Prompt injection in large hydroelectric dam spillway gate control AI

Four adversarial injection surfaces in large hydroelectric dam spillway AI

1. Spillway radial gate position indicator camera AI (Cognex InSight gate position AI, Keyence CV-X gate camera AI, Banner Engineering gate position AI — spillway Tainter gate aperture verification AI)

Large hydroelectric dam spillways typically use radial (Tainter) gates — curved steel plate gates mounted on radial arms that rotate about a horizontal trunnion pin at the gate pier, operated by hydraulic cylinders or wire rope hoists — to control the flow over the spillway weir. A large spillway may have 5–20 Tainter gates, each 10–20 m wide and 8–18 m tall, with a full-open discharge capacity of 500–3,000 m³/s per gate at design reservoir level. The gate position is confirmed by position encoders on the gate hoist (measuring the angular position of the gate about its trunnion) and by visual confirmation cameras mounted on the gate piers looking across at the gate seal position against the spillway sill and pier concrete. During a flood event, the spillway gate opening schedule — specifying which gates to open, in which order, to what aperture, and at what rate — is an automated sequence executed by the gate control system in response to the reservoir level and rate-of-rise, with AI camera systems providing visual confirmation that each gate has opened to its commanded aperture (to detect hydraulic actuator failures, gate jamming by debris, or mechanical binding of the gate on the sill). AI systems process rendered camera images of each gate to classify gate status: closed (gate at zero aperture), partially open (gate between 0 and design aperture — comparing apparent gate-to-sill gap to the position encoder value), fully open (gate at full design aperture), and malfunction (camera image shows gate below commanded aperture — backup gate opening required, spillway capacity reduced).

An adversarial perturbation on a rendered spillway gate position camera image that suppresses the gate-to-sill gap below the commanded aperture — applying a ±8 DN darkening to the pixel region encoding the water discharge flow between the gate and the sill (reducing the apparent gate opening from partially-open to closed) — causes the spillway gate AI to classify a properly opening gate as closed and potentially command redundant gate opening operations that overload the gate control system, or — more consequentially — it can suppress a gate malfunction (a gate genuinely stuck below commanded aperture) by making the stuck gate appear open. If a gate is genuinely stuck at reduced aperture and the gate position AI classifies it as fully open (adversarial suppression of the reduced-aperture visual indicator), the spillway capacity available during a flood event is overestimated by the automated flood routing model. During a PMF event, an overestimate of spillway capacity leads to delayed gate opening of adjacent gates — and a higher peak reservoir water level, potentially approaching the dam crest elevation if the cumulative effect of multiple gate malfunctions combines with the PMF inflow. For high-hazard earthen embankment dams (where overtopping causes immediate erosion of the downstream face and a cascading dam failure), a 0.3–0.5 m reduction in freeboard from misclassified gate position AI represents a direct reduction in safety margin against overtopping.

2. Reservoir water level rate-of-rise display AI (KISTERS WISKI reservoir AI, Siemens SICAM reservoir level AI, Yokogawa FAST/TOOLS reservoir SCADA AI — reservoir level forecasting and EAP trigger AI)

Reservoir water level monitoring — real-time measurement of the water surface elevation behind a hydroelectric dam using shaft encoders at the intake structure, stilling wells with float sensors, radar level sensors, or pressure transducers at the dam face — provides the primary input to the dam emergency action plan (EAP) trigger system. The EAP for a FERC-licensed high-hazard dam specifies action levels for the reservoir water surface elevation relative to the dam crest: a “Watch” level (typically 2–3 m below crest — increased monitoring frequency, operator notification), an “Warning” level (1–1.5 m below crest — downstream emergency notification, public warning), and an “Emergency” level (approaching or at crest — immediate downstream evacuation). For flood routing, the relevant EAP trigger is not just the instantaneous reservoir level but the rate-of-rise: during a PMF event with 10,000–20,000 m³/s inflow and 4,000 m³/s spillway discharge, the net inflow above spillway capacity raises the reservoir at 0.1–0.5 m/hour, providing 3–15 hours of warning time at the Watch level before the Emergency level is reached. AI systems process rendered displays of reservoir level time-series trend charts — showing both the instantaneous level and the 1-hour, 3-hour, and 6-hour rate-of-rise — to classify the reservoir flood status and generate the EAP level trigger at the correct action level, with sufficient lead time for the required downstream response.

An adversarial perturbation on a rendered reservoir level trend display image that suppresses the rate-of-rise — applying a ±10 DN shift to the pixel region encoding the rate-of-rise indicator (reducing the apparent slope of the reservoir level trend line from a rapidly rising PMF profile to a slowly rising non-emergency profile) — causes the reservoir management AI to classify an accelerating PMF reservoir rise as a routine seasonal flow event, delaying the EAP action-level trigger and the downstream emergency notification. The consequence at a high-hazard dam where 188,000 people live downstream (Oroville Dam’s downstream evacuation zone): a 6-hour delay in the Warning-level trigger — the typical lead time required for population evacuation from the flood-inundation zone — removes the evacuable window from the emergency response timeline. The Oroville Dam February 2017 event demonstrated this consequence envelope in the absence of an adversarial attack: the failure of the main spillway concrete at 1,280 m³/s discharge (one-third of the spillway capacity) and the subsequent emergency spillway activation created exactly the compressed decision timeline — level rising, downstream population at risk — in which the reservoir level rate-of-rise AI is the critical early-warning system.

3. Spillway chute concrete erosion CCTV camera AI (Axis Communications spillway camera AI, Bosch Security spillway CCTV AI, Hanwha Vision spillway erosion AI — spillway chute structural integrity monitoring AI)

The spillway chute — the concrete-lined channel that conveys the flow from the spillway crest gate to the energy dissipator (stilling basin or flip bucket) at the downstream end — is subjected to extreme hydraulic forces during high-flow discharge: unit discharge rates of 20–100 m³/s per metre of chute width, flow velocities of 20–50 m/s, and hydrodynamic pressures that fluctuate rapidly due to turbulence. The concrete lining of the spillway chute must resist: (1) cavitation — the implosion of vapour bubbles that form at the low-pressure zones behind surface irregularities in the concrete at high flow velocity (cavitation damage can remove 0.3–1.0 m of concrete per hour at flow velocities above 12 m/s at unventilated surface irregularities); (2) hydraulic uplift — the hydrodynamic uplift pressure beneath the concrete slabs from pressure waves entering through construction joints, causing the concrete slabs to lift and fail; and (3) abrasion from sediment carried in the flow. CCTV cameras mounted on the spillway pier walls and the chute sidewalls provide real-time visual monitoring of the chute concrete condition during high-flow discharge events — the only practical means of detecting concrete slab erosion while the spillway is in operation. AI systems process rendered CCTV camera images of the chute surface — video frames showing the flowing water surface and, during lower-flow periods, the exposed concrete surface condition — to detect concrete slab erosion, uplift damage, and cavity formation, classifying chute condition as: intact, minor surface roughness (increased monitoring), significant erosion (reduce flow and inspect), or critical erosion (emergency flow reduction, chute shutdown if possible).

An adversarial perturbation on a rendered spillway chute CCTV camera image that suppresses a developing erosion feature — applying a ±8 DN texture and colour normalisation to the pixel region encoding a concrete erosion cavity or slab displacement (rendering the crater appearance as the undamaged smooth concrete texture) — causes the chute erosion AI to classify an active erosion event as normal concrete surface condition, suppressing the flow reduction and inspection that a significant erosion classification requires. The Oroville Dam spillway failure of February 2017 is the definitive consequence anchor: the main spillway concrete slab on the left side of the upper chute failed during a 1,280 m³/s discharge (flow velocity approximately 30 m/s at the failure location), exposing the underlying granodiorite foundation rock, which was rapidly eroded by the unlined flow to form a 45-m deep, 50-m wide erosion crater within 12 hours. If the developing slab failure — visible in helicopter overflight footage as a growing hole in the chute concrete — had been detected and classified earlier by the chute CCTV camera AI, the flow reduction and spillway shutdown could have been initiated before the erosion became catastrophic. Adversarial suppression of the chute erosion AI performs exactly the misclassification that a real chute erosion event requires — normalising the developing cavity to match the undamaged concrete appearance.

4. Downstream tailwater level and energy dissipator performance display AI (Ott HydroMet tailwater AI, YSI environmental monitoring AI, Hach WIMS tailwater display AI — spillway energy dissipator hydraulic performance AI)

The energy dissipator at the downstream end of the spillway chute — either a hydraulic jump stilling basin (a concrete-lined pool in which the high-velocity supercritical flow from the chute decelerates through a hydraulic jump to subcritical flow) or a flip bucket (a curved concrete structure that deflects the chute flow upward as a free jet that lands in a plunge pool downstream) — is required to dissipate the kinetic energy of the high-velocity spillway discharge before it re-enters the downstream river channel. The hydraulic performance of the stilling basin or flip bucket depends on the tailwater level — the water surface elevation immediately downstream of the energy dissipator in the river channel. For a stilling basin, the tailwater level must be above a minimum threshold (the “sequent depth” of the hydraulic jump) for the hydraulic jump to remain within the stilling basin and dissipate the flow energy; if the tailwater level is below the sequent depth (submerged jump failure), the hydraulic jump “sweepout” leaves the basin and the undissipated supercritical flow attacks the downstream river bed and banks, causing rapid erosion that can undermine the stilling basin floor and side walls. The tailwater level in the downstream river channel depends on the total flow in the river below the dam — which can decrease during the early stages of a flood release as the upstream tributary flows arrive at the dam but the dam flow has not yet propagated downstream. AI systems process rendered tailwater level displays — real-time level time-series charts and stage-discharge relationship overlays showing whether the current tailwater is above or below the sequent depth for the current spillway discharge rate — to classify energy dissipator performance and warn of sweep-out conditions before stilling basin erosion initiates.

An adversarial perturbation on a rendered tailwater level display image that suppresses a low-tailwater condition — applying a ±8 DN upward shift to the pixel region encoding the tailwater level bar or trend line (raising the apparent tailwater from below the sequent depth to above it) — causes the energy dissipator monitoring AI to classify a stilling basin approaching sweep-out as operating with adequate tailwater, suppressing the spillway flow reduction and downstream inspection that a low-tailwater classification requires. Stilling basin sweep-out damage — documented at Tarbela Dam (Pakistan, 1974: $50M damage to stilling basins during first operational flood season), Bhakra Dam (India), and multiple US Bureau of Reclamation dams — erodes the stilling basin concrete and the foundation rock beneath the basin floor, ultimately undermining the toe of the dam or the spillway chute. The adversarial consequence: a suppressed tailwater warning allows stilling basin foundation erosion to develop undetected, reducing the structural integrity of the spillway energy dissipation system during the PMF event for which it is the critical last line of defence. See also: dam safety monitoring AI prompt injection (geotechnical piezometer, seepage, and deformation monitoring AI). Free tier — 10 scans/day, no card required.

Integration: dam spillway gate control AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for large hydroelectric dam spillway gate control AI belongs at every rendered-image ingestion boundary in the spillway operations AI pipeline — before gate position camera AI processes gate aperture images, before reservoir level AI processes rate-of-rise trend displays, before chute erosion CCTV AI processes chute surface camera frames, and before tailwater display AI processes downstream level charts. Threshold 30 reflects the FERC high-hazard dam downstream flood consequence (dam failure or overtopping with 188,000-person evacuation zone at high-hazard dams such as Oroville), the 6-hour evacuation lead time requirement that compresses the EAP action timeline, and the Oroville 2017 precedent ($1.1B, 188,000 evacuated) demonstrating that spillway chute concrete failure is a real operational hazard.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Large hydroelectric dam spillway gate control AI contexts: threshold 30
# FERC Part 12 (Safety of Water Power Projects and Project Works);
# FEMA P-94 (Selecting and Accommodating Inflow Design Floods for Dams);
# USACE EM 1110-2-1602 (Hydraulic Design of Spillways);
# Bureau of Reclamation FIST 3-5 (Inspection of Dams).
SPILLWAY_THRESHOLD = 30


class SpillwayAIContext(Enum):
    GATE_POSITION       = "gate_position"      # Radial gate aperture camera AI
    RESERVOIR_LEVEL     = "reservoir_level"    # Level rate-of-rise EAP trigger AI
    CHUTE_EROSION       = "chute_erosion"      # Chute concrete CCTV camera AI
    TAILWATER_LEVEL     = "tailwater_level"    # Energy dissipator performance AI


class AdversarialSpillwayImageError(Exception):
    """Raised when Glyphward detects adversarial content in a hydroelectric dam
    spillway gate control AI rendered monitoring image above threshold 30.

    Consequence if not raised:
    - GATE_POSITION: stuck gate suppressed as open → spillway capacity
      overestimated → higher peak reservoir level → reduced freeboard
      → overtopping risk at earthen embankment; FERC high-hazard consequence.
    - RESERVOIR_LEVEL: rate-of-rise suppressed → EAP Watch/Warning level
      delayed → downstream evacuation lead time lost; 188,000-person
      evacuation zone at Oroville-class high-hazard dams.
    - CHUTE_EROSION: erosion crater suppressed → flow continues at
      high discharge → erosion crater enlarges → chute structural
      failure; Oroville Dam February 2017: 45m deep crater in 12 hours.
    - TAILWATER_LEVEL: low tailwater suppressed → stilling basin
      hydraulic jump sweepout → foundation erosion under stilling basin
      → structural compromise of spillway toe; Tarbela Dam 1974 precedent.
    Fail-safe: halt AI classification; conduct immediate manual gauge
    reading and visual inspection before resuming AI-driven gate control.
    """

    def __init__(self, scan_id: str, score: int,
                 context: SpillwayAIContext,
                 dam_id: str, gate_id: str | None,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.dam_id = dam_id
        self.gate_id = gate_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial spillway image: "
            f"context={context.value} score={score} "
            f"dam={dam_id} gate={gate_id} scan_id={scan_id}"
        )


async def scan_spillway_image(
    image_bytes: bytes,
    context: SpillwayAIContext,
    dam_id: str,
    client: httpx.AsyncClient,
    gate_id: str | None = None,
) -> dict:
    """Scan a hydroelectric dam spillway gate control AI rendered monitoring
    image for adversarial content.

    Fail-safe contract: AdversarialSpillwayImageError or httpx error →
    halt AI spillway gate classification for the affected context;
    conduct manual gauge reading and gate position visual inspection before
    resuming AI-driven EAP trigger logic or gate control commands.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"spillway:{context.value}:{dam_id}:{gate_id or 'all'}",
        "metadata": {
            "dam_id": dam_id,
            "gate_id": gate_id,
            "context": context.value,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > SPILLWAY_THRESHOLD:
        raise AdversarialSpillwayImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            dam_id=dam_id,
            gate_id=gate_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_spillway_image at each spillway monitoring AI rendered-image ingestion boundary. On AdversarialSpillwayImageError for CHUTE_EROSION context: immediately reduce spillway discharge to below the erosion-initiation threshold, initiate visual inspection via patrol personnel or helicopter if accessible, and notify the FERC-licensed engineer-of-record before resuming AI-driven chute condition monitoring. See also: dam safety monitoring AI prompt injection (geotechnical and seepage monitoring AI) and hydroelectric power plant turbine AI prompt injection (generating unit AI). Get early access

Related questions