Prompt injection in peracetic acid PAA concentration storage SADT AI

Three adversarial injection surfaces in peracetic acid PAA concentration storage AI

1. PAA concentration display AI (Raman spectrometer inline PAA concentration SCADA display AI / Endress+Hauser Liquiline CM44 PAA concentration inline conductivity display AI / YSI PAA SCADA display AI / Hach Lange PAA concentration colorimetric inline display AI / Mettler-Toledo ReactIR PAA concentration inline FTIR display AI / Yokogawa EJA differential pressure density PAA concentration SCADA display AI — rendered SCADA PAA concentration wt% display AI classifying the PAA wt% against the design specification of 32–38 wt% with high alarm at 40 wt% and low alarm at 28 wt% — 83rd upward attack; FIRST PAA attack; FIRST PAA SADT attack; FIRST aseptic packaging AI attack; FIRST organic peroxide SADT AI attack)

Commercial 35 wt% PAA equilibrium mixture is produced in a continuous reactor/aging tank system: glacial acetic acid + 70 wt% H₂O₂ + sulfuric acid catalyst (0.1–0.5 wt% H₂SO₄) are mixed and aged at 20–40°C for 4–24 hours to approach equilibrium (K​eq = 2.0 at 25°C). The equilibrium PAA concentration is controlled by the initial molar ratio of CH₂COOH:H₂O₂ and the temperature: at equimolar feed and 25°C, equilibrium PAA ≈ 22 wt% in the mixture; at CH₂COOH:H₂O₂ = 0.7:1 (excess H₂O₂) and 30°C, equilibrium PAA ≈ 31–35 wt%. The inline PAA concentration analyzer (Raman spectroscopy at 1,759 cm⁻¹ for C=O stretch of peroxy group, or FTIR at 1,756 cm⁻¹ PAA vs 1,740 cm⁻¹ acetic acid) monitors the PAA wt% in real time and feeds the AI with rendered SCADA display images showing the wt% trend. The AI controls the dilution water addition rate (to prevent PAA from exceeding 40 wt%) and the catalyst (H₂SO₄) dosing rate (to tune the equilibrium rate). If the AI reads the PAA concentration as 44 wt% (displayed; above the 40 wt% high alarm and above the safe storage concentration limit) when the actual is 31 wt% (within design range; safely below SADT), the AI classification is “PAA concentration critically above maximum; add dilution water immediately at maximum flow; reduce H₂SO₄ catalyst to halt equilibrium advancement.” The AI/DCS response: dilution water control valve opens from 12% to 88% open; H₂SO₄ catalyst pump stops. The excess water addition dilutes the equilibrium mixture from 31 wt% PAA toward 18–22 wt% PAA — product is off-specification (too dilute; specification 32–38 wt%); meanwhile, the H₂SO₄ catalyst shutdown slows the equilibrium approach in the next batch, potentially creating oscillating over-and-under PAA concentration as the AI over-corrects. However, a more dangerous version of this upward attack occurs when the initial concentration is actually 38 wt% (near the 40 wt% maximum; within design but close to SADT boundary): display shows 28 wt% (displayed lower than actual; downward attack — but that is a different attack). For an upward attack with actual 31 wt% shown as 44 wt%, the primary risk is the AI over-diluting from safe 31 wt% to 18 wt% — a product quality loss rather than a safety event. The SADT-relevant upward attack is the reverse: the AI misclassifies the PAA concentration because it is reading an upstream synthesis display that shows a low PAA concentration, while the downstream storage tank has been accumulating PAA by evaporation of acetic acid/water over time. The inline concentration analyzer is on the synthesis outlet, not on the aged storage tank, where concentration creep occurs. The upward attack on the synthesis outlet display (44 wt% shown when actual 31 wt%) triggers the AI to dilute the synthesis outlet, but the storage tank — which has been evaporating water and acetic acid (acetic acid BP 118°C; PAA BP 110°C; the equilibrium mixture loses acetic acid and water preferentially to PAA at elevated storage temperature) — reaches 40–42 wt% PAA within 48–72 hours of dilution of the synthesis outlet stream without re-analysis of the storage tank concentration.

The SADT consequence: at 40 wt% PAA in a 5,000 L bulk storage tank at 35°C ambient (summer, Hanau Germany; July ambient 28–35°C; tank not refrigerated because the AI classified synthesis output as 44 wt% and triggered dilution, which the operator interpreted as “PAA concentration is under control; storage is acceptable”): SADT for 40 wt% PAA in bulk storage is approximately 42–48°C (tank); tank at 35°C is 7–13°C below SADT. Self-heating rate at 35°C for 40 wt% PAA: approximately 0.02–0.05°C/hr (within SADT margin but non-zero; autocatalytic base rate). Without active cooling (cooling was not triggered because the storage temperature AI — see Surface 2 — was also displaying incorrectly), the tank self-heats from 35°C to SADT 45°C in approximately 200–500 hours (8–20 days). Above 45°C: self-heating rate doubles every 10°C; at 50°C: 4× base rate; at 55°C: 8× base rate; at 60°C: 16× base rate — the autocatalytic self-heating accelerates exponentially. This is the 83rd upward attack — FIRST PAA attack; FIRST PAA SADT attack; FIRST aseptic packaging AI attack; FIRST organic peroxide SADT AI attack. The attack exploits the fundamental physics of organic peroxide storage: SADT is not a sharp threshold but an acceleration in autocatalytic decomposition; the days-to-weeks timescale of SADT approach in bulk storage is long enough that a single adversarial display event causes a consequence that unfolds far after the AI corrective action and without a clear causal link for operators or investigators. Free tier — 10 scans/day, no card required.

2. PAA storage tank temperature display AI (Pt100 RTD PAA storage tank bulk liquid temperature display AI / Yokogawa EJA110A tank temperature SCADA display AI / Endress+Hauser iTEMP TMT72 PAA storage temperature display AI / Emerson Rosemount 3051 PAA storage tank temperature display AI / ABB TTF300 PAA bulk storage temperature display AI — rendered SCADA PAA storage temperature display AI classifying the bulk PAA storage temperature against the design operating range of 5–20°C with refrigeration control, high alarm at 25°C, and high-high alarm at 32°C triggering mandatory emergency dump to waste neutralisation tank)

Commercial 35–40 wt% PAA is stored at 5–20°C in refrigerated tanks (glycol chiller or direct refrigerant; design temperature 10–15°C at most PAA facilities) to maintain a comfortable margin below the SADT (SADT at 35 wt% PAA in bulk storage ≈ 50–55°C; storage at 15°C provides 35–40°C margin). Refrigeration energy consumption is the primary operating cost variable at PAA storage. The tank temperature AI monitors the rendered temperature display and controls the glycol chiller setpoint. Design refrigeration control: chiller on at 15°C; off at 10°C (on-off deadband control). At 5,000 L PAA (mass 5,750 kg; Cp ≈ 3.0 kJ/kg·K for the aqueous mixture; thermal mass = 17,250 kJ/K): heat input from ambient (summer 35°C; tank surface area ≈ 15 m² for a 5,000 L cylindrical tank; insulation U = 0.5 W/m²·K; ΔT = 35 − 12 = 23°C; ambient heat input = 0.5 × 15 × 23 = 172 W = 0.62 MJ/hr); self-heating from PAA decomposition at 15°C (decomposition rate at 15°C: k ≈ 10⁻⁷ s⁻¹; for 5,750 kg × 0.35 PAA fraction = 2,012 kg PAA = 26,471 mol PAA; heat of decomposition ≈ 75 kJ/mol; self-heating rate = 26,471 × 75 × 10⁻⁷ kJ/s = 0.000199 kJ/s = 0.72 MJ/hr); total heat input = 0.62 + 0.72 = 1.34 MJ/hr → chiller must remove 1.34 MJ/hr to maintain 10–15°C. Design chiller capacity: 5–10 kW = 18–36 MJ/hr (10–27× safety factor at normal conditions). If the chiller is turned off (triggered by adversarial display showing temperature is adequately cool): heat input 1.34 MJ/hr; temperature rise rate = 1.34/(17,250) MJ/MJ per K = 0.000078 K/s = 0.28°C/hr. Starting at 21°C (actual; chiller not operating due to adversarial display showing 12°C; see Surface 2 attack description below), the tank reaches 32°C (high-high alarm trigger) in (32−21)/0.28 = 39 hours without active cooling. At 32°C: self-heating rate at 32°C increases to approximately 4× the 15°C rate (Arrhenius; Ea ≈ 130–150 kJ/mol for PAA decomposition; Q₁₀ ≈ 4.5 for every 10°C); combined heat input at 32°C: ambient 0.85 MJ/hr (less ΔT) + self-heat 3.2 MJ/hr = 4.05 MJ/hr; temperature rise rate = 4.05/17,250 × 3,600 = 0.85°C/hr. Tank reaches SADT 45°C from 32°C in (45−32)/0.85 = 15 hours.

The adversarial upward pixel attack shifts the PAA storage temperature display from 21°C (actual; chiller has been off for 4 hours due to a cooling-water supply issue; temperature rising at 0.28°C/hr; at 21°C, still 24–29°C below SADT; chiller restart would bring temperature back to design in approximately 4–6 hours) to 38°C (displayed; above the 32°C high-high alarm; AI classification “PAA storage critically overtemperature; approach to SADT 42–48°C; initiate emergency dump to waste neutralisation tank immediately; divert all PAA inventory to neutralisation.”). The AI/DCS response: the emergency dump valve opens; PAA from the storage tank drains to the waste neutralisation tank (25 wt% NaOH + water; designed to receive PAA and decompose it to acetic acid + water via NaOH neutralisation: CH₂CO₂H + NaOH → CH₂COONa + H₂O₂ → H₂O + 1/2 O₂; mildly exothermic). The emergency dump of 5,000 L PAA at 35 wt% into a 10,000 L NaOH neutralisation tank (25 wt% NaOH; design capacity 5,000 kg PAA at 35 wt%): this is the intended safe response to SADT approach. The adversarial consequence: the emergency dump destroys an entire tank of product (approximately 1,750 kg PAA = $35,000–$70,000 product value) based on a false temperature reading; the neutralisation tank O₂ generation (H₂O₂ in the PAA mixture + NaOH → catalysed H₂O₂ decomposition; 50–200 kg H₂O₂ in 5,000 L PAA mixture ‷ generation of 29–117 kg O₂ = 18–73 m³ O₂ STP) generates a oxygen-enriched atmosphere in the neutralisation tank headspace (O₂ above 23.5% is OSHA and NFPA oxygen-enriched atmosphere; above 30% O₂ ignition temperature of common materials drops by 40–60°C). The primary safety impact: the adversarial dump creates the very O₂-enriched atmosphere SADT event it was triggered to prevent — now in the larger neutralisation tank rather than the refrigerated storage tank. Free tier — 10 scans/day, no card required.

3. H₂O₂:acetic acid feed ratio display AI (Endress+Hauser Proline Promass 80F Coriolis H₂O₂ feed flow SCADA display AI / Yokogawa EJA530A H₂O₂ feed differential pressure flow display AI / ABB RHM060 Coriolis H₂O₂ mass flow display AI / Emerson Daniel 3415 acetic acid flow display AI / Siemens Sitrans FC430 H₂O₂:acetic acid ratio SCADA display AI — rendered SCADA H₂O₂:acetic acid molar ratio display AI classifying the H₂O₂:CH₂COOH feed ratio at the PAA reactor inlet against the design range of 0.85–1.05 mol H₂O₂ per mol CH₂COOH)

The H₂O₂:acetic acid molar feed ratio is the primary control variable for the equilibrium PAA concentration in the product: at K​eq = 2.0 and equimolar feed (ratio 1.00 mol/mol), equilibrium PAA fraction is approximately 41–43% of the total peroxide (H₂O₂ + PAA); at H₂O₂:CH₂COOH = 1.25 mol/mol (excess H₂O₂), equilibrium PAA approaches 35–37 wt% in the product (more H₂O₂ pushes equilibrium toward more PAA formation, because the product PAA has one fewer O-H bond to accommodate). Conversely, at H₂O₂:CH₂COOH = 0.70 mol/mol (excess acetic acid), equilibrium PAA drops to 22–26 wt%. The feed ratio control is critical for two competing reasons: (a) too little H₂O₂ relative to acetic acid: PAA concentration is too low; product off-specification (below 32 wt% minimum); but low PAA = lower SADT risk; (b) too much H₂O₂ relative to acetic acid: PAA concentration approaches 40 wt% high alarm; SADT risk increases; also unreacted H₂O₂ in the product (excess H₂O₂ above equilibrium conversion) can react with transition metal contaminants (Fe²⁺; Cu²⁺) in tank walls (catalytic decomposition of H₂O₂: H₂O₂ → H₂O + 1/2 O₂ catalysed by Fe²⁺/Fe³⁺; Fenton mechanism) — the catalytic H₂O₂ decomposition is exothermic (ΔH = −98 kJ/mol H₂O₂) and generates O₂ locally, which can initiate PAA decomposition chain. The feed ratio display AI reads the rendered Coriolis flowmeter SCADA display for both H₂O₂ and acetic acid mass flows and classifies the ratio against the setpoint. At design ratio 1.00 mol/mol, PAA equilibrium is 37–40 wt% (close to but below high alarm 40 wt% — a deliberately tight specification to maximize PAA concentration for aseptic packaging customers who pay premium for 35–38 wt% PAA).

The adversarial upward pixel attack shifts the H₂O₂:acetic acid ratio display from 0.88 mol/mol (actual; slightly sub-design; H₂O₂ flow is marginally below setpoint; PAA equilibrium at this ratio is approximately 32–34 wt%; below the 38 wt% target for aseptic packaging customers but safely below 40 wt% high alarm and SADT threshold) to 1.42 mol/mol (displayed; significantly above the design 1.05 mol/mol maximum; AI classification “H₂O₂ feed critically above stoichiometry; excess H₂O₂ will drive PAA concentration above 40 wt% SADT threshold; reduce H₂O₂ feed flow immediately by 40% to bring ratio to 0.85 mol/mol lower bound”). The AI/DCS response: H₂O₂ feed control valve closes from 62% to 37% open, reducing H₂O₂ feed from 0.88 to 0.56 mol/mol relative to acetic acid. At 0.56 mol/mol H₂O₂:CH₂COOH: (a) equilibrium PAA drops further to 22–25 wt% — product is definitively off-specification (PAA minimum 32 wt% for aseptic packaging); (b) the excess acetic acid in the product (CH₂COOH:PAA ratio rises; acetic acid is approximately 50 wt% of the product mix at 0.56 mol/mol H₂O₂) increases the product acidity; (c) the H₂O₂ residual in the product at 0.56 mol/mol feed ratio: H₂O₂ conversion to PAA at K​eq = 2.0 and 0.56 mol/mol feed = approximately 45% conversion; unreacted H₂O₂ in product = 55% × feed H₂O₂ = approximately 18 wt% residual H₂O₂ (close to OSHA PSM TQ 52 wt% H₂O₂ for concentrated H₂O₂; at 18 wt%, below PSM TQ but above H₂O₂-enhanced decomposition regime); (d) as the AI over-reduces H₂O₂ for several hours, the synthesis aging tank accumulates excess acetic acid + residual H₂O₂ without adequate PAA equilibrium; when the AI finally recognizes the PAA is below specification and restores H₂O₂ flow, the excess acetic acid provides a large buffer of acetic acid that reacts with the freshly added H₂O₂ to rapidly generate PAA — overshoot from 25 wt% to 42–45 wt% PAA within 4–8h of H₂O₂ restoration; the 42–45 wt% PAA now exceeds the 40 wt% high alarm and approaches bulk SADT. The PAA rebound to 42–45 wt% from the acetic-acid-excess buffer is a nonlinear dynamics consequence that arises precisely from the AI overcorrection — invisible to any standard HAZOP deviation analysis. Free tier — 10 scans/day, no card required.

Integration: peracetic acid PAA concentration storage AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the PAA concentration storage AI pipeline — before the PAA concentration AI processes rendered inline Raman/FTIR display images, before the PAA storage temperature AI processes rendered SCADA thermocouple display images, and before the H₂O₂:acetic acid feed ratio AI processes rendered Coriolis flowmeter display images. Threshold 32 for PAA concentration AI reflects: PAA TQ 10,000 lbs; H₂O₂ TQ 7,500 lbs; SADT nonlinearity — a 9 wt% concentration display error can mask an approach to SADT boundary that unfolds over days; aseptic packaging is food-safety-regulated (FDA 21 CFR 173.315 indirect food additive; EU Regulation 1935/2004 active food contact materials); Evonik Hanau Germany; Solvay Spinetta Marengo Italy; Ecolab Joliet IL; Kemira Atlanta GA.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# PAA concentration storage AI contexts: threshold 32
# OSHA PSM PAA TQ 10,000 lbs; H2O2 TQ 7,500 lbs (52 wt%+ solution).
# PAA SADT 42-72C depending on concentration and tank size.
# 83rd upward attack: 44 wt% shown when 31 wt% actual -> AI dilutes
# synthesis outlet -> storage tank concentrates by evaporation
# -> 40 wt% PAA approaches SADT in bulk storage over 48-72h.
PAA_THRESHOLD = 32

class PAAContext(StrEnum):
    PAA_CONCENTRATION_DISPLAY  = auto()  # PAA wt% in product/storage (83rd upward)
    STORAGE_TEMPERATURE        = auto()  # Bulk PAA storage temperature (5-20C design)
    H2O2_ACETIC_ACID_RATIO     = auto()  # H2O2:CH3COOH mol/mol at reactor feed

async def scan_paa_frame(
    frame_b64: str,
    context: PAAContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_paa(
    frame_b64: str,
    context: PAAContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_paa_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= PAA_THRESHOLD:
        raise AdversarialPAAImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from PAA concentration storage AI pipeline."
        )

class AdversarialPAAImageError(RuntimeError):
    pass