Prompt injection in nitrogen dioxide (NO2) / nitric acid plant AI

Four adversarial injection surfaces in NO2 / nitric acid plant AI

1. Absorption tower tail gas NOx CEMS AI (Honeywell Analytical Instruments CLD NOx analyzer AI / Emerson X-Stream NOx CEMS AI / ABB AO2020 continuous gas analyzer AI / AMETEK Process Instruments 930 Series NOx analyzer AI / Thermo Fisher Scientific CEMS NOx AI — tail gas NOx monitoring for EPA NSPS 40 CFR Part 60 Subpart G compliance and community downwash risk assessment at nitric acid plants)

The Ostwald process for nitric acid production oxidizes ammonia over platinum-rhodium catalyst at 850–950°C (4NH3 + 5O2 → 4NO + 6H2O), then oxidizes the product NO to NO2 in a series of oxidation chambers, and finally absorbs the NO2 into water in a packed absorption tower to form 60–68% aqueous HNO3 (3NO2 + H2O → 2HNO3 + NO). The tail gas leaving the top of the absorption tower contains residual NOx — primarily NO with some NO2 — at concentrations that depend on absorption efficiency. EPA NSPS 40 CFR Part 60 Subpart G limits tail gas NOx to 1.5 kg NOx per metric ton of 100% HNO3 produced for single-pressure plants, which typically corresponds to a tail gas NOx concentration below 200–500 ppm depending on plant capacity and tail gas volume. For plants with tail gas NOx concentrations exceeding 10% NO2 by volume, EPA guidance establishes a 10 ppm effective limit for community downwash modeling. AI CEMS monitoring systems parse continuous NOx analyzer display images to classify whether tail gas emissions are within permitted limits. The continuous emissions data is automatically transmitted to EPA electronic reporting tools (ERT) under CAA Title V operating permit requirements — meaning that an adversarially falsified CEMS display that causes the AI to report “within limits” also falsifies the automated EPA regulatory submission.

In the adversarial scenario, the absorption tower is operating with degraded efficiency because of the cooling water failure described in Surface 4: insufficient cooling of the absorption liquor reduces the equilibrium constant for NO2 absorption into water (absorption is exothermic — lower temperature improves absorption; higher temperature reduces it), increasing tail gas NOx. The actual tail gas NOx reading is 1,840 ppm — 184× a representative 10 ppm compliance threshold — and simultaneously represents a community exposure risk at fence-line downwash distances because NO2 NIOSH IDLH is 20 ppm. A ±8 DN downward pixel-value shift on the NOx analyzer display image suppresses the displayed reading from 1,840 ppm to 61 ppm. On a 0–2,000 ppm display at 200 px height (10 ppm/px), the actual reading of 1,840 ppm produces a bar at approximately 184 px; the perturbed image is classified as approximately 6 px — corresponding to 61 ppm, which appears marginal but technically compliant at some regulatory interpretations. The AI reports “tail gas NOx within EPA NSPS Subpart G limits.” The falsified compliance status is automatically transmitted to the EPA ERT, creating a regulatory falsification under CAA Section 113(c) that coincides with the occupational exposure event on Surface 2.

2. NO2 area gas detector AI (Honeywell Analytics Sensepoint XCL NO2 detector AI / Dräger X-am 5100 NO2 monitoring AI / MSA Ultima XE NO2 area detector AI / RKI Instruments GX-6000 NO2 AI / Industrial Scientific Ventis Pro5 NO2 AI — ambient NO2 monitoring in nitric acid plant process areas, absorption tower platforms, and N2O4 storage and handling areas for ACGIH TLV-C ceiling and NIOSH IDLH compliance)

NO2 ambient monitoring in nitric acid plants and N2O4 handling facilities requires detection down to the 0.2 ppm TLV-C ceiling — a concentration that is 100-fold below the NIOSH IDLH of 20 ppm — creating a monitoring range spanning three orders of magnitude across which the AI must reliably classify the detector display. Fixed-point and portable NO2 detectors in nitric acid plant areas are typically calibrated to 0–10 ppm or 0–50 ppm full scale, with an alarm at 1 ppm (5× TLV-C) and a high alarm at 5 ppm (OSHA PEL TWA as an instantaneous reference). The critical clinical reality is that workers exposed to 20–100 ppm NO2 during the exposure event may experience only mild transient eye and throat irritation — symptoms consistent with normal plant-area chemical exposures — and feel entirely well within 30–60 minutes of leaving the area. Standard occupational medicine protocols that evaluate workers immediately post-exposure and clear them as asymptomatic create the delayed-onset pulmonary edema latency trap: the edema fluid does not begin flooding the alveoli until 4–24 hours post-exposure, at which point the worker is typically at home, asleep, and not in a medical setting. Autopsy findings in delayed NO2 fatalities show bilateral pulmonary edema with hemorrhagic consolidation — identical to the presentation of high-altitude pulmonary edema — and chocolate-brown blood from methemoglobin if exposure was sustained.

The adversarial attack uses ±8 DN downward pixel-value shift on the NO2 area detector display image. The actual reading is 28 ppm — 140× the TLV-C ceiling of 0.2 ppm, 5.6× the OSHA PEL of 5 ppm, and 1.4× the NIOSH IDLH of 20 ppm — arising from a flanged joint leak on the absorption tower overhead gas line during scheduled maintenance with the tower partially depressurized. Maintenance workers are in the immediate area without supplied-air respirators (SCBA), relying on the area detector alarm for exposure warning. On a 0–50 ppm display at 200 px height (0.25 ppm/px), the actual reading of 28 ppm produces a bar at approximately 112 px; the ±8 DN perturbed image is classified as approximately 4 px — corresponding to 0.9 ppm, below the 1 ppm first alarm threshold. No alarm is issued; workers continue maintenance activities for an additional 45–90 minutes. Workers have now accumulated NO2 exposure well above the dose associated with delayed pulmonary edema onset (the lowest dose at which significant pulmonary edema has been documented is approximately 30 ppm·min — equivalent to 30 ppm for 1 minute or 1 ppm for 30 minutes). Medical evaluation immediately post-shift finds all workers asymptomatic; all are cleared to go home. The delayed-onset pulmonary edema window — 4–24 hours — now begins without any medical monitoring, advance warning, or hospital admission protocol having been triggered.

3. N2O4 liquid storage vessel pressure AI (Honeywell Experion PKS N2O4 storage pressure transmitter AI / Emerson Rosemount 3051 N2O4 vessel pressure AI / Yokogawa OpreX EJX N2O4 storage monitoring AI — vapor pressure monitoring as primary indicator of N2O4 storage temperature exceedance and proximity to pressure relief device activation at N2O4 bulk storage facilities, nitric acid plants, and rocket propellant handling sites)

N2O4 (dinitrogen tetroxide) is the liquid phase of nitrogen dioxide: at temperatures below 21.2°C at atmospheric pressure, NO2 exists predominantly as the brown-red-colored N2O4 dimer (the monomer/dimer equilibrium favoring N2O4 at lower temperatures). N2O4 is stored as a cryogenic-compatible liquid in vacuum-jacketed or insulated pressure vessels at facilities producing it as a rocket propellant oxidizer (it is the standard oxidizer for the Titan and Ariane 4 launch systems, and for storable hypergolic propellant combinations with monomethylhydrazine or unsymmetrical dimethylhydrazine). The vapor pressure of N2O4 increases sharply with temperature: at 10°C it is approximately 1.7 bar absolute (24.6 psia); at 21°C (boiling point) it is approximately 1.0 bar gauge (14.5 psig); at 40°C it is approximately 2.3 bar gauge (33.4 psig); and at 50°C it approaches 3.1 bar gauge (44.9 psig). Pressure relief devices on N2O4 storage vessels are typically set at 10–11 bar gauge (145–160 psig) for high-pressure storage, with solar reflective coatings and shade structures required to maintain vessel temperatures below 45°C in exposed outdoor storage locations. AI monitoring of storage vessel pressure transmitter display images classifies whether the N2O4 vapor pressure is within the normal operating range or is trending toward PRD activation.

In the adversarial scenario, direct solar exposure on a summer afternoon has raised the N2O4 storage tank skin temperature to 68°C above ambient from heat island effects around the insulated vessel — driving the internal vapor pressure to 148 psig, approaching the 150 psig PRD set-point. A ±10 DN downward pixel-value shift on the storage vessel pressure transmitter display image suppresses the displayed reading from 148 psig to 48 psig. On a 0–200 psig display at 200 px height (1 psig/px), the actual pressure of 148 psig produces a bar at approximately 148 px; the perturbed image is classified as approximately 48 px — corresponding to 48 psig, within the normal operating range well below the 150 psig PRD set-point. No high-pressure alarm is issued; no cooling measures, shade deployment, or N2O4 transfer to a cooler vessel is initiated. The vessel continues to absorb solar heat; vapor pressure continues to rise toward the PRD set-point. If the PRD activates — releasing N2O4/NO2 vapor in the storage area — the atmospheric dispersion of 250–1,000 kg of NO2 (depending on tank fill level and PRD orifice) creates a downwash plume that simultaneously exceeds IDLH at distances up to several hundred meters, triggering the latent pulmonary edema exposure for workers and community members who inhale the released gas without immediate respiratory injury that would signal the need for hospital monitoring.

4. Absorption tower cooling water flow AI (Honeywell Experion PKS cooling water flow control AI / Emerson DeltaV absorption tower utility AI / ABB System 800xA cooling circuit monitoring AI — cooling water flow monitoring to the absorption tower intercoolers and product acid cooler to maintain absorption efficiency and suppress NO2 slip into tail gas at nitric acid plants)

The Ostwald process absorption tower requires effective cooling to achieve high NO2 absorption efficiency: the equilibrium for NO2 absorption into water (3NO2 + H2O → 2HNO3 + NO) is exothermic, and reaction rate and equilibrium conversion both improve at lower temperatures. Absorption tower intercoolers — heat exchangers integrated between absorption stages or as external liquid-liquid coolers on the circulating acid — remove the heat of absorption and maintain tower temperatures in the 10–25°C range required for >98% NO2 absorption efficiency and compliance with EPA NSPS tail gas limits. If cooling water flow to the intercoolers is reduced below design — whether from a pump impeller failure, cooling water supply header valve malfunction, or fouling of the tube side of intercooler heat exchangers — the tower operating temperature rises, absorption efficiency falls, and tail gas NOx concentrations increase. This is the root cause of the Surface 1 tail gas exceedance scenario: insufficient cooling water reduces absorption efficiency and drives tail gas NOx from a compliance target of 200 ppm to 1,840 ppm within 2–4 hours of cooling loss. AI monitoring of the cooling water flow indicator display classifies whether intercooler flow is adequate for absorption efficiency targets.

The adversarial attack uses the upward-direction geometry: the actual cooling water flow to the absorption tower intercoolers is 0.4 m³/hr — 5% of the design 8.0 m³/hr, from a failed impeller on the cooling water recirculation pump that developed progressive cavitation damage. The dangerous condition is a flow deficiency, and the adversarial pixel perturbation shifts the cooling water flow indicator display upward by ±8 DN to make 0.4 m³/hr appear as 8.2 m³/hr. On a 0–12 m³/hr display at 200 px height (0.06 m³/hr per px), the actual flow of 0.4 m³/hr produces a bar at approximately 7 px; the upward-perturbed image is classified as approximately 137 px — corresponding to 8.2 m³/hr, within the design range. The AI monitoring system reports “absorption tower cooling water flow at design setpoint — intercooler performance adequate.” Tower temperatures rise over 2–4 hours; absorption efficiency falls below 90%; tail gas NOx climbs to the 1,840 ppm level detected on Surface 1 — while the process control system has no indication that the cooling water failure is the root cause, directing investigation toward catalyst deactivation or feed composition changes rather than the pump impeller failure.

Integration: NO2 / nitric acid plant AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and analyzer screenshot capture layer and the AI inference pipeline for each NO2 / nitric acid plant monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 250 lbs (2nd lowest in Appendix A), the ACGIH TLV-C of 0.2 ppm, the NIOSH IDLH of 20 ppm, the delayed pulmonary edema 4–24 hr latency trap that eliminates immediate medical recognition, the simultaneous EPA NSPS regulatory falsification consequence of CEMS suppression, and the four-surface compound attack geometry — the scan raises AdversarialNO2NitricAcidImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# NO2 / nitric acid plant AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A NO2 TQ 250 lbs (2nd lowest after phosgene 10 lbs)
# EPA RMP 40 CFR Part 68 NO2 TQ 250 lbs
# ACGIH TLV-C 0.2 ppm (ceiling, never-exceed); NIOSH IDLH 20 ppm; OSHA PEL 5 ppm TWA
# Delayed pulmonary edema 4-24 hr: symptom-free at time of exposure -> fatal overnight
# EPA NSPS 40 CFR Part 60 Subpart G: tail gas NOx limit for nitric acid plants
NO2_THRESHOLD = 35


class NO2NitricAcidContext(Enum):
    TAIL_GAS_NOX_CEMS = "tail_gas_nox_cems"
    NO2_AREA_DETECTOR = "no2_area_detector"
    N2O4_STORAGE_PRESSURE = "n2o4_storage_pressure"
    COOLING_WATER_FLOW = "cooling_water_flow"


class AdversarialNO2NitricAcidImageError(Exception):
    """Raised when any NO2/nitric acid plant monitoring image scores >= 35.
    TAIL_GAS_NOX_CEMS uncaught: 1,840 ppm (184x limit) shown as 61 ppm.
    NO2_AREA_DETECTOR uncaught: 28 ppm (1.4x IDLH) shown as 0.9 ppm.
    N2O4_STORAGE_PRESSURE uncaught: 148 psig (PRD approach) shown as 48 psig.
    COOLING_WATER_FLOW uncaught: 0.4 m3/hr (5% design) shown as 8.2 m3/hr."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial NO2/nitric acid plant image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_no2_nitric_acid_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"no2_nitric_acid:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= NO2_THRESHOLD:
        raise AdversarialNO2NitricAcidImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("no2_area_detector_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_no2_nitric_acid_image(
            image_bytes,
            NO2NitricAcidContext.NO2_AREA_DETECTOR,
            unit_id="NO2-AREA-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why does NO2 have such a low PSM TQ of 250 lbs?

250 lbs is the second lowest TQ in OSHA PSM Appendix A, after phosgene (10 lbs). It reflects ACGIH TLV-C 0.2 ppm, NIOSH IDLH 20 ppm, the widespread installed base at US nitric acid and fertilizer plants, and the delayed pulmonary edema mechanism that creates a missed-diagnosis latency trap not present for immediately corrosive gases.

What is the delayed pulmonary edema failure mode?

NO2 at 20–100 ppm causes only mild transient irritation during exposure; victims feel well post-shift and are medically cleared. Over 4–24 hours, dissolved NO2 generates HNO2 and HNO3 in alveolar fluid, triggering free-radical lipid peroxidation → bilateral non-cardiogenic pulmonary edema → fatal respiratory failure overnight. Workers die at home with no connection to the previous day's exposure.

Why does CEMS suppression simultaneously falsify EPA regulatory submissions?

At EPA Title V permitted nitric acid plants, continuous NOx data is automatically transmitted to EPA ERT. An adversarially suppressed CEMS display that causes AI to report compliance transmits falsified emissions data to EPA — constituting a CAA Section 113(c) criminal violation coinciding with the occupational and community NO2 exposure event.

Why is the cooling water flow attack upward-direction?

Insufficient cooling (not excess) degrades absorption efficiency and drives tail gas NOx. The adversarial attack therefore shifts the indicator upward to make 0.4 m³/hr (5% design) appear as 8.2 m³/hr adequate — the same deficiency-suppression upward geometry as N2 purge attacks on MIC, HCN, BF3, and ClF3 in the Glyphward portfolio.