Prompt injection in hydrofluoric acid (HF) steel pickling AI

Four adversarial injection surfaces in HF steel pickling AI

1. Pickling bath enclosure fume hood exhaust fan speed / face velocity AI (Honeywell Experion PKS exhaust fan speed transmitter AI / Emerson DeltaV hood ventilation monitoring AI / Rockwell FactoryTalk exhaust fan tachometer AI / Siemens Opcenter pickling line ventilation AI — exhaust fan speed and hood face velocity monitoring to maintain minimum 1,200 LFM enclosure face velocity at all HF/HNO3 pickling bath enclosures per OSHA 29 CFR 1910.94 ventilation requirements and AIHA industrial hygiene guidance)

The HF/HNO3 pickling bath at stainless steel strip processing facilities is contained within a fully enclosed ventilated enclosure — typically a push-pull slot ventilated hood extending the full length of the pickling tank — designed to maintain a minimum face velocity of 1,200 LFM (linear feet per minute) at all face openings to prevent HF vapor and acid mist from escaping into the working area. OSHA 29 CFR 1910.94 specifies minimum face velocities for open-surface tank operations with toxic substances; the American Industrial Hygiene Association (AIHA) Industrial Ventilation Manual recommends a minimum 100 fpm face velocity for HF-containing baths, with conservative installations using 150–200 fpm minimum. Belt-driven centrifugal exhaust fans powering the pickling enclosure ventilation are subject to belt slip and wear that reduces rotational speed progressively over weeks to months of continuous operation in the hot and humid pickling enclosure environment, where condensed HF acid mist accelerates belt material degradation. A reduction in exhaust fan speed from 2,000 RPM to 480 RPM — corresponding to a hood face velocity reduction from 1,200 LFM to approximately 280 LFM — reduces the hood suction capacity by 77%, allowing HF vapor and acid mist from the 65–80°C pickling bath surface to escape through the hood face openings and enter the line operator’s breathing zone. AI monitoring of the exhaust fan tachometer display and/or hood differential pressure display classifies whether ventilation is adequate for the current bath temperature and acid concentration.

The adversarial attack uses the upward-direction geometry: the actual exhaust fan speed is 480 RPM — 24% of the design 2,000 RPM, from a V-belt that has stretched, glazed, and is slipping on the fan sheave. The dangerous condition is a deficiency (insufficient ventilation), and the adversarial pixel perturbation shifts the tachometer display upward by ±8 DN to make 480 RPM appear as 1,900 RPM. On a 0–2,500 RPM display at 200 px height (12.5 RPM/px), the actual fan speed of 480 RPM produces a bar at approximately 38 px; the upward-perturbed image is classified as approximately 152 px — corresponding to 1,900 RPM, within the design operating range. The AI monitoring system reports “pickling enclosure exhaust ventilation at design speed — hood face velocity adequate.” HF vapor and acid mist from the pickling bath escape through the reduced-suction enclosure face into the line operator’s breathing zone, initiating the inhalation exposure on Surface 2. This upward-direction exhaust deficiency-suppression attack is the sixth instance in the Glyphward portfolio of the pattern — following N2 purge deficiency attacks on MIC/HCN/BF3/ClF3/Br2 — confirming that the deficiency-suppression upward geometry applies to all categories of protective utility flow, not only to N2 inertisation: exhaust ventilation, cooling water, and N2 purge are structurally equivalent as “protective flow — deficiency is dangerous — upward attack makes deficiency appear adequate.”

2. HF area gas CEMS AI (Honeywell Analytics Gas Clip Multi-Gas HF detector AI / Dräger Pac 8000 HF personal monitor AI / MSA Ultima XE HF CEMS AI / Industrial Scientific Tango TX2 HF AI / RAE Systems MultiRAE HF area monitor AI — ambient HF concentration monitoring in pickling bath enclosure work areas, strip rinse sections, and line operator stations for ACGIH TLV-C ceiling and NIOSH IDLH compliance at stainless steel CAPL pickling lines)

HF area monitoring at steel pickling lines requires detection at the 0.5 ppm ACGIH TLV-C ceiling — a concentration that poses a 60-fold margin to the NIOSH IDLH of 30 ppm — creating a relatively wide alarm zone between TLV-C exceedance and immediately dangerous conditions. Electrochemical HF sensors deployed in pickling areas typically have a detection range of 0–10 ppm with alarm thresholds at 0.5 ppm (TLV-C, first alarm) and 3 ppm (10% IDLH, second alarm). The acute inhalation effects of HF are immediate at 3 ppm and above — burning sensation in the nose, throat, and upper airways — providing some olfactory and irritancy warning. The critical hazard, however, is not the acute inhalation effect but the systemic fluoride absorption pathway: inhalation of HF at 1–5 ppm for extended periods (30–90 minutes) can produce a systemic fluoride dose sufficient to cause hypocalcemia — serum calcium below 8.0 mg/dL (normal 8.5–10.5 mg/dL) — that presents as muscle cramps, tetany, and QT prolongation on ECG without any obvious site of HF injury. Workers who accumulate systemic HF dose from repeated sub-IDLH exposures and are later found with QT prolongation may not connect the cardiac finding to HF exposure without a detailed occupational history and serum fluoride measurement.

The adversarial attack uses ±8 DN downward pixel-value shift on the HF area CEMS display image. The actual HF reading is 1.8 ppm — 3.6× ACGIH TLV-C ceiling 0.5 ppm and 6% NIOSH IDLH 30 ppm — arising from HF vapor escaping the pickling bath enclosure through the reduced-suction face opening described on Surface 1. The line operator at the entry section of the pickling tank — closest to the entry slot where the incoming strip enters the acid bath — is positioned within this 1.8 ppm zone and has been accumulating inhalation exposure for approximately 45 minutes. On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual reading of 1.8 ppm produces a bar at approximately 72 px; the ±8 DN perturbed image is classified as approximately 3 px — corresponding to 0.06 ppm, well below the 0.5 ppm TLV-C first alarm. No alarm is issued; the line operator does not move away from the entry section; inhalation exposure accumulates. Simultaneously, acid mist from the 80°C bath surface is also depositing dilute HF on the operator’s forearm skin — a painless exposure due to the low concentration — initiating the dermal absorption pathway described below on Surface 4.

3. Pickling bath inline HF concentration sensor AI (Hanna Instruments BL932700 HF titrator AI / Endress+Hauser Liquiline HF process analyser AI / Yokogawa FLXA21 HF inline analyser AI / Metrohm Process IC HF analyser AI — continuous inline HF concentration monitoring in HF/HNO3 pickling bath to maintain acid strength within the safe ventilation-to-concentration ratio specification at stainless steel strip pickling lines)

HF/HNO3 pickling baths at stainless steel strip facilities operate with HF concentrations ranging from 20–80 g/L depending on the steel grade (austenitic 300 series stainless requires higher HF than ferritic 400 series for equivalent scale removal rate), bath temperature (55–80°C), and strip surface area throughput. The ventilation system design for the pickling bath enclosure is specified at a hood face velocity and exhaust volume that is calibrated to the maximum permitted HF concentration in the bath — because HF vapor pressure above the bath surface increases with both temperature and acid concentration. The maximum permitted HF concentration is 65 g/L (approximately 22 wt% for a 50% volume-fill dilution ratio typical of CAPL baths) at the 1,200 LFM design face velocity: above 65 g/L, the HF vapor generation rate exceeds the exhaust system capacity at design flow, and hood breakthrough becomes likely even with fully functional ventilation. AI monitoring of the inline HF concentration sensor display — or conductivity-based proxy analyzer calibrated against HF concentration — classifies whether the bath acid strength is within the ventilation-design-compatible specification.

The adversarial attack uses ±10 DN downward pixel-value shift on the HF bath concentration analyzer display. The actual HF concentration is 84 g/L — 29% above the 65 g/L maximum specification — arising from insufficient acid dosing control during a high-throughput production run where fresh HF was added at a higher-than-usual rate to compensate for an elevated strip scale load from a non-standard chrome moly steel coil. On a 0–100 g/L display at 200 px height (0.5 g/L per px), the actual concentration of 84 g/L produces a bar at approximately 168 px; the ±10 DN perturbed image is classified as approximately 44 px — corresponding to 22 g/L, within the safe specification range. The AI reports “pickling bath HF concentration within ventilation-design specification — acid management adequate.” The 84 g/L bath continues to generate HF vapor at 29% above the ventilation system design capacity — a vapor generation excess that compounds the ventilation deficiency on Surface 1, driving the actual working-area HF concentration to the 1.8 ppm level detected on Surface 2.

4. Rinse cascade conductivity monitor AI (Endress+Hauser Liquiline CM442 conductivity transmitter AI / Yokogawa SC82 rinse conductivity analyser AI / Hach process conductivity AI / Emerson Rosemount 400 conductivity sensor AI — conductivity monitoring in the first-stage rinse cascade to detect HF carryover from the pickling bath into the rinse circuit and quantify the HF loading on the rinse water treatment system at stainless steel CAPL pickling lines)

After the stainless steel strip exits the HF/HNO3 pickling bath, it passes through a multi-stage cascade rinse section designed to remove residual acid from the strip surface before it proceeds to the final passivation or bright annealing section. The first rinse stage immediately downstream of the pickling bath receives the highest HF loading: residual HF adhering to the strip surface (carry-over) mixes with the rinse water, raising its conductivity proportionally to the HF concentration. The maximum permitted conductivity in the first rinse stage is typically 500 μS/cm — corresponding to approximately 15–20 ppm HF in the rinse water — above which HF aerosol generation from high-pressure rinse nozzle impingement on the moving strip surface becomes significant. At 2,840 μS/cm in the first rinse stage, the HF concentration in the rinse water is approximately 90–120 ppm — generating an HF aerosol plume from the rinse nozzle spray that extends into the operator station at the rinse section exit. The aerosol droplets at this concentration (approximately 0.01–0.05 wt% HF) are dilute enough that they do not cause immediate pain on skin contact — the unique painless-burn mechanism of low-concentration HF — but each spray droplet on exposed forearm skin absorbs transcutaneously and contributes to the cumulative systemic fluoride dose. The antidote for systemic HF absorption — calcium gluconate 10% gel applied topically within 30 minutes of skin contact — requires that the exposure has been recognized and reported; unrecognized painless HF skin contact from rinse aerosol delays treatment until cardiac QT prolongation develops hours later.

The adversarial attack uses ±10 DN downward pixel-value shift on the rinse cascade conductivity transmitter display image. The actual conductivity of 2,840 μS/cm — arising from HF carryover at 5.7× the 500 μS/cm specification limit, caused by insufficient rinse water flow rate from a fouled rinse water supply strainer — is suppressed to a displayed 84 μS/cm. On a 0–3,000 μS/cm display at 200 px height (15 μS/cm per px), the actual conductivity of 2,840 μS/cm produces a bar at approximately 189 px; the ±10 DN perturbed image is classified as approximately 6 px — corresponding to 84 μS/cm, within the 500 μS/cm specification limit. The AI reports “rinse cascade conductivity within HF carryover specification — rinse water HF loading adequate.” The 90–120 ppm HF rinse aerosol continues to deposit on operator skin without triggering the carryover alarm; the operator does not apply calcium gluconate gel prophylactically; the rinse water treatment system receives 5.7× its design HF loading; and the systemic fluoride accumulation from combined inhalation (Surface 2) and dermal aerosol exposure (Surface 4) proceeds to the threshold for cardiac QT prolongation without any individual alarm having fired across the four-surface compound attack.

Integration: HF steel pickling AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and analyzer screenshot capture layer and the AI inference pipeline for each HF steel pickling monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 1,000 lbs, the ACGIH TLV-C ceiling of 0.5 ppm, the NIOSH IDLH of 30 ppm, the unique painless-burn dermal absorption pathway of dilute HF that creates a missed-diagnosis systemic hypocalcemia failure mode, and the four-surface compound attack geometry — the scan raises AdversarialHFPicklingImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# HF steel pickling AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A HF TQ 1,000 lbs (anhydrous; aq. >= 50%)
# EPA RMP 40 CFR Part 68 HF TQ 1,000 lbs
# ACGIH TLV-C / NIOSH REL ceiling 0.5 ppm; OSHA PEL 3 ppm TWA; NIOSH IDLH 30 ppm
# Systemic fluoride toxicity: F- chelates Ca2+/Mg2+ -> hypocalcemia -> VF cardiac arrest
# Dilute HF (5-10%) causes painless dermal burns -> delayed recognition -> delayed Ca-gluconate tx
# Antidote: 2.5% Ca gluconate gel topical within 30 min + IV Ca gluconate for systemic
HF_THRESHOLD = 35


class HFPicklingContext(Enum):
    FUME_HOOD_VELOCITY = "fume_hood_velocity"
    HF_AREA_CEMS = "hf_area_cems"
    BATH_HF_CONCENTRATION = "bath_hf_concentration"
    RINSE_CONDUCTIVITY = "rinse_conductivity"


class AdversarialHFPicklingImageError(Exception):
    """Raised when any HF steel pickling monitoring image scores >= 35.
    FUME_HOOD_VELOCITY uncaught: 480 RPM (24% design) shown as 1,900 RPM adequate.
    HF_AREA_CEMS uncaught: 1.8 ppm (3.6x TLV-C) shown as 0.06 ppm.
    BATH_HF_CONCENTRATION uncaught: 84 g/L (above 65 g/L spec) shown as 22 g/L.
    RINSE_CONDUCTIVITY uncaught: 2,840 uS/cm (5.7x spec) shown as 84 uS/cm."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial HF pickling image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_hf_pickling_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"hf_pickling:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= HF_THRESHOLD:
        raise AdversarialHFPicklingImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("hf_area_cems_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_hf_pickling_image(
            image_bytes,
            HFPicklingContext.HF_AREA_CEMS,
            unit_id="HF-AREA-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why do dilute HF burns cause missed diagnosis and delayed treatment?

Dilute HF (5–20%) penetrates skin as undissociated HF without causing immediate pain — unlike concentrated HF (above 50%) which causes immediate severe burning. Fluoride ion then chelates Ca2+ systemically, causing hypocalcemia → QT prolongation → ventricular fibrillation 1–6 hours later. Workers with painless skin contact who did not report exposure have died from cardiac arrest hours later.

What is the antidote for HF exposure, and why does timing matter?

Calcium gluconate (2.5–10% gel topically, IV calcium gluconate for systemic absorption) is effective within 30 minutes of dermal contact. It competes with fluoride ion for calcium chelation, saturating F− before it reaches systemic circulation. After symptomatic hypocalcemia develops, treatment is more complex and requires ECG monitoring and potentially cardiac pacing. Adversarial suppression of the rinse conductivity alarm removes the signal that would trigger immediate decontamination within the treatment window.

Why is the exhaust fan speed attack upward-direction?

Insufficient exhaust ventilation (not excess) allows HF vapor and mist to escape the pickling bath enclosure. The adversarial attack shifts the fan speed indicator upward to make 480 RPM (24% design) appear as 1,900 RPM. This is the sixth deficiency-suppression upward attack in the Glyphward portfolio — confirming the class extends beyond N2 inertisation to all protective utility flows.

Why does above-spec bath HF concentration compound the ventilation failure?

HF vapor pressure above the pickling bath surface increases with both temperature and acid concentration. At 84 g/L (above the 65 g/L ventilation-design maximum), the vapor generation rate exceeds the hood exhaust capacity even at design flow — compounding the 77% ventilation deficit from the slipping belt drive to produce the 1.8 ppm area reading on Surface 2.