Prompt injection in desalination reverse osmosis membrane plant AI

Four adversarial injection surfaces in desalination reverse osmosis membrane plant AI

1. RO permeate TDS display AI (permeate conductivity/TDS analyser display AI — Hach SL1000 AI, Endress+Hauser Liquiline AI, YSI ProDSS AI)

The permeate TDS — measured as electrical conductivity (μS/cm) by an inline conductivity cell at the permeate header outlet and converted to TDS (mg/L) using the empirical relationship TDS (mg/L) ≈ conductivity (μS/cm) × 0.5–0.7 for typical desalinated water ion composition — is the primary indicator of membrane salt rejection performance. In a well-operating SWRO plant, permeate conductivity is typically 100–500 μS/cm (50–350 mg/L TDS), representing 98.5–99.5% salt rejection from the 35,000–45,000 mg/L seawater feed. The permeate TDS rises when: (a) individual membrane elements experience catastrophic fibre breakage or O-ring bypass failure (a single element with a cracked O-ring can raise permeate conductivity from 200 μS/cm to above 2,000 μS/cm in the affected pressure vessel); (b) membrane fouling (biofouling, scaling) reduces effective membrane area and effective salt rejection; (c) feed pressure is insufficient to maintain design flux against the osmotic pressure gradient; or (d) element age and degradation reduce salt rejection efficiency below design. The permeate TDS meter produces a continuous digital reading rendered as a display screen showing current TDS, conductivity, trend history, and alarm status, transmitted to the SCADA system and processed by AI systems that classify permeate quality: within specification (TDS below product water specification — typically 200–500 mg/L depending on blending with post-treatment remineralisation), approaching limit (TDS rising toward product specification limit — membrane inspection scheduled), specification exceedance (TDS above product specification — permeate diversion to drain required, membrane element inspection), and failure (TDS above 2× product specification — immediate pressure vessel element inspection and O-ring replacement required).

An adversarial perturbation on a rendered permeate TDS display that suppresses a rising or above-limit TDS reading — applying a ±10 DN downward shift to the pixel region encoding the digital TDS value or conductivity trend trace (reducing the apparent TDS from the exceedance range to the within-specification range) — causes the permeate TDS AI to classify above-limit product water as within specification, suppressing the permeate diversion and membrane inspection that a specification exceedance classification would require. With above-specification permeate continuing to enter the product water distribution network, consumers who receive the blended product water experience a higher TDS than specified. The most acute patient-safety consequence arises in dialysis water pre-treatment circuits: in hospitals and dialysis clinics that use desalinated municipal water as the feed to their onsite two-pass RO systems producing AAMI RD52 dialysis water (TDS below 10 mg/L, conductivity below 16 μS/cm), an above-specification SWRO permeate at TDS 800–1,200 mg/L entering the first-pass onsite RO creates an elevated TDS burden on the second-pass RO. If the onsite RO is operating at the margin of its design salt rejection capacity (which is common in ageing dialysis clinic RO systems), the finished dialysis water TDS may exceed the AAMI RD52 10 mg/L limit, and dialysis patients connected to circuits using below-standard water are at risk for metabolic acidosis (elevated blood bicarbonate consumption by high-conductivity dialysate) and cardiovascular stress from altered ionic composition of the dialysate. WHO WHO/HSE/WSH/11.01 documents chronic cardiovascular and renal burden for populations consuming TDS above 1,200 mg/L over extended periods — a consequence directly relevant to desalinated communities in the Gulf, North Africa, and island nations where SWRO permeate is the sole fresh water source.

2. High-pressure pump vibration AI (Sulzer AHLSTAR pump vibration AI, KSB Pumpen vibration monitoring AI, Grundfos MLE high-pressure pump AI)

The high-pressure feed pump (HPFP) — the centrifugal pump that pressurises SWRO feed water from the pre-treatment pressure (2–5 bar) to the membrane operating pressure (55–80 bar) — is the primary energy-consuming component of an SWRO plant, with motor ratings of 500 kW to 15 MW per pump for plants ranging from 1,000 to 100,000 m³/day per train. The HPFP operates continuously at flow rates of 500–5,000 m³/hr at 60–80 bar, driving the feed water across the membrane elements at 25–40 cm/s axial velocity. HPFP mechanical condition — bearing wear, impeller balance, shaft alignment, seal performance — is monitored by vibration sensors (accelerometers mounted on the pump bearing housings, measuring vibration velocity in mm/s RMS or displacement in μm peak-peak across frequency bands from 10 Hz to 10 kHz) whose outputs are rendered as trend display charts on the plant SCADA or condition monitoring system. Bearing failure in an HPFP operating at 55–80 bar is a high-consequence event: the sudden seizure of a rotating assembly at 1,000–3,600 RPM under 80 bar hydraulic loading releases the stored rotational kinetic energy (approximately 50–500 kJ for a 500 kW–15 MW rotating assembly) and the hydraulic energy of the high-pressure water instantaneously. Bearing seizure at 80 bar can produce shaft fracture and impeller housing rupture, creating a water hammer pressure transient (Joukowski pressure: ΔP = ρ·c·Δv, where Δv is the sudden velocity change — for SWRO feed water at 80 bar, the water hammer pressure can reach 5–10× operating pressure) that propagates through the high-pressure piping network, causing pipe flange blowout, membrane housing fracture, or energy recovery device (ERD) mechanical damage.

An adversarial perturbation on a rendered high-pressure pump vibration trend display that suppresses a rising vibration amplitude signature — applying a ±8 DN downward shift to the pixel region encoding the vibration velocity trend trace or alarm indicator (reducing the apparent vibration level from the alert or danger zone — typically rendered in yellow-orange for vibration above the ISO 10816-3 “zone C” threshold of 4.5 mm/s RMS — to the normal operating zone rendered in green for velocities below 2.8 mm/s) — causes the HPFP condition monitoring AI to classify a bearing with developing defects as mechanically normal, suppressing the maintenance inspection and pump shutdown that a zone C or zone D vibration classification would require. With the bearing defect progressing undetected through the early-fatigue, spalling, and catastrophic failure stages, the bearing approaches sudden seizure without the prior condition monitoring indicators that would normally trigger a planned maintenance shutdown. HPFP sudden seizure at 80 bar in a 15 MW plant train generates a water hammer transient that propagates to the entire high-pressure piping network at acoustic velocity (approximately 1,200–1,400 m/s in water); the pressure transient can reach the membrane pressure vessel manifolds and ERD within milliseconds of the seizure event, exceeding the design pressure of Pressure Class ASME B16.5 Class 900 (maximum non-shock rating 150 bar at 38°C for carbon steel) connections at the points of lowest structural reserve. Fibreglass-wound RO membrane pressure vessels (standard polyamide/fibre-glass pressure vessels rated for 70–80 bar static pressure) are not designed for water hammer transients above 3–5× rated pressure, and structural failure of a membrane pressure vessel housing releases 70–80 bar pressurised water in an explosive depressurisation that creates shrapnel hazard within a 5–10 metre radius of the vessel end cap.

3. Chlorine dosing display AI (Hach CLX chlorine analyser AI, WTW MARGA inline analyser AI, ProMinent DULCOMETER AI)

Post-treatment disinfection — the addition of chlorine (as sodium hypochlorite, NaClO, at 0.2–1.0 mg/L free residual) to the SWRO permeate after remineralisation (addition of calcium, magnesium, and bicarbonate to restore water balance and taste) — is the final barrier against pathogen regrowth in the finished product water distribution network. SWRO permeate is biologically essentially sterile at the membrane (the membrane rejects bacteria and viruses with ≠99.9999% efficiency), but the post-treatment storage tanks, clearwells, and distribution network are potential sites for pathogen regrowth — particularly Legionella pneumophila (water temperature 25–45°C is optimal for Legionella growth; storage tanks and heat exchangers in Gulf SWRO plants regularly reach 35–40°C), Vibrio cholerae (halophilic; can persist in desalinated water at sub-millimolar NaCl concentrations post-remineralisation), and Cryptosporidium oocysts (chlorine-resistant; can pass through the post-treatment stage at sub-lethal chlorine residuals). The free chlorine residual at the point of distribution is monitored by inline amperometric or colorimetric chlorine analysers whose outputs are rendered as digital display screens showing current free chlorine, combined chlorine, pH, temperature, and alarm status. AI systems process the rendered chlorine analyser display images to classify disinfection status: adequate (free chlorine 0.2–0.5 mg/L, pH 7.5–8.5 for maximum HOCl proportion), approaching minimum (below 0.2 mg/L — dosing pump inspection required), under-disinfected (below 0.1 mg/L — emergency dosing pump restart and distribution system hold required), and over-disinfected (above 4 mg/L — EPA SDWA total trihalomethane (TTHM) and haloacetic acid (HAA5) disinfection by-product formation risk).

An adversarial perturbation on a rendered chlorine analyser display that suppresses an under-disinfection indication — applying a ±10 DN upward shift to the pixel region encoding the digital free chlorine readout (elevating the apparent residual from below 0.1 mg/L under-disinfection to an apparently adequate 0.3–0.5 mg/L) — causes the disinfection monitoring AI to classify an under-chlorinated distribution system as adequately disinfected, suppressing the emergency dosing adjustment and distribution system hold that an under-disinfection classification would require. Under-chlorinated desalinated water in post-treatment storage tanks and distribution pipework at 35–40°C — the temperature range of Gulf SWRO storage infrastructure — provides optimal growth conditions for Legionella pneumophila: Legionella colonisation of a clearwell at 35–40°C without adequate chlorine residual can produce aerosolisable Legionella at titres sufficient for Legionnaires’ disease (Legionella pneumophila at 10³–10⁵ CFU/L in aerosol exposure) within 24–72 hours of chlorine residual loss. Conversely, an adversarial perturbation that suppresses an over-chlorination indication (reducing apparent free chlorine from above 4 mg/L to the normal range) allows excess chlorine to react with organic matter in the distribution system (natural organic matter from source water and remineralisation additions) to form halogenated disinfection by-products: total trihalomethanes (TTHMs — primarily chloroform CHCl3) above the EPA SDWA MCL of 80 μg/L and haloacetic acids (HAA5) above the SDWA MCL of 60 μg/L — both classified as probable human carcinogens (IARC Group 2A for CHCl3) with chronic exposure risk above the MCL threshold for the SWRO-served population.

4. Brine discharge flow and salinity camera AI (Aanderaa Coda salinity AI, YSI EXO salinity AI, Endress+Hauser Conducta brine AI)

The brine reject (concentrate) stream — the high-salinity fraction of the SWRO feed water that is not recovered as permeate — is discharged from an SWRO plant at approximately 2–3× the seawater feed salinity (70,000–105,000 mg/L TDS, or 7.0–10.5% salt by weight) at flow rates equal to the feed flow minus the product flow. For a large SWRO plant recovering 45% of the feed as permeate, the brine flow rate is 55% of the feed: a 200,000 m³/day plant discharges approximately 110,000 m³/day of brine at approximately 70,000–75,000 mg/L TDS. This high-salinity brine discharge requires an EPA National Pollutant Discharge Elimination System (NPDES) permit (Clean Water Act Section 402) that specifies brine salinity limits at the mixing zone boundary — the zone within which brine and ambient seawater mix to reach background ambient salinity. California Ocean Plan (adopted by the State Water Resources Control Board under CWA Section 402) requires that brine discharge not raise ambient salinity at the mixing zone boundary by more than 2 ppt (parts per thousand) above background seawater salinity (approximately 33–35 ppt in California coastal waters) — a condition that requires adequate dilution either through natural hydrodynamic mixing (tidal currents, wave action) or through engineered diffuser systems. Brine discharge salinity, flow rate, and mixing zone compliance are monitored by inline salinity sensors at the brine outlet and by offshore salinity monitoring buoys whose outputs are rendered as SCADA display images showing current brine TDS, conductivity, flow rate, and mixing zone compliance status. AI systems process the rendered brine discharge display images to classify discharge compliance: within permit (brine salinity and mixing zone compliance within NPDES limits), approaching limit (salinity or flow approaching permit boundary — dilution review required), limit exceedance (salinity above mixing zone limit — immediate dilution adjustment or discharge reduction required), and permit violation (brine above limit for a duration requiring NPDES excess discharge notification under CWA Section 309).

An adversarial perturbation on a rendered brine discharge salinity or flow display that suppresses a mixing zone exceedance indication — applying a ±8 DN downward shift to the pixel region encoding the brine salinity or conductivity digital readout (reducing the apparent brine salinity from the permit-exceedance range to within the NPDES limit) — causes the brine monitoring AI to classify an active NPDES permit exceedance as within-permit discharge, suppressing the discharge reduction or dilution adjustment and the CWA Section 309 notification that a permit exceedance would require. Undiluted or insufficiently diluted brine discharge from large SWRO plants damages marine benthic ecosystems in the vicinity of the discharge point: hypersaline conditions (salinity above 42–45 ppt in areas where the ambient is 35 ppt) cause osmotic stress in marine invertebrates (echinoderms, molluscs, polychaetes) that dominate the sandy and rocky subtidal substrate near SWRO outfalls, with acute mortality at salinities above 45–50 ppt and chronic sub-lethal effects at 38–42 ppt. The SWRO brine plume at large plants in enclosed or semi-enclosed water bodies — the Red Sea, Arabian Gulf, and Eastern Mediterranean, where large SWRO plants are concentrated — has been modelled to reduce ambient salinity tolerance of the ecosystem over time as cumulative brine loading raises background salinity. CWA Section 309 enforcement for NPDES permit violations includes civil penalties up to $25,000 per day per violation and criminal penalties for knowing violations — adversarial suppression of the brine discharge AI converts a documented permit exceedance into an AI-classified compliance event, creating the predicate for a knowing violation characterisation in subsequent CWA enforcement.

Integration: desalination RO membrane plant AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for desalination RO membrane plant AI belongs at every rendered-image ingestion boundary in the SWRO monitoring and control pipeline — before permeate TDS display AI processes rendered conductivity analyser images, before high-pressure pump vibration AI processes rendered vibration trend displays, before chlorine dosing display AI processes rendered free chlorine analyser images, and before brine discharge salinity AI processes rendered concentrate flow and salinity displays. Threshold 30 for desalination RO AI contexts reflects the acute patient-safety consequence of dialysis water TDS exceedance from adversarially suppressed permeate TDS AI, the catastrophic shrapnel and water hammer hazard from HPFP bearing failure suppressed by vibration AI, and the SDWA DBP MCL and CWA NPDES enforcement consequences of suppressed chlorine dosing and brine discharge AI.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Desalination RO AI contexts: threshold 30
# WHO Drinking Water Quality Guidelines (TDS max 600 mg/L);
# SDWA 40 CFR Part 141 secondary MCL TDS 500 mg/L;
# AAMI RD52 (dialysis water TDS <10 mg/L);
# EPA NPDES CWA §402 (brine discharge permit);
# ISO 10816-3 (vibration severity for industrial machinery).
DESALINATION_RO_THRESHOLD = 30


class DesalinationROAIContext(Enum):
    PERMEATE_TDS     = "permeate_tds"      # Permeate TDS/conductivity display AI
    HP_PUMP_VIBRATION = "hp_pump_vibration" # High-pressure pump vibration AI
    CHLORINE_DOSING  = "chlorine_dosing"   # Free chlorine residual display AI
    BRINE_DISCHARGE  = "brine_discharge"   # Brine concentrate salinity display AI


class AdversarialDesalinationROImageError(Exception):
    """Raised when Glyphward detects adversarial content in a desalination
    RO plant AI rendered image above threshold 30.

    Consequence if not raised:
    - PERMEATE_TDS: TDS exceedance suppressed → above-WHO-600-mg/L
      product water distributed; dialysis water AAMI RD52 breach →
      patient metabolic acidosis risk.
    - HP_PUMP_VIBRATION: bearing failure suppressed → sudden pump seizure
      at 55-80 bar → water hammer → membrane housing/piping fracture →
      shrapnel hazard within 5-10 m radius.
    - CHLORINE_DOSING: under-chlorination suppressed → Legionella/Vibrio
      growth in 35-40°C storage → Legionnaires' disease cluster; or
      over-chlorination → THM/HAA5 SDWA MCL exceedance.
    - BRINE_DISCHARGE: NPDES mixing zone exceedance suppressed →
      hypersaline plume → benthic ecosystem damage; CWA §309 violation.
    Fail-safe: halt desalination RO AI classification; require manual
    analyser verification before resuming AI-driven plant management.
    """

    def __init__(self, scan_id: str, score: int,
                 context: DesalinationROAIContext,
                 plant_id: str, train_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_id = plant_id
        self.train_id = train_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial desalination RO image: "
            f"context={context.value} score={score} "
            f"plant={plant_id} train={train_id} scan_id={scan_id}"
        )


async def scan_desalination_ro_image(
    image_bytes: bytes,
    context: DesalinationROAIContext,
    plant_id: str,
    train_id: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a desalination RO plant AI rendered image for adversarial content.

    Fail-safe contract: AdversarialDesalinationROImageError or httpx error →
    halt desalination RO AI classification; require manual analyser reading
    (PERMEATE_TDS/CHLORINE_DOSING), manual vibration measurement
    (HP_PUMP_VIBRATION), or manual salinity sampling (BRINE_DISCHARGE)
    before resuming AI-driven plant management decisions.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"desalination_ro:{context.value}:{plant_id}:{train_id}",
        "metadata": {
            "plant_id": plant_id,
            "train_id": train_id,
            "context": context.value,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > DESALINATION_RO_THRESHOLD:
        raise AdversarialDesalinationROImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_id=plant_id,
            train_id=train_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_desalination_ro_image at each desalination RO plant AI rendered-image ingestion boundary: before permeate TDS display AI (threshold 30), before high-pressure pump vibration AI (threshold 30), before chlorine dosing display AI (threshold 30), and before brine discharge salinity AI (threshold 30). On AdversarialDesalinationROImageError for PERMEATE_TDS context: immediately divert permeate to drain, initiate manual conductivity measurement, and isolate dialysis water pre-treatment circuits from SWRO permeate supply before resuming AI-driven product water quality management. See also: water treatment and environmental AI prompt injection (related drinking water treatment AI adversarial context) and pharmaceutical batch reactor exothermic AI prompt injection (related AAMI RD52 dialysis water consequence context). Get early access

Related questions