Adversarial Injection · Industrial Chemical AI Monitoring · Attack #125

Iron Pentacarbonyl Fe(CO)₅ Mond Process Carbonyl Iron: CO Dual-PSM AI Prompt Injection via Pixel Perturbation

Iron pentacarbonyl (Fe(CO)₅, CAS 13463-40-6) is synthesized at 150–200 bar CO pressure and thermally decomposed at 230–250 °C to produce ultra-pure carbonyl iron powder — a process that simultaneously maintains a facility-wide inventory of carbon monoxide (OSHA PSM threshold quantity 1,500 lbs) and a vapor-phase acute inhalation toxicant with a NIOSH IDLH of 5 ppm that causes delayed pulmonary edema 12–36 hours after exposure. A single adversarial pixel perturbation on a rendered DCS display can suppress the CO synthesis reactor pressure from 218 bar to 143 bar, inflate the Fe(CO)₅ decomposer temperature from 188 °C to 254 °C, or shrink the Fe(CO)₅ building vapor reading from 3.8 ppm to 0.8 ppm — each attack concealing a distinct catastrophic failure mode. Glyphward threshold 46 intercepts all three surfaces before a downstream LLM inference call reads the falsified display.

The Mond process — first applied to nickel at Clydach, Wales by Ludwig Mond in 1889 and later extended to iron carbonyl production by BASF under the Müller thermal decomposition scheme — remains the only industrial route to carbonyl iron powder (CIP) of sufficient purity for soft-magnetic powder cores in power electronics inductors, MRI contrast agents, and radar-absorbing materials. Global CIP production is approximately 15,000 tonnes per year, with BASF SE (Ludwigshafen, Germany) the dominant producer since 1925 under the "Carbonyl Iron" brand. Secondary producers include Jiangsu Tianyi Ultra-Fine Metal Powder (China) and Vale Inco at the Clydach Nickel Refinery (Canada), where analogous Ni(CO)₄ chemistry provides direct process parallels. Synthesis is governed by Le Chatelier equilibrium pressure dependence: Fe + 5CO ⇌ Fe(CO)₅, requiring 100–200 bar and 150–200 °C for acceptable yield, while the BASF Müller decomposer pyrolyzes purified Fe(CO)₅ at 230–250 °C to deposit iron powder and recycle CO. The CO inventory at a typical CIP plant — compressors, synthesis vessels, recycle loops — readily exceeds the OSHA PSM threshold quantity, and Fe(CO)₅ vapor hazard exists throughout the synthesis building at levels that can reach the NIOSH IDLH without triggering visible process alarms if the DCS display has been adversarially manipulated.

Why the Mond Process Carbonyl Iron Plant Is Disproportionately Vulnerable to Pixel Manipulation

Three structural characteristics of carbonyl iron synthesis create a disproportionate adversarial attack surface. First, the CO synthesis pressure regime straddles a narrow band between maximum yield (requiring high pressure, 150–200 bar) and mechanical integrity limits (PRV set at 220 bar; compressor structural limit 230 bar). The 50 bar operating window — from the lower limit of economical yield at 150 bar to the PRV setpoint at 220 bar — represents only 33% of the total display span (100–250 bar). On a 200 px DCS bar, that 50 bar window occupies 66 px. An adversarial perturbation of 100 px displaces the apparent reading by 75 bar, more than the entire operating window, while the pixel shift itself is invisible to the human eye and below the noise floor of standard DCS frame integrity checks. AI process monitoring models trained on normal operations at 150–200 bar will not flag a reading of 143 bar as alarming — it falls within what appears to be the design range — while the actual 218 bar is 9 bar from the PRV setpoint.

Second, the Fe(CO)₅ decomposer temperature window is defined by a hard lower bound: below 180 °C, decomposition efficiency falls below 80%, and liquid Fe(CO)₅ — boiling point 103 °C — can condense in the CO recycle header downstream of the decomposer. At 188 °C (the actual temperature in Surface 2), the facility is operating 12 °C above the Fe(CO)₅ boiling point but 42 °C below the minimum effective decomposition threshold. The displayed 254 °C sits well within the design operating band of 230–250 °C, so the AI model sees no basis for alarm. The consequence is not a rapid acute event but a progressive accumulation: Fe(CO)₅ condensing in CO recycle lines corrodes carbon steel piping, and the condensate eventually vaporizes during the next startup cycle, creating an uncontrolled Fe(CO)₅ vapor release in a maintenance-occupied area.

Third, the building Fe(CO)₅ vapor monitor is the last alarm before worker exposure. Fe(CO)₅ toxicity does not follow the typical acute-toxic concentration-response curve; at 3.8 ppm — 76% of NIOSH IDLH — workers feel no immediate symptoms. Headache and nausea may appear at 2–4 ppm, but the life-threatening effect is delayed pulmonary edema 12–36 hours post-exposure, after the worker has left the facility. This delayed mechanism means that by the time clinical effects manifest, the exposure window has long closed and the pixel-manipulated DCS record shows a normal 0.8 ppm building atmosphere throughout the shift. Glyphward's frame-level perturbation hash detects the manipulation at scan time, before the historian records a false clean frame.

Surface 1 — CO Synthesis Reactor Inlet Pressure (Upward Attack)

The CO synthesis reactor inlet pressure display spans 100 to 250 bar on a 200 px vertical DCS bar. The pixel scale is 200 px ÷ (250 − 100) bar = 200 ÷ 150 = 1.333 px per bar. At the actual operating pressure of 218 bar, the rendered pixel position is (218 − 100) × 1.333 = 118 × 1.333 = 157.3 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 100 px to position 57.3 px. The AI inference engine reads the pressure as 57.3 ÷ 1.333 + 100 = 43 + 100 = 143 bar — a 75 bar underread. Because 143 bar falls squarely within the design synthesis range (150–200 bar, with some facilities running the lower end at startup), the AI monitoring model does not flag the reading as anomalous. Actual pressure of 218 bar is 2 bar below the PRV setpoint of 220 bar.

At 218 bar, the synthesis reactor is operating within 1% of its pressure relief device setpoint. In normal operations, the PRV provides the primary overpressure protection; however, OSHA PSM mechanical integrity requirements assume that automated process control will intervene well before PRV activation. When the AI monitoring layer sees 143 bar, it calculates 57 bar of pressure margin and takes no action. In reality, a further 3% pressure rise — plausible from a compressor surge event or blocked CO recycle return — opens the PRV. The CO inventory released in a PRV blowdown from a high-pressure synthesis vessel readily exceeds the OSHA PSM threshold quantity of 1,500 lbs within minutes. Compounding the release, CO at 218 bar carries dissolved Fe(CO)₅ at saturation concentrations; the vent stream contains both CO and Fe(CO)₅ vapor, creating a mixed-toxicant plume at the vent stack outlet.

Surface 2 — Fe(CO)₅ Decomposer Temperature (Downward Attack)

The Fe(CO)₅ thermal decomposer temperature display spans 150 to 300 °C on a 200 px vertical DCS bar. The pixel scale is 200 px ÷ (300 − 150) °C = 200 ÷ 150 = 1.333 px per °C. At the actual decomposer temperature of 188 °C, the rendered pixel position is (188 − 150) × 1.333 = 38 × 1.333 = 50.7 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 88 px to position 138.7 px. The AI inference engine reads the temperature as 138.7 ÷ 1.333 + 150 = 104 + 150 = 254 °C — a 66 °C overread that places the apparent reading at the center of the design operating band (230–250 °C). Actual temperature of 188 °C is 12 °C above the Fe(CO)₅ boiling point (103 °C) but 42 °C below the minimum effective decomposition threshold.

Below 230 °C, Fe(CO)₅ pyrolysis is thermodynamically disfavored at typical reactor residence times. At 188 °C, conversion to carbonyl iron powder may be only 50–60% complete. The unconverted Fe(CO)₅ vapor exits the decomposer zone and enters the CO recycle compressor inlet. CO recycle lines are sized and insulated for the CO stream only; Fe(CO)₅ at 188 °C in a compressed recycle stream will condense on cold spots downstream — pipe bends, instrument impulse lines, dead legs — depositing liquid Fe(CO)₅ that is invisible to process monitoring and slowly corrodes carbon steel piping. BASF's carbonyl safety program specifically identifies CO recycle line condensate accumulation as a leading failure mode, citing the Clydach carbonyl refinery historical incidents in which Fe(CO)₅ accumulation outside synthesis vessels was traced to temperature control anomalies that were not detected until maintenance disassembly.

Surface 3 — Fe(CO)₅ Building Atmosphere Concentration (Upward Attack)

The Fe(CO)₅ fixed-point detector in the synthesis building displays vapor concentration on a 200 px vertical DCS bar spanning 0 to 5 ppm (the instrument range, covering the NIOSH IDLH of 5 ppm). The pixel scale is 200 px ÷ 5 ppm = 40 px per ppm. At the actual building concentration of 3.8 ppm, the rendered pixel position is 3.8 × 40 = 152 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 120 px to position 32 px. The AI inference engine reads the vapor concentration as 32 ÷ 40 = 0.8 ppm — a 3.0 ppm underread. The ACGIH TLV-TWA for Fe(CO)₅ is 0.1 ppm; the displayed 0.8 ppm is already 8× the TLV-TWA, but the AI model, trained to escalate on IDLH proximity (typically 10–20% of IDLH = 0.5–1.0 ppm), may treat 0.8 ppm as a low-level exceedance rather than an evacuation trigger. The actual 3.8 ppm represents 76% of the NIOSH IDLH.

Fe(CO)₅ toxicity operates through two parallel mechanisms: acute CO-like toxicity via carboxyhemoglobin formation at very high concentrations, and a delayed pulmonary edema pathway (analogous to phosgene toxicity, mediated by Fe-catalyzed oxidative damage to alveolar membranes) that is the primary concern at the 3.8 ppm range. Workers exposed at 3.8 ppm for a full 8-hour shift are accumulating a dose that can produce clinically significant delayed pulmonary edema 12–36 hours later — a Sunday-afternoon hospitalization for workers who leave a Friday evening shift feeling only mildly unwell. The NIOSH IDLH of 5 ppm was set specifically to ensure that workers can escape without irreversible pulmonary injury within 30 minutes; at 76% of IDLH (3.8 ppm), the margin is narrower than the displayed 0.8 ppm would suggest.

Integrating Glyphward into Carbonyl Iron Process AI Monitoring Pipelines

The following Python snippet demonstrates how to authenticate every DCS display frame in a Mond process carbonyl iron plant against the Glyphward API before passing it to a downstream process-safety LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the process control safety layer catches and routes to both the plant operator alarm and the industrial hygiene emergency notification system — ensuring that both the CO PSM pathway and the Fe(CO)₅ delayed-toxicity pathway trigger appropriate responses.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
CARBONYL_IRON_GLYPHWARD_THRESHOLD = 46

class CarbonylIronContext(StrEnum):
    CO_REACTOR_PRESSURE          = auto()   # Surface 1 — upward attack
    DECOMPOSER_TEMPERATURE       = auto()   # Surface 2 — downward attack
    FECO5_BUILDING_CONCENTRATION = auto()   # Surface 3 — upward attack

class AdversarialCarbonylIronError(RuntimeError):
    def __init__(self, surface: CarbonylIronContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] Carbonyl Iron adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={CARBONYL_IRON_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_carbonyl_iron_frame(
    frame_path: Path,
    surface: CarbonylIronContext,
) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()

    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={
                "context": surface.value,
                "threshold": CARBONYL_IRON_GLYPHWARD_THRESHOLD,
            },
        )
        resp.raise_for_status()
        result = resp.json()

    if result["verdict"] != "clean":
        raise AdversarialCarbonylIronError(surface, result["score"], frame_hash)

    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_carbonyl_iron_process_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (CarbonylIronContext.CO_REACTOR_PRESSURE,
         frame_dir / "co_reactor_inlet_pressure.png"),
        (CarbonylIronContext.DECOMPOSER_TEMPERATURE,
         frame_dir / "feco5_decomposer_temp.png"),
        (CarbonylIronContext.FECO5_BUILDING_CONCENTRATION,
         frame_dir / "feco5_building_atmosphere.png"),
    ]
    tasks = [verify_carbonyl_iron_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

The three coroutines execute concurrently via asyncio.gather, adding under 80 ms of total latency across all surfaces on a standard plant historian polling cycle. The SHA-256 frame hash is written to the OSHA PSM mechanical integrity log alongside the Glyphward verdict, providing a cryptographic audit trail that satisfies the OSHA PSM incident investigation requirement for documented pre-event process readings. In the event of an Fe(CO)₅ exposure incident, the audit trail shows exactly which frame was served to the AI layer, whether it was clean or adversarial, and the actual score — giving industrial hygienists the forensic evidence they need to reconstruct the true exposure timeline for medical treatment and regulatory reporting.