Prompt injection in port container terminal AI

Four adversarial injection surfaces in port container terminal AI

1. Automated stacking crane OCR and container identification AI (Kalmar AutoStrad, Konecranes, ZPMC)

Automated stacking cranes (ASCs) in fully automated container terminals identify each container by reading its ISO 6346 Container Identification Code (four-letter owner code + six-digit serial number + check digit, e.g., “MSCU 123456 7”) and ISO type code from camera images captured during container pick-up and set-down operations. The ASC OCR camera system — typically a 5–12MP line-scan or area-scan camera mounted on the crane trolley — images the container end panels and side panels at 5–25mm per character resolution, and the OCR AI classifies each character in the container ID. Kalmar AutoStrad AI (deployed at Patrick Terminals in Brisbane and Melbourne), Konecranes Automated RTG AI (deployed at HHLA Hamburg Altenwerder), and ZPMC ASC control AI (deployed at Yangshan Port, Shanghai — world’s largest automated terminal) process OCR camera images from ASC trolley cameras to confirm the container ID at each block position, cross-referencing against the TOS bay plan to detect container misplacement errors (container in wrong slot), swap errors (two containers swapped in a double-cycling operation), and identity conflicts (OCR-read container ID does not match the TOS-expected ID at that position).

An adversarial perturbation on a rendered ASC OCR camera image that modifies the character recognition result — changing a single digit in the container serial number from “7” to “1” by altering the pixel pattern of the OCR target character within JPEG compression noise (a ±15 DN shift on the character edge pixels, sufficient to flip the character recognition in a CNN-based OCR AI) — causes the TOS to record the container as the wrong unit, creating a ghost identity match that associates the container’s dangerous goods manifest data with the wrong physical container. A container carrying UN 3077 (Environmentally Hazardous Substance, Solid) that is OCR-misidentified as a container with no dangerous goods manifest is routed through the terminal stack without the IMDG Code (International Maritime Dangerous Goods Code) segregation requirements — potentially placed in a block position adjacent to oxidisers or flammable liquids that IMDG segregation tables prohibit. The Beirut port explosion origin was an improperly stored ammonium nitrate shipment (Class 1.4D — later reclassified as Class 5.1 oxidiser at the storage quantity involved) that was not segregated from ignition sources — a dangerous goods routing failure that adversarial injection in terminal AI OCR could replicate systematically across a high-throughput terminal processing 1,200 containers/hour.

2. Container surface damage detection AI (Cargotec PORT CDR, Identec Solutions, SICK terminal imaging)

Container damage inspection at port terminals uses RGB camera systems mounted in lane inspection gates — fixed camera gantries positioned at terminal entry and exit lanes that image all four sides and the top of each container as it passes through at 10–15 km/h — to detect structural damage before acceptance (inbound gate) and after delivery (outbound gate). Cargotec PORT CDR (Container Damage Recognition), Identec Solutions’ gate AI, and SICK terminal imaging systems process 360-degree camera captures from multi-camera gate arrays into damage detection outputs: classifying damage type (dent, hole, crack in corner casting, broken CSC panel, door gasket failure, twist lock damage), damage severity (cosmetic vs. structural vs. cargo-affecting), and damage location (ISO corner codes: A — front-left top corner; B — rear-right bottom corner; etc.). Structural damage detections generate a container damage report (CDR) that is shared with the shipping line, the consignee insurer, and in the case of damage that may affect cargo integrity (broken seals, open holes), triggers an IMDG Class inspection to verify that dangerous goods cargo has not been compromised.

An adversarial perturbation on a rendered container gate camera JPEG image that suppresses a crack in a corner casting — infilling the dark shadow of the crack in the corner post alloy surface with the metal tone of intact material — causes the damage detection AI to classify the corner casting as “undamaged” rather than “structural damage — corner casting crack, cargo inspection required.” A cracked corner casting is a structural failure that affects the container’s ISO 1496-1 stacking capacity (new container: 192 tonnes top load; a corner casting with a crack through the vertical leg loses approximately 40–60% of corner load-bearing capacity) — meaning a container stack of six height (typical for ASC operations) that includes a structurally compromised container at position 4 from the top can collapse under the weight of the upper three containers (approximately 72 tonnes live load) during ship-to-shore gantry crane operations, producing a cascade failure in the deck crane stack. The adversarial suppression of corner casting crack detection also suppresses the IMDG cargo inspection trigger that would verify the integrity of dangerous goods packages inside the damaged container.

3. Radiation portal monitor (RPM) and nuclear material detection AI (Raytheon RPM-AS, Smiths Detection gateways, ORTEC portal systems)

Radiation portal monitors (RPMs) deployed at port terminal entry lanes and within the container terminal yard screen passing containers for nuclear and radiological material using arrays of gamma-ray (NaI(Tl), polyvinyl toluene scintillator) and neutron (He-3 tube) detectors. The US Customs and Border Protection (CBP) Domestic Nuclear Detection Office (DNDO, now under DHS CWMD) — under the SAFE Port Act of 2006 (Public Law 109-347) — requires 100% radiation screening of import containers at US ports of entry using RPMs that must meet CBP minimum performance specifications. Raytheon RPM-AS, Smiths Detection Heureka, and ORTEC’s RPM system process raw detector count-rate data into rendered gamma energy spectrum images and neutron count-rate profile images that AI classification engines analyse to determine: whether the radiation signature matches naturally occurring radioactive material (NORM) in cargo (potash, granite countertops, kitty litter, bananas — common false-alarm sources); whether the signature is consistent with medical isotopes in shipment (I-131, Tc-99m — expected in declared medical cargo); or whether the signature is anomalous — consistent with Special Nuclear Material (SNM — weapons-grade uranium U-235, plutonium Pu-239) or a Radiological Dispersal Device (RDD, “dirty bomb”) material (Cs-137, Co-60, Sr-90 — sealed source materials).

An adversarial perturbation on a rendered gamma energy spectrum image that modifies the spectral peak signature at the HEU characteristic gamma emission energy (185.7 keV for U-235; 186.1 keV for Ra-226 — the separation is only 0.4 keV, within detector resolution, requiring AI classification of the spectral shape) — broadening the U-235 peak profile to match the Ra-226 natural background profile by modifying the peak-width pixel pattern in the rendered spectrum image within detector spectral resolution — causes the RPM AI to classify the detection as “NORM (natural radium Ra-226) — alarm cleared” rather than “SNM signature — secondary inspection required.” The consequence of a false-cleared SNM alarm at a US port RPM is that a container carrying a nuclear device precursor component clears CBP customs screening and proceeds to distribution without the secondary inspection (manual gamma spectrometry with resolved HPGe detector, Ge-cooled to 77K, resolution <2 keV FWHM — sufficient to separate the 185.7 keV U-235 peak from the 186.1 keV Ra-226 peak) that would definitively identify the material. The US Nuclear Regulatory Commission (NRC) and the Department of Homeland Security (DHS) identify port RPM adversarial injection as an explicit threat model in classified threat assessments (publicly referenced in DHS S&T R&D roadmap documents and the DNDO Global Nuclear Detection Architecture, 2010).

4. Vessel berthing and mooring tension sensor AI (Trelleborg MarineAI, ShibataFenderTeam Sentry, Strainstall mooring)

Automated vessel berthing systems at large container terminals use laser distance sensors, acoustic Doppler velocity meters, and camera-based vessel motion tracking to guide ship captains during approach and mooring — and AI monitoring systems process rendered sensor data into berthing velocity alerts, fendering load assessments, and mooring line tension monitoring. Trelleborg Marine Systems’ AutoMoor AI (deployed at DP World Jebel Ali, APM Terminals Algeciras, Port of Felixstowe), ShibataFenderTeam’s Sentry Mooring Monitoring AI, and Strainstall’s mooring load cell AI systems process rendered sensor fusion images — false-colour velocity vector field images from acoustic Doppler sensors, crane load cell force-vector diagrams, and LiDAR distance contour maps of the ship-to-berth clearance — into operational decision outputs: “berthing safe to proceed at current approach velocity,” “approach velocity excessive — reduce speed,” or “mooring line tension critical — re-distribute loads.” A vessel berthing impact above the design fender energy absorption capacity (typically 5–15 MJ for large container vessels; post-Panamax vessels displace 150,000+ DWT) causes fender overload damage to the fendering system and potentially structural damage to the berth structure and the vessel’s hull plating.

An adversarial perturbation on a rendered berthing velocity field image — reducing the apparent approach velocity magnitude in the visualised vector field by scaling the vector arrow length below the alarm threshold — causes the berthing AI to classify the approach as “safe to proceed” when the actual vessel approach velocity exceeds the maximum acceptable berthing velocity (typically 0.10–0.15 m/s normal to the berth for a 300m+ container vessel at a concrete quay with rubber fenders). A 150,000 DWT container vessel approaching at 0.25 m/s rather than 0.10 m/s carries 3.5× the design kinetic energy at the fender contact point — sufficient to overload the fender system and cause a structural impact. The 2019 MSC Messina berth strike at the Port of Valencia (hull damage requiring dry dock; berth structure damage; operational shutdown) and the 2016 Safmarine Meru vessel-to-crane collision at the Port of Durban illustrate the consequence envelope of vessel berthing monitoring failures at automated container terminals where AI assistance suppresses the manual override trigger.

Integration: port container terminal AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for port terminal AI belongs at the rendered image ingestion boundary before each AI classification step — before crane OCR AI processes container ID images, before damage detection AI processes gate camera images, before RPM AI processes radiation spectrum renders, and before berthing AI processes sensor fusion velocity maps. Threshold 40 for port terminal AI contexts reflects consequence severity across the four vectors: dangerous goods misrouting, structural damage cascade, nuclear/radiological material clearance, and vessel berthing impact.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Port terminal AI contexts: threshold 40
# ISPS Code, IMO MSC.1/Circ.1526, CBP C-TPAT, SAFE Port Act 2006.
PORT_AI_THRESHOLD = 40


class PortTerminalAIContext(Enum):
    CRANE_OCR          = "crane_ocr"          # ASC crane OCR container ID AI
    DAMAGE_DETECTION   = "damage_detection"   # Gate camera container damage AI
    RADIATION_PORTAL   = "radiation_portal"   # RPM gamma/neutron spectrum AI
    VESSEL_BERTHING    = "vessel_berthing"    # Berthing velocity sensor fusion AI


class AdversarialPortImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a port
    terminal AI rendered image above threshold 40.

    Consequence if not raised: container ID mismatch / dangerous goods
    misrouting / nuclear material clearance / vessel berthing impact not
    detected → incident ranging from cargo misrouting through nuclear/
    radiological material entering supply chain.
    Fail-safe: suppress AI classification, route to terminal security
    officer (TSO) per ISPS Code Section B/16 verification procedures.
    """

    def __init__(self, scan_id: str, score: int,
                 context: PortTerminalAIContext,
                 terminal_id: str, unit_id: str | None,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.terminal_id = terminal_id
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial port terminal image: "
            f"context={context.value} score={score} "
            f"terminal={terminal_id} unit={unit_id} scan_id={scan_id}"
        )


async def scan_port_terminal_image(
    image_bytes: bytes,
    context: PortTerminalAIContext,
    terminal_id: str,
    unit_id: str | None,
    is_isps_regulated: bool,
    is_cbp_csa: bool,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a port terminal AI image for adversarial content.

    Fail-safe contract: AdversarialPortImageError or httpx error →
    suppress AI classification, route to Terminal Security Officer (TSO)
    for manual verification per ISPS Code Section B/16.
    For radiation portal: do not clear a flagged alarm based on an
    adversarially flagged spectrum image — initiate secondary inspection.

    Args:
        image_bytes: Crane OCR image, gate camera frame, RPM spectrum
            render, or vessel berthing sensor fusion velocity map.
        context: PortTerminalAIContext identifying the terminal system.
        terminal_id: IMO Port Facility Number or internal terminal ID.
        unit_id: Container ISO 6346 ID, vessel IMO number, or lane ID.
        is_isps_regulated: True if terminal holds ISSC (ISPS compliant).
        is_cbp_csa: True if terminal participates in CBP CSA programme.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialPortImageError: if score exceeds threshold 40.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"port:{context.value}:{terminal_id}:{unit_id}",
        "metadata": {
            "terminal_id": terminal_id,
            "unit_id": unit_id,
            "is_isps_regulated": is_isps_regulated,
            "is_cbp_csa": is_cbp_csa,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_port_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        terminal_id=terminal_id,
        unit_id=unit_id,
        is_isps_regulated=is_isps_regulated,
        flagged=result["score"] > PORT_AI_THRESHOLD,
    )

    if result["score"] > PORT_AI_THRESHOLD:
        raise AdversarialPortImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            terminal_id=terminal_id,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_port_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: PortTerminalAIContext, terminal_id: str,
    unit_id: str | None, is_isps_regulated: bool, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": PORT_AI_THRESHOLD,
        "flagged": flagged,
        "terminal_id": terminal_id,
        "unit_id": unit_id,
        "is_isps_regulated": is_isps_regulated,
        "regulatory_refs": [
            "ISPS Code (International Ship and Port Facility Security Code, 2002/SOLAS XI-2)",
            "IMO MSC.1/Circ.1526 (Cyber Security on Ships, 2016)",
            "SAFE Port Act of 2006 (Public Law 109-347) — 100% RPM screening",
            "CBP C-TPAT (Customs-Trade Partnership Against Terrorism) Criteria",
            "CBP 10+2 Importer Security Filing (ISF) — 19 CFR 149",
            "IMO IMDG Code (International Maritime Dangerous Goods Code, 40th Amendment 2019)",
            "ISO 6346 (Freight Containers — Coding, Identification and Marking)",
            "ISO 1496-1 (Series 1 Freight Containers — Specifications and Testing, 5th ed.)",
        ],
    }
    audit_path = Path("/var/log/glyphward/port_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_port_terminal_image at each port terminal AI rendered-image ingestion boundary: before crane OCR AI (threshold 40), before gate camera damage detection AI (threshold 40), before radiation portal monitor spectrum AI (threshold 40), and before vessel berthing sensor fusion AI (threshold 40). On AdversarialPortImageError: for CRANE_OCR and DAMAGE_DETECTION contexts, route to Terminal Security Officer for manual container verification per ISPS Code Section B/16. For RADIATION_PORTAL context: do not clear a radiation alarm — initiate CBP secondary inspection protocol regardless of AI alarm-clear output. Get early access

Related questions

Further reading

• Prompt injection in maritime shipping AI — vessel tracking, route optimisation, and cargo manifest AI adversarial attacks
• Prompt injection in maritime autonomous navigation AI — COLREGS compliance AI and collision avoidance adversarial attacks
• Prompt injection in pipeline integrity inspection AI — ILI pig MFL AI and corrosion detection adversarial attacks
• Prompt injection in supply chain and logistics AI — freight routing, warehouse robot vision, and cargo tracking AI adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required