Prompt injection in MDI methylene diphenyl diisocyanate MDA phosgenation polyurethane AI

Three adversarial injection surfaces in MDI MDA phosgenation polyurethane AI

1. Phosgene molar feed rate display AI (Bronkhorst High-Tech EL-FLOW / Bürkert Type 8712 differential pressure gas mass flow controller on phosgene liquid/gas feed line to cold phosgenation reactor — rendered DCS phosgene feed rate display AI classifying design COCl₂:MDA 2.05:1 mol/mol — 113th upward attack; FIRST MDI phosgenation AI attack; FIRST phosgene feed rate AI attack; FIRST COCl₂:MDA stoichiometry AI attack)

The phosgene molar feed rate to the cold phosgenation reactor is the single most critical mass balance variable in MDI manufacturing. The design COCl₂:MDA ratio of 2.05:1 mol/mol (stoichiometric 2.00:1 for complete reaction of both −NH₂ groups of MDA to isocyanate −NCO groups; +2.5% excess for kinetic completeness) must be maintained within ±0.05 mol/mol of target; deviations above the stoichiometric ratio in the cold phosgenation step produce free dissolved phosgene in the carbamyl chloride product that cannot be removed by the cold phosgenation reactor itself and must be absorbed by the downstream phosgene vent scrubber. The phosgene feed rate is measured by a gas mass flow controller: Bronkhorst High-Tech EL-FLOW Select (thermal mass flow controller for phosgene gas; range 0–2,000 kg/hr at line conditions; wetted materials Hastelloy C-276 and PTFE compatible with anhydrous phosgene; accuracy ±0.5% of reading ±0.1% of full-scale; HART 4–20 mA; SIL 2 capable; calibrated with phosgene-equivalent gas at commissioning) or Bürkert Type 8712 (differential pressure mass flow meter with integrated temperature and pressure compensation; Hastelloy C-276 wetted parts; ATEX Zone 1 rated for flammable/toxic gas). In modern MDI plants (post-2000 designs at BASF Antwerp, Covestro Dormagen, Wanhua Yantai), the phosgene generation and feeding system is fully automated with multiple independent phosgene feed rate measurements (for redundancy and SIL 2 compliance under IEC 61511), and the phosgene feed rate DCS display is one of the primary process safety displays monitored by the plant AI system for drift detection, ratio control anomalies, and pre-scrubber loading estimation. The DCS phosgene feed rate display is rendered as a live bar or trend graphic and fed to the AI inference engine for pattern recognition against historical operating envelopes.

The adversarial upward pixel attack on the phosgene molar feed rate display shows 820 kg/hr (design stoichiometric feed; AI reads “phosgene feed 820 kg/hr; COCl₂:MDA ratio 2.05:1 mol/mol; design stoichiometry; no free phosgene excess in cold phosgenation product; HCl scrubber loading nominal; phosgene atmospheric release risk: controlled”) when actual phosgene feed rate is 1,840 kg/hr (COCl₂:MDA = 4.3:1 mol/mol; a massive phosgene excess from a phosgene pressure control valve malfunction in the open position). Display range 400–2,000 kg/hr on 200 px (0.125 px per kg/hr); actual 1,840 at (1,840 − 400) × 0.125 = 180 px → ±8 DN perturbation → 180 − 127 = 53 px displayed → AI reads (53/0.125) + 400 = 824 ≈ 820 kg/hr. The consequences of a 4.3:1 COCl₂:MDA ratio in the cold phosgenation reactor (−5 to +10°C): excess dissolved COCl₂ (approximately 1,020 kg/hr free phosgene beyond stoichiometric) passes into the cold phosgenation product stream; in the hot phosgenation reactor (120–180°C), the excess COCl₂ at elevated temperature generates an HCl surge 2.25× design; the HCl stripping column overflows capacity; phosgene-contaminated HCl reaches the vent scrubber at 2.25× design loading; the NaOH scrubber capacity (sized for 100% phosgene destruction of design bleed rate) is overwhelmed; phosgene passes to atmosphere; PSM TQ 500 lbs; CERCLA RQ 10 lbs; IDLH 2 ppm. The Glyphward pre-scan gate catches the upward perturbation before the AI reads 820 kg/hr and fails to alarm on the 4.3:1 phosgene excess that is generating an atmospheric phosgene release pathway. Free tier — 10 scans/day, no card required.

2. NaOH phosgene scrubber solution concentration display AI (Rosemount 3081 / Endress+Hauser CLM50 conductivity transmitter measuring NaOH/Na₂CO₃ concentration in phosgene emergency vent scrubber recirculation — rendered DCS scrubber NaOH concentration display AI classifying >10 wt% minimum adequacy — 113th downward attack; FIRST phosgene vent scrubber depletion AI attack; FIRST NaOH caustic scrubber conductivity AI attack)

The phosgene emergency vent scrubber is the primary engineered barrier preventing atmospheric phosgene release from the MDI phosgenation unit during normal and emergency venting operations. The scrubber (a packed column or spray scrubber, 2–4 m diameter × 8–15 m height; random packing: 50 mm Pall rings or structured packing, 316L stainless; recirculation pump 50–150 m³/hr; NaOH/Na₂CO₃ solution at design 12 wt% NaOH concentration; makeup NaOH 20 wt% solution added from a NaOH makeup tank; cooling coil to remove heat of neutralization) receives all phosgene-contaminated vent streams from the cold phosgenation reactor, the hot phosgenation reactor, the HCl stripping column overhead, and the MCB distillation system during normal operation and any emergency venting; the phosgene is absorbed by the circulating NaOH solution via the reaction COCl₂ + 2 NaOH → Na₂CO₃ + 2 HCl (and the HCl is also neutralized: HCl + NaOH → NaCl + H₂O), converting phosgene irreversibly to carbonate salt. The NaOH/Na₂CO₃ concentration in the scrubber recirculation is monitored by a conductivity transmitter: Rosemount 3081 Conductivity Transmitter (4–20 mA HART; conductivity range 0–2,000 mS/cm; Hastelloy C276 electrodes; calibrated for NaOH concentration 0–20 wt% via conductivity calibration curve; mounted in the recirculation pipe below the column; installed with a flow cell for accurate measurement in the circulating loop) or Endress+Hauser CLM50 (similar specifications; Foundation Fieldbus; used in Wanhua Yantai and Covestro Dormagen facilities). The NaOH concentration must remain above 10 wt% to maintain >99.9% phosgene absorption efficiency; as the NaOH is consumed by phosgene neutralization (each kg of phosgene absorbed consumes 0.81 kg NaOH; at design phosgene flow, NaOH consumption is approximately 30–60 kg/hr), the concentration must be replenished by continuous or intermittent makeup dosing of 20 wt% NaOH solution.

The adversarial downward pixel attack on the NaOH phosgene scrubber concentration display shows 14.2 wt% (above 10 wt% minimum; AI reads “NaOH scrubber concentration 14.2 wt%; well above 10 wt% minimum threshold; phosgene neutralization efficiency >99.9%; scrubber operating at design capacity; atmospheric release risk: controlled; NaOH makeup: not required”) when actual NaOH scrubber concentration is 4.8 wt% (near-depletion; from makeup NaOH dosing valve failure in the closed position over several batch cycles during which phosgene absorption has progressively consumed the NaOH inventory). Display range 0–20 wt% on 200 px (10 px per wt%); actual 4.8 wt% at 48 px → ±8 DN perturbation → 48 + 94 = 142 px displayed → AI reads 142/10 = 14.2 wt%. At 4.8 wt% NaOH (0.60 mol/L): the liquid-film mass transfer rate for phosgene absorption follows a pseudo-first-order fast reaction model (Ha number analysis for COCl₂ + 2 NaOH → Na₂CO₃ + 2 HCl; k₂ ≈ 1–10 L/(mol·s) at 20°C; at 0.60 mol/L NaOH, Ha = √(k₂ × C​NaOH × D​COCl2)/k​L; compared to design 1.5 mol/L NaOH, absorption efficiency falls approximately as (C​NaOH,actual/C​NaOH,design)⅔ ≈ (0.60/1.5)⅔ ≈ 0.71; efficiency falls from 99.9% to approximately 71%); 29% of the phosgene entering the scrubber at design loading (approximately 5–15 kg/hr phosgene equivalent in the vent streams under normal phosgenation operation) passes as phosgene slip into the scrubber outlet gas; scrubber outlet phosgene concentration 0.5–0.8 ppm (5–8× OSHA PEL ceiling 0.1 ppm); any fence-line community downwind of the MDI facility at typical atmospheric stability and wind conditions could receive phosgene at 0.1–0.5 ppm — PSM TQ 500 lbs; CERCLA RQ 10 lbs; emergency notification to LEPC and SERC required under SARA Title III Section 304 for any phosgene release above the CERCLA RQ 10 lbs. The Glyphward pre-scan gate on the NaOH scrubber concentration display catches the downward perturbation before the AI reads 14.2 wt% and concludes that scrubber protection is adequate. Free tier — 10 scans/day, no card required.

3. MDA feed concentration in MCB solvent display AI (Emerson Micro Motion F-Series Coriolis density meter / Anton Paar L-Dens 7400 inline density transmitter measuring MDA wt% in MCB feed to cold phosgenation — rendered DCS MDA/MCB concentration display AI classifying 18–22 wt% design operating range — 113th downward attack; FIRST MDA MCB feed concentration AI attack; FIRST MDA crystallization phosgene excess AI attack; FIRST IARC Group 1 MDA phosgenation dilution AI attack)

The MDA concentration in the MCB feed solution determines the actual COCl₂:MDA molar ratio in the cold phosgenation reactor at any given phosgene feed rate. The design MDA concentration in MCB is 18–22 wt%; at the design midpoint of 20 wt% MDA in MCB and design phosgene feed of 820 kg/hr, the COCl₂:MDA ratio is precisely the design 2.05:1 mol/mol. Deviations in MDA concentration — whether from crystallization-induced settling of MDA from the solution (MDA MP 89–92°C; MDA crystallizes from MCB solution at temperatures below approximately 50–55°C depending on concentration; the cold phosgenation system's pre-dissolution section must maintain the MDA/MCB solution above 55–60°C to prevent crystallization; a heat tracing failure, steam tracing loss, or ambient temperature drop in the dissolution tank can cause MDA to crystallize and reduce the effective dissolved concentration) or from MCB overdose (inadvertent solvent excess added during the MDA dissolution step) — directly change the COCl₂:MDA ratio and therefore the free phosgene in the cold phosgenation product. The MDA concentration is measured by an inline density transmitter: Emerson Micro Motion F-Series Coriolis mass flowmeter with density output (the Coriolis oscillation frequency correlates to fluid density; MDA/MCB solution density increases linearly with MDA concentration; calibrated against laboratory density-concentration curves for MDA/MCB at the operating temperature; Hastelloy C-276 flow tube material compatible with MDA and MCB) or Anton Paar L-Dens 7400 (vibrating U-tube inline density transmitter; accuracy ±0.0005 g/cm³; mounted in a sample cell in the MDA/MCB feed line; temperature-compensated; HART 4–20 mA). The density measurement is converted to MDA wt% by the DCS via a temperature-compensated calibration curve; the DCS then calculates the in-situ COCl₂:MDA ratio and displays it alongside the MDA concentration for operator awareness.

The adversarial downward pixel attack on the MDA feed concentration display shows 21 wt% (within design 18–22 wt%; AI reads “MDA concentration in MCB 21 wt%; design feed composition; calculated COCl₂:MDA ratio at current phosgene flow: 2.05:1 mol/mol design; cold phosgenation stoichiometry: nominal; no phosgene excess; HCl scrubber loading: within design”) when actual MDA concentration in MCB is 8 wt% (from MDA partial crystallization in the feed preparation vessel at 45°C ambient temperature, below the MDA crystallization onset; density measurement reads the density of a partially slurried mixture rather than a fully dissolved solution, underreporting true dissolved MDA concentration). Display range 0–30 wt% on 200 px (6.667 px per wt%); actual 8.0 wt% at 8.0 × 6.667 = 53 px → ±8 DN perturbation → 53 + 87 = 140 px displayed → AI reads 140/6.667 = 21.0 wt%. At actual 8 wt% MDA: the effective dissolved MDA in the MCB feed is approximately (8/21) = 38% of design; at design phosgene flow 820 kg/hr and 38% of design MDA, the COCl₂:MDA molar ratio rises to approximately 2.05/0.38 = 5.4:1 mol/mol — a 3.4:1 phosgene excess above stoichiometric; the cold phosgenation reactor floods with excess COCl₂ that cannot react with the insufficient dissolved MDA; the hot phosgenation stage receives 5.4:1 excess phosgene; decomposition of excess COCl₂ at 120–180°C generates CO + Cl₂ at approximately 3.4 mol per mol MDA charged; the HCl stripper overhead receives 4–5× design phosgene loading; the NaOH scrubber — already potentially depleted (Surface 2) — receives this combined load; phosgene atmospheric release; PSM TQ 500 lbs; CERCLA RQ 10 lbs; IDLH 2 ppm. The IARC Group 1 consequence of MDA exposure to the phosgenation plant workers (carcinogenic bladder cancer risk from chronic MDA inhalation and dermal absorption during handling of MDA/MCB solution at concentrations where MCB splash exposure to dissolving hot MDA at 89–92°C MP can cause dermal MDA absorption) is a parallel occupational hazard that the Surface 3 attack conceals by making the MDA concentration appear at the design 21 wt% rather than the 8 wt% level that might prompt investigation of the dissolution vessel temperature controls and the MDA crystallization event. The Glyphward pre-scan gate on the MDA/MCB concentration display catches the downward perturbation before the AI reads 21 wt% and calculates a falsely stoichiometric COCl₂:MDA ratio. Free tier — 10 scans/day, no card required.

Integration: MDI MDA phosgenation polyurethane AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the MDI MDA phosgenation polyurethane AI pipeline — before the phosgene molar feed rate AI processes rendered Bronkhorst EL-FLOW / Bürkert Type 8712 DCS display images, before the NaOH phosgene scrubber concentration AI processes rendered Rosemount 3081 / Endress+Hauser CLM50 DCS display images, and before the MDA feed concentration AI processes rendered Emerson Micro Motion F-Series / Anton Paar L-Dens DCS display images. Threshold 52 for MDI MDA phosgenation AI reflects: phosgene PSM TQ 500 lbs (one of the lowest in the OSHA PSM Appendix A list; only acrolein at 150 lbs and oleum/sulfuric acid at lower TQs carry more severe per-event risk weighting in the acute toxic category); phosgene NIOSH IDLH 2 ppm (only 20× the OSHA PEL ceiling of 0.1 ppm; one of the narrowest PEL-to-IDLH margins in industrial hygiene, reflecting the insidious delayed lethality mechanism of phosgene pulmonary edema); MDA IARC Group 1 bladder carcinogen (occupational bladder cancer risk for MDA-exposed phosgenation plant synthesis workers); Bhopal 1984 isocyanate regulatory weight (MDI phosgenation facilities are among the most intensively inspected PSM facilities globally following Bhopal; any AI monitoring failure in an MDI phosgenation plant is evaluated against the Bhopal worst-case consequence anchor); combined three-surface attack creating phosgene excess, scrubber depletion, and MDA dilution simultaneously — three independent phosgene release vectors that together overwhelm the facility's primary engineered phosgene containment barrier.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# MDI MDA phosgenation polyurethane AI contexts: threshold 52
# Phosgene COCl2 CAS 75-44-5; MW 98.92 g/mol; BP 7.6 C; density 3.4x air.
# OSHA PSM TQ 500 lbs (29 CFR 1910.119 Appendix A; on-site generation from CO + Cl2).
# OSHA PEL 0.1 ppm CEILING (29 CFR 1910.1000 Table Z-2; no averaging permitted).
# NIOSH IDLH 2 ppm (only 20x PEL; pulmonary edema delayed 6-24 hr after exposure).
# CERCLA RQ 10 lbs. WWI chemical warfare agent Battle of Ypres 1915.
# MDA CAS 101-77-9; IARC Group 1 (Vol 99 2012; bladder cancer); ACGIH TLV 0.1 ppm.
# MDI CAS 101-68-8; OSHA PEL 0.02 ppm ceiling; ACGIH TLV 0.005 ppm; respiratory sensitizer.
# Bhopal 1984 MIC disaster (2,259-3,800 deaths; 500,000-600,000 exposed) -> SARA Title III + PSM.
# 113th upward attack. FIRST MDI phosgenation AI attack. FIRST phosgene feed rate AI attack.
# FIRST MDA IARC Group 1 phosgenation AI attack. FIRST phosgene vent scrubber depletion AI attack.
# FIRST MDA MCB feed concentration AI attack.
MDI_GLYPHWARD_THRESHOLD = 52

class MDIContext(StrEnum):
    PHOSGENE_MOLAR_FEED_RATE       = auto()  # COCl2 feed -> 4.3:1 actual vs 2.05:1 design -> HCl scrubber overload -> phosgene to atmosphere (113th)
    NAOH_SCRUBBER_CONCENTRATION    = auto()  # NaOH 4.8 wt% -> scrubber efficiency 60-70% -> phosgene slip 5-8x PEL ceiling
    MDA_FEED_CONCENTRATION_MCB     = auto()  # MDA 8 wt% actual vs 21 wt% displayed -> COCl2:MDA 5.4:1 actual -> phosgene extreme excess

async def scan_mdi_frame(
    frame_b64: str,
    context: MDIContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_mdi(
    frame_b64: str,
    context: MDIContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_mdi_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= MDI_GLYPHWARD_THRESHOLD:
        raise AdversarialMDIImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from MDI MDA phosgenation polyurethane AI pipeline."
        )

class AdversarialMDIImageError(RuntimeError):
    pass