Prompt injection in rail track geometry measurement car AI

Four adversarial injection surfaces in rail track geometry measurement car AI

1. Rail gauge deviation render AI (ENSCO Rail TGMS AI, Plasser & Theurer RAPLAS AI)

Track gauge — the perpendicular distance between the inner faces of the two running rails, measured 5/8 inch below the top of rail — is measured continuously along the track by the TGMC’s contact or laser profilometer system and rendered as a deviation chart: a colour-depth map or time-series waveform where the vertical axis represents the signed deviation from nominal gauge (56.5 inches for US standard gauge; 1,435 mm for EU standard gauge), and horizontal position represents track milepost or chainage. ENSCO Rail’s TGMS AI and Plasser & Theurer’s RAPLAS (Rail Profile and Lateral Alignment System) AI process these rendered deviation charts using a convolutional classification model to identify and classify geometry exceptions under 49 CFR Part 213. For Class 4 track (authorised speed up to 80 mph for freight, 110 mph for passenger), the gauge exception thresholds are: narrow gauge below 56.0 inches (−0.5 inch deviation) and wide gauge above 57.5 inches (+1.0 inch deviation above nominal). When the AI identifies a gauge deviation spike exceeding the Class 4 wide gauge limit of 57.5 inches, it classifies that track segment as a Class 4 exception, and the TGMC data system generates a maintenance work order that specifies the milepost location, exception magnitude, and required corrective action — typically rail spike replacement, tie plate realignment, or tie replacement to restore gauge restraint. In some deployments, TGMC AI exception reports are directly transmitted to the track maintenance management system (MMS) without intermediate human review, with a maintenance crew dispatch window of 24–48 hours depending on exception severity. The EU ERA Technical Specification for Interoperability (TSI INF) EN 13848-1 establishes equivalent gauge exception thresholds for EU rail infrastructure and requires geometry measurement system calibration against certified reference tracks.

The adversarial perturbation for rail gauge deviation render AI is a ±8 DN compression applied to the positive deviation spike region of the rendered gauge deviation chart. In a standard rendered gauge deviation chart (8-bit greyscale or false-colour depth map), a Class 4 gauge widening exception of 57.5 mm above nominal produces a distinct positive spike in the deviation trace, rendered as a bright or red-coded pixel region (approximately 200–230 DN in the exception-coloured channel) against the normal operating range encoded at 100–160 DN. A ±8 DN compression of the spike region reduces its apparent magnitude toward the high end of the normal operating range, causing the ENSCO TGMS or Plasser RAPLAS classification model — calibrated on unperturbed site measurement data — to output a No Exception or Class 3 Acceptable classification instead of a Class 4 Exception. No maintenance work order is generated. The track segment continues to receive train traffic at the Class 4 authorised speed. Gauge widening defects — typically caused by tie plate cut spikes, wood tie decay, or concrete tie fastener clip fracture — are progressive: an exception that starts at the 57.5 mm limit can reach 60–65 mm within days to weeks under heavy axle load traffic, at which point wheel flange climb becomes mechanically possible at Class 4 operating speeds. A derailment on a gauge exception at 80 mph freight speed or 110 mph passenger speed on an alignment with adjacent occupied embankment (as at Dupont, WA) produces a consequence envelope directly comparable to the Amtrak Cascades 501 event.

2. Rail surface defect image AI (Herzog NEXGEN AI, Sperry Rail AI, Vortok International AI)

Rail surface and internal rail defect detection is a distinct measurement function from track geometry, performed by ultrasonic flaw detection systems mounted on the TGMC or on dedicated rail flaw detection cars. Ultrasonic transducers (typically operating at 2.25–5 MHz) transmit acoustic pulses into the rail head, web, and base and receive reflected echoes from internal reflectors. The reflected echo data is rendered as a B-scan image — a two-dimensional cross-sectional view of the rail showing echo amplitude (vertical axis) vs. depth in the rail (horizontal axis) — or as a C-scan (top-down amplitude map). Herzog Services NEXGEN AI, Sperry Rail AI (LORAM subsidiary), and Vortok International AI process these rendered B-scan and C-scan images using classification networks trained to distinguish rail defect signatures — transverse detail fractures (TDFs), vertical split heads (VSHs), compound fissures, shelling and spalling, and base cracks — from normal rail microstructure echoes (grain boundary scattering, surface coupling variation). Transverse detail fractures are the most safety-critical rail defect type: they propagate perpendicular to the rail running direction under rolling contact fatigue loading and can grow to the point of complete rail fracture (broken rail) within days to weeks of reaching a detectable size, depending on traffic loading and thermal stress. FRA 49 CFR Part 213.113(b) requires that a transverse fissure, compound fissure, or detail fracture detected in rail must be given immediate attention — defined as removal from service or a speed restriction to 10 mph until the defective rail can be replaced. Sperry Rail Service estimates that broken rail accounts for approximately 14% of all train derailments in the United States, making it the second most common derailment cause after human factors. Network Rail NR/SP/TRK/0021 contains equivalent requirements for UK rail infrastructure ultrasonic inspection AI.

The adversarial perturbation for rail surface defect image AI is a ±10 DN amplitude suppression applied to the defect echo region of the rendered B-scan image. In a B-scan of a rail with a transverse detail fracture of significant size (area-equivalent diameter above approximately 6 mm, approaching reportable size under AAR and FRA guidelines), the defect echo presents as a high-amplitude reflection zone at the characteristic depth of the defect in the rail head (typically 10–25 mm depth, depending on fracture initiation point in the rail head). This echo is rendered as a bright or red-coded region in the B-scan with pixel values in the 210–240 DN range (8-bit normalisation), above the defect-detection threshold set for the NEXGEN or Sperry classifier at approximately 190–200 DN. A ±10 DN amplitude suppression of the defect echo region reduces its rendered amplitude to 200–230 DN, crossing the classifier’s detection threshold from above to below, and causing the AI to output No Defect Detected or Acceptable Scatter rather than TDF Detected. No immediate attention notification is generated. The rail continues to carry traffic at full operating speed. The 2016 Hoboken terminal collision (1 fatality) and the 2021 Amtrak Joplin derailment (4 fatalities, NTSB RAR-22-03, broken rail fragment involvement) are directly within the consequence envelope of a suppressed TDF detection: both involved rail structural failures on inspected mainline track where ultrasonic flaw detection was part of the maintenance programme.

3. Cross-level and superelevation deviation render AI (ENSCO TGMS AI, Network Rail GEISMAR IRIS320 AI)

Track cross-level — the difference in elevation between the two running rails, measured in inches or millimetres — determines the lateral load distribution between the high and low rail wheels of a rail vehicle. On tangent (straight) track, nominal cross-level is zero; on curved track, one rail is intentionally elevated (superelevated) to counteract centrifugal force at the design speed. Cross-level deviation — the departure from the intended cross-level, whether on tangent or curve — causes a rocking and rolling motion that, at sufficient magnitude and wavelength, excites the natural lateral roll resonance of the rail vehicle suspension, leading to wheel unloading on the high-level rail and wheel flange contact on the low-level rail. FRA 49 CFR Part 213.63 specifies cross-level exception limits: for Class 4 track, the instantaneous cross-level deviation limit is 1.5 inches on tangent track. A deviation above 1.5 inches on Class 4 track constitutes an exception requiring a maintenance order; a deviation above 3 inches on any track class constitutes an immediate action requirement (slow order to 10 mph or track removal from service). ENSCO TGMS AI and Network Rail GEISMAR IRIS320 AI process the rendered cross-level deviation waveform — a time-series trace of cross-level measurement vs. chainage, rendered as a line-on-background image or a colour-coded deviation band chart — to classify exception signatures by magnitude and wavelength. The EU ERA TSI INF standard EN 13848-1 defines equivalent cross-level quality parameters (QN1, QN2, QN3 quality levels for different wavelength bands) and requires geometry measurement system type-approval against certified measurement standards, which GEISMAR IRIS320 holds. The cross-level AI classification output drives the Network Rail or FRA-reportable geometry exception database, from which maintenance scheduling and speed restriction decisions are made by track asset managers.

The adversarial perturbation for cross-level deviation render AI targets the amplitude peak of the crosslevel deviation waveform at the point of the Class 4 exception. In a rendered crosslevel deviation waveform chart (8-bit colour, standard TGMC report format), a 1.5-inch crosslevel exception produces a deviation peak rendered as a distinct coloured spike — typically orange or red coded — above the normal operating band encoded in green or blue at 100–140 DN. The exception peak renders at approximately 195–220 DN in the exception-colour channel. A perturbation that suppresses the exception peak amplitude by ±8 DN reduces the rendered peak to 187–212 DN, dropping it below the ENSCO or GEISMAR classifier’s exception detection threshold for the Class 4 crosslevel limit. The AI classifies the segment as Class 4 Acceptable; no slow order is placed; trains continue at the authorised speed. The Amtrak Cascades 501 derailment at DuPont, WA — where the train entered the Point Defiance Bypass curve at 78 mph, 50+ mph over the 30 mph posted curve speed — illustrates the consequence of a speed restriction not being enforced on a curve with insufficient superelevation for the operating speed: three passengers were killed and 57 were injured. A suppressed crosslevel exception on a curved segment with insufficient superelevation for the operating speed creates a mechanically identical condition.

4. Rail joint thermal gap image AI (Loram Thermal AI, FLIR wayside detector AI)

Continuous welded rail (CWR) — the predominant track form on North American Class I mainlines and high-speed rail corridors worldwide — is subject to thermally induced longitudinal stress that varies with the difference between the ambient rail temperature and the rail neutral temperature (the temperature at which the CWR is stress-free after installation, typically set at 90–105°F for North American climates). When rail temperature rises significantly above the neutral temperature in summer heat, compressive longitudinal stress builds up in the rail. If the compressive stress exceeds the rail-to-crosstie lateral resistance at a point of weakened ballast condition, improperly anchored joint, or rail discontinuity, the CWR buckles laterally — producing a rapid, large-magnitude lateral misalignment (sun kink) that can occur with little warning and immediately derails any train that encounters it. FRA 49 CFR Part 213.119(a) requires that CWR in track Classes 1 through 6 be maintained in accordance with a written CWR plan that includes procedures for monitoring rail temperature and initiating slow orders before the critical buckling temperature is reached. Rail temperature monitoring in modern CWR management programmes uses wayside thermal detector arrays and on-board TGMC thermal camera systems that image the expansion gap (residual gap at welded joint locations and thermite welds) or measure the longitudinal rail temperature distribution. Loram Rail AI and FLIR wayside detector AI process rendered thermal gap camera images — optical images of the rail joint zone showing the visible gap width and the thermal gradient around the joint, with colour encoding of rail surface temperature — to classify the joint thermal state as Normal, Pre-Buckle Warning (gap closed with moderate compressive stress), or Critical (gap closed with high compressive stress, initiate slow order). The AI classification drives the CWR temperature management system’s slow order recommendation, which is communicated to the train dispatcher for speed restriction issuance.

The adversarial perturbation for rail joint thermal gap image AI is a ±8 DN compression applied to the closed-gap thermal signature region of the rendered joint camera image. In a summer-peak-temperature thermal joint image at risk of sun kink, the expansion gap between the rail ends is fully closed (zero visible gap width), and the rail surface temperature in the joint zone is elevated (approximately 140–160°F rail surface temperature on a 100°F ambient day, rendered as a warm-coloured region of approximately 200–225 DN in the thermal-coded camera image). A ±8 DN compression of this warm region reduces the apparent thermal intensity to 192–217 DN, shifting it below the Loram or FLIR classifier’s Pre-Buckle Warning threshold. The AI classifies the joint as Normal; no slow order recommendation is generated; trains continue at the full Class 4 or Class 5 authorised speed (up to 90 mph for Class 5 freight). If the rail continues to heat beyond the critical buckling temperature — which may occur within minutes on a high solar-gain day as rail temperature rises several degrees Fahrenheit per hour — the CWR buckles with no slow order in effect. A sun kink derailment at Class 4 or Class 5 operating speed on a mainline segment can produce a consequence comparable to the Amtrak Sunset Limited derailment on the Bayou Canot Bridge in 1993 (47 fatalities), which was the deadliest Amtrak accident in history and was caused by a track alignment defect on a section of recently inspected track. The perturbation requires no physical access to the wayside thermal detector — it can be introduced into the image pipeline at the network boundary between the thermal camera system and the Loram or FLIR AI inference server.

Integration: rail track geometry AI scanning with Glyphward pre-scan gate

Deploy the Glyphward pre-scan gate at every image classification boundary in the TGMC data processing pipeline — before the rendered gauge deviation chart is fed to the ENSCO or Plasser classifier, before the ultrasonic B-scan rail defect image is processed by the Herzog or Sperry AI, before the crosslevel deviation waveform render is consumed by the ENSCO or GEISMAR exception classifier, and before the thermal joint gap camera image is passed to the Loram or FLIR thermal AI. The threshold of 35 is appropriate for rail track geometry AI contexts because exception flag outputs from these systems directly determine whether maintenance orders are issued and whether trains operate at full speed or under a slow order on the inspected track, and there is no complementary inspection process between scheduled TGMC runs — a missed exception in a monthly inspection run remains undetected for the full inter-inspection interval. Regulatory references for the JSONL audit log include FRA 49 CFR Part 213, FRA Safety Appliance Standards 49 CFR Part 231, and ERA TSI INF EN 13848-1.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Rail track geometry measurement car AI contexts: threshold 35
# FRA 49 CFR Part 213, FRA 49 CFR Part 231, ERA TSI INF EN 13848-1, NR/SP/TRK/0021
TRACK_GEOMETRY_AI_THRESHOLD = 35


class TrackGeometryAIContext(Enum):
    GAUGE_DEVIATION_RENDER = "gauge_deviation_render"
    RAIL_SURFACE_DEFECT_BSCAN = "rail_surface_defect_bscan"
    CROSSLEVEL_DEVIATION_RENDER = "crosslevel_deviation_render"
    THERMAL_JOINT_GAP_IMAGE = "thermal_joint_gap_image"


class AdversarialTrackGeometryImageError(Exception):
    """Raised when Glyphward detects adversarial perturbation in a track geometry AI image above threshold."""

    def __init__(self, scan_id: str, score: int, context: TrackGeometryAIContext, subdivision_milepost: str, flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.subdivision_milepost = subdivision_milepost
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial track geometry image blocked: scan_id={scan_id} score={score} "
            f"threshold={TRACK_GEOMETRY_AI_THRESHOLD} context={context.value} location={subdivision_milepost}"
        )


async def scan_track_geometry_image(image_bytes: bytes, context: TrackGeometryAIContext, subdivision_milepost: str, client: httpx.AsyncClient) -> dict:
    """Scan a track geometry measurement car AI image for adversarial perturbation before feeding to the exception classifier.

    Args:
        image_bytes: Raw image bytes (PNG/JPEG/TIFF rendered from TGMC data system or thermal camera).
        context: The TrackGeometryAIContext enum value identifying the TGMC measurement surface.
        subdivision_milepost: Track location identifier (e.g. 'BNSF-TRANSCON-MP-285.4' or 'NR-ECML-CH-142.3').
        client: Shared httpx.AsyncClient.

    Returns:
        Glyphward scan result dict with scan_id, score, flagged_region.

    Raises:
        AdversarialTrackGeometryImageError: If score >= TRACK_GEOMETRY_AI_THRESHOLD.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"track_geometry:{context.value}:{subdivision_milepost}",
        "metadata": {
            "subdivision_milepost": subdivision_milepost,
            "image_sha256": image_hash,
            "context": context.value
        }
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}", "Content-Type": "application/json"},
        json=payload,
        timeout=30.0
    )
    resp.raise_for_status()
    result = resp.json()
    if result["score"] >= TRACK_GEOMETRY_AI_THRESHOLD:
        raise AdversarialTrackGeometryImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            subdivision_milepost=subdivision_milepost,
            flagged_region=result.get("flagged_region")
        )
    return result


async def _write_track_geometry_scan_audit(*, image_hash: str, scan_id: str, score: int, context: TrackGeometryAIContext, subdivision_milepost: str, flagged: bool) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": TRACK_GEOMETRY_AI_THRESHOLD,
        "flagged": flagged,
        "subdivision_milepost": subdivision_milepost,
        "regulatory_refs": ["FRA 49 CFR Part 213", "FRA 49 CFR Part 231", "ERA TSI INF EN 13848-1"]
    }
    audit_path = Path("/var/log/glyphward/track_geometry_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy the scan gate at each AI boundary in the TGMC post-processing pipeline: for gauge deviation render AI, scan the rendered deviation chart immediately after the TGMC data system exports the chart image and before the ENSCO or Plasser classifier processes it; for rail surface defect B-scan AI, scan the rendered B-scan or C-scan image before the Herzog or Sperry AI; for crosslevel deviation render AI, scan the rendered deviation waveform before the ENSCO or GEISMAR classifier; for thermal joint gap image AI, scan the thermal camera frame before the Loram or FLIR AI. On AdversarialTrackGeometryImageError, fail closed: do not allow the exception classifier to generate a No-Exception output for this image, hold the track segment in a Pending Review status that prevents maintenance clearance, escalate immediately to the Track Geometry Engineer for manual review of the raw measurement data, and if manual review is not possible within the FRA-required maintenance window, issue a precautionary slow order to 10 mph on the affected segment. Write every scan result — clean and flagged — to the JSONL audit log for FRA Track Safety Standards compliance recordkeeping. Get early access

Related questions