Adversarial Injection · Fumigant AI Monitoring · Attack #153

Ethylene Dibromide (EDB, 1,2-Dibromoethane, BrCH₂CH₂Br, CAS 106-93-4) Grain Fumigation and QPS Treatment — OSHA PEL 20 ppm TWA, ACGIH TLV-TWA 0.045 ppm Skin A3, IARC Group 2A, CERCLA RQ 1 lb, Flash Point 10°C: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Ethylene Dibromide Grain Fumigation AI Attack

Ethylene dibromide (EDB; 1,2-dibromoethane; BrCH₂CH₂Br; CAS 106-93-4; MW 187.86 g/mol; BP 131.4°C; flash point 10°C; NFPA Class IB; LEL 6.5 vol%; UEL 11.5 vol%; autoignition 420°C; density 2.18 g/mL; vapor density 6.48 — extremely heavy, floor-pooling; OSHA PEL 20 ppm TWA, 30 ppm STEL per Z-1 1978 amendment; ACGIH TLV-TWA 0.045 ppm with skin notation and A3 confirmed animal carcinogen designation — 444× lower than the OSHA PEL; NIOSH designation Ca — potential occupational carcinogen at lowest feasible concentration; NIOSH IDLH 100 ppm; IARC Group 2A probably carcinogenic to humans, Monograph 71 1999 — renal cell carcinoma in male rats by inhalation at 40 ppm, nasal squamous cell carcinoma, forestomach tumors; positive Ames assay TA1535 and TA100 with and without S9 activation; direct alkylating agent via SN2 at bromine leaving group; CERCLA RQ 1 lb — among the lowest CERCLA RQs for any fumigant compound; EPA/FIFRA registration cancelled 1984 for most crop uses after renal carcinogenicity findings; still permitted under FIFRA Section 18 emergency exemptions for certain QPS (quarantine and pre-shipment) commodity treatments under USDA APHIS and EPA joint authority) was the dominant grain and soil fumigant in the United States through the early 1980s, surpassing methyl bromide in commercial grain storage applications before EPA's 1984 cancellation order. Post-cancellation, EDB remains in regulated use for quarantine and pre-shipment (QPS) treatment of international commodity shipments — logs, milled lumber, fresh fruit, and non-QPS grain at facilities operating under USDA APHIS permits — and continues to appear as a soil contaminant at legacy fumigation sites where residual concentrations exceed EPA maximum contaminant levels (MCL) in groundwater of 0.05 µg/L. A single ±8 DN adversarial pixel perturbation on rendered DCS or fumigation-management-system display images can show a grain silo headspace EDB area monitor at 1.1 ppm when the actual concentration is 48 ppm (2.4× OSHA PEL 20 ppm; 1,067× ACGIH TLV-TWA 0.045 ppm) — suppressing worker evacuation and masking chronic IARC Group 2A carcinogen exposure; can display exhaust ventilation flow at 3,200 m³/hr when the actual flow is 420 m³/hr — 7.6× below the target that FIFRA's post-fumigation re-entry standard requires for silo clearance — triggering premature re-entry into a high-EDB atmosphere; or can conceal a perimeter atmospheric monitor reading of 6.8 ppm as 0.09 ppm — masking a concentration 151× above ACGIH TLV-TWA 0.045 ppm from community and co-worker exposure. Glyphward detects all three surfaces at threshold 44 before any image reaches a downstream fumigation management AI.

EDB's fumigation chemistry exploits its vapor pressure of 12 mmHg at 25°C and vapor density of 6.48 (6.48× the density of air; air = 1.0) to achieve deep penetration of grain matrices. Applied as a liquid or gas to sealed grain storage bins, steel elevator silos, or ship cargo holds, EDB vaporizes from application points, sinks under gravity to fill below-grade spaces and inter-grain pore volumes, and achieves fumigant distribution at concentrations of 30–100 ppm over 24–72 hour exposure periods required for complete insect kill at the target life stages (eggs, larvae, pupae, adults) specified by USDA APHIS and IPPC treatment schedules. The extreme vapor density (6.48) means that EDB accumulates preferentially at floor level, in sumps, below-grade conveyors, and in the lowest strata of grain columns — locations where entry workers first penetrate after fumigation. EDB's water solubility of 3.91 g/L at 25°C (among the highest for a halogenated fumigant) also creates a secondary residue pathway: EDB absorbs into grain moisture, is slowly desorbed during aeration, and can produce elevated headspace concentrations during aeration phases that are misread as declining-exposure ventilation-completion states by automated monitoring systems that sample at mid-silo height rather than at the floor-level accumulation zone. The commercial scale of grain fumigation operations using EDB — elevators with storage capacities of 50,000 to 500,000 bushels (1,400 to 14,000 tonnes) sealed for fumigation periods of 24–96 hours — means that the number of AI-monitored display surfaces (multiple bin headspace sensors, aeration flow meters, perimeter atmospheric monitors at property boundaries required by FIFRA) is large, and the probability that at least one adversarial perturbation passes an unprotected AI monitoring pipeline without detection is high in operations with more than three active fumigation points.

The regulatory asymmetry between the OSHA PEL (20 ppm TWA; adopted 1971 from ACGIH TLV of that era, not updated despite subsequent carcinogenicity findings) and the ACGIH TLV-TWA (0.045 ppm; adopted 2001 based on the IARC Group 2A determination and linear low-dose extrapolation from male rat renal tumor dose-response data at 10, 20, and 40 ppm inhalation exposures) creates a 444× gap between OSHA's legally enforceable standard and the current evidence-based exposure limit. Workers at EDB fumigation facilities operating under OSHA enforcement may be chronically exposed at concentrations that satisfy OSHA compliance (below 20 ppm TWA) while receiving doses 100–400× above the ACGIH TLV-TWA that represents current scientific consensus on carcinogenic risk. An adversarial pixel injection that shows 48 ppm as 1.1 ppm converts a clear OSHA PEL exceedance (2.4× the Z-1 standard, which would trigger OSHA 1910.1000 engineering controls and respiratory protection requirements) into a reading apparently within the safe operating band — while also masking the 1,067× ACGIH TLV-TWA exceedance that industrial hygienists rely upon for long-term cancer risk assessment at fumigation facilities. NIOSH Ca designation and the lowest-feasible-concentration policy mean that no NIOSH-compliant occupational exposure to EDB is acceptable — the AI monitoring failure that shows 48 ppm as 1.1 ppm not only suppresses immediate safety responses but also prevents documentation of carcinogen exposures required by OSHA's Hazard Communication Standard (HazCom, 29 CFR 1910.1200) for carcinogen-listed substances. Glyphward threshold 44 for EDB reflects: IARC Group 2A (higher concern than Group 2B used for many other chemicals in this portfolio); ACGIH TLV-TWA 0.045 ppm (skin, A3 — among the lowest non-metal TLV values in the ACGIH database); CERCLA RQ 1 lb (one of the lowest RQs for any organic fumigant — equivalent to NIOSH Ca concern level expressed through CERCLA's environmental hazard framework); OSHA PEL/ACGIH TLV gap of 444×; and flash point 10°C (NFPA Class IB), adding ignition risk for liquid EDB at all temperatures above 10°C during application.

Why EDB Grain Fumigation Operations Are Disproportionately Vulnerable to Pixel Manipulation

EDB fumigation monitoring presents an attack surface shaped by three concurrent monitoring requirements that share no common instrument scale and serve distinct regulatory frameworks. The headspace area monitor spans the ppm range for OSHA PEL compliance (0–100 ppm; 200 px at 2 px/ppm); the exhaust ventilation flow meter spans the cubic-meter-per-hour range for FIFRA re-entry clearance (0–5,000 m³/hr; 200 px at 0.04 px per m³/hr); and the perimeter atmospheric monitor spans the sub-ppm range for ACGIH TLV community exposure (0–5 ppm; 200 px at 40 px/ppm). Each instrument is independently exploitable by ±8 DN pixel perturbations tailored to the specific scale of each display — and the three surface attacks can be applied simultaneously to suppress the three safety responses that depend on them: worker evacuation and respiratory protection (Surface 1), re-entry clearance hold (Surface 2), and community notification (Surface 3). EDB's vapor density of 6.48 compounds the attack impact: when the headspace monitor at mid-silo height reads suppressed (Surface 1), workers who re-enter based on the falsified ventilation clearance (Surface 2) encounter the EDB-enriched floor-level atmosphere that is systematically missed by mid-height sensors — the actual floor-level EDB concentration during incomplete aeration is estimated at 1.8–2.5× the mid-height value due to vapor density stratification, placing re-entrant workers in a 86–120 ppm floor-level EDB atmosphere rather than the 48 ppm headspace average that is itself suppressed by the Surface 1 attack.

Surface 1 — Grain Silo Headspace EDB Area Monitor (Downward Attack)

The grain silo headspace EDB area monitor — typically a photoionization detector (PID) with an 11.7 eV lamp for EDB's ionization potential, or a halogen-selective flame ionization detector — is displayed on a 200 px vertical bar spanning 0 to 100 ppm. The pixel scale is 200 px ÷ 100 ppm = 2.0 px/ppm. At the actual EDB headspace concentration of 48 ppm — during the aeration phase following a 36-hour fumigation cycle in a 50,000-bushel wheat elevator in Hutchinson, Kansas — the rendered pixel position is 48 × 2.0 = 96 px from the bottom. The adversarial perturbation shifts this pixel cluster downward by 93.8 px to position 2.2 px. The AI fumigation-management-system reads the concentration as 2.2 ÷ 2.0 = 1.1 ppm — well within the OSHA-compliant operating band and below any alarm threshold configured for the EDB monitoring system, which typically uses an action level of 5 ppm for engineering controls and 20 ppm for evacuation. No worker evacuation alarm fires; no half-face respirator with organic vapor cartridge requirement activates; no OSHA Hazard Communication carcinogen-exposure entry is logged in the fumigation supervisor's exposure record.

At 48 ppm EDB in the silo headspace, the OSHA PEL of 20 ppm TWA is exceeded by 2.4-fold — a level that, under OSHA 1910.1000, requires implementation of engineering controls (forced ventilation) and respiratory protection before worker entry is permitted. More consequentially, 48 ppm is 1,067× the ACGIH TLV-TWA of 0.045 ppm (skin, A3) — reflecting the order-of-magnitude distance between the outdated OSHA PEL (adopted from the 1968 ACGIH TLV, before EDB was identified as a carcinogen) and the current evidence-based exposure guidance. EDB's primary carcinogenic mechanism is direct alkylation: the molecule reacts with cellular DNA nucleophiles (primarily N7-guanine and O6-guanine positions) through an SN2 mechanism at the α-carbon adjacent to the bromine leaving groups, forming both monofunctional adducts and interstrand DNA crosslinks. In the male rat renal carcinogenesis studies (National Cancer Institute Bioassay 1978; NTP Technical Report 210 1982), EDB exposure at 10 ppm, 20 ppm, and 40 ppm by inhalation for 78 weeks produced dose-dependent increases in renal cell carcinoma. At 40 ppm — less than the actual 48 ppm exposure masked by the Surface 1 attack — virtually all exposed male rats developed kidney tumors. IARC's 2A designation (Monograph 71, 1999) reflects this evidence plus positive genotoxicity data (Ames assay, mouse lymphoma assay, in vivo micronucleus test) and the structural analogy to 1,2-dibromoethane's carcinogenicity mechanism. Workers entering the silo under the suppressed Surface 1 display (believing they are in a 1.1 ppm EDB atmosphere rather than a 48 ppm one) receive an unreported acute dose of 48 ppm per 8-hour shift — a dose that, extrapolated from the NTP bioassay dose-response curve using linear low-dose methodology, corresponds to an estimated excess lifetime cancer risk of approximately 3–7 × 10⁻³ per shift of unprotected exposure. Over a season of grain fumigation work (20–40 fumigation cycles per year), the cumulative unreported cancer-risk increment represents a substantial occupational health liability that the suppressed monitoring record would entirely conceal.

Surface 2 — Exhaust Ventilation Flow Meter (Upward Attack)

The exhaust ventilation flow meter measuring cubic meters per hour of aeration through the grain silo rooftop exhaust ducts is displayed on a 200 px vertical bar spanning 0 to 5,000 m³/hr. The pixel scale is 200 px ÷ 5,000 = 0.04 px per m³/hr. At the actual ventilation flow of 420 m³/hr — the result of two of three exhaust fans operating with reduced motor speed after a variable-frequency drive (VFD) fault condition, while the third fan is in maintenance lockout/tagout — the rendered pixel position is 420 × 0.04 = 16.8 px from the bottom. The adversarial perturbation shifts this pixel cluster upward by 109.0 px to position 125.8 px. The AI fumigation-management-system reads the flow as 125.8 ÷ 0.04 = 3,145 m³/hr — which rounds to the displayed 3,200 m³/hr in the DCS UI. At this displayed flow, the AI calculates that the silo's 30,000 m³ headspace volume (50,000-bushel steel elevator with 6.1 m ceiling and 900 m² floor area) has undergone 3,200 ÷ 30,000 = 0.107 air changes per hour, and over the 5-hour aeration period shown in the log, a cumulative 0.53 air changes — suggesting adequate dilution from the fumigation concentration of 80 ppm (post-exposure target) to below the OSHA re-entry standard of 1 ppm. The AI clears the silo for re-entry.

At the actual 420 m³/hr, the air change rate is 420 ÷ 30,000 = 0.014 per hour — and the 5-hour aeration achieved only 0.07 cumulative air changes. At an initial EDB headspace concentration of 80 ppm (typical post-fumigation level in the silo immediately following the 36-hour treatment period), an exponential decay model predicts remaining EDB at 0.07 air changes: 80 × e^(−0.07) = 80 × 0.932 = 74.5 ppm. Combined with the under-aeration of the below-grade headspace (where EDB vapor density 6.48 maintains a floor-level enrichment factor of approximately 1.8–2.1×), the floor-level EDB at worker breathing zone during the falsely cleared re-entry event is estimated at 74.5 × 1.9 = 141 ppm — 7.1× the OSHA PEL, 3.1× the NIOSH IDLH (100 ppm), and well above the level at which CNS effects (dizziness, headache, narcosis) accompany the IARC Group 2A carcinogen exposure. FIFRA 40 CFR Part 156 Subpart I and EPA Label Requirements for Fumigants require that post-fumigation re-entry be authorized only when monitored concentration at the worker breathing zone is at or below the fumigation label's re-entry level — for EDB, the EPA label specifies 1 ppm as the re-entry clearance standard. The Surface 2 upward attack on the exhaust flow display creates a falsified record showing adequate ventilation progress while the actual aeration has reduced EDB headspace concentration by only 7% from the fumigation peak rather than the 98.8% reduction (80 ppm → 1 ppm) required for re-entry clearance.

Surface 3 — Perimeter Atmospheric EDB Monitor (Downward Attack)

The perimeter atmospheric EDB monitor — a fixed-point PID sensor at the property boundary of the grain elevator complex, required under FIFRA fumigation labeling for grain storage facilities above certain size thresholds — is displayed on a 200 px vertical bar spanning 0 to 5 ppm. The pixel scale is 200 px ÷ 5 ppm = 40 px/ppm. At the actual perimeter EDB concentration of 6.8 ppm — from the combined effect of silo conservation vent emissions during the fumigation hold period, grain elevator leg (bucket elevator) sweep emissions during active aeration, and floor-level EDB vapor migration through building gaps in the partially aerated headspace facility — the rendered pixel position is 6.8 × 40 = 272 px, which is off-scale at 200 px maximum; the sensor is at over-range (OVR). However, in DCS systems that handle over-range by clamping the pixel display at the bar maximum, the actual pixel position in the AI monitoring image might reflect the clamped reading, or the AI may read a partially off-scale bar. For this scenario, we treat the adversarial perturbation as downward from the reported 6.8 ppm re-scaled to a 0–50 ppm display range used at this facility (the perimeter monitor auto-ranges during fumigation periods): at 6.8 ppm on a 0–50 ppm scale, the pixel position is 6.8 ÷ 50 × 200 = 27.2 px. The adversarial perturbation shifts this downward by 23.6 px to 3.6 px. The AI reads 3.6 ÷ 200 × 50 = 0.09 ppm — below the 0.1 ppm display-resolution noise floor, effectively zero. No perimeter alarm triggers; no community notification is initiated; no CERCLA emergency release notification is considered.

At 6.8 ppm EDB at the property boundary atmospheric monitor, the concentration is 151× the ACGIH TLV-TWA of 0.045 ppm — a community exposure concentration that would, if accurately reported, trigger mandatory notification under CERCLA Section 103 (40 CFR Part 302) given EDB's CERCLA RQ of 1 lb. At a fumigation rate that produces perimeter EDB of 6.8 ppm over a property boundary 150 m from the nearest silo, the mass release rate of EDB required to maintain that concentration under typical Gaussian dispersion parameters (Pasquill Class D, 3 m/s wind) is approximately 0.8–1.2 g/s = 2.9–4.3 kg/hr = 6.4–9.5 lbs/hr — well above the CERCLA RQ of 1 lb per 24-hour period in continuous release terms. The suppressed perimeter monitor reading prevents the fumigation operator from recognizing that a CERCLA-reportable release is occurring — a reporting obligation under CERCLA Section 103(a) that requires notification to the National Response Center (NRC) within 24 hours of a release exceeding RQ. It also prevents the EPCRA Section 313 TRI annual release estimate from being accurately calculated — a FIFRA and EPA Superfund reporting requirement that tracks EDB releases at grain fumigation facilities and informs ongoing cancer risk assessments for agricultural communities near grain elevators. The Surface 3 attack simultaneously conceals community health risk (151× ACGIH TLV-TWA at property boundary) and suppresses mandatory regulatory reporting obligations under three separate federal frameworks (CERCLA, EPCRA TRI, FIFRA fumigant labeling).

Integrating Glyphward into EDB Fumigation AI Monitoring Pipelines

The following Python snippet demonstrates how to authenticate EDB fumigation monitoring display images — headspace area monitor, exhaust ventilation flow, and perimeter atmospheric sensor — against the Glyphward API before passing any reading to a fumigation management AI that controls re-entry clearances, dosing calculations, or CERCLA reporting triggers. A non-clean verdict raises a typed exception routed to immediate safety system response: aeration hold, re-entry lockout, and FIFRA-compliant manual sampling requirement before any re-entry decision.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
EDB_GLYPHWARD_THRESHOLD = 44

class EDBFumigationContext(StrEnum):
    HEADSPACE_AREA_MONITOR = auto()   # Surface 1 — downward attack
    EXHAUST_VENTILATION    = auto()   # Surface 2 — upward attack
    PERIMETER_ATMOSPHERIC  = auto()   # Surface 3 — downward attack

class AdversarialEDBImageError(RuntimeError):
    def __init__(self, surface: EDBFumigationContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] EDB adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={EDB_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_edb_frame(frame_path: Path, surface: EDBFumigationContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": EDB_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialEDBImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_edb_monitoring_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (EDBFumigationContext.HEADSPACE_AREA_MONITOR, frame_dir / "headspace_monitor.png"),
        (EDBFumigationContext.EXHAUST_VENTILATION,    frame_dir / "exhaust_flow.png"),
        (EDBFumigationContext.PERIMETER_ATMOSPHERIC,  frame_dir / "perimeter_monitor.png"),
    ]
    tasks = [verify_edb_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls execute concurrently, adding under 80 ms of total latency per fumigation monitoring cycle. Glyphward threshold 44 for EDB is calibrated against the compound of IARC Group 2A (higher concern level than the Group 2B used for most other chemicals in this portfolio — indicating probable human carcinogenicity at occupational exposure concentrations), ACGIH TLV-TWA 0.045 ppm skin A3 (one of the lowest TLV values for any liquid-phase fumigant; the 444× gap between this and the OSHA PEL 20 ppm means that an AI monitoring system calibrated to the OSHA standard alone would never flag a 48 ppm reading as hazardous), CERCLA RQ 1 lb (the lowest feasible reporting quantity, indicating regulatory recognition of EDB's high toxicity and carcinogenicity in environmental release context), and NIOSH Ca designation. The SHA-256 frame hashes provide FIFRA, OSHA, CERCLA, and EPCRA TRI audit traceability — documenting that each fumigation monitoring display image was authenticated against adversarial injection before it was used to make re-entry clearance, community notification, or federal release-reporting decisions.