Prompt injection in hydrogen fluoride HF production AI

Three adversarial injection surfaces in hydrogen fluoride production AI

1. Rotary kiln temperature profile display AI (Yokogawa EJA530A / Emerson Rosemount 3031 / ABB TA10 rotary kiln shell thermocouple array — rendered SCADA kiln temperature gradient display AI classifying axial temperature profile against 150–280°C design gradient — 88th upward attack; FIRST HF production attack; FIRST fluorspar CaF₂ attack; FIRST Müller-Kühne process attack; FIRST rotary kiln temperature AI attack)

The rotary kiln in HF production is a complex countercurrent reactor in which temperature control along the kiln axis is the fundamental variable governing reaction completeness, product quality, and byproduct formation. At the feed (cold) end, the CaF₂/H₂SO₄ slurry enters at approximately 80–100°C; the reaction initiates above 130°C as H₂SO₄ achieves sufficient activity to displace HF from the fluorite lattice. The primary reaction zone, where 70–80% of CaF₂ conversion occurs, operates at 150–220°C. In the discharge zone at the hot end of the kiln, temperatures of 240–280°C drive the final conversion of residual CaF₂ and ensure that the anhydrite product (CaSO₄) has sufficiently low residual fluoride content for safe disposal (typically <0.5 wt% F). Below 150°C in the primary reaction zone, the H₂SO₄ viscosity increases sharply (H₂SO₄ viscosity doubles from ∼10 cP at 200°C to ∼20 cP at 150°C and ∼40 cP at 100°C), slowing mass transfer and effectively halting the surface reaction between H₂SO₄ and CaF₂ crystal faces. Above 320°C in the discharge zone, CaSO₄ undergoes sintering—the anhydrite particles fuse together, creating a hard crust (called “kiln ring” in plant parlance) that can partially or fully block the rotating kiln interior, requiring a kiln shutdown and mechanical cleaning—a multi-day operation at major HF facilities. Above 280°C, H₂SO₄ also begins to dehydrate to SO₃ and H₂O, meaning that SO₃ appears in the HF gas stream and is carried into the condenser, where it reacts with condensed HF to form fluorosulfuric acid (HSO₃F), a highly corrosive contaminant that attacks Monel condenser hardware. The AI monitoring system reads the rendered thermocouple profile display—a color-coded zone diagram rendered by the Yokogawa CENTUM VP or Emerson DeltaV DCS—as a bitmap image, classifying each zone against its design temperature window and issuing burner fuel-flow increase or decrease commands through the DCS control layer.

In the adversarial scenario targeting the 88th upward attack, pixels in the rendered kiln temperature profile display are perturbed such that the reaction zone thermocouple reading appears as 278°C (within the upper normal range) when the true kiln temperature in the primary reaction zone is 118°C—a deficiency of 160°C. The AI interprets the rendered display as indicating an overheating kiln and responds by commanding a reduction in burner fuel flow to cool the kiln, consistent with its design intent of maintaining the reaction zone below 280°C. As the AI continues to read the adversarially-manipulated display, it registers no improvement (the displayed value stays near the faked 278°C) and continues cutting fuel; the actual kiln temperature falls to 95°C. Below 130°C, the CaF₂–H₂SO₄ reaction stalls entirely: the reaction rate constant k(T) at 95°C is approximately 25–30 times lower than at 200°C (Arrhenius activation energy ∼55–65 kJ/mol). Unreacted CaF₂/H₂SO₄ slurry continues to accumulate in the kiln interior as fresh feed is charged normally. When the next operator manual cross-check—typically on a 1–2 hour schedule in most OSHA PSM Process Safety Management programs—detects the actual temperature deficit and restores burner fuel flow, the large bolus of accumulated unreacted slurry suddenly reaches the reaction threshold temperature simultaneously across the kiln: the result is a rapid, uncontrolled HF generation pulse. At 150,000 t/yr plant capacity (e.g., Mexichem Fluor San Luis Potosí), 90 minutes of stalled reaction represents ∼17 tonnes of unreacted CaF₂ (equivalent to ∼14 tonnes of HF generation potential). When this reacts in a pulse, the instantaneous HF gas flow exceeds the condenser design capacity by a factor of 3–5×, causing HF gas breakthrough downstream of the condenser into the NaOH scrubber and potentially into the atmosphere at concentrations exceeding the IDLH of 30 ppm. OSHA PSM requires a Process Hazard Analysis (PHA) for each scenario exceeding TQ 1,000 lbs; 14 tonnes of HF ≈ 30,864 lbs — 30.9× the PSM TQ. Glyphward pre-scan gate interception at this surface prevents the AI from acting on the adversarially manipulated rendered image. Free tier — 10 scans/day, no card required.

2. H₂SO₄:CaF₂ molar feed-ratio display AI (Yokogawa ROTAMASS Coriolis / Emerson Micro Motion 2700 / ABB CoriolisMaster FCB450 mass flow meter ratio display — rendered DCS molar ratio calculation display AI classifying H₂SO₄:CaF₂ against 1.05–1.10 mol/mol design — 88th upward attack; FIRST HF production attack)

The stoichiometry of HF production requires exactly 1 mole of H₂SO₄ per mole of CaF₂ (CaF₂ MW 78.08 g/mol; H₂SO₄ MW 98.08 g/mol; mass ratio 98.08/78.08 = 1.257 kg H₂SO₄ per kg CaF₂). In plant operation, a 5–10% excess of H₂SO₄ is maintained—a design H₂SO₄:CaF₂ molar ratio of 1.05–1.10—to ensure complete CaF₂ conversion and maximize HF yield per tonne of fluorspar charged, since CaF₂ is typically the more expensive raw material. The molar ratio is computed in the DCS by dividing the H₂SO₄ mass flow (measured by Coriolis meter on the acid line) by 98.08 and dividing the CaF₂ mass flow (measured by belt-scale or Coriolis on the solid feeder) by 78.08, then taking their ratio. This computed value is rendered as a digital readout in the DCS historian display, updated every 30 seconds, and is the primary variable read by the AI monitoring system. A deficit in H₂SO₄ (ratio below 0.95 mol/mol) leads to incomplete CaF₂ conversion: unreacted CaF₂ passes through the kiln and appears in the anhydrite discharge, where it constitutes both a yield loss and a disposal complication (CaF₂ in anhydrite requires co-disposal classification in many jurisdictions). Conversely, excess H₂SO₄ (ratio exceeding 1.20 mol/mol) creates a different hazard: at discharge-zone temperatures of 250–280°C, the excess H₂SO₄ vaporizes and appears in the HF gas stream as H₂SO₄ mist and SO₃ vapor. These sulfur-containing species are carried by the HF gas flow into the primary condenser, where they co-condense with HF. The resulting HF-H₂SO₄ condensate is significantly more corrosive to the aluminum condenser vessels used at some facilities (Monel condensers are used at others, but aluminum is common for cost reasons) because the mixed acid attacks aluminum passivation at temperatures above –15°C. More critically, concentrated H₂SO₄ in the HF product stream—even at 1–3 wt%—is an out-of-specification product: customers including semiconductor fabs (which use ultra-high-purity HF for silicon wafer etching) will reject contaminated HF, but more importantly, H₂SO₄ contamination in HF used in UF₆ production for nuclear enrichment creates serious downstream problems in conversion plant fluorinators.

The adversarial attack on the molar ratio display presents 1.0 mol/mol on the rendered DCS display when the true H₂SO₄:CaF₂ ratio is 1.45 mol/mol—a deviation of +0.45 mol/mol above the design maximum of 1.10. The AI reads the rendered ratio as slightly below stoichiometric, interprets this as insufficient H₂SO₄ dosing, and commands the H₂SO₄ feed pump to increase its output—a reasonable and correct response to a genuine under-dosing condition. As the actual ratio climbs from 1.45 to 1.65 mol/mol, the kiln now contains 0.65 mol excess H₂SO₄ per mol CaF₂—equivalent to approximately 15–20 wt% free sulfuric acid in the slurry beyond what is needed for stoichiometric reaction. At the 250–280°C discharge zone, this excess H₂SO₄ has a vapor pressure of 0.3–1.5 mmHg, sufficient to generate several hundred ppm of H₂SO₄ mist in the 120–150°C HF gas stream exiting the kiln cold end. The condenser receives this H₂SO₄/HF mixture: at –25°C, H₂SO₄ condenses essentially completely alongside HF, so the liquid HF product contains 8–12 wt% H₂SO₄—far above the maximum 0.05 wt% specification for acid-grade HF. The dual OSHA PSM exposure is triggered: concentrated H₂SO₄ (≥93 wt%) has a PSM TQ of 1,000 lbs, identical to HF. At Honeywell Geismar (100,000 t/yr HF capacity), H₂SO₄ inventory in the condenser receiver containing contaminated HF product can reach 5,000–8,000 kg of H₂SO₄—5–8× the PSM TQ—with the additional hazard that a downstream fluoropolymer customer receiving contaminated HF may experience catastrophic corrosion in their fluorination reactors. Glyphward's pre-scan gate at the molar ratio display prevents the AI from reading the adversarially manipulated ratio value and issuing inappropriate H₂SO₄ addition commands. Free tier — 10 scans/day, no card required.

3. HF condenser exit temperature display AI (Yokogawa EJA430A / Emerson Rosemount 644 condenser wall temperature / ABB TB82PH condenser outlet temperature — rendered refrigeration system SCADA display AI classifying HF condenser exit temperature against –25°C ±3°C design — 88th upward attack; FIRST HF production attack; FIRST fluorspar CaF₂ attack)

The primary HF condenser in the Müller-Kühne process is the single most critical piece of equipment for preventing HF emissions to atmosphere: it is the point at which gaseous HF is converted to liquid HF product and separated from non-condensable impurities (SiF₄, SO₂, air). Condensation is performed at –25 to –30°C, providing a 5–10°C margin below the HF boiling point of –19.5°C to ensure complete liquefaction of all but trace HF vapor. The condenser exit temperature—the temperature of the liquid HF leaving the condenser and flowing to the HF receiver tank—is the primary process variable indicating whether the refrigeration system is maintaining adequate cooling duty. The refrigeration system itself typically uses ammonia or HFC refrigerant in a closed loop, with the condenser wall temperature (measured by the Emerson Rosemount 644 or Yokogawa EJA430A sensor mounted on the external condenser shell) as a proxy for the internal HF temperature. The HF condenser exit temperature is rendered by the refrigeration-system SCADA panel (typically a separate Honeywell Experion PKS or Yokogawa CENTUM VP subsystem) as a color-coded analog gauge with a digital readout overlaid, updated every 15 seconds. The AI monitoring system reads this rendered image to verify that the condenser is operating within its design temperature window. If the condenser exit temperature rises above –20°C, HF vapor carry-through to the downstream equipment increases sharply (HF vapor pressure at –20°C ≈ 760 mmHg — i.e., HF boils at exactly –20°C, so at –20°C the condenser provides essentially zero liquid HF condensation). The non-condensable SiF₄ and SO₂ gases, along with uncondensed HF vapor, pass to a water scrubber or NaOH absorber designed for non-condensable flows—not for the full HF gas stream from the kiln.

In the adversarial scenario against the HF condenser exit temperature display, the rendered condenser SCADA display is perturbed to show –26°C (within normal operating range, well below the HF boiling point) when the actual condenser exit temperature is –8°C. At –8°C, the condenser is operating 11.5°C above the HF boiling point of –19.5°C; the HF vapor pressure at –8°C is approximately 1,100 mmHg (1.45 atm)—meaning HF is superheated gas at this temperature, not liquid. The AI reads the displayed –26°C and determines the refrigeration system is operating normally; it does not issue any alarm or refrigeration adjustment command. In reality, essentially all HF gas leaving the kiln is passing through the condenser uncondensed and entering the downstream NaOH scrubber—a vessel sized for non-condensable gas flows of perhaps 5–10% of the total kiln HF output (i.e., designed for ∼2–5 kg HF/hr carry-through, not for 100% of the 5,000–20,000 kg HF/hr production flow at large facilities). Within minutes, the NaOH absorber becomes saturated: the NaOH (typically 10 wt% NaOH solution) is neutralized by HF (HF + NaOH → NaF + H₂O; ΔH = –56 kJ/mol) and depleted to below 1 wt% NaOH, at which point the absorption efficiency falls sharply. HF begins to break through the NaOH scrubber to the atmosphere. At ACGIH TLV-C of 0.5 ppm HF (the most stringent occupational ceiling limit), the downwind atmospheric HF concentration at 50 m from a facility releasing 1 kg/min HF exceeds 0.5 ppm under Pasquill-Gifford stability class D (neutral) conditions. Mexichem Fluor (San Luis Potosí, 200,000 t/yr) operates adjacent to an urban area; Honeywell Geismar, LA is in a community adjacent to the Mississippi River corridor already burdened by cumulative industrial air quality impacts. HF at 30 ppm (IDLH) causes immediate severe respiratory tract damage; at 100 ppm, inhalation exposure is immediately life-threatening. The Glyphward pre-scan gate at the condenser exit temperature display surface intercepts the adversarially manipulated image before the AI reads it, preventing the AI from incorrectly validating condenser operation and allowing the actual thermal breakthrough to continue undetected. Free tier — 10 scans/day, no card required.

Integration: hydrogen fluoride production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the hydrogen fluoride production AI pipeline—before the rotary kiln temperature profile AI processes rendered Yokogawa EJA530A / Emerson Rosemount 3031 / ABB TA10 kiln shell thermocouple SCADA display images, before the H₂SO₄:CaF₂ molar ratio AI processes rendered Yokogawa ROTAMASS / Emerson Micro Motion / ABB CoriolisMaster DCS molar ratio calculation display images, and before the HF condenser exit temperature AI processes rendered Yokogawa EJA430A / Emerson Rosemount 644 / ABB TB82PH refrigeration system SCADA condenser outlet display images. Threshold 42 for HF production AI reflects: OSHA PSM 29 CFR 1910.119 dual TQ 1,000 lbs (anhydrous HF TQ 1,000 lbs AND concentrated H₂SO₄ ≥93 wt% TQ 1,000 lbs simultaneously present); IDLH 30 ppm; ACGIH TLV-C 0.5 ppm ceiling (one of the most stringent inorganic acid TLVs); systemic fluoride poisoning via skin penetration (hypocalcemia → cardiac arrhythmia at sub-lethal dermal exposures); Müller-Kühne kiln temperature inertia (90-minute lag between temperature deviation and operator detection at PSM-required check intervals); HF supply chain criticality (aluminum, nuclear, semiconductor, refrigerant industries); Mexichem Fluor/Orbia (San Luis Potosí, Mexico—world’s largest HF producer, ∼200,000 t/yr, dual-PSM PSM Program 3 plant); Honeywell International (Geismar, LA—∼100,000 t/yr, Mississippi River corridor community right-to-know); Solvay Fluor (Onsan, South Korea—major Asian HF producer, fluoropolymer supply chain); Lanxess (Krefeld, Germany—European HF production, formerly Bayer CropScience HF plant, REACH-regulated dual PSM equivalent under Seveso III Directive).

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Hydrogen fluoride (HF) production AI contexts: threshold 42
# OSHA PSM anhydrous HF TQ 1,000 lbs (29 CFR 1910.119 App. A).
# OSHA PSM concentrated H2SO4 ≥93 wt% TQ 1,000 lbs (dual PSM).
# IDLH 30 ppm; ACGIH TLV-C 0.5 ppm (ceiling).
# Müller-Kühne process CaF2 + H2SO4 → 2HF + CaSO4.
# 88th upward attack.
HF_PRODUCTION_GLYPHWARD_THRESHOLD = 42

class HFProductionContext(StrEnum):
    KILN_TEMPERATURE_PROFILE   = auto()  # rotary kiln thermocouple array (88th upward; FIRST HF production; FIRST Müller-Kühne)
    H2SO4_CAF2_MOLAR_RATIO     = auto()  # H2SO4:CaF2 feed ratio (dual PSM: HF + H2SO4)
    CONDENSER_EXIT_TEMPERATURE = auto()  # HF condenser exit T (IDLH 30 ppm if condenser fails)

async def scan_hf_production_frame(
    frame_b64: str,
    context: HFProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_hf_production(
    frame_b64: str,
    context: HFProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_hf_production_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= HF_PRODUCTION_GLYPHWARD_THRESHOLD:
        raise AdversarialHFProductionImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from HF production AI pipeline."
        )

class AdversarialHFProductionImageError(RuntimeError):
    pass