Prompt injection in road tunnel fire detection AI

Four adversarial injection surfaces in road tunnel fire safety AI

1. CCTV smoke and flame detection AI (Bosch AVIOTEC, Viasis Tunnel AI, IndigoVision AI)

Video-based fire detection (VFD) systems in road tunnels process CCTV camera frames continuously — at frame rates of 5–25 fps from cameras spaced 30–50m apart along the tunnel ceiling — using AI classification pipelines that detect fire smoke (grey/black pixel texture with characteristic diffusion boundary and movement patterns), flame (yellow/orange/white high-luminance flickering texture), and fire precursor indicators (excessive CO concentration indicated by haze pattern in camera frame, vehicle stopping abnormally, debris on roadway). Bosch AVIOTEC VFD AI uses a convolutional neural network trained on labelled smoke/flame camera frames from tunnel fire scenarios and weather-induced false-alarm sources (water vapour, diesel exhaust, tunnel lighting artefacts) to generate frame-level fire probability scores; when the rolling average score exceeds a configurable threshold (typically 60–75% probability over 10–30 consecutive frames), the system generates a “FIRE DETECTED” alarm that activates the Emergency Ventilation System. Viasis Tunnel AI (deployed in multiple French SANEF motorway tunnels and UK Highways England major road tunnels) and IndigoVision Tunnel Analytics AI process architecturally equivalent CCTV frames to the same alarm generation logic.

An adversarial perturbation on a rendered CCTV camera frame that suppresses a fire smoke plume — shifting the characteristic grey smoke diffusion texture at the tunnel ceiling toward the clean-air background pixel distribution of normal tunnel atmosphere by a ±10 DN pixel shift in the smoke region — causes the VFD AI to score the frame below the fire detection threshold, preventing the “FIRE DETECTED” alarm. A fire in a heavy goods vehicle in a road tunnel with bidirectional traffic — the scenario in both Mont Blanc 1999 and Gotthard 2001 — produces visible smoke within 60–90 seconds of ignition; the time from smoke detection to emergency ventilation activation is the critical window during which upstream motorists can still evacuate before the smoke layer drops to road level. An adversarial suppression of the smoke detection for even 3–5 minutes during this window — the time required for an operator-on-call to respond to a delayed pager alert rather than an immediate automated VFD alarm — can result in the smoke layer reaching pedestrian evacuation route entry doors before the last vehicle has reached safety, replicating the fatal delay pattern observed in both Mont Blanc and Gotthard.

2. CO/NO2 sensor concentration trend AI (Siemens Desigo CC AI, Ametek Land AI, ABB Ability Air Quality AI)

Longitudinal ventilation in road tunnels is controlled by CO (carbon monoxide) and NO2 (nitrogen dioxide) concentration measurements from fixed-point electrochemical or infrared sensor arrays spaced 200–500m apart along the tunnel length. The sensor output is rendered into concentration trend charts — time-series line plots with concentration (ppm or mg/m³) on the Y-axis and time on the X-axis, with alarm threshold lines overlaid — that Siemens Desigo CC tunnel management AI, ABB Ability tunnel air quality AI, and Ametek Land gas analysis AI process to classify whether CO/NO2 concentrations require jet fan speed increase (normal ventilation management), emergency ventilation activation (fire event response), or tunnel closure (concentration exceeds NFPA 502 Table 11.8.1 maximum allowable CO of 100 ppm for longitudinal tunnels or WHO guideline NO2 of 200 μg/m³ over 1 hour). Under NFPA 502:2023 Section 11.8 and EU Directive 2004/54/EC Article 3(c), tunnel operators must maintain CO below 100 ppm at any point in the tunnel (fire exclusion zone threshold is 30 ppm for high-traffic tunnels) and activate emergency ventilation within the Design Fire scenario response time (typically 120–180 seconds from fire event).

An adversarial perturbation on a rendered CO concentration trend chart image that suppresses a rapid CO spike — smoothing the steep upward CO concentration curve of a fire event (200–500 ppm within 90 seconds of HGV fire) to a gradual normal ventilation management curve (15–25 ppm rising trend from traffic congestion) by compressing the Y-axis scaling in the rendered chart image — causes the CO monitoring AI to classify the trend as “normal traffic congestion, increase jet fan speed by 10%” rather than “fire event, activate Emergency Ventilation System.” NFPA 502:2023 Table B.1 specifies CO concentration survival thresholds: 400 ppm produces loss of consciousness in less than 1 hour; 800 ppm produces convulsions and death within 2–3 hours; 6,400 ppm produces loss of consciousness within 20 minutes (the HGV fire scenario produces concentrations in the 500–3,000 ppm range in the downstream smoke zone within 5–10 minutes). A CO trend AI that misclassifies a 500 ppm spike as normal congestion and fails to activate emergency ventilation allows the high-CO smoke zone to propagate downstream at 2–6 m/s (tunnel natural ventilation airspeed) before the manual operator response is triggered.

3. Traffic incident and wrong-way driver detection AI (Citilog TrafficVision AI, Viasis AID AI, Q-Free Sensys AI)

Automatic Incident Detection (AID) systems in road tunnels process CCTV traffic camera frames to classify traffic states — normal flow, congestion, stopped vehicle, pedestrian in roadway, wrong-way driver, debris on carriageway, and vehicle fire precursor (vehicle stopping abnormally, smoke from vehicle exhaust) — using AI models that generate incident alerts to the tunnel control room operator. Citilog TrafficVision AI (deployed in SANEF French motorway tunnels, Spanish DGT motorway tunnels, and UK National Highways major road tunnels), Viasis AID AI, and Q-Free Sensys traffic video AI process CCTV traffic camera frames at 10–25 fps using optical flow algorithms and convolutional incident classifiers to generate AID alerts. A stalled HGV alert is the most critical AID event in a road tunnel — a stalled HGV with mechanical fire risk (engine compartment fire, brake system overheating) that is not detected by AID and evacuated within the tunnel’s emergency stop bay evacuation time (typically 5–10 minutes from first stop to fire) can initiate the fire event without any prior CCTV smoke alert, because the fire begins inside the HGV engine compartment (not visible to the tunnel camera) before external smoke is visible.

An adversarial perturbation on a rendered AID CCTV camera frame that misclassifies a stationary HGV — adding an optical flow vector overlay artefact to the stationary truck’s pixel region that mimics the optical flow signature of a slowly moving vehicle — causes the AID AI to classify the HGV as “slow-moving vehicle in congestion” rather than “stalled vehicle: incident alert.” In a high-traffic tunnel where HGV fires have historically initiated with a 10–15 minute period of mechanical breakdown before ignition (Mont Blanc 1999: the HGV stopped due to a mechanical failure approximately 6 minutes before fire was visible to other drivers), the AID AI’s failure to detect the stall means the emergency response team is not dispatched to the stall location before the fire event begins, removing the primary preventive response opportunity that could have averted the fire entirely through early vehicle extraction or fire suppression system activation in the vehicle stop bay.

4. Jet fan ventilation control status AI (Zitron Tunnel Fan AI, Novenco Tunnel AI, SIKA Digital Twin Ventilation AI)

Road tunnel Emergency Ventilation Systems (EVS) use arrays of longitudinal jet fans mounted in the tunnel ceiling at 100–200m intervals to create directed airflow that maintains smoke flow direction toward the designated downstream portal, away from evacuating road users and emergency responders entering from the upstream portal. EVS jet fan status is monitored through SCADA dashboards that render jet fan operational states (ON/OFF, speed setting, airflow direction, fault status) as schematic tunnel cross-section visualisations — colour-coded fan icons on a tunnel plan view, airflow vector arrows, and speed/power strip gauges. Zitron tunnel fan control AI, Novenco ventilation AI, and SIKA Digital Twin tunnel ventilation AI process rendered SCADA dashboard screenshot images or ventilation status overlay renders to verify that the EVS activation sequence has been correctly implemented (correct fan zones activated, correct airflow direction set per the incident location) and that all critical fans are operational (no fan faults in the activated zone). The EVS control verification AI is the automated check that the correct fans are running in the correct direction before the tunnel operator issues the “clear to commence fire-fighting access from upstream portal” signal to the fire brigade.

An adversarial perturbation on a rendered EVS SCADA dashboard image that falsely shows critical jet fans in the upstream zone as “ON” and “operational” — changing the greyed-out “OFF/FAULT” fan icons to active green “ON” icons by a ±15 DN colour shift in the icon pixel region — causes the ventilation AI to confirm “EVS activation complete, all critical upstream fans operational” when the upstream fan zone has a fault and is not producing the required smoke-clearing airflow. Fire brigade personnel entering the tunnel from the upstream portal relying on the EVS activation confirmation may be advancing into a tunnel section where smoke flow direction has not been established and where CO concentrations remain lethal — a fire-fighting access decision that the EVS activation verification AI directly controls. The 2005 Fréjus Tunnel fire (2 fatalities, tunnel closed for months) occurred in conditions where the EVS response was not optimally coordinated — NFPA 502:2023 Section 11.9.3 now requires EVS activation verification procedures for all new tunnel designs, but without specifying AI adversarial robustness requirements for the verification system.

Integration: road tunnel fire safety AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for road tunnel fire safety AI belongs at each rendered-image ingestion boundary — before CCTV smoke/flame detection AI processes camera frames, before CO/NO2 trend AI processes sensor chart renders, before AID AI processes traffic camera frames, and before EVS control AI processes SCADA dashboard renders. Threshold 35 for road tunnel fire safety AI reflects the fully enclosed environment with limited evacuation time: a missed fire detection in a road tunnel has an extremely compressed consequence timeline (minutes from detection failure to lethal smoke propagation), with no complementary detection barrier if the primary AI fails.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Road tunnel fire safety AI contexts: threshold 35
# NFPA 502:2023 (Road Tunnels, Bridges, and Other Limited Access Highways)
# EU Safety Directive 2004/54/EC; UK DfT Design Manual for Roads and Bridges TD 78/17.
TUNNEL_FIRE_AI_THRESHOLD = 35


class TunnelFireAIContext(Enum):
    CCTV_SMOKE_FLAME     = "cctv_smoke_flame"    # CCTV smoke/flame detection AI
    CO_NO2_TREND         = "co_no2_trend"        # CO/NO2 sensor trend chart AI
    TRAFFIC_INCIDENT     = "traffic_incident"    # AID stalled vehicle/wrong-way AI
    EVS_SCADA_DASHBOARD  = "evs_scada_dashboard" # Jet fan EVS activation status AI


class AdversarialTunnelFireImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a road tunnel
    fire safety AI rendered image above threshold 35.

    Consequence if not raised: fire smoke suppressed from CCTV frame → EVS
    not activated → smoke layer propagates to pedestrian evacuation route →
    mass casualty (Mont Blanc 1999: 39 fatalities, Gotthard 2001: 11 fatalities).
    Fail-safe: suspend AI fire-detection output; escalate to human tunnel
    operator for manual CCTV review per NFPA 502:2023 Section 11.7 monitoring
    procedures; do not confirm EVS activation without physical verification.
    """

    def __init__(self, scan_id: str, score: int,
                 context: TunnelFireAIContext,
                 tunnel_id: str, camera_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.tunnel_id = tunnel_id
        self.camera_id = camera_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial tunnel image: "
            f"context={context.value} score={score} "
            f"tunnel={tunnel_id} camera={camera_id} scan_id={scan_id}"
        )


async def scan_tunnel_image(
    image_bytes: bytes,
    context: TunnelFireAIContext,
    tunnel_id: str,
    camera_id: str,
    chainage_m: float | None,
    utc_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a road tunnel fire safety AI rendered image for adversarial content.

    Fail-safe contract: AdversarialTunnelFireImageError or httpx error →
    suspend AI fire-detection output; escalate to human tunnel operator for
    immediate manual CCTV review per NFPA 502:2023 Section 11.7. For EVS
    SCADA dashboard AI: do not confirm EVS activation without physical
    verification of fan operational status. For CO/NO2 trend AI: revert to
    direct sensor reading display for operator manual assessment.

    Args:
        image_bytes: CCTV smoke/flame camera frame, CO/NO2 trend chart render,
            AID traffic camera frame, or EVS SCADA dashboard image bytes.
        context: TunnelFireAIContext identifying the safety monitoring modality.
        tunnel_id: Tunnel identifier (e.g., "Mont_Blanc", "A2_Zurich_Gubrist").
        camera_id: Camera or sensor station identifier.
        chainage_m: Tunnel chainage in metres from portal at camera location.
        utc_timestamp: ISO 8601 UTC timestamp of the image capture.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialTunnelFireImageError: if score exceeds threshold 35.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"tunnel:{context.value}:{tunnel_id}:{camera_id}",
        "metadata": {
            "tunnel_id": tunnel_id,
            "camera_id": camera_id,
            "chainage_m": chainage_m,
            "utc_timestamp": utc_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=1.5,  # tightest timeout: fire detection is seconds-critical
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_tunnel_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        tunnel_id=tunnel_id,
        camera_id=camera_id,
        chainage_m=chainage_m,
        flagged=result["score"] > TUNNEL_FIRE_AI_THRESHOLD,
    )

    if result["score"] > TUNNEL_FIRE_AI_THRESHOLD:
        raise AdversarialTunnelFireImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            tunnel_id=tunnel_id,
            camera_id=camera_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_tunnel_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: TunnelFireAIContext, tunnel_id: str,
    camera_id: str, chainage_m: float | None, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": TUNNEL_FIRE_AI_THRESHOLD,
        "flagged": flagged,
        "tunnel_id": tunnel_id,
        "camera_id": camera_id,
        "chainage_m": chainage_m,
        "regulatory_refs": [
            "NFPA 502:2023 (Road Tunnels, Bridges, and Other Limited Access Highways)",
            "EU Directive 2004/54/EC (Safety in Road Tunnels in the Trans-European Road Network)",
            "PIARC Safety in Road Tunnels — A Technical Guide",
            "ITA-AITES WG05 Road Tunnel Safety Guidelines",
            "UK DfT TD 78/17 (Traffic Signals and Road Markings in Tunnels)",
            "Swiss SN 505 197 (Road Tunnel Safety Standards)",
            "Norwegian Directorate of Public Roads Handbook N500 (Road Tunnels)",
        ],
    }
    audit_path = Path("/var/log/glyphward/tunnel_fire_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_tunnel_image at each road tunnel fire safety AI rendered-image boundary: before CCTV smoke/flame AI (threshold 35), before CO/NO2 trend AI (threshold 35), before AID traffic incident AI (threshold 35), and before EVS SCADA dashboard AI (threshold 35). On AdversarialTunnelFireImageError: suspend AI fire-detection output immediately; escalate to the human tunnel operator for manual CCTV review per NFPA 502:2023 Section 11.7 monitoring procedures. For EVS dashboard AI: do not confirm EVS activation without physical fan operational status verification from the SCADA physical I/O layer. Log all flagged events in the tunnel’s safety management audit trail per EU Directive 2004/54/EC Article 13 (Incident reporting). Get early access

Related questions

Further reading

• Prompt injection in railway signalling AI — Red signal adversarial injection, CENELEC EN 50129 SIL 4 gap
• Prompt injection in smart city urban mobility AI — traffic management AI adversarial attacks
• Prompt injection in fire safety and emergency services AI — dispatch AI adversarial attacks
• Prompt injection in CCTV physical security AI — video analytics bypass, perimeter detection adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required