Prompt injection in phosphoric acid thermal process white phosphorus P₄ combustion AI

Three adversarial injection surfaces in white phosphorus P₄ thermal H₃PO₄ production AI

1. P₄ atomization nozzle pressure display AI (Endress+Hauser Cerabar PMC71 / Yokogawa EJA430A / Emerson Rosemount 3051 P₄ nozzle upstream pressure transmitter display AI — rendered DCS P₄ burner nozzle pressure display AI classifying atomization pressure against 3.5–6.0 bar design range — 94th upward attack; FIRST white phosphorus P₄ thermal H₃PO₄ attack; FIRST P₄ combustion chamber AI attack; FIRST P₄ atomization nozzle AI attack; FIRST spontaneous-ignition chemistry AI attack; FIRST food-grade phosphoric acid production AI attack)

The P₄ atomization nozzle is the initiating device in the thermal H₃PO₄ process: liquid P₄ at 55–65°C (above MP 44.1°C; below the point where viscosity increases to processing difficulty — P₄ viscosity at 65°C is approximately 1.1 mPa·s, similar to water) is pumped under pressure through a spray nozzle (typically a swirl-cup or twin-fluid atomizing nozzle using compressed air or nitrogen as atomizing medium; nozzle design: Bete Fog Nozzle WL-series or Spraying Systems SpiralAir® model; target droplet diameter d₃₃ = 50–150 μm for complete combustion residence time in the 2–4 second combustion zone of a typical P₄ burner). The atomization quality — specifically the droplet size distribution produced by the nozzle — is controlled by the P₄ feed pressure upstream of the nozzle: at 3.5–6.0 bar upstream P₄ pressure, the nozzle produces the design droplet size distribution (d₃₃ 50–150 μm; >95% of mass in droplets <200 μm that combust completely within the 2 m combustion chamber length); below 2 bar: the spray degrades to a coarse mist (d₃₃ 300–800 μm; droplets with diameter >500 μm have a combustion burnout time exceeding the combustion chamber residence time at typical air velocity 8 m/s through a 4 m chamber = 0.5 s residence; a 600 μm P₄ droplet requires approximately 1.2 s to combust completely at 900°C in 3× stoichiometric air). At 0.6 bar actual nozzle upstream pressure (the adversarial scenario): the P₄ emerges from the nozzle not as an atomized spray but as a coarse stream of large droplets or a continuous liquid “dribble” — entirely outside the design atomization regime. Large P₄ droplets (>1 mm diameter) travel through the combustion zone at the air velocity (8 m/s; transit time 0.5 s for a 4 m chamber) with only partial combustion: the P₄ outer surface combusts (P₄ + 5O₂ → P₅O₆ on the droplet surface; forms a P₂O₅ shell that can inhibit further O₂ diffusion to the interior), leaving a liquid P₄ core inside a P₂O₅ shell.

These partially-combusted P₄ core / P₂O₅ shell droplets exit the combustion chamber and enter the hydration tower. In the hydration tower, the P₂O₅ shell reacts with water: P₂O₅ + 3H₂O → 2H₃PO₄. The P₂O₅ shell dissolution exposes the liquid P₄ core to the hot interior of the hydration tower. The hydration tower interior is at approximately 90–120°C (temperature from the exothermic P₂O₅ hydration reaction and the residual heat from the combustion chamber gas). Liquid P₄ at 90–120°C in the hydration tower atmosphere (which contains steam, air, and H₃PO₄ mist): (a) P₄ is above its MP (44.1°C) — liquid state; (b) P₄ autoignition temperature 34°C — any P₄ liquid contacting the tower walls, collecting in the tower sump, or dripping onto a surface where a dry air pocket exists will autoignite; (c) the hydration tower is not entirely O₂-free: the combustion air (300–500% excess beyond P₄ stoichiometry) passes through the tower as the carrier gas, and the tower interior has O₂ present at approximately 15–18 vol% (excess combustion air after P₄ oxidation). P₄ accumulating in the hydration tower sump (a liquid collection zone at the bottom of the tower where H₃PO₄ acid collects) is in contact with this O₂-containing atmosphere at temperatures above 34°C — conditions for spontaneous P₄ ignition. The white phosphorus fire in the hydration tower: P₄ burns intensely with a bright white flame producing thick white P₂O₅ smoke (corrosive H₃PO₄ mist on contact with moisture); P₄ fire is extraordinarily difficult to extinguish — water applied as a spray can spread burning P₄ droplets (liquid P₄ density 1.76 g/cm³ floats on water at high water-to-P₄ volume ratios but can be dispersed by water jet as burning droplets). The OSHA PSM TQ of 500 lbs P₄ is exceeded by any accumulation of liquid P₄ in the hydration tower sump exceeding 227 kg — which at a 50,000 t/yr H₃PO₄ plant processing approximately 10,000 kg/hr P₄ at the atomization nozzle, a nozzle failure lasting 90 seconds delivers 250 kg of unatomized P₄ to the tower sump. Free tier — 10 scans/day, no card required.

2. Combustion chamber exit temperature display AI (Yokogawa EJA110A / Emerson Rosemount 3051 refractory thermocouple / ABB TTF300 high-temperature thermocouple display AI — rendered DCS combustion chamber exit temperature display AI classifying exit temperature against 850–1,100°C design range — 94th upward attack; FIRST P₄ combustion chamber AI attack; FIRST P₄ slip to H₃PO₄ product AI attack)

The combustion chamber exit temperature is the primary indicator of P₄ combustion completeness. The adiabatic flame temperature of P₄ combustion in air (P₄ + 5O₂ → 2P₂O₅; ΔH = −1,640 kJ/mol P₄) at 3× stoichiometric air (75% N₂ in air dilutes the flame) is approximately 1,700–2,200°C at the primary flame zone adjacent to the nozzle. As the gas travels down the combustion chamber (2–4 m length; refractory-lined steel shell; operating temperature at wall 800–950°C; exit temperature measured by embedded Type-S or Type-B platinum thermocouple at the chamber exit, or by pyrometer): the gas cools by heat transfer to the refractory wall and dilution by the large excess air. Design exit temperature range 850–1,100°C ensures: (a) all P₄ droplets (even the largest design droplets at 150 μm) have combusted to P₂O₅ before exiting the chamber (combustion kinetics: burnout time for a 150 μm P₄ droplet in air at 900°C ≈ 0.4 s; at 0.6 bar P₄ nozzle failure scenario, coarse droplets >500 μm require >1.5 s which exceeds the 0.5 s chamber residence time at 8 m/s); (b) the P₂O₅ exit concentration is at or near 100% P₄ conversion. Below 750°C at the combustion chamber exit: either the excess air dilution is too high (combustion zone temperature suppressed below the threshold for complete P₄ burnout) or the P₄ feed rate has dropped (insufficient heat generation). At 670°C (the adversarial scenario), there are two possible causes: (1) the air:P₄ ratio has increased above design (too much excess air; the combustion zone is temperature-limited); (2) the P₄ feed pressure has dropped (atomization failure; coarse droplets; incomplete combustion — the same root cause as Surface 1 above, but detectable via the temperature signal if the temperature display AI is not adversarially attacked). The co-occurrence of both Surface 1 (atomization failure) and Surface 2 (chamber exit temperature suppressed) attacks creates a compound scenario where neither signal provides the correct diagnostic.

The adversarial upward pixel attack on the combustion chamber exit temperature display shows 940°C (normal range; within design 850–1,100°C; AI reads “chamber exit temperature 940°C; complete P₄ combustion confirmed; no action required”) when the actual exit temperature is 670°C (below the minimum for complete P₄ combustion of design 150 μm droplets, and far below the threshold for complete combustion of any coarse droplets that may result from atomization nozzle degradation). At 670°C exit temperature: the combustion efficiency for P₄ is approximately 85–88% (P₄ burnout kinetics at 670°C; at 150 μm droplet: burnout time ≈ 0.65 s, slightly above the 0.5 s residence time; 10–15% of P₄ mass exits the chamber unburned). The 10–15% P₄ slip from the combustion chamber at 50,000 t/yr H₃PO₄ production rate: at P₄:H₃PO₄ mass ratio of approximately 0.65 (P₄ + 5O₂ → 2P₂O₅; 2P₂O₅ + 6H₂O → 4H₃PO₄; MW 4H₃PO₄ = 392 g vs P₄ 124 g; mass ratio 124/392 = 0.316 kg P₄ per kg H₃PO₄ at 85 wt% H₃PO₄; actually: 50,000 t/yr × 0.316 = 15,800 t/yr P₄ consumed), 10% P₄ slip = 1,580 t/yr P₄ entering the H₃PO₄ product stream. P₄ in food-grade H₃PO₄ is an adulterant: white phosphorus is acutely hepatotoxic (garlic-breath poisoning; “phossy jaw” — necrotic jaw bones from chronic P₄ exposure; the FDA regulatory action level for P in H₃PO₄ food additive is essentially zero — elemental P is not an approved food additive; product recall, FDA enforcement action, and criminal liability apply). Additionally, P₄-contaminated H₃PO₄ is pyrophoric: elemental P₄ dispersed in 85% H₃PO₄ may ignite spontaneously when the acid is concentrated in the evaporation step (at higher temperature and lower water activity, P₄ oxidation rate increases; spontaneous ignition in the evaporator or storage tank is a documented P₄ production hazard). Free tier — 10 scans/day, no card required.

3. P₂O₅ hydration tower water feed ratio display AI (Emerson Rosemount 8800D vortex / Yokogawa EJA110A / ABB CoriolisMaster water flow display AI — rendered DCS water-to-P₂O₅ feed ratio display AI classifying water feed as % of stoichiometric against 110–135% design range — 94th upward attack; FIRST P₄ thermal H₃PO₄ attack)

The hydration tower water feed rate is the stoichiometric control variable for converting P₂O₅ vapor to H₃PO₄. The reaction P₂O₅ + 3H₂O → 2H₃PO₄ requires exactly 3 mol H₂O per mol P₂O₅ (MW P₂O₅ = 141.94 g/mol = 2 × 30.97 + 5 × 16.00; stoichiometric H₂O:P₂O₅ = 3 × 18.02 / 141.94 = 0.381 kg H₂O per kg P₂O₅). In practice, excess water is used to ensure complete P₂O₅ absorption (design 110–135% of stoichiometric water feed; product H₃PO₄ concentration 75–85 wt% is controlled by the excess water beyond stoichiometric). The water feed to the hydration tower is measured by a vortex flowmeter (Emerson Rosemount 8800D; accuracy ±0.5% of reading; range 0–50 m³/hr at the water spray nozzle headers; calibrated in kg/hr water; the computed water:P₂O₅ molar ratio is derived from the water flow, the P₄ feed flow, and the known P₄→P₂O₅ stoichiometry: each mol P₄ produces 2 mol P₂O₅ requiring 6 mol H₂O = 3 × 2 × 18 = 108 g H₂O per 2 × 141.94 = 283.88 g P₂O₅). The rendered water feed ratio is displayed on the hydration tower DCS panel as % of stoichiometric, updated every 30 seconds. At the design range 110–135%: all P₂O₅ vapor is absorbed into the aqueous H₃PO₄ product; the tower off-gas (excess air + steam + trace H₃PO₄ mist that passes through demister pads) has negligible P₂O₅ content (<5 mg/m³ P₂O₅ in off-gas; well below the OSHA PEL for P₂O₅-derived H₃PO₄ mist of 1 mg/m³). Below 100% stoichiometric water feed: P₂O₅ vapor is not fully absorbed; the unreacted P₂O₅ exits with the tower off-gas. P₂O₅ is an extreme desiccant and the most aggressive common acid anhydride: P₂O₅ + H₂O → 2HPO₃ → 2H₃PO₄ on any moisture contact; the reaction is violently exothermic (ΔH = −177 kJ/mol H₃PO₄) and produces H₃PO₄ acid mist on contact with atmospheric moisture.

The adversarial upward pixel attack on the hydration tower water feed ratio display shows 125% (within the design range 110–135%; AI reads “water feed 125% of stoichiometric; P₂O₅ absorption nominally complete; tower operating normally”) when the actual water feed ratio is 82% (below stoichiometric; 18% of the P₂O₅ leaving the combustion chamber is not absorbed in the hydration tower; this is either due to a water pump malfunction, a stuck-closed water control valve, or a blocked spray nozzle header). At 82% water:P₂O₅ stoichiometry, the tower off-gas contains approximately 18% of the total P₂O₅ load as unabsorbed vapor. At a 50,000 t/yr H₃PO₄ production rate, the total P₂O₅ flow through the hydration tower is approximately 3,500 kg/hr (P₄ combustion rate 1,800 kg/hr P₄ → 2,940 kg/hr P₂O₅ × 1.2 (excess air mass; approximately 7,700 kg/hr total gas through the tower including air)). The unabsorbed P₂O₅ in the tower off-gas at 82% hydration: 3,500 × 0.18 = 630 kg/hr P₂O₅ in off-gas. This 630 kg/hr P₂O₅ exits from the hydration tower exhaust duct (typically venting via wet scrubber and stack to atmosphere after mist elimination). In the exhaust duct downstream of the hydration tower, the remaining moisture in the gas stream (from the tower spray water) partially converts P₂O₅ to H₃PO₄ mist: P₂O₅ + 3H₂O → 2H₃PO₄; the resulting H₃PO₄ aerosol in the exhaust duct deposits on duct walls (corrosive attack on mild steel; phosphoric acid at 85 wt% has pH <1; severe corrosion of unlined steel ductwork at >80°C) and exits through the stack as a corrosive H₃PO₄ aerosol cloud. H₃PO₄ aerosol release at the stack: at the fence line of the Pocatello ID ICL-IP plant (residential areas within 500 m to the north), H₃PO₄ aerosol at 630 kg/hr source rate under calm conditions (Pasquill stability F; wind 1 m/s) creates atmospheric H₃PO₄ concentrations exceeding OSHA PEL 1 mg/m³ within 200 m of the stack. The EPA Clean Air Act Section 112 hazardous air pollutant list includes phosphoric acid (as H₃PO₄) at a facility-wide emission threshold of 100 lb/yr before HAP notification is required — the adversarial scenario generates 630 kg/hr = approximately 1.4 × 10₆ lb/yr, dramatically above the HAP threshold. Free tier — 10 scans/day, no card required.

Integration: P₄ thermal H₃PO₄ production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the P₄ thermal H₃PO₄ production AI pipeline — before the P₄ atomization nozzle pressure AI processes rendered Endress+Hauser Cerabar PMC71 / Yokogawa EJA430A / Emerson Rosemount 3051 burner nozzle pressure DCS display images, before the combustion chamber exit temperature AI processes rendered Yokogawa EJA110A thermocouple / ABB TTF300 / Emerson Rosemount 3051 chamber exit temperature DCS display images, and before the P₂O₅ hydration tower water feed ratio AI processes rendered Emerson Rosemount 8800D / Yokogawa EJA110A / ABB CoriolisMaster water flow DCS display images. Threshold 44 for P₄ thermal H₃PO₄ AI reflects: OSHA PSM TQ 500 lbs white/yellow phosphorus (second-lowest PSM TQ; exceeded in 90 seconds of nozzle failure at 50,000 t/yr scale); P₄ autoignition 34°C in air without any ignition source; P₄ fire behavior (sustained burning, difficult to extinguish, P₂O₅/H₃PO₄ smoke); consequence chain extends to food supply (pyrophoric P in food-grade H₃PO₄); regulatory intersection of EPA HAP 112, OSHA PSM 29 CFR 1910.119, and FDA food additive standards; critical public infrastructure (thermal-grade H₃PO₄ supplies global cola beverage industry from <10 production facilities worldwide).

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# White phosphorus (P4) thermal H3PO4 production AI contexts: threshold 44
# OSHA PSM P4 TQ 500 lbs (29 CFR 1910.119 App. A, "white or yellow phosphorus").
# P4 autoignition 34°C in air (no ignition source needed below ambient temperature).
# P4 OSHA PEL 0.1 mg/m³; NIOSH IDLH 0.1 mg/m³ (PEL == IDLH: any exceedance immediately dangerous).
# P4 + 5O2 → 2P2O5 (ΔH = -1,640 kJ/mol P4; adiabatic flame T ~1,700-2,200°C at burner zone).
# 94th upward attack. FIRST white phosphorus P4 thermal H3PO4 attack.
PHOSPHORIC_ACID_P4_GLYPHWARD_THRESHOLD = 44

class PhosphoricAcidP4Context(StrEnum):
    P4_ATOMIZATION_NOZZLE_PRESSURE  = auto()  # burner nozzle P4 spray pressure (94th; FIRST P4 thermal H3PO4; FIRST P4 combustion; FIRST atomization nozzle; FIRST spontaneous-ignition; FIRST food-grade H3PO4)
    COMBUSTION_CHAMBER_EXIT_TEMP    = auto()  # P4 combustion completeness indicator (P4 slip to product → pyrophoric acid)
    HYDRATION_TOWER_WATER_RATIO     = auto()  # P2O5 hydration stoichiometry (under-hydration → P2O5 aerosol in off-gas)

async def scan_phosphoric_acid_p4_frame(
    frame_b64: str,
    context: PhosphoricAcidP4Context,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_phosphoric_acid_p4(
    frame_b64: str,
    context: PhosphoricAcidP4Context,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_phosphoric_acid_p4_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= PHOSPHORIC_ACID_P4_GLYPHWARD_THRESHOLD:
        raise AdversarialPhosphoricAcidP4ImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from P4 thermal H3PO4 production AI pipeline."
        )

class AdversarialPhosphoricAcidP4ImageError(RuntimeError):
    pass