Prompt injection in deep space and planetary exploration AI

Four adversarial injection surfaces in deep space and planetary exploration AI

1. NASA AEGIS autonomous targeting AI — rover rock and feature classification

The AEGIS (Autonomous Exploration for Gathering Increased Science) system — originally deployed on the Mars Exploration Rover Opportunity (AEGIS-MER) and significantly enhanced for NASA’s Curiosity (AEGIS-MSL) and Perseverance (AEGIS-M2020) rovers — is a machine vision pipeline that classifies rocks and geological features from Mastcam-Z stereoscopic image pairs using a convolutional neural network trained on annotated Mars surface image datasets from MRO (Mars Reconnaissance Orbiter) HiRISE imagery and prior rover image archives. AEGIS processes rendered terrain classification images — false-color confidence maps overlaid on Mastcam-Z stereo pairs, with detected rock candidates highlighted by bounding boxes and confidence scores — through a target selection network that ranks rocks by scientific interest classification (target type: volcanic breccia, carbonate vein, sedimentary nodule, float rock, soil patch) and selects the highest-ranked target for autonomous SuperCam LIBS laser firing or contact science instrument placement without ground uplink approval. The AEGIS targeting decision is executed autonomously within the rover’s onboard flight software, which sequences the SuperCam LIBS firing command, records the resulting spectrum, and stores the observation for the next telemetry downlink — a complete science observation cycle that executes entirely without human intervention.

An adversarial perturbation on the rendered AEGIS classification image — a structured pixel modification that elevates the apparent confidence score and target-type classification of a geologically uninteresting float rock to appear as a high-priority carbonate vein candidate — causes AEGIS to command a SuperCam LIBS firing at the wrong target, consuming the LIBS laser’s limited lifetime firing budget (estimated 1,100,000 total shots for the SuperCam LIBS at Perseverance) on a low-scientific-value observation. At a mission scale where SuperCam LIBS time is the primary resource constraint on Perseverance’s geochemical characterization campaign, adversarial AEGIS targeting manipulation is equivalent to consuming irreplaceable mission science capacity. More critically, an adversarial terrain traversability manipulation in the AutoNav pipeline — where the rover’s terrain hazard assessment AI processes rendered stereo pair depth maps to classify traversal corridors — can generate a phantom safe-traversal classification for a rock field or slope that exceeds the rover’s tilt tolerance (Perseverance operational tilt limit: 30 degrees from vertical), directing an autonomous drive into a terrain feature that tips the rover beyond the recovery threshold. The 2005 Spirit rover entrapment in soft soil (“Troy” site, Spirit stuck in May 2009 — ultimately not recovered) provides a historical precedent for rover terrain assessment errors producing mission-ending consequences without any communication window to correct the error.

2. NASA SPLICE Terrain Relative Navigation precision landing AI

NASA’s SPLICE (Safe and Precise Landing — Integrated Capabilities Evolution) technology suite — developed at NASA Langley Research Center and NASA Johnson Space Center under the Game Changing Development program, demonstrated on a Blue Origin New Shepard suborbital rocket flight in 2021, and integrated into Intuitive Machines’ Nova-C class lunar lander (IM-1 Odysseus mission, February 2024) and targeted for Artemis Human Landing System integration — combines three sensor modalities: a Doppler lidar system providing 3D velocity and altitude measurements, a downward-facing optical camera providing Terrain Relative Navigation (TRN) imagery, and a hazard detection lidar providing 3D surface point cloud hazard maps. The TRN component processes downward camera frames — high-resolution optical images of the landing zone surface captured during terminal descent at altitudes of 1–5 km — through a convolutional neural network that matches features in the descent camera image against a pre-loaded reference map (compiled from orbital reconnaissance imagery) to determine the lander’s precise position relative to the target landing zone. This position estimate, fused with Doppler lidar velocity, enables hazard detection and the autonomous divert manoeuvre — a lateral translation of up to 100 metres from the nominal target if the lander’s hazard detection system identifies rocks, craters, or slopes that exceed the lander’s safe touchdown envelope within the primary target zone.

An adversarial perturbation on the TRN downward camera image — a structured pixel modification that corrupts the feature-matching correlation between the descent camera frame and the pre-loaded reference map, producing a false position estimate that places the lander’s computed position 50–100 metres offset from its true position — causes the TRN-fused navigation state to report an incorrect landing zone, potentially directing the autonomous divert manoeuvre away from a known-safe target zone toward a crater or boulder field. The IM-1 Odysseus mission (February 2024) experienced a landing system anomaly — a hardware-level lidar ranging system that had not been activated correctly — that required last-minute ground intervention to switch to NASA’s experimental Navigation Doppler Lidar; Odysseus landed in a tilted attitude and ceased operations after approximately 14 hours on the lunar surface. The SPLICE TRN AI is the specific component that enables autonomous hazard divert during the 12–120 second terminal descent window where communication latency (1.28 seconds Earth-Moon one-way) theoretically permits ground intervention but where the manoeuvre timeline is too compressed for a human operator to assess the TRN position estimate, recognise an adversarial corruption, and uplink a corrective command before touchdown. For Mars missions where one-way communication latency is 4–24 minutes, the terminal descent window is entirely outside any possible human intervention timeline.

3. Planetary helicopter and drone navigation AI — Ingenuity and Dragonfly class

NASA’s Ingenuity Mars Helicopter — a 1.8 kg coaxial rotor rotorcraft that completed 72 flights on Mars between April 2021 and January 2024 covering 17.7 km total distance before rotor blade damage ended operations — and the Dragonfly dual-quadcopter mission targeting Titan (Saturn’s moon) for launch in 2028 both rely on vision-based navigation AI for autonomous flight control in environments where radio communication cannot support real-time piloting. Ingenuity’s autonomous navigation system processes frames from a downward-facing navigation camera (VGA resolution grayscale, 30 fps during flight) through an optical flow and terrain tracking AI — a JPL-developed vision-based state estimator (VIO — Visual-Inertial Odometry) that estimates the helicopter’s lateral velocity, altitude, and heading by tracking feature displacement in sequential navigation camera frames. The VIO AI output drives the Ingenuity flight control system’s horizontal velocity control loop — if the VIO estimates horizontal drift, the controller applies cyclic pitch to counteract it. Dragonfly’s Titan navigation AI faces a more challenging environment: Titan’s nitrogen-methane atmosphere (surface pressure 1.5 bar, 4x Earth’s atmospheric density) with organic haze layers that reduce optical visibility, requiring the Dragonfly TAN (Terrain Absolute Navigation) system to fuse downward camera terrain classification with pre-loaded Cassini/Huygens radar surface maps — an architecture analogous to SPLICE TRN but in a denser, lower-visibility atmosphere.

An adversarial perturbation on the downward navigation camera frame processed by Ingenuity’s VIO AI — a structured pixel modification that introduces a false apparent optical flow vector in the rendered camera frame — causes the VIO to estimate lateral drift that is not present, generating a compensating cyclic pitch command that actually introduces horizontal velocity in the control system’s compensation direction. In Ingenuity’s Flight 25 (April 2022), a navigation camera processing anomaly caused the VIO system to lose feature tracking, generating erroneous velocity estimates that resulted in a 3-metre position error and a hard landing that damaged one of Ingenuity’s rotor blade tips — ultimately the same rotor damage class that ended Ingenuity’s operations in Flight 72. An adversarially induced VIO failure is mechanistically equivalent to the Flight 25 navigation anomaly — the flight controller responds to false velocity estimates by applying corrective manoeuvres that deviate from the planned flight profile, potentially directing the helicopter into an obstacle (a rock, a crater rim) or into a terrain feature that the Ingenuity airframe was not designed to withstand. For Dragonfly on Titan, an adversarial TAN navigation failure during a landing approach — a Titan methane-lake shoreline or organic dune field where terrain features are subtler than Mars basalt rock fields — can direct Dragonfly into a landing site that exceeds the dual-quadcopter’s touchdown stability envelope, a consequence that is irreversible at a Saturn communication latency of 75–85 minutes one-way.

4. Orbital conjunction avoidance AI for deep space mission trajectory planning

Deep space mission trajectory planning and autonomous spacecraft conjunction avoidance employ AI systems that process orbital track visualization displays — rendered 3D mission trajectory plots showing the spacecraft’s planned trajectory, planetary ephemeris positions, asteroid and debris catalog tracks, and close-approach corridors — through neural network classifiers that identify trajectory segment conjunction risks and rank potential correction manoeuvre (TCM — Trajectory Correction Manoeuvre) opportunities. JPL’s MONTE (Mission analysis, Operations, and Navigation Toolkit Environment) trajectory analysis platform, used for all JPL deep space missions including Perseverance, DART (Double Asteroid Redirection Test, 2022), and Europa Clipper (Jupiter system mission, launch 2024), incorporates AI-assisted TCM opportunity identification that processes rendered trajectory visualization images. For proximity operations — spacecraft operating near asteroids, moons, or during planetary flyby sequences — autonomous hazard avoidance AI that processes rendered range-image or optical navigation camera frames in real time drives the autonomous thrust-abort decision that determines whether a planned TCM should execute or be aborted due to a detected hazard in the burn corridor.

NASA’s DART mission (Double Asteroid Redirection Test, September 2022) — the first intentional asteroid deflection mission, impacting Dimorphos at 6.14 km/s — used the DRACO (Didymos Reconnaissance and Asteroid Camera for Optical navigation) camera and SmartNav autonomous navigation AI for terminal guidance, autonomously adjusting the impact trajectory based on onboard classification of Dimorphos’s surface features from DRACO image frames during the final 4 hours before impact when communication latency (30+ seconds one-way) precluded ground-commanded corrections. An adversarial perturbation on the SmartNav classification image — one that misidentifies Dimorphos’s limb position and generates a corrected pointing vector that shifts the final impact point away from the intended target — would have directed DART’s kinetic impactor to a different impact geometry on Dimorphos, altering the momentum transfer and the deflection efficiency of the planetary defence demonstration. For planetary defence applications — the operational descendant of DART in a real asteroid deflection scenario — adversarial injection into the terminal guidance AI could convert a successful asteroid deflection into a near-miss that fails to achieve the required trajectory change, leaving the threat object on an Earth-impacting trajectory.

Integration: deep space AI image scanning with Glyphward pre-uplink gate

The Glyphward scan gate for deep space and planetary exploration AI belongs at the image ingestion boundary before each AI classification step — as a pre-uplink gate applied to command sequences and model update packages before uplink to the spacecraft or rover, or as an onboard scan gate in ground-in-the-loop operational phases. For fully autonomous operations where ground intervention is impossible within the consequence window, the scan gate must execute onboard. Threshold 35 across all mission-critical planetary AI contexts reflects irreversibility — any adversarially induced mission failure is permanent, with no recovery or redundancy possible — and the zero-communication-window consequence profile. The implementation uses JSONL audit logging referencing NASA-STD-8739.8 and NASA-STD-7009.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# All deep space / planetary exploration AI contexts: threshold 35
# NASA-STD-8739.8 Software Class A/B and ESA ECSS-Q-ST-80C apply.
# Threshold 35 reflects irreversibility: no recovery possible at interplanetary ranges.
DEEP_SPACE_AI_THRESHOLD = 35


class DeepSpaceAIContext(Enum):
    AEGIS_ROVER_TARGETING       = "aegis_rover_targeting"       # AEGIS rock classification AI
    AUTONAV_TRAVERSABILITY      = "autonav_traversability"      # AutoNav terrain hazard AI
    SPLICE_TERRAIN_RELATIVE_NAV = "splice_terrain_relative_nav" # SPLICE TRN landing AI
    PLANETARY_HELI_VIO          = "planetary_heli_vio"          # VIO helicopter navigation AI
    PROXIMITY_OPS_HAZARD        = "proximity_ops_hazard"        # SmartNav/DRACO proximity AI


class AdversarialDeepSpaceImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a deep space
    or planetary AI image above threshold 35.

    Consequence if not raised: rover traversal into impassable terrain,
    precision landing on hazardous surface, helicopter navigation failure,
    or planetary defence deflection miss — all irreversible at interplanetary
    communication latency.

    NASA-STD-8739.8 Software Class A: single failure with catastrophic consequence.
    """

    def __init__(self, scan_id: str, score: int,
                 context: DeepSpaceAIContext,
                 mission_id: str, frame_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.mission_id = mission_id
        self.frame_id = frame_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial deep space AI image: "
            f"context={context.value} score={score} "
            f"mission={mission_id} frame={frame_id} scan_id={scan_id}"
        )


async def scan_deep_space_ai_image(
    image_bytes: bytes,
    context: DeepSpaceAIContext,
    mission_id: str,
    frame_id: str,
    sol_or_met: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a deep space / planetary exploration AI image for adversarial content.

    Fail-safe contract: any exception must result in halting the autonomous
    action dependent on this AI classification and queuing ground-in-the-loop
    review at next available uplink window.

    Args:
        image_bytes: Rendered AEGIS classification image, AutoNav depth map,
            SPLICE TRN downward camera frame, VIO navigation camera frame,
            or proximity ops optical nav image.
        context: DeepSpaceAIContext identifying the mission AI pipeline.
        mission_id: Mission identifier (e.g., 'M2020-PERCY', 'IM-1', 'DART').
        frame_id: Onboard frame ID or image sequence number.
        sol_or_met: Mission elapsed time — Sol number for Mars rovers or
            MET (Mission Elapsed Time) for spacecraft.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialDeepSpaceImageError: if score exceeds threshold 35.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed: halt action).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"deep_space_ai:{context.value}:{mission_id}:{frame_id}",
        "metadata": {
            "mission_id": mission_id,
            "frame_id": frame_id,
            "sol_or_met": sol_or_met,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_deep_space_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        mission_id=mission_id,
        frame_id=frame_id,
        sol_or_met=sol_or_met,
        flagged=result["score"] > DEEP_SPACE_AI_THRESHOLD,
    )

    if result["score"] > DEEP_SPACE_AI_THRESHOLD:
        raise AdversarialDeepSpaceImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            mission_id=mission_id,
            frame_id=frame_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_deep_space_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: DeepSpaceAIContext, mission_id: str,
    frame_id: str, sol_or_met: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": DEEP_SPACE_AI_THRESHOLD,
        "flagged": flagged,
        "mission_id": mission_id,
        "frame_id": frame_id,
        "sol_or_met": sol_or_met,
        "regulatory_refs": [
            "NASA-STD-8739.8 (Software Assurance Standard, Class A/B)",
            "NASA-STD-7009 (Standards for Models and Simulations)",
            "NASA-HDBK-2203 (NASA Software Engineering Handbook)",
            "ESA ECSS-Q-ST-80C (Software Product Assurance)",
            "JPL D-78192 (Software Development Requirements for Mission-Critical Software)",
            "NIST AI 100-2 (Adversarial Machine Learning, 2024)",
        ],
    }
    audit_path = Path("/var/log/glyphward/deep_space_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_deep_space_ai_image as a pre-uplink gate at JPL/GSFC mission operations centers before uplink of model update packages and AEGIS target list updates (threshold 35), and as an onboard gate at the image-to-AI-classification boundary for SPLICE TRN (threshold 35), AutoNav traversability (threshold 35), and planetary helicopter VIO (threshold 35). On AdversarialDeepSpaceImageError or any Glyphward API error: fail-closed — halt the dependent autonomous action; queue the flagged image for ground-in-the-loop review at the next uplink window; fall back to the most-conservative safe state (AutoNav: stop rover and wait; SPLICE: abort divert manoeuvre and use nominal landing target; VIO: land-in-place). Log all events with NASA-STD-8739.8 Software Class A references. Get early access

Related questions

Further reading

• Prompt injection in satellite communications ground station AI — antenna tracking AI and SSA conjunction assessment adversarial attacks
• Prompt injection in air traffic control radar AI — FAA STARS, ACAS Xu, and ASDE-X adversarial attacks
• Prompt injection in smart manufacturing and ICS AI — industrial vision inspection and SCADA AI adversarial attacks
• NIST AI RMF GenAI Profile and multimodal prompt injection risk management
• Prompt injection scanning API free tier — 10 scans/day, no card required