Prompt injection in nuclear power plant AI

Four adversarial injection surfaces in nuclear power plant AI

1. Reactor equipment condition monitoring AI injection (Bently Nevada 3500, Emerson AMS Machinery Health, GE Digital APM, Baker Hughes SmartSignal)

Every commercial nuclear power plant in the United States operates a fleet of rotating machinery — reactor coolant pumps (RCPs), main turbine-generators rated between 600 MWe and 1,400 MWe, boiler feed pump turbines, circulating water pumps, and emergency diesel generators — that is continuously monitored by online vibration protection and surveillance systems. Bently Nevada’s 3500 Series rack-based machinery protection system, the industry-standard platform installed at more than 80% of U.S. nuclear plants, collects proximity probe, accelerometer, and velocity transducer signals from bearing journals, casing measurement points, and shaft reference keyphasors at sample rates of up to 65,536 samples per second, providing both protection-level (hard-trip) and surveillance-level (condition monitoring) output channels. The surveillance-level vibration data — sampled continuously and buffered for trending — is transmitted to plant process computers and, increasingly, to cloud-connected predictive maintenance AI platforms operated by the plant’s maintenance organization. Emerson Automation Solutions AMS Machinery Health Advisor, the dominant predictive maintenance AI platform in the U.S. nuclear fleet following Emerson’s acquisition of CSi Technologies, processes vibration spectrum data by rendering raw Fast Fourier Transform (FFT) vibration spectrogram images and bearing defect frequency waterfall plots that are submitted to AI pattern recognition models trained to identify bearing outer race defects, inner race defects, rolling element defects, and cage defects by their characteristic spectral signatures (BPFO, BPFI, BSF, FTF frequencies). GE Digital APM and Baker Hughes SmartSignal similarly process rendered spectrogram images and trend visualization charts through AI models that assess equipment health and generate work order recommendations. NRC 10 CFR 50.65 (the Maintenance Rule) and NEI 21-07 Section 4.3 on AI-assisted predictive maintenance establish the regulatory framework within which these AI-generated maintenance recommendations influence outage planning and corrective maintenance scheduling at nuclear facilities.

The adversarial injection attack against nuclear predictive maintenance AI targets the rendered vibration spectrogram image at the boundary where FFT data is converted to a spectrogram display image before submission to the AI pattern recognition engine. Adversarial pixel perturbations applied to turbine-generator or RCP motor vibration spectrogram images can cause the AI to suppress bearing defect frequency amplitude indicators even when the underlying vibration data clearly shows defect signature growth — causing the AI to report “healthy” bearing condition for a bearing accumulating fatigue damage toward failure. For reactor coolant pump motors, where bearing failure can lead to increased RCP seal leakoff and ultimately to a loss-of-coolant accident (LOCA) precursor condition, suppression of bearing condition monitoring AI alerts has direct nuclear safety significance. The 10 CFR 50.65 Maintenance Rule requires plants to monitor the effectiveness of maintenance against pre-established goals and take corrective action when goals are not met — a requirement that AI-suppressed bearing fault alerts would cause the plant to fail silently, believing maintenance program effectiveness is satisfactory when the monitored component is actually degrading. NEI 21-07 Section 5.1 notes that AI-generated maintenance recommendations must be subject to human oversight commensurate with the safety significance of the affected component, but the specific adversarial robustness of image-input spectrogram AI is not addressed. Adversarial manipulation of predictive maintenance AI at nuclear facilities operated by Exelon, Duke Energy, or Southern Nuclear could allow equipment degradation to proceed undetected through multiple surveillance intervals, increasing the probability of forced outages, equipment failures, or safety system unavailability.

2. Reactor coolant system (RCS) leak detection AI injection (Westinghouse LEFM, Combustion Engineering, GE Hitachi NUMAC RPS/ATWS)

Nuclear reactor coolant system leak rate monitoring is among the most safety-critical instrumentation functions in a pressurized water reactor (PWR) or boiling water reactor (BWR) plant. The reactor coolant system pressure boundary — encompassing the reactor vessel, pressurizer, steam generators, and interconnecting primary piping — must be maintained at a high level of structural integrity to prevent loss-of-coolant accidents, and continuous leak rate monitoring provides the earliest indication of developing pressure boundary degradation. NRC Technical Specification 3.4.13 requires PWR plants to identify and quantify RCS leakage, with action levels triggered when identified leakage exceeds 10 gallons per day (approximately 0.007 gpm) or unidentified leakage exceeds 0.1 gpm. 10 CFR Part 50 Appendix J primary containment integrity testing requirements and Regulatory Guide 1.45 (Guidance on Monitoring and Responding to Reactor Coolant System Leakage) provide the broader regulatory framework. Westinghouse Electric Company’s LEFM CheckPlus ultrasonic leak flow measurement system uses clamp-on ultrasonic transducers on primary coolant piping to measure flow directly, providing leak rate data with sensitivity below the TS 3.4.13 threshold. Combustion Engineering (now Framatome) designed RCS leak detection systems for CE-designed PWRs (Calvert Cliffs, Palo Verde, Fort Calhoun before shutdown) that integrate containment sump level indication, radiation monitor readings (R-11, R-12 area radiation monitors and particulate monitors), and makeup water usage rates into a calculated leak rate. GE Hitachi’s NUMAC-based Reactor Protection System and ATWS (Anticipated Transient Without Scram) instrumentation, deployed across the BWR fleet, integrates drywell pressure, drywell temperature, drywell humidity, and suppression pool level signals that inform AI-assisted primary boundary leak status assessment.

The adversarial injection attack against RCS leak detection AI exploits the pipeline segment where radiation monitor readings, containment sump level trends, and RCS inventory makeup rate measurements are rendered as time-series trend charts and submitted to AI analysis models for leak rate classification and trending. Modern plant process computer systems at plants such as Dominion Energy’s North Anna and Surry stations, Duke Energy’s McGuire and Catawba stations, and NextEra’s Turkey Point station render RCS leakage indicator trend data as visualization charts that are ingested by AI-assisted leak rate calculation programs and operational decision support systems for shift supervisor review. Adversarial pixel perturbations applied to these trend chart images can cause the AI to classify a leak rate trend showing gradual growth toward the 0.1 gpm TS 3.4.13 action threshold as a stable, below-threshold condition — delaying or preventing operator recognition of developing primary coolant leakage. At NRC-regulated plants, the shift supervisor’s TS Limiting Condition for Operation (LCO) entry decision for TS 3.4.13 is the primary mechanism for ensuring continued safe operation with identified leakage; adversarial suppression of the RCS leak AI’s trend alert delays LCO entry, potentially allowing leakage to exceed the action threshold without prompting the required corrective actions (identifying leak source, reducing leakage to within limits, or entering the applicable action statement for plant shutdown if the LCO is not met within the allowed outage time). For plants operating under NRC Initial License Conditions or operating under Increased Inspection findings for leakage-related issues — as have occurred at several BWR plants in the Southeast with drywell leakage history — adversarial suppression of AI-assisted leakage trend monitoring has direct implications for the plant’s NRC performance indicator standing.

3. Spent fuel pool (SFP) monitoring AI injection (Holtec International HI-TRAC, MAGNASTOR, NRC Generic Letter 2012-06)

Spent nuclear fuel removed from the reactor core is stored in on-site spent fuel pools — large, deep pools of borated water that provide cooling and radiation shielding for the highly radioactive spent fuel assemblies. The spent fuel pool at a typical large PWR plant holds 600 to 1,500 spent fuel assemblies, each continuing to generate significant decay heat for years after discharge from the reactor. SFP cooling system integrity is essential to preventing fuel clad damage, zircaloy fire scenarios, and fission product release — the scenario that drove NRC regulatory attention following the Fukushima Daiichi accident in March 2011, where spent fuel pool cooling was lost at Unit 4 due to station blackout and SFP water evaporation. NRC Generic Letter 2012-06 (Proposed Resolution of Challenges to Defense in Depth for Loss of Large Areas of the Plant Due to Explosions or Fire) and NRC Bulletin 2012-01 (Design Vulnerability in Electric Power System) directly addressed spent fuel pool cooling robustness following Fukushima. 10 CFR Part 72 (Licensing Requirements for the Independent Storage of Spent Nuclear Fuel, High-Level Radioactive Waste, and Reactor-Related Greater Than Class C Waste) governs Independent Spent Fuel Storage Installations (ISFSIs) at nuclear sites where dry cask storage has been established — with Holtec International HI-TRAC, HI-STORM, and MAGNASTOR dry cask systems deployed at more than 70 U.S. nuclear sites. Holtec’s HI-TRAC and MAGNASTOR systems include instrumented monitoring packages for dry cask storage canister temperature and shielding performance; the most advanced deployments transmit canister temperature telemetry data to site monitoring servers and to Holtec’s remote monitoring infrastructure, with trend visualization of canister temperature against design thermal limits.

The adversarial injection attack against SFP monitoring AI targets the rendered trend chart images showing pool water level, pool water temperature, boron concentration trending, and SFP cooling pump differential pressure — the four primary SFP health indicators whose AI-assisted trending provides early warning of SFP cooling degradation before it reaches the threshold for operator action under plant Emergency Operating Procedures. AI-assisted SFP monitoring platforms deployed at Exelon’s multi-unit sites (Braidwood, Byron, Quad Cities, Limerick, each with substantial SFP inventories from decades of operation) and at TVA’s Browns Ferry and Watts Bar stations render SFP parameter trend data as visualization images for AI trend analysis and automated notification generation. Adversarial perturbations applied to SFP temperature trend chart images can cause the AI to classify a gradually rising pool temperature trend — indicating degraded SFP cooling capacity — as a stable, within-normal-limits condition, suppressing the early warning notification that would prompt operator investigation of SFP cooling system performance before the temperature reaches the threshold at which Emergency Operating Procedures direct declaration of an Unusual Event under 10 CFR Part 50.72 event notification. For on-site ISFSI dry cask storage systems, adversarial suppression of canister temperature trend alert AI delays recognition of canister thermal performance degradation, potentially allowing a cask with blockage of annular air cooling flow to continue operating without the prompt corrective maintenance that 10 CFR Part 72 Technical Specifications require. The NRC’s Generic Letter 2012-06 actions required plants to establish SFP instrumentation capable of providing operators with accurate indications of SFP level, temperature, and radiation in the event of a beyond-design-basis external event — requirements that adversarial injection attacks on AI-assisted SFP monitoring systems directly undermine by corrupting the AI’s interpretation of that instrumentation data.

4. Nuclear security / protected area access control AI (NRC 10 CFR Part 73.55, NEI 08-09 Cybersecurity Baseline Controls, vital area video AI)

Nuclear power plant physical protection programs required under 10 CFR Part 73.55 represent the most stringent mandated physical security regime for any civilian industrial facility in the United States. NRC regulations require licensees to establish and maintain a Physical Protection Program that includes detection of, and protection against, design basis threats — including adversaries with the intent and capability to cause radiological sabotage of the plant. The protected area (PA) and vital area (VA) access control infrastructure at U.S. nuclear plants combines multiple independent layers: two-person rule requirements for vital area entry, personnel identification systems, search detection devices (magnetometers, X-ray equipment), and continuous video surveillance of vital area access points. Modern nuclear plant physical protection programs integrate AI-assisted biometric systems and video analytics at vital area access points — the reactor control room entry vestibule, the reactor building airlock entry point, the auxiliary building access corridors leading to safety system equipment rooms — where AI processes biometric data (fingerprint, iris, or facial recognition) and video feeds to verify personnel identity and detect unauthorized access attempts. NEI 08-09 (Cyber Security Plan for Nuclear Power Reactors) Appendix D identifies digital I&C systems, security-related digital systems, and digital monitoring systems associated with NRC-required security functions as within-scope for cybersecurity controls; AI-assisted access control and video surveillance systems at vital area entry points fall squarely within the NEI 08-09 scope. NRC Regulatory Guide 5.71 (Cybersecurity Programs for Nuclear Facilities) provides the NRC-endorsed framework for implementing 10 CFR 73.54 cybersecurity requirements, including protections for digital assets that are associated with safety, security, and emergency preparedness functions.

The adversarial injection attack against nuclear physical security AI exploits the image input boundary where biometric enrollment templates, live video frames from vital area entry point cameras, and badge photo comparison images are submitted to AI authentication and anomaly detection models. Adversarial pixel perturbations applied to facial recognition enrollment images or live camera frames at vital area entry vestibules can cause the AI to authenticate an unauthorized individual as an authorized employee — bypassing the identity verification layer of the multi-layer vital area access control system. This is not a theoretical concern: academic adversarial attacks on facial recognition systems (see Sharif et al., “Accessorize to a Crime,” CCS 2016; Eykholt et al., “Robust Physical Perturbations,” CVPR 2018) have demonstrated reliable physical-world adversarial image attacks against commercial facial recognition systems at attack success rates above 70% for targeted impersonation. For nuclear vital area access AI, the consequence of a successful adversarial authentication bypass is access to the reactor control room, reactor building, or safety system equipment rooms — the highest-consequence physical access compromise scenario for nuclear safety and security. Conversely, adversarial perturbations applied to motion detection and behavioral anomaly AI video feeds covering protected area perimeter sectors could suppress intrusion detection AI alerts for an active adversary moving through the protected area, defeating the detection layer that triggers armed response team deployment. NEI 08-09’s Appendix D cybersecurity controls and NRC Regulatory Guide 5.71’s defense-in-depth requirements for digital security systems do not specifically address adversarial pixel perturbation as an attack vector against AI-based biometric and video security systems — leaving inference-time adversarial scanning as the primary technical control available to plant cybersecurity programs to address this attack surface.

Integration: nuclear power plant AI sensor visualization ingestion with Glyphward pre-scan

The Glyphward scan gate belongs at the sensor data visualization ingestion point in each nuclear plant AI pipeline — before the vibration spectrogram reaches Emerson AMS or GE Digital APM; before the RCS leak rate trend chart reaches the AI-assisted leak rate calculation program; before the SFP parameter trend chart reaches the AI monitoring alert engine; and before the vital area video frame reaches the biometric access control AI. The async pattern below handles all four nuclear AI contexts through a shared scan_nuclear_ai_image function, with safety-calibrated thresholds and structured JSONL audit output suitable for 10 CFR Part 73 cybersecurity incident reporting under NRC Regulatory Guide 5.71.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Per-context thresholds reflecting nuclear AI safety significance
PREDICTIVE_MAINT_THRESHOLD    = 45  # Bently Nevada / Emerson AMS / GE Digital APM / SmartSignal
RCS_LEAK_DETECTION_THRESHOLD  = 45  # Westinghouse LEFM / CE / GE Hitachi NUMAC RCS leak AI
SFP_MONITORING_THRESHOLD      = 45  # Holtec HI-TRAC / MAGNASTOR / SFP cooling AI
PHYSICAL_SECURITY_THRESHOLD   = 60  # 10 CFR 73.55 vital area biometric/video access AI


class NuclearAIContext(Enum):
    PREDICTIVE_MAINT    = "predictive_maint"    # threshold 45
    RCS_LEAK_DETECTION  = "rcs_leak_detection"  # threshold 45
    SFP_MONITORING      = "sfp_monitoring"      # threshold 45
    PHYSICAL_SECURITY   = "physical_security"   # threshold 60


_CONTEXT_THRESHOLDS: dict[NuclearAIContext, int] = {
    NuclearAIContext.PREDICTIVE_MAINT:   PREDICTIVE_MAINT_THRESHOLD,
    NuclearAIContext.RCS_LEAK_DETECTION: RCS_LEAK_DETECTION_THRESHOLD,
    NuclearAIContext.SFP_MONITORING:     SFP_MONITORING_THRESHOLD,
    NuclearAIContext.PHYSICAL_SECURITY:  PHYSICAL_SECURITY_THRESHOLD,
}


class AdversarialNuclearAIImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a
    nuclear plant AI sensor visualization image above the context threshold.

    Attributes:
        scan_id: Glyphward scan identifier for NRC cybersecurity audit records.
        score: Adversarial signal score (0-100).
        context: The NuclearAIContext in which detection occurred.
        plant_unit_id: Anonymized plant/unit identifier for audit correlation.
        flagged_region: Optional dict describing the flagged pixel region.
    """

    def __init__(
        self,
        scan_id: str,
        score: int,
        context: NuclearAIContext,
        plant_unit_id: str,
        flagged_region: dict | None = None,
    ) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_unit_id = plant_unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial nuclear plant AI image detected: "
            f"context={context.value} score={score} "
            f"plant_unit={plant_unit_id} scan_id={scan_id}"
        )


async def scan_nuclear_ai_image(
    image_path: Path,
    context: NuclearAIContext,
    plant_unit_id: str,
    system_tag: str,
    recording_ts: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a nuclear plant AI sensor visualization for adversarial pixel content.

    Args:
        image_path: Absolute path to the sensor visualization or video frame image.
        context: NuclearAIContext enum value identifying the nuclear AI pipeline.
        plant_unit_id: Anonymized plant/unit identifier (e.g., SHA-256 of plant DUNS).
        system_tag: Plant instrument tag identifier for the source sensor system.
        recording_ts: ISO 8601 timestamp of sensor recording or video frame capture.
        client: Shared httpx.AsyncClient for connection reuse across batch scans.

    Returns:
        Glyphward scan result dict: scan_id, score, flagged_region, modality.

    Raises:
        AdversarialNuclearAIImageError: if score exceeds context threshold.
            Caller MUST NOT pass the image to the nuclear AI system.
        httpx.HTTPStatusError: on Glyphward API errors (fail-closed by design —
            do not pass unscanned images to nuclear AI on API unavailability).
    """
    threshold = _CONTEXT_THRESHOLDS[context]
    image_bytes = image_path.read_bytes()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nuclear:{context.value}:{recording_ts}",
        "metadata": {
            "plant_unit_id": plant_unit_id,
            "system_tag": system_tag,
            "recording_ts": recording_ts,
            "image_sha256": image_hash,
        },
    }

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=5.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await write_nuclear_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        threshold=threshold,
        plant_unit_id=plant_unit_id,
        system_tag=system_tag,
        recording_ts=recording_ts,
        flagged=result["score"] > threshold,
    )

    if result["score"] > threshold:
        raise AdversarialNuclearAIImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_unit_id=plant_unit_id,
            flagged_region=result.get("flagged_region"),
        )

    return result


async def write_nuclear_scan_audit(
    *,
    image_hash: str,
    scan_id: str,
    score: int,
    context: NuclearAIContext,
    threshold: int,
    plant_unit_id: str,
    system_tag: str,
    recording_ts: str,
    flagged: bool,
) -> None:
    """Append structured JSON audit record to nuclear AI scan log.

    Satisfies NRC 10 CFR Part 73.54 cybersecurity event recordkeeping,
    NRC Regulatory Guide 5.71 cybersecurity controls audit documentation,
    and NEI 08-09 Appendix D digital asset cybersecurity audit trail
    requirements. No raw sensor data is stored — only hash and metadata.
    """
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": threshold,
        "flagged": flagged,
        "plant_unit_id": plant_unit_id,
        "system_tag": system_tag,
        "recording_ts": recording_ts,
    }
    audit_path = Path("/var/log/glyphward/nuclear_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")


async def process_nuclear_image_batch(
    images: list[tuple[Path, NuclearAIContext, str, str, str]],
) -> list[dict]:
    """Process a batch of (path, context, plant_unit_id, system_tag, ts) tuples.

    Fail-closed: quarantines flagged images; httpx errors propagate upward
    to prevent unscanned images from reaching nuclear AI systems.
    """
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_nuclear_ai_image(
                image_path=path,
                context=ctx,
                plant_unit_id=puid,
                system_tag=tag,
                recording_ts=ts,
                client=client,
            )
            for path, ctx, puid, tag, ts in images
        ]
        results = []
        for coro in asyncio.as_completed(tasks):
            try:
                results.append(await coro)
            except AdversarialNuclearAIImageError as exc:
                results.append({
                    "status": "quarantined",
                    "context": exc.context.value,
                    "scan_id": exc.scan_id,
                    "score": exc.score,
                    "plant_unit_id": exc.plant_unit_id,
                    "flagged_region": exc.flagged_region,
                })
        return results

Deploy scan_nuclear_ai_image at each sensor visualization ingestion boundary: before a vibration spectrogram reaches Emerson AMS Machinery Health Advisor or Baker Hughes SmartSignal predictive maintenance AI; before an RCS leak rate trend chart reaches the plant process computer’s AI-assisted leak rate calculation module; before an SFP parameter trend image reaches the SFP monitoring AI alert engine; and before a vital area camera frame reaches the biometric or video access control AI at any NRC 10 CFR 73.55 vital area entry point. The audit JSONL file written by write_nuclear_scan_audit provides the cybersecurity event record required by NRC Regulatory Guide 5.71 Section C.5 for digital asset cybersecurity controls documentation, and supports 10 CFR Part 73.54(e) reporting obligations for cybersecurity events at nuclear facilities. Get early access

Related reading

• Prompt injection in energy and utilities field operations AI — grid operations, substation, and field crew AI injection surfaces
• Prompt injection in cybersecurity SOC and SIEM AI — alert triage and threat hunting AI injection
• FedRAMP AI security and prompt injection — high-impact authorization controls for federal AI systems
• Prompt injection in nuclear energy AI — GE Vernova, Westinghouse, Framatome inspection and fuel assembly AI
• Prompt injection scanning API free tier — 10 scans/day, no card required