Adversarial Injection · Industrial Chemical AI Monitoring · Attack #132

Nitromethane (CH₃NO₂) Racing Fuel Explosive in Confinement: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Nitromethane AI Attack

Nitromethane (CH₃NO₂; CAS 75-52-5; MW 61.04; bp 101 °C; flash point 35 °C; density 1.137 g/mL) appears in OSHA's Process Safety Management standard 29 CFR 1910.119 Appendix A under a dual listing — as a flammable liquid at TQ 2,500 lbs and as an explosive/reactive at the same TQ — one of the few chemicals in Appendix A to carry both hazard classifications simultaneously, reflecting its ability to detonate under confinement when heated above approximately 280 °C, or as low as 100–120 °C when sensitised by trace aliphatic amine contamination as low as 0.03–0.05 wt% (300–500 ppm). Produced commercially by Angus Chemical Company (BASF subsidiary, Sterlington, Louisiana) via vapour-phase nitration of propane (CH₃CH₂CH₃ + HNO₃ → CH₃NO₂ + CH₃CH₂OH + H₂O + byproducts at 350–400 °C), nitromethane is used as a racing fuel (NHRA Top Fuel and Funny Car classes — up to 100% nitromethane at 3.2 L per 0.4 km pass), a synthesis solvent, and a pharmaceutical intermediate (chloramphenicol synthesis, tromethamine production). CERCLA reportable quantity is 100 lbs. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image can conceal a 380 ppm amine contaminant in the nitromethane product stream that sensitises detonation, hide a storage tank temperature of 88 °C approaching the sensitised DDT onset, or mask a synthesis reactor pressure of 12.8 bar approaching the maximum allowable working pressure. Glyphward detects all three attack surfaces at threshold 36 before any image reaches a downstream AI inference call.

The nitromethane amine sensitisation phenomenon is the key hazard that distinguishes nitromethane's explosive risk profile from simple flammable-liquid fire risk. At atmospheric pressure, pure nitromethane does not detonate under confinement below approximately 280 °C — it burns cleanly as a liquid fuel. However, trace quantities of aliphatic amines (primary, secondary, or tertiary; examples: dimethylamine, trimethylamine, diethylamine, triethylamine, morpholine) shift the detonation sensitivity of liquid nitromethane dramatically: a concentration of 0.03 wt% (300 ppm) dimethylamine lowers the DDT onset temperature to approximately 120–130 °C and reduces the minimum amount of confined nitromethane that can sustain detonation. This sensitisation mechanism was identified in the 1950s during the development of nitromethane as an industrial solvent and led directly to US DOT regulations requiring nitromethane and amine compounds to be shipped in separate vehicles (HM-181 segregation requirements). In a synthesis facility, amine contamination can enter the nitromethane product stream via: piping shared with amine-handling processes (inadequate cleaning between product transitions), decomposition of any trace protein-based or amino compound (lubricant additives, gasket residues), or backflow of amine-containing scrubber liquor into product lines. An AI monitoring system that misses a 380 ppm amine contamination in the product analyser reading has created the conditions for a sensitised nitromethane storage tank explosion at the temperature conditions of Surface 2.

Why Nitromethane Production and Storage Is Disproportionately Vulnerable to Pixel Manipulation

Three features of nitromethane production and storage create exceptional adversarial DCS attack vulnerability. First, the amine contaminant analyser operates in the 0–500 ppm range on a product stream where a 300 ppm contamination event is the difference between a flammable liquid and a sensitised explosive. On a 0–500 ppm DCS bar (200 px), the pixel scale is 0.4 px/ppm; the difference between 12 ppm (shown) and 380 ppm (actual) is 147 px — a shift of 73.5% of the bar height. This is a large absolute shift, but in a complex DCS dashboard displaying 50+ process variables simultaneously, a single bar shifted to a different region of its scale is easily overlooked by operators and indistinguishable from normal process variation on a rendered display image delivered to an AI inference endpoint as a JPEG. Second, the storage tank temperature monitor on a 0–150 °C scale (1.33 px/°C) requires only an 80 px downward shift to convert a displayed 88 °C into 28 °C — and 80 px is well within the adversarial perturbation capacity of a pixel-level DCS manipulation. Third, the synthesis reactor pressure on a 0–16 bar scale (12.5 px/bar) requires a 118 px downward shift to convert 12.8 bar into 3.4 bar — again, well within practical adversarial perturbation range.

Surface 1 — Amine Contaminant in Nitromethane Product Stream (Downward Attack)

The amine contaminant analyser (GC-FID or dedicated amine-selective sensor) output for the nitromethane product stream is displayed on a 200 px vertical DCS bar spanning 0 to 500 ppm amine. The pixel scale is 200 px ÷ 500 ppm = 0.4 px/ppm. At the actual amine concentration of 380 ppm — 0.038 wt%, sufficient to sensitise nitromethane detonation — the rendered pixel position is 380 × 0.4 = 152 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 147.2 px to position 4.8 px ≈ 5 px from the bottom. The AI inference engine reads the amine as 5 ÷ 0.4 = 12.5 ppm ≈ 12 ppm — well below the product specification maximum of 50 ppm and far below the 300 ppm sensitisation threshold. No product hold is initiated; no amine source investigation is triggered; the sensitised nitromethane continues flowing into storage.

The relationship between amine concentration and nitromethane sensitisation follows a steep dose-response: below 100 ppm amine, the DDT onset temperature is reduced from 280 °C (pure) by approximately 20–30 °C; at 300–500 ppm amine, the reduction reaches 150–180 °C, bringing the DDT onset to 100–130 °C range. At 380 ppm (the actual contamination level in Surface 1), the DDT onset in the liquid phase under confinement is approximately 120 °C — a temperature achievable in the storage tank if the tank has solar heat gain, is near a steam-traced process line, or if the polymerisation of nitromethane (a slow background reaction at elevated temperatures) begins contributing heat. The amine contamination represents the critical sensitisation event that determines whether Surface 2 (tank temperature 88 °C) is a recoverable process upset or an imminent detonation precursor.

Surface 2 — Nitromethane Storage Tank Temperature (Upward Attack)

The nitromethane storage tank temperature is displayed on a 200 px vertical DCS bar spanning 0 to 150 °C. The pixel scale is 200 px ÷ 150 °C = 1.333 px/°C. At the actual tank temperature of 88 °C — 8 °C below the sensitised DDT onset of 120 °C for 380 ppm amine-contaminated nitromethane — the rendered pixel position is 88 × 1.333 = 117.3 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 80.5 px to position 36.8 px. The AI inference engine reads the temperature as 36.8 ÷ 1.333 = 27.6 °C ≈ 28 °C — indistinguishable from ambient temperature. No cooling activation is triggered; no emergency inspection is ordered.

At 88 °C, nitromethane is well above its flash point (35 °C) and generating significant vapour pressure (approximately 60 mmHg at 88 °C compared to 36 mmHg at ambient). The vapour space above the liquid — if the tank venting is inadequate due to pressure relief device fouling or isolation — pressurises the tank, accelerating the approach to PRV activation. More critically, at 88 °C with 380 ppm amine contamination (Surface 1), nitromethane is only 32 °C below the sensitised detonation onset. Normal process variation (±5 °C), a 15-minute solar heat gain period on an exposed metal storage tank, or the onset of slow background nitromethane polymerisation (endothermic degradation pathway begins above ~80 °C) can close the remaining 32 °C gap. The AI system reading 28 °C displays a picture of ambient-temperature stable storage while the actual 88 °C represents a critical process upset 32 °C from the detonation threshold in sensitised product.

Surface 3 — Nitromethane Synthesis Reactor Pressure (Upward Attack)

The nitromethane synthesis reactor pressure is displayed on a 200 px vertical DCS bar spanning 0 to 16 bar (the maximum allowable working pressure, MAWP). The pixel scale is 200 px ÷ 16 bar = 12.5 px/bar. At the actual reactor pressure of 12.8 bar — 88% of the MAWP and 1.7 bar below the PRV setpoint of 14.5 bar — the rendered pixel position is 12.8 × 12.5 = 160 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 117.5 px to position 42.5 px. The AI inference engine reads the pressure as 42.5 ÷ 12.5 = 3.4 bar — consistent with normal design operating pressure of 2–4 bar for the vapour-phase propane nitration step. No alarm is generated; no APC feed-reduction intervention is initiated.

The propane nitration reaction (CH₃CH₂CH₃ + HNO₃ → CH₃NO₂ + CH₃CH₂OH + CH₃NO₃ + CH₂OHCH₃ + CO₂ + H₂O at 350–400 °C and 2–4 bar) generates multiple byproducts. At 12.8 bar — 3.2× the design operating pressure — the reaction is operating in an anomalous regime that indicates one of: HNO₃ feed over-delivery causing increased reaction rate, cooling system failure allowing temperature to rise (increasing vapour pressure of the reaction mixture), or a downstream pressure blockage (fouled downstream separator, closed valve, or plugged line). The PRV at 14.5 bar will activate if pressure continues rising; PRV activation on the nitration reactor discharges a mixture of nitromethane vapour, HNO₃ mist, propane (unconverted feed), and NO₂/NOₓ byproducts into the emergency vent system. If the vent system is not designed for the combined reactive/flammable/toxic discharge, or if the PRV discharge ignites, the vent system can provide the confined volume and thermal input needed for sensitised nitromethane to transition from deflagration to detonation.

Integrating Glyphward into Nitromethane Production AI Monitoring Pipelines

The following Python snippet authenticates every nitromethane production DCS frame against the Glyphward API before passing it to a downstream safety-monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception routed to the plant's SIS for automatic product stream hold, storage tank emergency cooling activation, and reactor feed cutoff.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
NM_GLYPHWARD_THRESHOLD = 36

class NMContext(StrEnum):
    AMINE_CONTAMINANT_CONC = auto()   # Surface 1 — downward attack
    STORAGE_TANK_TEMP      = auto()   # Surface 2 — upward attack
    REACTOR_PRESSURE       = auto()   # Surface 3 — upward attack

class AdversarialNMImageError(RuntimeError):
    def __init__(self, surface: NMContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] Nitromethane adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={NM_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_nm_frame(frame_path: Path, surface: NMContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": NM_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialNMImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_nitromethane_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (NMContext.AMINE_CONTAMINANT_CONC, frame_dir / "amine_contaminant_analyser.png"),
        (NMContext.STORAGE_TANK_TEMP,      frame_dir / "nm_storage_tank_temp.png"),
        (NMContext.REACTOR_PRESSURE,       frame_dir / "nm_reactor_pressure.png"),
    ]
    tasks = [verify_nm_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls run concurrently. The amine contamination check, the storage temperature check, and the reactor pressure check execute simultaneously — critical because all three surfaces are causally linked: amine contamination (Surface 1) sensitises the product; elevated storage temperature (Surface 2) brings the sensitised product close to its DDT onset; and reactor pressure overshoot (Surface 3) can trigger PRV activation that discharges sensitised NM vapour into a confined vent system. A compound adversarial attack manipulating all three displays simultaneously creates the full detonation precursor scenario while the AI monitoring system reports normal operations across all three variables. The SHA-256 frame hash in each exception provides forensic traceability for the post-incident investigation required under OSHA PSM 29 CFR 1910.119(m) and EPA RMP 40 CFR Part 68.