety Coalition Guidelines",
            "ICOLD Bulletin 171 (Internal Erosion of Existing Dams, 2017)",
        ],
    }
    audit_path = Path("/var/log/glyphward/dam_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_dam_image at each dam safety AI rendered-image ingestion boundary: before seepage turbidity camera AI (threshold 40), before structural crack inspection AI (threshold 40), before spillway erosion AI (threshold 40), and before InSAR deformation AI (threshold 40). On AdversarialDamImageError: suppress AI condition assessment, notify dam safety engineer immediately per EAP Section 4 notification procedures (FEMA P-64). For high-hazard FERC Part 12 regulated facilities: do not clear any safety monitoring parameter from escalated status based on an adversarially flagged image without human engineer review and field verification. Get early access

Related questions

Further reading

• Prompt injection in pipeline integrity inspection AI — ILI pig MFL AI and corrosion detection adversarial attacks
• Prompt injection in highway bridge inspection AI — drone crack detection AI and FHWA NBIS adversarial attacks
• Prompt injection in smart grid and power distribution AI — SCADA sensor image and power flow AI adversarial attacks
• Prompt injection in offshore platform inspection AI — ROV camera corrosion AI and riser inspection adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required