Adversarial Injection · Industrial Chemical AI Monitoring · Attack #133

Industrial Ozone (O₃) Generation via Corona Discharge Water Treatment: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Industrial Ozone AI Attack

Industrial ozone (O₃; CAS 10028-15-6; MW 48; OSHA PEL 0.1 ppm 8-hr TWA; NIOSH IDLH 5 ppm; ACGIH TLV-TWA 0.05 ppm for heavy work, 0.1 ppm for light work) is generated by high-voltage corona discharge (typically 5–20 kV AC across a dielectric-barrier discharge cell fed with O₂ or dry air) at concentrations of 1–14 wt% in the product gas stream, used as the primary oxidative disinfection agent in drinking water treatment plants across North America, Europe, and Asia. Ozone drinking water treatment is the subject of EPA regulatory requirements under the Long Term 2 Enhanced Surface Water Treatment Rule (LT2ESWTR, 40 CFR Part 141 Subpart W) which mandates minimum CT values (concentration × contact time, in mg/L·min) for Cryptosporidium inactivation credit — a regulatory framework with direct public health consequences if CT compliance is misreported or undetected. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image can suppress the CT value from an inadequate 0.9 mg/L·min (below the Cryptosporidium 0.5-log credit threshold) to an apparently compliant 4.2 mg/L·min, hide a dangerous 3.8 ppm O₃ leak in the off-gas destruct unit discharge, or conceal a corona discharge cell temperature of 112 °C indicating dielectric quartz tube degradation and imminent yield collapse. Glyphward detects all three attack surfaces at threshold 26 before any image reaches a downstream AI inference call.

Large-scale water treatment ozone systems serve populations of tens of thousands to millions. A single water utility treating 200 million gallons per day (MGD) — comparable to the Los Angeles Metropolitan Water District ozone facilities or the Philadelphia Water Department Baxter/Queen Lane plants — operates multiple parallel ozone contact basins and corona discharge generator banks producing thousands of kilograms of O₃ per day. The Veolia Water Technologies (OZONIA) and Xylem Wedeco product lines, together with Pacific Ozone (US) and Metawater/Ebara (Japan), supply the global water treatment ozone market. In addition to direct disinfection, ozone is used for colour removal, taste-and-odour control (geosmin and 2-methylisoborneol at ng/L concentrations that are detectable at extremely low thresholds), and advanced oxidation (O₃/UV or O₃/H₂O₂) for trace organic contaminant destruction. The public health consequence of failed ozone disinfection is not an immediate chemical acute hazard but a lagged infectious disease outcome: Cryptosporidium oocysts passing through inadequately ozonated drinking water cause cryptosporidiosis, with the 1993 Milwaukee outbreak (403,000 cases, 69 deaths, estimated 54 deaths directly attributable) as the defining public health anchor for why CT-compliance AI monitoring in water treatment must be adversarially robust. AI monitoring systems managing ozone contact basin CT values, off-gas destruct unit performance, and generator cell integrity must authenticate every display image before passing it to a downstream regulatory compliance inference engine.

Why Industrial Ozone Water Treatment Is Disproportionately Vulnerable to Pixel Manipulation

Three characteristics of ozone water treatment make it uniquely susceptible to adversarial DCS display attacks. First, the CT value calculation is performed from two separate sensor readings — dissolved or residual O₃ concentration in the contact basin (mg/L) and contact time T (minutes, determined by tracer testing and hydraulic modelling) — whose rendered DCS display can each be independently manipulated. A perturbation of the dissolved O₃ concentration display that inflates the apparent concentration from 0.18 mg/L to 0.84 mg/L, combined with a 5-minute hydraulic residence time, inflates the CT from 0.9 mg/L·min (non-compliant) to 4.2 mg/L·min (compliant) — a factual impossibility undetectable by an AI monitoring system that cannot authenticate the sensor display images. Second, the off-gas O₃ destruct unit outlet monitor must detect 5 ppm O₃ (IDLH) against a background of essentially zero expected O₃ (the thermal/catalytic destruct unit is designed for >99.9% O₃ destruction efficiency). On a 0–5 ppm DCS bar (40 px/ppm), the 3.8 ppm actual reading is at 152 px (76% of full scale) — far from background — but an adversarial shift of 147 px places it at 5 px (0.12 ppm), indistinguishable from destruct unit background emissions. Third, the corona discharge cell temperature DCS bar spans 0–150 °C at 1.33 px/°C; a 98-px adversarial shift converts the 112 °C actual temperature (equipment emergency) to 38 °C (normal ambient-cooled operation) — a shift achievable within DCS display rendering variation.

Surface 1 — Ozone CT Value in Drinking Water Contact Chamber (Downward Attack)

The ozone CT compliance display in the water treatment plant SCADA system shows the rolling average CT value for the primary ozone contact basin on a 200 px vertical display bar spanning 0 to 6 mg/L·min (the regulatory maximum credit threshold with design margin). The pixel scale is 200 px ÷ 6 mg/L·min = 33.33 px per mg/L·min. At the actual CT value of 0.9 mg/L·min — below the minimum EPA LT2ESWTR credit threshold of 1.0 mg/L·min for 0.5-log Cryptosporidium inactivation at water temperatures ≤5 °C — the rendered pixel position is 0.9 × 33.33 = 30 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 110 px to position 140 px. The AI inference engine reads the CT as 140 ÷ 33.33 = 4.2 mg/L·min — far above the minimum threshold and apparently providing 1.0-log or greater Cryptosporidium inactivation credit. No regulatory non-compliance alarm is triggered; the CT log submitted to the state drinking water programme records 4.2 mg/L·min as the measured value.

The EPA LT2ESWTR Cryptosporidium CT tables (40 CFR Part 141 Appendix E) specify that at 5 °C water temperature and pH 6–9, ozone must achieve CT ≥ 1.0 mg/L·min for 0.5-log inactivation credit. Cryptosporidium parvum oocysts are highly resistant to chlorine at typical drinking water doses (CT 99% inactivation requires chlorine CT of ~3,100 mg/L·min at 25 °C, compared to ozone CT of only ~10 mg/L·min) — ozone is the primary tool for drinking water Cryptosporidium control in surface water utilities required by the Surface Water Treatment Rule. At an actual CT of 0.9 mg/L·min (90% of the minimum threshold), the 0.5-log credit is not achieved; the actual inactivation credit is approximately 0.47 log, meaning 34% of Cryptosporidium oocysts that entered the contact basin pass through into the distribution system. In a 200 MGD plant treating a source with typical Cryptosporidium occurrence of 0.01–0.1 oocysts/L, the daily Cryptosporidium load reaching consumers (after the failed ozone step) is orders of magnitude above the safe threshold — with cryptosporidiosis incubation period of 2–10 days before the outbreak becomes clinically visible.

Surface 2 — O₃ Concentration at Off-Gas Destruct Unit Outlet (Upward Attack)

The O₃ monitor at the outlet of the off-gas thermal/catalytic destruct unit is displayed on a 200 px vertical DCS bar spanning 0 to 5 ppm O₃ (the NIOSH IDLH). The pixel scale is 200 px ÷ 5 ppm = 40 px/ppm. At the actual O₃ concentration of 3.8 ppm at the destruct outlet — indicating 76% incomplete destruction — the rendered pixel position is 3.8 × 40 = 152 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 147.2 px to position 4.8 px ≈ 5 px from the bottom. The AI inference engine reads the O₃ as 5 ÷ 40 = 0.125 ppm ≈ 0.12 ppm — slightly above the OSHA PEL of 0.1 ppm but apparently near the performance floor of a functional destruct unit. No destruct unit failure alarm is generated; no access restriction is placed on the ozone contact chamber building.

Ozone from the contact basin headspace is collected as off-gas and directed to the destruct unit, which uses either thermal oxidation (250–350 °C over an MnO₂/CuO catalyst) or ultraviolet photolysis to decompose O₃ back to O₂ before discharge. A functional destruct unit achieves >99.9% O₃ destruction, reducing a typical contact basin headspace O₃ concentration of 2,000–5,000 ppm to less than 0.5 ppm at the outlet. An actual 3.8 ppm O₃ at the outlet indicates that the destruct unit catalyst has deactivated (possible causes: moisture poisoning, SO₂ contamination from source water, or thermal cycling damage), leaving the off-gas with 76% of the NIOSH IDLH. Plant operators routinely enter the ozone contact chamber building to perform sampling, valve adjustments, and equipment checks — if the building ventilation draws the destruct unit outlet discharge through the building HVAC system, workers experience sustained O₃ exposure at 3.8 ppm. Pulmonary effects of O₃ at 2–5 ppm include airway inflammation, decreased lung function, and oedema potential at extended exposures; the OSHA PEL exceedance is a recordable illness trigger under OSHA 300 logging.

Surface 3 — Corona Discharge Cell Temperature (Upward Attack)

The cooling water outlet temperature of the corona discharge ozone generator cell bank is displayed on a 200 px vertical DCS bar spanning 0 to 150 °C. The pixel scale is 200 px ÷ 150 °C = 1.333 px/°C. At the actual cell temperature of 112 °C — well above the design operating range of 25–40 °C for the cooling water outlet of a properly operating generator cell — the rendered pixel position is 112 × 1.333 = 149.3 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 98.6 px to position 50.7 px. The AI inference engine reads the temperature as 50.7 ÷ 1.333 = 38.0 °C — consistent with the warm end of the design cooling range. No generator cell shutdown is initiated; no maintenance inspection is triggered.

Corona discharge ozone generation depends on a high-voltage (5–20 kV) AC discharge across a narrow gap (0.5–3 mm) between a high-voltage electrode and a grounded electrode, separated by a dielectric barrier (quartz glass tube or ceramic plate). The dielectric must remain at low temperature to maintain its electrical properties and mechanical integrity — typically achieved by cooling water flow on the ground electrode side. At 112 °C on the cooling water outlet, the heat transfer from the corona discharge gap is insufficient to maintain the dielectric below its operating design temperature: borosilicate quartz, commonly used for dielectric tubes, begins to soften above ~820 °C (well above this scenario), but the real failure mode at 112 °C is differential thermal expansion causing fine cracks in the quartz tube wall at the electrode seating points. Micro-cracks in the quartz dielectric create by-pass paths for the O₂ feed gas that avoid the corona discharge gap entirely — the O₂ passes through the cracked zone uncombusted, reducing the effective electrode gap length and therefore the ozone generation yield per unit O₂ feed. As the quartz tubes crack progressively over hours to days after the temperature exceedance begins, the ozone generation efficiency drops, delivered O₃ dose to the contact basin decreases, and CT compliance degrades toward the Surface 1 non-compliance scenario — closing the causal loop between generator cell thermal failure and CT regulatory violation.

Integrating Glyphward into Ozone Water Treatment AI Monitoring Pipelines

The following Python snippet authenticates every ozone treatment system DCS frame against the Glyphward API before passing it to a downstream regulatory compliance AI or safety LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception routed to the plant's SCADA control system for automatic contact basin bypass (routing water to backup chlorination), destruct unit access lockout, and generator cell emergency shutdown.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
O3_GLYPHWARD_THRESHOLD = 26

class O3Context(StrEnum):
    CONTACT_BASIN_CT_VALUE    = auto()   # Surface 1 — downward attack
    OFF_GAS_DESTRUCT_MONITOR  = auto()   # Surface 2 — upward attack
    GENERATOR_CELL_TEMP       = auto()   # Surface 3 — upward attack

class AdversarialO3ImageError(RuntimeError):
    def __init__(self, surface: O3Context, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] O₃ adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={O3_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_o3_frame(frame_path: Path, surface: O3Context) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": O3_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialO3ImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_ozone_treatment_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (O3Context.CONTACT_BASIN_CT_VALUE,   frame_dir / "contact_basin_ct_value.png"),
        (O3Context.OFF_GAS_DESTRUCT_MONITOR, frame_dir / "offgas_destruct_o3_monitor.png"),
        (O3Context.GENERATOR_CELL_TEMP,      frame_dir / "corona_cell_temp.png"),
    ]
    tasks = [verify_o3_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently. The CT compliance check, the off-gas destruct check, and the generator cell temperature check run simultaneously — enabling detection of a compound attack that masks both the disinfection failure (Surface 1/3) and the personnel hazard (Surface 2) simultaneously. Unlike industrial chemical PSM scenarios where consequences are immediate and confined to the facility, the primary consequence of an ozone CT AI adversarial attack is a delayed, distributed public health outcome — the 2–10 day cryptosporidiosis incubation period means the outbreak is not detectable until after a regulatory-reportable number of cases appears in syndromic surveillance. The Glyphward threshold of 26 reflects this unique consequence profile: lower than PSM chemical thresholds because there is no OSHA PSM TQ for ozone, but critical because an adversarial attack on an ozone water treatment AI system can harm populations orders of magnitude larger than any single industrial facility incident. The SHA-256 frame hash provides forensic documentation that the CT monitoring AI received adversarially manipulated display images during the non-compliance period — potentially critical for regulatory defence and public health enforcement.