Prompt injection in maritime and shipping AI

Four adversarial injection surfaces in maritime and shipping AI

1. Ship hull inspection AI injection (Bureau Veritas marine AI, Lloyd’s Register ShipRight AI, DNV Veracity survey AI)

Ship hull inspection AI processes underwater and above-waterline hull inspection photographs and video frames captured by ROVs (remotely operated vehicles), AUVs (autonomous underwater vehicles), and drone survey systems during class renewal surveys, special surveys, and annual condition assessments to classify corrosion severity, coating breakdown, structural deformation, crack propagation, and weld defect severity that determine the classification society’s survey outcome — the gateway to continued class certification and P&I Club insurance coverage for commercial vessels. Bureau Veritas Marine & Offshore processes hull inspection imagery through its BVAI digital survey platform for class renewal and special survey assessments across its fleet of over 11,500 classed vessels, including bulk carriers, tankers, container ships, and offshore platforms. Lloyd’s Register’s ShipRight structural assessment AI and digital survey platform processes hull inspection ROV imagery for Lloyd’s Register-classed vessels, integrating AI-assisted corrosion measurement and structural defect classification into the class renewal survey workflow. DNV’s Veracity digital assurance platform processes hull inspection imagery from remotely operated survey systems for DNV-classed vessels — approximately 13% of global fleet gross tonnage — integrating AI-assisted condition assessment into survey planning, defect tracking, and class renewal recommendation generation.

The adversarial injection surface is the hull inspection ROV/drone survey image upload pathway: photographs and video frames captured during underwater and above-waterline hull surveys and submitted through BVAI, ShipRight, or DNV Veracity digital survey portals for AI structural condition classification. An adversarially crafted hull inspection ROV photograph — in which pixel perturbations applied to image regions showing pitting corrosion, coating delamination exceeding NACE standard threshold areas, or crack propagation at structural weld joints cause the Bureau Veritas AI or DNV Veracity AI to classify the structural condition as within acceptable class parameters when the actual corrosion severity or structural deformation exceeds the threshold for a class condition (CC) notation or mandatory rectification before the next voyage — can result in a class renewal survey outcome that authorises continued vessel operation despite structural defects that would otherwise require drydock rectification. The adversarial suppression motivation is direct: a shipowner whose vessel’s hull inspection AI survey outcome incorrectly characterises severe corrosion as moderate avoids the drydock rectification cost — which for a Panamax bulk carrier can range from $2–$5 million depending on corrosion extent — and avoids the off-hire period during drydock, typically 10–20 days at charter rates of $15,000–$25,000 per day.

SOLAS Chapter II-1 structural requirements and IMO ISM Code mandatory survey compliance mean that a vessel operating on an adversarially manipulated class renewal survey certificate that fails to reflect actual structural defects is operating outside the SOLAS structural compliance framework — creating criminal and civil liability for the shipowner, master, and classification society under flag state maritime authority enforcement. P&I Club insurance consequences are the most immediate commercial exposure: the International Group of P&I Clubs, which provides liability and pollution insurance for approximately 90% of the world’s ocean-going tonnage, conditions coverage on class certificate validity. A vessel operating on a class certificate generated by an adversarially manipulated hull inspection survey — where the actual structural condition of the vessel at the time of loss was more severe than the class survey recorded — faces a P&I Club coverage challenge that can result in coverage denial for any cargo claim, collision claim, or pollution incident that occurs during the period of compromised class certification. Classification society liability for AI survey system failures is an emerging area of maritime law: BIMCO and the International Union of Marine Insurance (IUMI) have both identified AI-assisted survey systems as a risk exposure requiring enhanced assurance frameworks. Threshold: 55 for ship hull inspection AI (SOLAS structural compliance, P&I Club coverage, classification society liability, IMO ISM Code).

2. Container cargo inspection AI injection (DP World terminal AI, PSA International AI, Hutchison Ports AI)

Container cargo inspection AI processes inspection photographs captured at terminal gate inspection points, damage documentation stations, and non-intrusive inspection (NII) scanning gantry imaging systems to classify container and cargo condition, detect damage and cargo shift, identify anomalies in container contents for CBP and C-TPAT risk assessment, and generate damage notes that determine insurance claims and shipper liability under the contract of carriage. DP World’s AI-integrated terminal operations platform processes container inspection photographs at major hub terminals including DP World Jebel Ali (the ninth-largest container port globally), DP World Antwerp, and DP World London Gateway, using AI-assisted condition assessment and NII scan analysis for cargo security screening and damage documentation workflows. PSA International’s AI port operations platform processes container inspection imagery at Port of Singapore — the world’s second-busiest port by container throughput — and PSA International terminals in Belgium, India, and China, integrating AI cargo condition assessment with automated gate inspection and terminal management systems. Hutchison Ports AI processes container inspection photographs at Hutchison-operated terminals including port of Hong Kong, Yantian International Container Terminal, and Harwich International Port, using AI damage classification and anomaly detection for container gate release and cargo security screening.

The adversarial injection surface is the terminal gate inspection photograph and NII scan image submission pathway: container exterior condition photographs captured at terminal gate inspection cameras and submitted through terminal operating system (TOS) AI interfaces for cargo condition classification and security screening anomaly detection. An adversarially crafted container inspection photograph — in which pixel perturbations applied to regions showing container wall damage, improper seals, cargo shift indicators, or NII scan density anomalies cause the DP World or PSA AI to classify the container as undamaged and cargo as compliant when the actual container condition shows damage warranting damage note documentation or the cargo contents show density anomalies warranting CBP examination referral — can result in a damaged container being released from the terminal without a damage note that would support a cargo insurance claim, or a CBP security examination being suppressed that would otherwise identify misdeclared cargo. The adversarial suppression motivation operates at two levels: a shipper whose damaged cargo is not documented with a damage note at the port of discharge faces a carrier liability limitation under the Hague-Visby Rules (Carriage of Goods by Sea Act, 46 USC § 30701) that prevents recovery for undocumented damage, creating a financial incentive to ensure damage notes are generated; conversely, a cargo consignor seeking to move misdeclared or contraband cargo has a direct incentive to suppress CBP examination referral AI flags at terminal gate screening.

CBP/C-TPAT security consequences are the most significant consequence of adversarial container inspection AI manipulation: C-TPAT certification requires that importers, carriers, and terminal operators implement supply chain security measures including cargo integrity verification at terminal gate inspection points. A terminal operator whose container inspection AI has been adversarially manipulated to suppress CBP examination referral flags faces C-TPAT certification suspension, which prevents the terminal from operating in the expedited lane processing that C-TPAT certification provides and imposes additional CBP examination requirements on all containers processed through the terminal. Under the Container Security Initiative (CSI), major ports including Port of Rotterdam, Port of Hamburg, and Port of Singapore are required to pre-screen US-bound containers for security threats before loading; adversarial manipulation of pre-screening inspection AI at CSI ports creates a CBP bilateral enforcement issue that can result in increased examination rates at US port of arrival for all containers from the affected terminal. Threshold: 55 for container cargo inspection AI (CBP/C-TPAT security, Hague-Visby cargo liability, container damage documentation, IMO ISPS Code).

3. Port state control document AI injection (Tokyo MOU PSC AI, Paris MOU PSC AI, USCG PSIX AI)

Port state control (PSC) AI systems process deficiency notice document photographs, ship certification document images, and crew certification record scans submitted through PSC officer digital inspection platforms during port state control examinations to classify deficiency severity, identify detainable deficiencies under SOLAS, MARPOL, STCW, and ISM Code, and generate digital PSC inspection records that are published in the Tokyo MOU and Paris MOU vessel inspection databases accessed by charterers, port authorities, insurers, and flag state administrations worldwide. The Tokyo MOU Information System (TOIS) supports PSC examinations at 21 member state maritime authorities across the Asia-Pacific region, covering approximately 18,000 vessels per year; AI-assisted deficiency classification and detention decision support is integrated into PSC officer inspection platforms used at major PSC inspection ports including Shanghai, Tokyo, Busan, and Sydney. The Paris MOU Equasis system and THETIS-EU platform support PSC examinations at 27 European maritime authority member states, processing deficiency documentation and certification images for AI-assisted inspection prioritisation and deficiency severity classification. The United States Coast Guard’s PSIX (Port State Information Exchange) system processes PSC examination deficiency documentation for all vessels calling at US ports, integrating with USCG boarding team digital inspection platforms for AI-assisted deficiency classification and detention decision support.

The adversarial injection surface is the deficiency notice document scan and ship certification document photograph submission pathway: scanned images of PSC deficiency notices (Nil-deficiency reports, deficiency categorisation forms), crew certification documents (STCW certificates, medical fitness certificates), and vessel certification records (SOLAS safety equipment certificates, ISM Document of Compliance, MARPOL International Oil Pollution Prevention Certificate) submitted through PSC officer digital inspection platforms for AI deficiency severity classification. An adversarially crafted deficiency notice document scan — in which pixel perturbations applied to the deficiency code field, the “detainable” classification checkbox, or the deficiency description text region cause the Tokyo MOU PSC AI to classify a deficiency that would otherwise require immediate rectification and port detention as a lesser non-detainable deficiency — can result in a vessel with a SOLAS detainable deficiency being issued a deficiency notice rather than a detention order, allowing the vessel to sail from port with a deficiency that the PSC officer’s physical examination identified as detention-warranting. The adversarial suppression motivation is commercially significant: a port detention for a SOLAS or ISM Code deficiency typically requires 2–5 days of rectification before the vessel is permitted to sail, generating off-hire costs of $30,000–$100,000 per day for a large containership or tanker, plus the direct rectification cost for the deficiency itself.

IMO SOLAS Chapter I Part B Regulation 19 empowers port states to detain vessels where a deficiency creates an unreasonable danger to the safety of life at sea, the marine environment, or the vessel’s structural integrity — a PSC detention order under SOLAS is one of the most significant operational disruptions a vessel can experience, with publication in the Tokyo MOU and Paris MOU inspection databases creating lasting reputational consequences for the vessel, the shipowner, and the flag state. Adversarial manipulation of PSC AI deficiency classification that allows a vessel with a genuine SOLAS detainable deficiency to sail from port creates flag state liability under UNCLOS Article 94 (duties of the flag state) and IMO Code for the Implementation of IMO Instruments (III Code), which require flag states to maintain enforcement programmes that ensure vessels flying their flag comply with IMO conventions. A PSC detention that is subsequently found to have been improperly resolved because the AI deficiency classification was adversarially manipulated — resulting in a subsequent casualty or pollution incident during the voyage — creates liability for the flag state maritime authority, the classification society that issued the class certificate, and the shipowner that operated the vessel with a known deficiency. Threshold: 55 for port state control document AI (SOLAS detention, IMO flag state liability, Tokyo/Paris MOU database publication, ISM Code enforcement).

4. Bill of lading and freight document AI injection (CargoWise AI, Flexport AI, Maersk Twill AI)

Bill of lading and freight document AI processes scanned images and photographs of bills of lading (B/L), commercial invoices, packing lists, phytosanitary certificates, fumigation certificates, and export declaration documents submitted through freight forwarding platforms and digital shipping management systems to extract commodity descriptions, HS tariff codes, cargo quantity and weight data, port of loading and discharge, shipper and consignee identity, and incoterms data for automated customs declaration generation, freight invoice reconciliation, and cargo manifest compilation. WiseTech Global’s CargoWise AI processes freight document images for over 17,000 freight forwarding and customs brokerage companies globally, using AI document extraction to populate customs declarations across 150+ countries from scanned B/L and commercial invoice images submitted by freight forwarder clients. Flexport AI processes freight document image data for its enterprise shipper clients, using AI-assisted document extraction to generate Automated Export System (AES) Electronic Export Information (EEI) and CBP Form 3461 (Entry) data from scanned shipping document images. Maersk’s Twill digital freight platform and Maersk AI document processing extracts B/L and shipping instruction data from document images submitted by Maersk shipper accounts for automated booking confirmation, cargo manifest generation, and customs declaration filing.

The adversarial injection surface is the B/L and commercial invoice scan submission pathway: scanned images of paper bills of lading, commercial invoices, and packing lists submitted through CargoWise document scanning interfaces, Flexport document upload portals, or Maersk Twill shipping document management for AI-assisted commodity description extraction and HS code classification. An adversarially crafted B/L scan — in which pixel perturbations applied to the commodity description field, the HS tariff code pre-printed on the B/L, the declared value field, or the weight and quantity fields cause the CargoWise AI or Flexport AI to extract an incorrect commodity description, HS code, or declared value that is then used to populate the automated customs declaration — can result in a customs declaration that misdeclares the commodity, understates the cargo value for duty calculation, or misclassifies the HS tariff code in a way that avoids applicable tariff rates or export control requirements. The adversarial HS code misdeclaration motivation is commercially significant in the era of tariff-differentiated trade policy: adversarial manipulation of B/L commodity description AI to extract a commodity classification that attracts lower import duty rates than the actual commodity represents a customs fraud that the US CBP, EU customs authorities, and WCO (World Customs Organization) member states actively investigate and prosecute.

US customs fraud consequences under 18 USC § 542 (entry of goods by means of false statements) and 18 USC § 545 (smuggling goods) impose criminal liability for commodity misdeclaration and undervaluation in customs declarations, with civil penalty exposure under 19 USC § 1592 (negligence, gross negligence, and fraud penalties) for CBP enforcement. The WCO’s Revised Kyoto Convention Framework of Standards (SAFE Framework) and CBP’s Customs-Trade Partnership Against Terrorism (C-TPAT) programme impose supply chain documentation integrity requirements on importers and freight forwarders — an importer or freight forwarder whose freight document AI has been adversarially manipulated to extract incorrect HS codes from B/L scans faces C-TPAT certification suspension and increased CBP examination rates independent of whether the HS code misdeclaration was intentional. Export control consequences under EAR (Export Administration Regulations, 15 CFR Parts 730–774) and ITAR (International Traffic in Arms Regulations, 22 CFR Parts 120–130) attach where adversarially manipulated B/L AI produces a commodity description that fails to capture an Export Control Classification Number (ECCN) or ITAR Category designation applicable to the actual cargo — creating a strict liability export violation that does not require proof of intent under the EAR enforcement framework. Threshold: 55 for bill of lading and freight document AI (US customs fraud, CBP/C-TPAT, WCO SAFE Framework, EAR/ITAR export control).

Integration: maritime AI image ingestion with Glyphward pre-scan

Maritime AI image ingestion flows from ROV/drone hull survey image upload portals, terminal gate container inspection APIs, PSC officer digital inspection document platforms, and freight document scanning interfaces into classification society survey AI, port authority cargo AI, port state control AI, and freight document extraction AI pipelines. Insert Glyphward’s pre-scan at the ingestion boundary — particularly for externally submitted or compliance-critical hull inspection imagery, cargo inspection photographs, and freight document scans:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Maritime AI — SOLAS structural compliance, P&I Club coverage,
# CBP/C-TPAT cargo security, PSC detention, IMO ISM Code,
# customs HS code misdeclaration, EAR/ITAR export control.
# Uniform threshold 55 across all maritime contexts — classification
# society and customs consequences attach at high confidence only.
THRESHOLD_MARITIME = 55


class MaritimeAIContext(str, Enum):
    HULL_INSPECTION    = "hull_inspection"    # BV marine AI, LR ShipRight, DNV Veracity
    CARGO_INSPECTION   = "cargo_inspection"   # DP World, PSA, Hutchison terminal AI
    PSC_DOCUMENT       = "psc_document"       # Tokyo MOU, Paris MOU, USCG PSIX
    FREIGHT_DOCUMENT   = "freight_document"   # CargoWise, Flexport, Maersk Twill


async def scan_maritime_image(
    image_path: str | Path,
    context: MaritimeAIContext,
    vessel_imo_hash: str,       # SHA-256 of IMO number — vessel linkage without plaintext
    survey_ref: str,            # survey reference or B/L number (non-identifying form)
    frame_label: str,           # e.g. "frame_45_portside", "container_MSCU1234567_front"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a maritime AI image for adversarial injection payloads before forwarding
    to a hull inspection AI, container cargo inspection AI, port state control AI,
    or bill of lading freight document extraction AI.

    Raises AdversarialMaritimeImageError if the Glyphward score meets or
    exceeds the maritime threshold (55).
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "maritime_context": context.value,
                "vessel_imo_hash": vessel_imo_hash,
                "survey_ref": survey_ref,
                "frame_label": frame_label,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=10.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "vessel_imo_hash": vessel_imo_hash,
        "survey_ref": survey_ref,
        "frame_label": frame_label,
        "maritime_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": THRESHOLD_MARITIME,
        "action": "blocked" if result["score"] >= THRESHOLD_MARITIME else "allowed",
    }
    await write_maritime_audit_record(audit_record)

    if result["score"] >= THRESHOLD_MARITIME:
        raise AdversarialMaritimeImageError(
            f"Maritime AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"imo_hash={vessel_imo_hash} frame={frame_label}"
        )
    return result


async def scan_hull_survey_batch(
    frame_paths: list[Path],
    vessel_imo_hash: str,
    survey_ref: str,
) -> dict:
    """
    Scan a batch of hull inspection ROV/drone frames before loading into
    Bureau Veritas/Lloyd's Register/DNV Veracity AI survey classification.
    All frames scanned with HULL_INSPECTION context (threshold 55).
    """
    allowed, blocked, errors = [], [], []
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_maritime_image(
                p, MaritimeAIContext.HULL_INSPECTION,
                vessel_imo_hash, survey_ref, f"frame_{i:04d}", client,
            )
            for i, p in enumerate(frame_paths)
        ]
        results = await asyncio.gather(*tasks, return_exceptions=True)

    for path, result in zip(frame_paths, results):
        if isinstance(result, AdversarialMaritimeImageError):
            blocked.append({"path": str(path), "error": str(result)})
        elif isinstance(result, Exception):
            errors.append({"path": str(path), "error": str(result)})
        else:
            allowed.append({"path": str(path), "scan_id": result["scan_id"]})

    return {
        "vessel_imo_hash": vessel_imo_hash,
        "survey_ref": survey_ref,
        "total": len(frame_paths),
        "allowed": len(allowed),
        "blocked": len(blocked),
        "errors": len(errors),
        "blocked_frames": blocked,
    }


async def write_maritime_audit_record(record: dict) -> None:
    """Persist audit record to maritime compliance audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialMaritimeImageError(Exception):
    """Raised when a maritime AI image exceeds the adversarial injection threshold."""
    pass

Call scan_hull_survey_batch() before forwarding hull inspection ROV/drone frame sets to Bureau Veritas BVAI, Lloyd’s Register ShipRight, or DNV Veracity AI survey classification — hull survey batch scanning is the highest-priority integration point in the maritime AI pipeline because a compromised class renewal survey outcome affects vessel insurance and operational status for the full survey cycle (typically 5 years for special surveys, 1 year for annual surveys). Call scan_maritime_image() with MaritimeAIContext.CARGO_INSPECTION for container inspection photographs before DP World/PSA/Hutchison terminal AI cargo condition and security screening classification. Call with MaritimeAIContext.PSC_DOCUMENT for deficiency notice document scans before Tokyo MOU/Paris MOU/USCG PSIX AI deficiency severity classification — PSC document scanning is critical because adversarial deficiency classification suppression allows a detained-warranting deficiency to remain on the vessel during the voyage. Call with MaritimeAIContext.FREIGHT_DOCUMENT for B/L and commercial invoice scans before CargoWise/Flexport/Maersk Twill AI commodity extraction and HS code classification. The vessel_imo_hash parameter links audit records to specific vessels using a SHA-256 hash of the IMO number, enabling survey and inspection audit trail reconstruction without exposing plaintext vessel identification at the API boundary. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four maritime AI injection surfaces; covers how adversarial pixel-level perturbations cause AI misclassification through image content manipulation without detectable visual artifacts.
• PDF prompt injection detection — document-based injection vectors relevant to bill of lading PDFs, PSC deficiency notice PDFs, and ship certification document PDFs in freight and port state control workflows.
• Prompt injection scanner for document AI — document AI scanning covering the broader class of scanned document and photograph-based injection vectors applicable to freight document AI and PSC document AI.
• Prompt injection in energy trading and commodity AI — commodity trading AI with overlapping cargo documentation and commodity classification adversarial attack vectors relevant to maritime freight document AI.
• Free tier — 10 scans/day, no card required — start scanning maritime AI images at development volumes before committing to a production plan.