Prompt injection in manufacturing quality inspection AI

Four adversarial injection surfaces in manufacturing quality inspection AI

1. PCB and semiconductor defect detection camera injection (Cognex, Keyence, Landing AI)

PCB and semiconductor manufacturing quality inspection AI — deployed via Cognex VisionPro in automated optical inspection (AOI) machines, Keyence IV-HG AI image sensor systems, and Landing AI LandingLens custom model deployments — processes images from production line cameras at every stage of PCB and semiconductor assembly: bare board inspection, solder paste inspection (SPI), post-solder AOI, and final assembly inspection. The AI defect classification models detect: solder bridge shorts between adjacent pads, insufficient solder on BGA and QFN pads, missing components in populated positions, component misalignment exceeding placement tolerances, and PCB surface damage including scratches, delamination, and contamination. Images from production line cameras feed into the inspection AI through two pathways with distinct injection surfaces: the real-time in-line pathway (high-speed camera frame processed in milliseconds by the inspection AI) and the off-line submission pathway (images submitted through Landing AI’s web platform or Cognex ViDi’s training portal for AI model retraining and validation). The off-line submission pathway — the one accessible to remote adversaries without physical production line access — is the injection surface. An adversarially crafted defect image submitted as a training sample through Landing AI’s annotation and training portal can introduce a mislabelled example into the AI model’s training set: an image in which a genuine solder bridge defect has been perturbed to appear as an acceptable solder joint to the AI, causing the retrained model to under-detect solder bridges in a specific pad geometry or solder alloy context. For electronics contract manufacturers (CM) and ODMs who use AI retraining as a continuous improvement process — submitting production escape images to the AI platform to improve detection of previously missed defect types — a compromised training data submission poisons the feedback loop and systematically degrades detection of the targeted defect class over successive retraining cycles.

2. Food safety inspection conveyor belt image injection (Landing AI, Mettler-Toledo CI-Vision)

Food safety visual inspection AI — Landing AI LandingLens food inspection deployments, Mettler-Toledo CI-Vision AI, Key Technology VERYX AI sorter, and TOMRA food sorting AI — processes images from conveyor belt cameras and sorting machine optical systems to detect foreign objects, colour and shape deviations indicating spoilage or pest damage, and product quality defects (misshapen fruit, broken snack pieces, contaminated produce). These AI systems operate at high throughput in food processing environments: TOMRA’s optical sorter processes up to 10 tonnes per hour of produce, making real-time AI go/no-go classification the primary quality gate. The training data and quality validation image submission pathways — through which food safety teams upload example images of reject categories (foreign objects: stones, glass, insect fragments, plastic pieces) to train and update the AI models — are the injection surface. An adversarially crafted foreign object image submitted as a training positive — in which the foreign object’s visual signature has been perturbed to reduce the AI model’s confidence on that object class — causes the retrained model to systematically under-detect that foreign object type on the production line. For glass and stone detection in ready-to-eat food products — where a missed foreign object reaching a consumer constitutes an FDA reportable event under 21 CFR Part 117 Current Good Manufacturing Practice and a potential product recall — adversarial training data injection that degrades glass detection confidence has direct food safety and regulatory compliance consequences. The food processing industry’s extensive use of third-party quality consulting firms and AI training data labelling services — who have access to training image upload portals — creates the supply-chain injection pathway analogous to the energy sector’s contracted inspection provider model.

3. Pharmaceutical tablet visual inspection injection (FDA 21 CFR Part 11, Cognex, Keyence)

Pharmaceutical tablet and capsule visual inspection AI — deployed via Cognex VisionPro in automated visual inspection (AVI) machines, Keyence XG-X series AI inspection systems, and OEM-specific vision systems from Körber, ACG, and Syntegon — inspects 100% of solid oral dose products at production speed for: tablet chipping, capping, and lamination defects; surface contamination and colour deviations outside batch specification; embossing and debossing legibility; dimensional deviations from tolerance; and foreign particulate contamination. In regulated pharmaceutical manufacturing, 21 CFR Part 820 (Quality System Regulation), EU GMP Annex 11 (computerised systems), and ICH Q10 (pharmaceutical quality system) require that automated inspection systems demonstrate validated performance, and that all inspection records — including defect images captured as non-conformance records — meet 21 CFR Part 11 electronic records requirements (audit trail, access control, integrity). AI model validation and retraining in pharmaceutical manufacturing involves submitting known defect images — chipped tablets, contaminated capsules, foreign particle images — through the AI platform’s validated method qualification (VMQ) portal or training data management system. An adversarially crafted tablet defect image submitted through the VMQ portal can corrupt the AI model’s performance on the targeted defect class — causing the inspection AI to fail its IQ/OQ/PQ validation challenge for that defect type, triggering an unplanned re-validation event. More consequentially, adversarial corruption of a production defect image submitted as a non-conformance record under 21 CFR Part 11 can cause the quality AI system to misclassify the non-conformance severity — affecting the disposition decision (rework vs. reject) for the affected production lot. Pharmaceutical lot disposition decisions based on corrupted AI inspection records create direct regulatory exposure: FDA inspections that find discrepancies between actual product quality records and AI inspection system outputs constitute 483 observations and may drive Warning Letter action.

4. Automotive body panel defect detection injection (NVIDIA Metropolis, BMW iFACTORY AI)

Automotive body and paint quality inspection AI — deployed via NVIDIA Metropolis edge AI in OEM paint shop inspection stations, BMW’s iFACTORY AI visual quality control, Tesla’s automated body inspection AI, and AI systems from Perceptron and Hexagon Manufacturing Intelligence — inspects automotive body panels for paint defects (orange peel, runs, sags, dirt nibs, cratering), panel fit and gap measurements, and surface damage (scratches, dents, chips). These inspection systems operate in the paint shop and body-in-white (BIW) assembly environment, capturing high-resolution images of each vehicle body under controlled lighting conditions. The AI defect classification models determine whether a vehicle requires manual rework — a decision with significant cost implications at OEM production volumes, where rework rates and paint defect escape rates are tracked as key quality metrics. Supplier qualification and AI model validation for automotive quality inspection involves submitting reference defect images — curated sets of paint defect samples from production escape incidents — through the AI platform’s validation and retraining interface. Tier-1 and Tier-2 suppliers who develop and maintain AI inspection systems under contract to OEMs have upload access to these interfaces. An adversarially crafted paint defect image submitted through the validation interface by a compromised supplier system can corrupt the AI model’s classification boundary for the targeted defect type — causing the retrained model to accept a surface defect class that should require rework. At OEM production volumes (hundreds of vehicles per shift), systematic under-detection of a paint defect class caused by adversarial training data injection translates to increased warranty claims, customer satisfaction impacts, and potential recall exposure if the defect class is safety-relevant (e.g., headlamp housing scratches affecting optical performance, structural adhesive bond surface contamination affecting crash-relevant joints).

Integration: manufacturing quality inspection AI with Glyphward pre-scan

Manufacturing AI image ingestion typically flows from production line cameras, manual submission portals, or quality management system (QMS) integrations into an AI processing queue. Insert Glyphward’s pre-scan at the ingestion boundary — particularly for off-line submission pathways (training data uploads, reference image baselines, audit image submissions) that accept externally submitted images:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Regulated manufacturing: pharmaceutical (FDA 21 CFR), automotive safety-critical.
# Missed defect has regulatory and product safety consequences.
THRESHOLD_REGULATED_MANUFACTURING = 55
# Standard manufacturing: electronics assembly, food safety visual inspection.
THRESHOLD_STANDARD_MANUFACTURING = 60


class ManufacturingAIContext(str, Enum):
    PCB_SEMICONDUCTOR_DEFECT = "pcb_semiconductor_defect"   # Cognex, Keyence, Landing AI
    FOOD_SAFETY_INSPECTION = "food_safety_inspection"       # Mettler-Toledo, TOMRA
    PHARMA_TABLET_INSPECTION = "pharma_tablet_inspection"   # Cognex AVI, Keyence
    AUTOMOTIVE_BODY_PANEL = "automotive_body_panel"         # NVIDIA Metropolis, Perceptron


def _threshold_for(context: ManufacturingAIContext) -> int:
    if context in (
        ManufacturingAIContext.PHARMA_TABLET_INSPECTION,
        ManufacturingAIContext.AUTOMOTIVE_BODY_PANEL,
    ):
        return THRESHOLD_REGULATED_MANUFACTURING
    return THRESHOLD_STANDARD_MANUFACTURING


async def scan_manufacturing_inspection_image(
    image_path: str | Path,
    context: ManufacturingAIContext,
    production_lot_id: str,    # internal lot identifier (non-PHI, non-GPS)
    submission_type: str,      # "training_data" | "audit_record" | "reference_image"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a manufacturing quality inspection image for adversarial injection payloads
    before forwarding to an AI defect detection, training, or quality audit system.

    submission_type distinguishes training data uploads (highest risk — model poisoning)
    from production audit records and reference images.
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())
    threshold = _threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "manufacturing_context": context.value,
                "production_lot_id": production_lot_id,
                "submission_type": submission_type,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "production_lot_id": production_lot_id,
        "submission_type": submission_type,
        "manufacturing_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": threshold,
        "action": "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_manufacturing_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialManufacturingImageError(
            f"Manufacturing inspection image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"lot={production_lot_id} type={submission_type}"
        )
    return result


async def write_manufacturing_audit_record(record: dict) -> None:
    """Persist audit record to your QMS / 21 CFR Part 11 compliant store (stub)."""
    import json, sys
    # For pharmaceutical: write to your Part 11-compliant audit trail system
    print(json.dumps(record), file=sys.stderr)


class AdversarialManufacturingImageError(Exception):
    """Raised when a manufacturing inspection image exceeds the adversarial threshold."""
    pass

The submission_type field distinguishes training data uploads — where adversarial injection poisons the AI model — from production audit records and reference images, allowing your downstream security monitoring to prioritise investigation of blocked training data submissions. For pharmaceutical manufacturing, the audit record’s scan_id plus image_sha256 plus production_lot_id provides the provenance chain required by 21 CFR Part 11 for electronic quality records associated with the AI inspection system. Get early access

Coverage matrix

Related questions

Further reading

• Indirect prompt injection via image — foundational attack pattern; covers how adversarial images deliver instructions through AI-processed content, the supply-chain variant directly relevant to training data injection.
• OWASP LLM03:2025 Training Data Poisoning — multimodal dataset attack surface — the OWASP framework for training data poisoning; PCB and pharmaceutical inspection AI training data injection is the LLM03 vector applied to industrial computer vision.
• Vision-language model security — VLM security covering multimodal AI; relevant to AI quality inspection platforms that combine vision outputs with LLM-generated quality report drafting.
• Construction and engineering AI prompt injection — adjacent industrial AI inspection surface; covers construction site photo injection and permit document injection — similar supply-chain model to manufacturing quality inspection AI.
• Free tier — 10 scans/day, no card required — start scanning manufacturing inspection images at development volumes before committing to a production plan.