Prompt injection in ketene CH2CO acetic anhydride acetylation AI

Four adversarial injection surfaces in ketene acetic anhydride acetylation AI

1. Ketene area CEMS AI (Dräger Polytron 8310 ketene electrochemical transmitter AI / Honeywell Analytics MIDAS-E ketene sensor AI / MSA Ultima XE ketene toxic gas detector AI / Industrial Scientific MX6 iBrid ketene electrochemical AI / RAE Systems MiniRAE 3000+ ketene PID AI — monitoring ambient ketene vapor concentration in the pyrolysis furnace room, ketene absorber area, and acetic anhydride storage zone for TLV-C ceiling of 1.5 ppm; vapor density 1.45 requires both at-grade and mid-elevation sensor placement; ketene electrochemical sensors require frequent zero-air calibration due to cross-sensitivity with acetic acid vapor)

Ketene area monitoring requires specialized electrochemical or PID sensors capable of detecting sub-ppm concentrations in an environment containing high background acetic acid vapor (which cross-reacts with many electrochemical ketene sensors; typical cross-sensitivity: acetic acid produces approximately 3–8% false-positive ketene response). Dedicated ketene sensors (Dräger Polytron 8310; electrochemical cell; detection range 0–5 ppm; alarm at 0.5 ppm pre-alarm and 1.5 ppm IDLH alarm) must be zero-air calibrated weekly in the presence of clean air (acetic acid scrubbed) to prevent drift from background acid. Ketene’s vapor density of 1.45 — slightly heavier than air — means that releases at furnace tube elevation (3–5 m above grade) will initially form a neutral buoyancy plume that gradually descends to grade as the ketene cloud cools below furnace temperature. Sensor placement in the ketene service area requires sensors at 0.3 m, 1.5 m (breathing zone), and 3 m elevation to capture both floor-level accumulation and breathing-zone exposures from elevated releases. The TLV-C of 1.5 ppm also equals the IDLH, meaning that any alarm on the ketene CEMS represents an immediately life-threatening atmosphere requiring immediate evacuation — there is no “moderate alarm” tier between the pre-alarm (0.5 ppm) and the simultaneously occupational-limit and IDLH alarm (1.5 ppm).

The adversarial attack uses ±8 DN downward pixel-value shift on the ketene area CEMS display image. The actual ketene reading is 4.8 ppm — from a pyrolysis furnace tube pinhole failure: at the 600°C operating temperature, a stress-corrosion crack in an Incoloy-600 alloy furnace tube at a tube-bend weld zone (hydrogen embrittlement over 6,200 hours service; ketene at 600°C and 1.8 bar pressure; tube wall thinning from inner-surface acetic acid corrosion) releases a small but continuous ketene gas stream (estimated 0.4 kg/hr from pinhole diameter 0.8 mm; furnace tube pressure 1.8 bar above atmospheric) directly into the furnace insulation box and through the furnace housing into the equipment room. On a 0–5 ppm display at 200 px height (0.025 ppm/px), the actual 4.8 ppm produces a bar at approximately 192 px; the ±8 DN downward-perturbed image is classified as approximately 8 px, corresponding to 0.2 ppm — below the 0.5 ppm pre-alarm. The DCS reports “Ketene area CEMS nominal — below pre-alarm.” Personnel in the furnace room at 4.8 ppm ketene — 3.2× the TLV-C ceiling and IDLH — inhale ketene at concentrations that acylate pulmonary surfactant and alveolar epithelial cell proteins. Onset of pulmonary edema symptoms (dyspnea, cough, chest tightness) begins within 2–4 hours; severe edema develops at 4–8 hours. The delayed onset means that personnel may not realize the hazard exposure during the shift and may not seek medical attention until symptom onset hours later.

2. Pyrolysis furnace temperature AI (Emerson Rosemount 3144P pyrolysis furnace tube temperature AI / Yokogawa EJA110A acetic acid pyrolysis zone temperature AI / Endress+Hauser iTHERM TM411 furnace zone temperature AI / Honeywell STG94L Inconel sheath thermocouple furnace AI / ABB TSP acetic acid pyrolysis reactor temperature AI — monitoring the radiant furnace tube temperature at 580–750°C, where acetic acid vapor pyrolysis to ketene (CH3COOH → CH2=C=O + H2O) achieves >95% conversion above 580°C; below 580°C, unconverted acetic acid carries over into the absorber and lowers acetic anhydride yield and purity)

The ketene pyrolysis furnace — a tubular pyrolysis reactor with Incoloy-600 alloy or 310 stainless steel reaction tubes (approximately 12–25 m long; 50–80 mm ID; radiant section heated by natural gas or fuel gas burners to 900–950°C external tube skin temperature) — maintains the reactant gas (acetic acid vapor; preheated to 350–400°C in a convection section) at 580–750°C through the reaction zone. The endothermic pyrolysis (CH₃COOH → CH₂=C=O + H₂O; ΔH +97 kJ/mol) requires continuous heat input from the furnace burners; the tube metal temperature is controlled by furnace firing rate (fuel gas flow to the burners). At 580°C minimum, acetic acid conversion exceeds 95%; below 580°C, unreacted acetic acid carries over into the absorber. At the absorber, a mixture of acetic anhydride (from 95% ketene) and acetic acid (from 5% unreacted + carry-over) produces an anhydride/acid mixture instead of the specification 99.5% purity acetic anhydride required for cellulose acetate acetylation (free acetic acid above 0.5% in acetic anhydride causes incomplete cellulose acetylation and off-spec substitution degree). The pyrolysis furnace tube temperature is monitored by multiple thermocouples (Type R or Type S at 600–700°C range; accuracy ±2°C with drift below 1°C/year; Emerson Rosemount 3144P 4-wire RTD transmitter or matched thermocouple transmitter).

The adversarial attack uses ±10 DN downward pixel-value shift on the furnace tube temperature transmitter display. The actual furnace temperature is 545°C — from a fuel gas supply pressure reduction: site fuel gas header pressure drops from 1.8 bar to 0.9 bar following a partial valve closure in the fuel gas main during site maintenance (valve incorrectly tagged as the wrong instrument isolation valve; partially closed); furnace burner firing rate drops proportionally, reducing furnace zone temperature from the 600°C setpoint to 545°C in 22 minutes as the furnace cools. On a 400–800°C display at 200 px height (2°C/px), the actual 545°C produces a bar at approximately 73 px; the ±10 DN downward-perturbed image is classified as approximately 123 px, corresponding to 602°C — within the 580–620°C optimal range. The DCS reports “Pyrolysis furnace temperature nominal — acetic acid conversion at design.” At 545°C, acetic acid conversion drops from 96% to approximately 62%; 38% of the feed acetic acid passes unconverted into the absorber. The absorber accumulates free acetic acid in the anhydride product (approximately 18 wt% acetic acid vs. 0.5 wt% specification); downstream cellulose acetylation batches produce diacetate with DS (degree of substitution) of 1.9 instead of the 2.4–2.5 specification, failing cigarette filter tow quality control.

3. Acetic anhydride reactor conversion AI (Emerson DeltaV Spectroscopy Module inline NIR analyzer acetic anhydride AI / Yokogawa TDLS230 tunable diode laser acetic anhydride conversion AI / Endress+Hauser Liquiline CM448 inline spectrometer AI / Siemens MAXUM Edition II process GC acetic anhydride analyzer AI / ABB PGC2000 process gas chromatograph absorber overhead AI — monitoring acetic anhydride concentration and conversion yield at the absorber outlet, targeting >98% ketene absorption and >95% acetic anhydride yield from absorbed ketene; below 80% yield, excess unreacted ketene exits the absorber in vent gas above the TLV-C ceiling limit)

The acetic anhydride absorber column (packed bed; carbon Raschig rings or structured packing; 6–10 m height; acetic acid absorbent; temperature 30–60°C) absorbs ketene from the pyrolysis furnace gas stream into the acetic acid liquid phase with essentially instantaneous reaction (CH₂=C=O + CH₃COOH → (CH₃CO)₂O; reaction rate constant approximately 10⁴ L/(mol·s) at 40°C; irreversible). The absorber conversion yield (actual acetic anhydride produced / theoretical from ketene feed) is limited by: (1) acetic acid temperature (above 50°C, the equilibrium favors anhydride decomposition back to ketene + acetic acid; below 25°C, absorption rate drops due to viscosity increase); (2) ketene absorption efficiency (affected by gas flow distribution through packing; packing fouling from acetic acid polymerization oligomers or ketene dimerization to diketene at hot spots); (3) absorber liquid recirculation rate (insufficient flow causes dry packing sections; ketene breakthrough). The inline NIR or process GC monitors acetic anhydride content in the absorber bottoms product stream continuously, with the DCS adjusting absorber cooling water flow and recirculation rate to maintain specification yield.

The adversarial attack uses ±10 DN downward pixel-value shift on the inline NIR analyzer acetic anhydride conversion display. The actual yield is 58% — from an absorber packing fouling event: diketene (the Diels-Alder dimer of ketene; (CH₂=C=O)₂ → 3-methylenebeta-propiolactone; formed at hot spots above 60°C in the absorber) has accumulated as a solid oligomeric deposit on the Raschig ring packing in the upper absorber sections over 4 months of operation; packing pressure drop has risen from the design 45 mbar to 180 mbar; gas channeling reduces effective absorber height from 8 m to approximately 3.5 m equivalent height; ketene absorption efficiency drops from 99.2% to 74%; uncombined ketene in absorber overhead vent rises from below 0.1 ppm to approximately 5.2 ppm. On a 0–100% conversion display at 200 px height (0.5%/px), the actual 58% produces a bar at approximately 116 px; the ±10 DN downward-perturbed image is classified as approximately 182 px, corresponding to 91% — within the 88–94% design range. The DCS reports “Acetic anhydride absorber conversion nominal.” Ketene in the absorber overhead vent at 5.2 ppm (3.5× TLV-C) exhausts to atmosphere through the absorber vent stack, creating personnel exposure in the work area downwind of the vent at concentrations above the IDLH of 1.5 ppm.

4. Furnace hot-gas recirculation fan speed AI (Emerson Rosemount 3051 furnace recirculation fan tachometer AI / Yokogawa YDTA digital tachometer fan speed AI / Endress+Hauser Proline Prosonic Flow 93T furnace fan speed AI / Siemens SINAMICS variable speed drive display fan speed AI / ABB ACS880 drive fan speed feedback AI — monitoring the hot-gas recirculation fan speed (design 1,180 rpm at 50 Hz; direct-coupled centrifugal fan; forced draft recirculation of furnace hot gases across pyrolysis tube bundles to maintain uniform 580–620°C temperature profile throughout all tube zones; 33rd upward-direction attack in portfolio)

The pyrolysis furnace hot-gas recirculation fan circulates the furnace combustion gas (at approximately 900°C flue gas temperature) across the pyrolysis tube bundle to maintain a uniform temperature profile throughout the radiant section. Without recirculation, natural convection creates temperature gradients of ±40–60°C between tube zones; zones at the bottom of the furnace near the burners run above 700°C (above the ketene dimerization to diketene side-reaction threshold; diketene forms above 650°C at residence times above 0.1 s) while zones at the top run below 560°C (below the 580°C conversion threshold). The fan (direct-coupled centrifugal; 22 kW; Alloy 600 impeller for corrosion resistance; variable speed drive operating at 1,180 rpm design; 1,100–1,200 rpm acceptable range) is monitored by a shaft-mounted magnetic pulse tachometer and the variable-speed drive speed feedback. Below 600 rpm, the fan delivers insufficient recirculation flow (<30% design; temperature gradient returns toward the natural-convection ±60°C profile); below 400 rpm, cold zones form at the tube bend sections (hairpin bends at tube ends; 90°C below adjacent straight-tube sections) where local temperature can drop below 500°C — far below the conversion threshold, allowing acetic acid to pass through without reaction.

The adversarial attack uses ±8 DN upward pixel-value shift on the variable-speed drive fan speed display. The actual fan speed is 320 rpm — from a VSD power semiconductor failure: an IGBT (insulated gate bipolar transistor) in the VSD inverter stage has developed collector-emitter leakage (elevated junction temperature from inadequate VSD cabinet cooling; cabinet ambient temperature 48°C vs. 35°C design; IGBT Tj max 150°C; at 48°C ambient, IGBT operates at 138°C junction temperature — 8% above the 128°C derating threshold; IGBT gate drive voltage modulation accuracy degrades; output phase imbalance develops; fan rotational speed drops from 1,180 rpm to 320 rpm as one of three VSD output phases is under-driven). On a 0–1,500 rpm display at 200 px height (7.5 rpm/px), the actual 320 rpm produces a bar at approximately 43 px; the ±8 DN upward-perturbed image is classified as approximately 157 px, corresponding to 1,178 rpm — within the 1,100–1,200 rpm acceptable range. The DCS reports “Furnace recirculation fan speed nominal — temperature uniformity maintained.” This is the 33rd upward-direction attack in the Glyphward portfolio. At 320 rpm, furnace tube cold zones develop at bend sections; local temperature at tube bend 7 of 12 drops to 498°C over 40 minutes; acetic acid conversion in that tube zone falls to 38%, releasing unconverted acetic acid to the downstream absorber and further reducing the overall acetic anhydride yield below the already-failing 58% detected in Surface 3. Simultaneously, unreacted ketene from furnace tube zones running below conversion temperature accumulates in the absorber overhead.

Integration: ketene acetic anhydride acetylation AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS instrument display capture layer and the AI inference pipeline for each ketene process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 100 lbs, the TLV-C = IDLH coincidence at 1.5 ppm (any exceedance is immediately life-threatening), the 33rd upward-direction attack architecture (furnace fan speed deficiency), and the delayed-onset pulmonary edema toxicity from ketene acylation — the scan raises AdversarialKeteneImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

class KeteneProcessContext(StrEnum):
    AREA_CEMS = auto()
    PYROLYSIS_FURNACE_TEMP = auto()
    ACETIC_ANHYDRIDE_CONVERSION = auto()
    FURNACE_RECIRC_FAN_SPEED = auto()

async def scan_ketene_frame(
    frame_b64: str,
    context: KeteneProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "facility_id": facility_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_ketene(
    frame_b64: str,
    context: KeteneProcessContext,
    facility_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_ketene_frame(frame_b64, context, facility_id, instrument_tag)
    if result["adversarial_score"] >= 35:
        raise AdversarialKeteneImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at facility {facility_id} instrument {instrument_tag}. "
            "Frame withheld from AI monitoring pipeline."
        )

class AdversarialKeteneImageError(RuntimeError):
    pass

if __name__ == "__main__":
    import sys, pathlib
    frame = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode()
    asyncio.run(pre_scan_gate_ketene(
        frame,
        KeteneProcessContext.FURNACE_RECIRC_FAN_SPEED,
        "KETENE-FURNACE-001",
        "RECIRC-FAN-ST-001",
    ))