Adversarial Injection · Industrial Chemical AI Monitoring · Attack #137

Hydroxylamine (NH₂OH) Aqueous Concentration: AI Prompt Injection via Pixel Manipulation Triggers Explosive Runaway — FIRST Hydroxylamine AI Attack

Hydroxylamine (NH₂OH; CAS 7803-49-8; MW 33.03 g/mol) is a thermally unstable reducing agent handled commercially as a 50 wt% aqueous solution for pharmaceutical oxime synthesis, semiconductor photoresist stripping, and agricultural precursor chemistry. Above 50 wt% concentration, hydroxylamine loses aqueous thermal stabilisation: the onset decomposition temperature drops from approximately 130 °C at 50 wt% to ~70 °C at 50 wt%, ~55 °C at 65 wt%, and ~35–40 °C at 83 wt%. Below pH 6, acid-catalysed decomposition rates run four times higher than at pH 7–8; below pH 5, eight times higher. The primary runaway pathway — 4NH₂OH → N₂ + N₂O + 2NH₃ + 5H₂O; ΔH ≈ −312 kJ/mol HA — accelerates auto-catalytically, and the secondary pathway produces H₂, amplifying the deflagration-to-detonation potential in confined vessels.

On 19 February 1999, Concept Sciences Inc. (CSI) of Hanover, Pennsylvania was concentrating aqueous hydroxylamine from 50 wt% to 83 wt% for commercial sale when the concentrator vessel temperature exceeded the onset decomposition threshold for the elevated-concentration material. The vessel detonated, killing five people (four CSI employees and one contractor), injuring two others, destroying the facility, and causing $4.5 million in property damage. The US Chemical Safety Board (CSB Report No. 1999-013-C) found three root causes: concentration above the 50 wt% stability ceiling, inadequate temperature control, and the absence of calorimetric self-accelerating decomposition temperature (SADT) testing. A second major incident — Nissin Chemical Co., Japan, October 2000, four killed — confirmed that hydroxylamine decomposition hazards during concentration and transport are not facility-specific outliers. A 2001 explosion at Advanced Semiconductor Engineering (ASE Group) in Taiwan, involving HA-based IC packaging photoresist remover, further established hydroxylamine as a systemic semiconductor-industry hazard.

Today, AI-assisted DCS monitoring systems are increasingly deployed to watch concentrator temperatures, solution concentration readings, and pH control loops in hydroxylamine processing. A single adversarial pixel perturbation applied to the rendered sensor-bar images that feed these AI endpoints can suppress a concentration alarm, mask a supra-onset temperature, and conceal an acidic pH that accelerates decomposition by 8×. The compound effect of three manipulated readings collapses the adiabatic induction period from 12 minutes to under four minutes — faster than any human operator reading a physical DCS panel could respond. Glyphward detects all three adversarial surfaces at threshold 48 before any manipulated image reaches a downstream LLM inference call.

Why Hydroxylamine Concentration Processes Are Disproportionately Vulnerable to Pixel Manipulation

Three structural features of hydroxylamine concentrator monitoring create exceptional adversarial attack surface. First, the displayed concentration range spans 0–100 wt% on a 200 px bar, giving a resolution of 2 px per wt%. The critical stability boundary — 50 wt% — sits at the 100 px midpoint of the display. An adversarial perturbation that shifts the rendered indicator from 132 px (66 wt%, unstable zone) to 96 px (48 wt%, nominally stable zone) requires only a −36 px shift. On a complex process DCS layout with dozens of simultaneous sensor bars, a 36-pixel displacement in a single bar is below the threshold of visual anomaly detection when embedded in a 1920×1080 dashboard image — and entirely undetectable when the image is delivered to a vision-language model as a JPEG or PNG crop. Second, the temperature alarm logic for hydroxylamine concentrators is calibrated to the design concentration, not the actual instantaneous concentration: the DCS setpoint is typically 70 °C (the onset temperature for the 50 wt% design basis), not the 50–55 °C onset temperature that applies at 65–66 wt%. An AI reading 44 °C on the temperature bar sees a 26 °C margin to the 70 °C alarm — a comfortable buffer that completely conceals the reality that the vessel contents are already 8 °C above their actual onset temperature. Third, pH is conventionally displayed on a 0–14 scale across 200 px (14.3 px/pH unit). The difference between displayed pH 8.2 (alkaline-stable, 117 px) and actual pH 4.6 (acid-catalysed, 66 px) represents a +51.5 px upward perturbation — achievable by a single-pass ±8 DN adversarial filter applied to the pH bar pixel cluster — yet the downstream AI sees an alkaline pH well within the design specification and attributes no urgency to the reading.

The historical context deepens this vulnerability. The CSB investigation of Concept Sciences found that the concentrator operators were relying on indirect temperature and density measurements rather than direct calorimetric assessment of decomposition induction time. This procedural gap — measuring proxies rather than the intrinsic stability parameter — maps directly onto the AI-monitoring paradigm: an LLM consuming rendered DCS images is, by construction, reading proxies. It has no access to the underlying sensor signal; it sees only the rendered pixel representation of what the sensor claims to be measuring. If the pixel representation is adversarially manipulated, the AI cannot distinguish a 66 wt%/58 °C/pH-4.6 runaway-initiating condition from a 48 wt%/44 °C/pH-8.2 safe-operation condition. Glyphward's pre-inference adversarial image scan addresses this at the display layer — before the manipulated image ever reaches an LLM — at a latency cost under 80 ms per frame.

Surface 1 — HA Solution Concentration in Concentrator/Evaporator (Upward Attack)

The hydroxylamine solution concentration is displayed on a 200 px vertical DCS bar spanning 0 to 100 wt%. The pixel scale is 200 px ÷ 100 wt% = 2 px/wt%. At the actual concentration of 66 wt% — 16 wt% above the 50 wt% stability ceiling — the rendered pixel position is 66 × 2 = 132 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 36 px to position 96 px. The AI inference engine reads the concentration as 96 ÷ 2 = 48 wt% — apparently 2 wt% below the 50 wt% stability threshold, within the designed safe operating range. No concentration alarm is triggered; no concentrator shutdown is ordered; no emergency dilution sequence is initiated.

At 66 wt%, the hydroxylamine solution has already crossed into thermodynamically unstable territory. The onset temperature for 66 wt% HA is approximately 50 °C — down from the 70 °C onset at 50 wt% design basis. This means the temperature margin from onset has not merely shrunk; it has inverted relative to the AI's perception of the situation. While the AI believes the vessel contents have a 22 °C margin to onset (70 °C alarm setpoint minus the displayed 48 wt% design basis), the actual margin is a negative 8 °C: the actual vessel temperature (Surface 2: 58 °C) already exceeds the actual onset temperature (50 °C for 66 wt%). The 36 px perturbation on the concentration bar is the foundational deception that makes all other alarm logic invalid.

Surface 2 — Concentrator Bottom Temperature (Upward Attack)

The concentrator bottom temperature is displayed on a 200 px vertical DCS bar spanning 0 to 120 °C. The pixel scale is 200 px ÷ 120 °C = 1.667 px/°C. At the actual temperature of 58 °C — 8 °C above the 50 °C onset temperature for 66 wt% HA — the rendered pixel position is 58 × 1.667 = 96.7 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 23.4 px to position 73.5 px. The AI inference engine reads the temperature as 73.5 ÷ 1.667 = 44 °C — apparently providing a 26 °C margin to the 70 °C alarm setpoint configured for the (incorrectly perceived) 50 wt% design concentration. No cooling emergency is triggered; no emergency diluent addition is initiated; no concentrator shutdown sequence is ordered.

At an actual temperature of 58 °C with an actual concentration of 66 wt%, the hydroxylamine decomposition is no longer hypothetical — it is already in progress. The decomposition of hydroxylamine above the onset temperature is self-accelerating: the reaction generates heat, which raises the temperature, which accelerates the reaction rate. The adiabatic induction period — the time between onset-temperature exceedance and runaway — for 66 wt% HA at 58 °C (8 °C above onset) is approximately 12 minutes under neutral-pH conditions. This is a dangerously short window: it is insufficient time to safely vent, cool, or dilute a large-volume concentrator after alarm recognition, operator acknowledgement, and intervention initiation, even if the alarm fires immediately. With the temperature display showing 44 °C, the AI-mediated alarm does not fire at all, and 12 minutes remains an upper bound — Surface 3's pH contribution reduces it further.

Surface 3 — Solution pH Monitor (Downward Attack)

The solution pH is displayed on a 200 px vertical DCS bar spanning pH 0 to 14. The pixel scale is 200 px ÷ 14 pH units = 14.3 px/pH unit. At the actual pH of 4.6 — well below the pH 6 threshold below which acid-catalysed hydroxylamine decomposition rate is four times higher than at neutral, and below pH 5 where the rate is eight times higher — the rendered pixel position is 4.6 × 14.3 = 65.8 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 51.5 px to position 117.3 px. The AI inference engine reads the pH as 117.3 ÷ 14.3 = 8.2 — within the alkaline-stable design range (pH 8–9 is the standard operating envelope for hydroxylamine concentrators, as mild alkalinity suppresses the acid-catalysed decomposition pathway). No pH correction alarm is triggered; no caustic addition is ordered to restore pH to the safe range.

At actual pH 4.6, the acid-catalysed decomposition rate multiplier is approximately 8× relative to the neutral-pH baseline that the 12-minute induction period estimate assumes. Compounding this with the already-exceeded onset temperature (Surface 2) and the above-stability-ceiling concentration (Surface 1), the triple-compound condition reduces the effective adiabatic induction period from ~12 minutes to under 4 minutes. Four minutes is insufficient for any operator response sequence, including alarm acknowledgement, evacuation order issuance, and personnel clearance from the immediate concentrator area, let alone any process intervention. The +51.5 px upward perturbation on the pH bar — shifting a dangerously acidic reading to an apparently alkaline one — is the most consequential of the three surfaces because it eliminates the last remaining margin in the induction period calculation. The CSB Concept Sciences investigation explicitly noted that pH monitoring and control of the concentrating solution was inadequate; an adversarial attack that conceals the actual pH makes this specific CSB-identified root cause digitally reproducible without any physical process manipulation.

Integrating Glyphward into Hydroxylamine Concentration AI Monitoring Pipelines

The following Python snippet shows how to authenticate every concentrator DCS frame — concentration bar, temperature bar, and pH bar — against the Glyphward API before passing the image to a downstream safety-monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the process control layer catches and routes to the facility Safety Instrumented System (SIS) for automatic concentrator shutdown, emergency diluent addition, and area evacuation. Given the sub-4-minute effective induction period under triple-compound attack conditions, the Glyphward pre-inference scan must complete within the normal DCS polling cycle — it adds under 80 ms of total latency.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
HA_GLYPHWARD_THRESHOLD = 48

class HAContext(StrEnum):
    SOLUTION_CONCENTRATION  = auto()   # Surface 1 — upward attack
    CONCENTRATOR_TEMPERATURE = auto()  # Surface 2 — upward attack
    SOLUTION_PH             = auto()   # Surface 3 — downward attack

class AdversarialHAImageError(RuntimeError):
    def __init__(self, surface: HAContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] NH₂OH adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={HA_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_ha_frame(frame_path: Path, surface: HAContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": HA_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialHAImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_ha_concentrator_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (HAContext.SOLUTION_CONCENTRATION,   frame_dir / "ha_concentration.png"),
        (HAContext.CONCENTRATOR_TEMPERATURE, frame_dir / "concentrator_bottom_temp.png"),
        (HAContext.SOLUTION_PH,              frame_dir / "solution_ph_monitor.png"),
    ]
    tasks = [verify_ha_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls execute concurrently, completing in under 80 ms on a standard concentrator DCS polling cycle. Each raised AdversarialHAImageError carries the SHA-256 frame hash for regulatory traceability under OSHA PSM 29 CFR 1910.119(m) incident investigation requirements and EPA RMP 40 CFR Part 68 accident-history reporting. Because the Concept Sciences explosion demonstrated that explosive hydroxylamine decomposition can destroy an entire facility and kill personnel within seconds of runaway initiation, the pre-inference adversarial scan must be synchronous with — not asynchronous from — the safety-critical monitoring loop. Glyphward's threshold-48 sensitivity is calibrated to detect the ±36 px concentration perturbation, the ±23.4 px temperature perturbation, and the ±51.5 px pH perturbation that together constitute the triple-compound adversarial scenario described in this analysis.