Prompt injection in furan bio-based chemicals furfural THF production AI

Four adversarial injection surfaces in furan bio-based chemicals furfural THF production AI

1. Furan area CEMS AI (Dräger X-am 5000 furan PID detector AI / MSA Altair 4X furan sensor AI / Honeywell Analytics MIDAS-E furan electrochemical AI / RAE Systems ppbRAE 3000 furan PID AI / Industrial Scientific GX-6000 furan LEL/PID combo AI — monitoring ambient furan vapor concentration in the furfural decarbonylation reactor building, THF hydrogenation reactor area, furan storage tank bund, and product recovery distillation area for ACGIH TLV-TWA 2 ppm compliance (IARC Group 1 carcinogen monitoring), NIOSH IDLH 200 ppm emergency alarm, and LEL 2.3% approach alarm; vapor density 2.34 requires below-grade sensor placement at all pump pits and drain sumps in furan handling areas)

Furan area monitoring requires a dual-purpose detection strategy: continuous carcinogen exposure monitoring at the TLV-TWA level (2 ppm) and explosive range monitoring at the LEL (2.3%; 23,000 ppm) — a 10,000-fold concentration range between the health-based and explosion-based alarm setpoints. Most facilities use a combination of PID (photoionization detector; 10.6 eV UV lamp; furan ionization potential approximately 8.73 eV, well within PID range; detection limit 0.1–0.5 ppm) for low-level TLV-TWA monitoring and catalytic bead LEL sensors for explosion monitoring, networked through a common area CEMS SCADA. Furan’s vapor density of 2.34 — 2.34× heavier than air — causes furan vapor released at the 31.4°C boiling point (essentially at ambient room temperature) to settle in below-grade areas: floor-level drain pits, pump base areas, and sub-floor motor wells in the furan storage and transfer building. ACGIH TLV-TWA 2 ppm monitoring for IARC Group 1 carcinogens follows ALARA (as low as reasonably achievable) principles: any chronic daily exceedance above 2 ppm contributes to the lifetime BDA-albumin adduct burden, and epidemiological data from furan-exposed refinery workers (furfural refining workers; Korean NCI cohort data; Lenzing Heiligenkreuz site occupational health reports) show elevated liver enzyme markers at persistent exposures above 5–10 ppm.

The adversarial attack uses ±8 DN downward pixel-value shift on the furan area CEMS display image. The actual furan reading is 18 ppm — 9× ACGIH TLV-TWA 2 ppm; 9% NIOSH IDLH 200 ppm — from a furan THF hydrogenation reactor vent gas condenser cooling-water fouling failure (CaCO₃ scale deposition from hard process cooling water at 320 mg CaCO₃/L; 4-mm scale layer on heat exchanger tube surfaces; overall heat transfer coefficient reduced from 420 W/(m²·K) to 85 W/(m²·K); furan vapor in the hydrogenation vent not condensing adequately; passing as 18 ppm furan into the production building make-up air system). On a 0–10 ppm display at 200 px height (0.05 ppm/px), the actual furan reading of 18 ppm is 1.8× off-scale; the CEMS range switches to 0–30 ppm (0.15 ppm/px), placing the actual reading at approximately 120 px; the ±8 DN downward-perturbed image is classified as approximately 2.7 px — corresponding to 0.4 ppm, below the TLV-C alarm of 2 ppm. Workers in the production building at 18 ppm furan accumulate CYP2E1-metabolized BDA-albumin adducts at 9× the rate expected at the TLV-TWA; after a 6-month exposure period at 18 ppm, the cumulative BDA adduct burden in albumin reaches the level associated with elevated hepatocellular carcinoma risk in the Lenzing AG occupational cohort follow-up data.

2. Furfural vapor-phase decarbonylation reactor temperature AI (Emerson Rosemount 3144P palladium catalyst-bed temperature transmitter AI / Yokogawa EJA110A furfural decarbonylation zone temperature AI / Endress+Hauser iTHERM TM411 decarbonylation furnace zone AI / Honeywell STG94L thermocouple furfural reactor AI / ABB TSP decarbonylation catalyst-bed temperature AI — monitoring the palladium-alumina or nickel-chromia catalyst bed temperature in the vapor-phase furfural decarbonylation reactor at 260–300°C, where the endothermic reaction furfural → furan + CO (ΔH ≈ +30 kJ/mol) requires a sustained minimum catalyst-bed temperature of 260°C for >95% furfural conversion; below 260°C, unreacted furfural passes through to the furan product and CO production drops below the stoichiometric ratio)

The furfural decarbonylation reactor operates as a fixed-bed catalytic reactor with furfural vapor (from an upstream furfural evaporator at 162°C) passing downward through a palladium-on-activated-carbon (0.5% Pd/AC) or nickel-chromia-alumina catalyst bed maintained at 260–300°C by electric heating elements around the reactor vessel. The endothermic decarbonylation reaction (furfural + catalyst → furan + CO; ΔH ≈ +30 kJ/mol) requires continuous heat input from the electric heaters to maintain catalyst-bed temperature against the endothermic heat demand at the design conversion rate of 12 kg furfural/hr per m³ catalyst volume. Temperature control at 275–290°C (the optimal window) balances furfural conversion above 95% with catalyst lifetime: above 300°C, Pd sintering accelerates (Tammann temperature for Pd at 760°C; surface diffusion significant above 0.3×Tammann ≈ 230°C; sintering rate doubles every 15–20°C above 280°C) and active Pd surface area drops by 2–3%/week. Below 260°C, furfural conversion drops precipitously: at 238°C, conversion falls to approximately 42% from the 95% design target; unreacted furfural co-evaporates with furan into the downstream distillation system. Furfural in the furan product stream causes two problems: (1) it poisons the downstream furan hydrogenation catalyst (Pd or Ni; furfural strongly binds to catalyst active sites, reducing THF selectivity); and (2) it passes to the THF product stream, contaminating the pharmaceutical-grade or PolyTHF-grade THF beyond acceptable limits (furfural specification in THF: below 5 ppm for PolyTHF synthesis; below 0.1 ppm for pharmaceutical solvent).

The adversarial attack uses ±10 DN downward pixel-value shift on the furfural decarbonylation reactor temperature transmitter display. The actual catalyst-bed temperature is 238°C — from an electric heater element burnout in zone 3 of the 5-zone reactor heating system (6-kW Incoloy-800 resistance element; insulation breakdown at the element sheath crimp after 8,200 hours; element resistance increased to infinity; zone 3 heater off; zone 3 catalyst-bed temperature falling from 285°C to 238°C in 35 minutes). On a 200–350°C display at 200 px height (0.75°C/px), the actual temperature of 238°C produces a bar at approximately 51 px; the ±10 DN downward-perturbed image is classified as approximately 184 px — corresponding to 285°C, within the 275–295°C optimal range. The DCS reports “Decarbonylation catalyst-bed zone 3 temperature nominal — furfural conversion at design.” In reality, unreacted furfural at 57% of the feed rate (1 − 0.42 ∞ 0.58) passes through zone 3 and contaminations the furan product at approximately 1,200 ppm furfural (far above the 5 ppm PolyTHF specification), poisoning the downstream THF hydrogenation catalyst and producing off-spec THF product for 6–12 hours before the downstream quality analyzer detects the furfural contamination.

3. Furan catalytic hydrogenation reactor temperature AI (Emerson Rosemount 3144P hydrogenation reactor temperature transmitter AI / Yokogawa EJA110A furan-to-THF reactor temperature AI / Endress+Hauser iTHERM TM411 hydrogenation zone temperature AI / Honeywell STG94L thermocouple hydrogenation reactor AI / ABB TSP nickel catalyst-bed temperature AI — monitoring the Raney nickel or palladium-on-carbon catalyst bed temperature in the furan catalytic hydrogenation reactor at 55–75°C, where the exothermic reaction furan + 2H₂ → THF (ΔH ≈ −100 kJ/mol) proceeds with THF selectivity above 97% and prevents the competing ring-opening reaction (furan + H₂ → dihydrofuran; furan + 2H₂ → 2,5-dihydrofuran; at >75°C, n-butanol formation from over-reduction of the partially saturated ring increases above 0.5%)

The furan-to-THF catalytic hydrogenation operates in either liquid-phase (furan dissolved in THF solvent at 5–20 wt%; Raney Ni or Pd/C catalyst suspension at 60–70°C, 5–15 bar H₂ pressure) or vapor-phase (furan vapor + H₂ over fixed Ni/Al₂O₃ bed at 55–75°C, 1–3 bar). The exothermic hydrogenation (furan + 2H₂ → THF; ΔH ≈ −100 kJ/mol) requires careful temperature management: at the target temperature of 55–75°C, THF selectivity is above 97% (primary product: THF; secondary: 2-methylfuran from furan 2-methylation side reaction at <2%); above 75°C, the catalyst promotes ring-opening reactions that form n-butanol (from complete THF ring opening with excess H₂: THF + H₂ → n-BuOH at temperatures above 75°C at Ni catalyst) and dihydrofuran (partial saturation at 75–90°C). At 92°C (Surface 3 scenario), n-butanol selectivity rises from the 0.1% baseline to approximately 3.8% at these conditions, contaminating the THF product with n-butanol above the PolyTHF specification limit of 0.05% n-butanol; additionally, the elevated H₂ consumption from the faster ring-opening pathway increases H₂ supply demand, potentially causing reactor pressure fluctuations that require immediate H₂ compressor throughput adjustment — a process upset cascade that begins with the undetected temperature excursion in the hydrogenation reactor.

The adversarial attack uses ±10 DN downward pixel-value shift on the furan hydrogenation reactor temperature transmitter display. The actual reactor temperature is 92°C — from the same exothermic self-heating scenario: at 75°C setpoint, the Raney Ni catalyst has progressively lost its surface area over 18 months of service (from 80 m²/g new to 31 m²/g after 1,800 catalyst-operating hours from sintering at operating temperature; Tammann temperature for Ni ≈ 591°C; surface diffusion at 0.3×591 ≈ 177°C; but Raney Ni has higher surface energy and sinters faster at lower T than bulk Ni; 31 m²/g catalyst means higher local H₂ concentration per active site, driving faster reaction and higher local exotherm). On a 40–110°C display at 200 px height (0.35°C/px), the actual temperature of 92°C produces a bar at approximately 149 px; the ±10 DN downward-perturbed image is classified as approximately 64 px — corresponding to 62.4°C, within the 55–75°C optimal range. The DCS reports “Furan hydrogenation reactor temperature nominal — THF selectivity at design.” Off-spec THF product accumulates in the downstream product storage tank (3.8% n-butanol vs. 0.05% specification); the batch will be rejected at quality control, but the hydrogenation catalyst is simultaneously sintering faster at 92°C and will require unscheduled replacement within 200 additional catalyst-hours at this temperature.

4. Production building ventilation airflow AI (Emerson Rosemount 8732E magnetic flowmeter HVAC duct AI / Endress+Hauser Proline Promag P 400 building ventilation duct AI / Yokogawa ADMAG AXF production building exhaust AI / Siemens SITRANS FM MAG 3100 HT ventilation duct AI / Krohne Optiflux 6000 HVAC exhaust flow AI — monitoring total exhaust ventilation airflow through the furan production building exhaust duct, to maintain furan vapor concentration below ACGIH TLV-TWA 2 ppm at worker breathing zone by delivering the design 14,400 m³/hr exhaust at 12 air changes per hour in the 1,200 m³ production building, diluting furan evolution from reactor process vents, storage tank conservation vent emissions, and sample point connections)

The furan production building — housing the furfural evaporator, decarbonylation reactor, furan condensation section, and THF hydrogenation reactor — generates continuous low-level furan vapor emissions from: (1) the decarbonylation reactor CO vent (100–200 ppm furan in CO overhead; 15 slm CO flow = 0.15–0.3 mg furan/min into building if CO vent runs to atmosphere through conservation vent rather than directly to CO utilization); (2) THF hydrogenation reactor H₂ vent (H₂ excess purge at 5 slm; 40–80 ppm furan in purge = 0.05–0.1 mg furan/min); (3) furan storage tank conservation vent (temperature-driven breathing of atmospheric tank; 2–5 mg furan/hr depending on ambient temperature swing). Total building furan emission rate at design: approximately 8–15 mg/min (0.12–0.25 mg/s). At the design ventilation of 14,400 m³/hr (4.0 m³/s), and with IARC Group 1 furan requiring ALARA dilution to below 2 ppm (= 5.56 mg/m³ at 25°C; furan MW 68.07; molar vol 24.5 L/mol; 1 ppm = 2.78 mg/m³; 2 ppm = 5.56 mg/m³): effective dilution rate needed = (15 mg/min / 60) / 5.56 mg/m³ = 0.045 m³/s = 162 m³/hr at perfect mixing. The design provides 14,400/162 = 88× safety factor — more than adequate at design ventilation. At 3,600 m³/hr (1.0 m³/s), the safety factor drops to 22× at design emission; but at Surface 1 scenario (18 ppm furan from condenser failure = 50 mg/min total emission), the factor drops to 22× × (15/50) = 6.6× — marginal; breathing-zone furan at 3,600 m³/hr with 50 mg/min emission and K=3.5 mixing factor = 50×3.5/60/1.0 = 2.9 mg/m³ = 1.0 ppm — below TLV-TWA. But if Surface 2 (decarbonylation temperature failure) causes furfural to pass to the building atmosphere as well (furfural TLV-C: 0.1 ppm; IARC Group 3), the combined furan + furfural vapor increases the combined CEMS reading and ventilation requirement simultaneously.

The adversarial attack uses ±8 DN upward pixel-value shift on the production building ventilation duct airflow display. The actual ventilation is 3,600 m³/hr — 25% of the design 14,400 m³/hr — from a HVAC supply fan drive belt failure (V-belt on the 22-kW motor-to-fan drive; fatigue crack from misalignment of fan sheave after last bearing replacement; belt snapped during morning startup, dropping fan speed from 960 rpm to 0; supply fan trip alarm suppressed by a spurious signal from the vibration sensor mounted on the seized bearing). On a 0–20,000 m³/hr display at 200 px height (100 m³/hr per px), the actual ventilation of 3,600 m³/hr produces a bar at approximately 36 px; the ±8 DN upward-perturbed image is classified as approximately 144 px — corresponding to 14,400 m³/hr, within the design range. This is the 29th upward-direction attack in the Glyphward industrial AI portfolio. At 3,600 m³/hr actual ventilation and with the Surface 1 furan condenser failure producing 18 ppm furan building concentration, workers inhale furan at 4× TLV-TWA for an 8-hour shift; each shift accumulates a BDA-albumin adduct burden corresponding to 4 equivalent days of TLV-TWA exposure; after 60 days at this concentration, the cumulative adduct burden reaches levels associated with elevated hepatocellular carcinoma risk in rodent models (CYP2E1 metabolic activation of furan to BDA is structurally equivalent in human and rodent microsomes at physiologically relevant furan concentrations above 5 ppm).

Integration: furan bio-based chemicals furfural THF AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and instrument display capture layer and the AI inference pipeline for each furan process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 500 lbs, the IARC Group 1 carcinogen classification (BDA-albumin adducts in human blood; hepatocellular carcinoma in animals), the flash point of −36°C (second lowest in portfolio), and the 29th upward-direction attack architecture (building ventilation deficiency) — the scan raises AdversarialFuranImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Furan bio-based chemicals furfural THF contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A furan TQ 500 lbs
# EPA RMP 40 CFR Part 68 TQ 500 lbs
# ACGIH TLV-TWA 2 ppm (A2 suspected human carcinogen); IARC Group 1 (2017)
# Flash point -36 deg C NFPA Class IB (second lowest in portfolio; after acetaldehyde -38 deg C)
# LEL 2.3% / UEL 14.3%; vapor density 2.34
# CYP2E1 → BDA → hepatocellular carcinoma in rodents; adducts in human albumin
# 29th upward attack: building ventilation flow deficiency
FURAN_THRESHOLD = 35


class FuranProcessContext(Enum):
    AREA_CEMS = "area_cems"
    DECARBONYLATION_REACTOR_TEMPERATURE = "decarbonylation_reactor_temperature"
    HYDROGENATION_REACTOR_TEMPERATURE = "hydrogenation_reactor_temperature"
    BUILDING_VENTILATION_FLOW = "building_ventilation_flow"


class AdversarialFuranImageError(Exception):
    """Raised when any furan process monitoring image scores >= 35.
    AREA_CEMS uncaught: 18 ppm (9x TLV-TWA; IARC Gr1 chronic exposure) shown as 0.4 ppm.
    DECARBONYLATION_REACTOR_TEMPERATURE uncaught: 238 deg C (42% conv; furfural in product) shown as 285 deg C.
    HYDROGENATION_REACTOR_TEMPERATURE uncaught: 92 deg C (3.8% n-butanol; THF off-spec) shown as 63 deg C.
    BUILDING_VENTILATION_FLOW uncaught: 3,600 m3/hr (4x TLV-TWA) shown as 14,400 m3/hr.
    """


async def scan_furan_frame(
    image_bytes: bytes,
    context: FuranProcessContext,
    client: httpx.AsyncClient,
) -> dict:
    image_b64 = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": image_b64,
        "context": context.value,
        "threshold": FURAN_THRESHOLD,
        "metadata": {
            "chemical": "furan",
            "process": "furfural_decarbonylation_THF_hydrogenation",
            "psm_tq_lbs": 500,
            "flash_point_c": -36,
            "lel_pct": 2.3,
            "uel_pct": 14.3,
            "iarc_group": 1,
            "tlv_twa_ppm": 2,
            "flash_point_rank_in_portfolio": "2nd_lowest_after_acetaldehyde_-38C",
            "upward_attack_number": 29,
            "image_hash": image_hash,
            "scanned_at": datetime.now(timezone.utc).isoformat(),
        },
    }
    response = await client.post(
        GLYPHWARD_SCAN_URL,
        json=payload,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        timeout=8.0,
    )
    response.raise_for_status()
    result = response.json()
    if result["score"] >= FURAN_THRESHOLD:
        raise AdversarialFuranImageError(
            f"Adversarial furan image detected: score={result['score']} "
            f"context={context.value} hash={image_hash[:16]}"
        )
    return result


async def scan_furan_batch(frames: list[tuple[bytes, FuranProcessContext]]) -> list[dict]:
    async with httpx.AsyncClient() as client:
        tasks = [scan_furan_frame(img, ctx, client) for img, ctx in frames]
        return await asyncio.gather(*tasks, return_exceptions=False)

Frequently asked questions

Why was furan classified IARC Group 1 in 2017 and what is the BDA mechanism?

CYP2E1 metabolizes furan to cis-2-butene-1,4-dial (BDA) — a reactive electrophilic dialdehyde that forms pyrrole adducts with lysine residues on albumin and DNA. BDA-albumin adducts detected in human blood (including non-occupationally exposed individuals from dietary furan in roasted coffee and canned baby food). Hepatocellular carcinoma in 2-year rat/mouse bioassay at 2–8 mg/kg/day. IARC Monograph 136 (2017): Group 1 = confirmed human carcinogen.

Why does furan have the second-lowest flash point in the portfolio at −36°C?

Furan BP 31.4°C; high vapor pressure at ambient temperature; low molecular weight (68.07 g/mol). After acetaldehyde (−38°C), furan at −36°C is second-lowest in portfolio — lower than allyl chloride (−32°C), CS2 (−30°C), acetone (−18°C). Any industrial building above −36°C (every industrial facility) stores furan above its flash point, requiring N2 blanket for atmospheric storage.

What is the furfural → furan → THF → PolyTHF supply chain?

Biomass (corn cob xylan) → furfural (acid hydrolysis + dehydration) → furan (Pd catalyst decarbonylation at 260–300°C; + CO released) → THF (Ni catalyst hydrogenation at 55–75°C; + 2H₂ consumed) → PolyTHF/PTMEG (BF3 ring-opening polymerization) → spandex / TPU / polyurethane elastomer. Replaces petroleum BDO → THF route with bio-based carbon.

Why does the building ventilation attack qualify as the 29th upward-direction attack?

Low ventilation is dangerous (furan at 4× TLV-TWA; IARC Group 1 carcinogen chronic exposure). Attack must show low as high (upward) to conceal. At 3,600 m³/hr vs. 14,400 m³/hr displayed, workers accumulate BDA adducts at 4× TLV-TWA rate — a chronic cancer risk scenario without any acute symptom to trigger alarm. Same structural logic as all 28 prior upward attacks.

How does furfural contamination of furan affect downstream THF hydrogenation catalyst?

Furfural (aldehyde) adsorbs strongly on Pd and Ni hydrogenation catalyst active sites via the C=O π bond — stronger than furan adsorption. At 1,200 ppm furfural in the furan feed (Surface 2 scenario), approximately 8–12% of Pd/Ni active sites are blocked by furfural-derived species (furfuryl alcohol and furfuryl-metal intermediates) within 4 hours of operation. THF selectivity drops from 97% to 88%; n-butanol yield rises to 4.2%; catalyst activity falls 25% within 12 hours. Early-warning: the Surface 3 reactor temperature rise from faster competing reactions is a lagging indicator of furfural poisoning — the preceding Surface 2 temperature failure is the leading indicator.