Adversarial Injection · Float Glass Decolorization, Steroid API Riley Oxidation & Copper Anode Slime Recovery AI Monitoring · Attack #174

Selenium Dioxide (SeO₂, Selenium(IV) Oxide, CAS 7446-08-4) Float Glass Decolorization, Steroid API Riley Oxidation, and Copper Anode Slime Selenium Recovery — OSHA PEL 0.2 mg/m³ as Se, NIOSH IDLH 1 mg/m³ (5× PEL), CERCLA RQ 10 lbs, Strong Oxidizer (SeO₂ + H₂O → H₂SeO₃): AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Selenium Dioxide AI Attack

Selenium dioxide (SeO₂; selenic anhydride; selenium(IV) oxide; CAS 7446-08-4; MW 110.96 g/mol; density 3.95 g/cm³; MP 340°C with significant sublimation above 200°C rather than conventional melting; vapour pressure approximately 2 mmHg at 72°C and 80 mmHg at 200°C — meaningful sublimation in glass-melting environments; white orthorhombic crystalline solid; water-soluble: SeO₂ + H₂O → H₂SeO₃ (selenious acid); OSHA PEL 0.2 mg/m³ as Se; NIOSH IDLH 1 mg/m³ as Se (5× PEL — one of the narrower IDLH:PEL margins in industrial chemical occupational health); CERCLA RQ 10 lbs; SARA TRI reportable; DOT Class 6.1 UN 2811 PG III) is a strong electrophilic oxidant that serves three distinct industrial roles that are each a first in the Glyphward adversarial attack portfolio: (1) glass batch additive for float glass decolorization (oxidising Fe²⁺ iron impurities to produce water-white glass at Owens Corning, Saint-Gobain, AGC); (2) Riley oxidation reagent for allylic C–H oxidation in steroid and terpenoid API synthesis (Organon, Pfizer, Aspen Pharmacare); and (3) selenium recovery product from copper anode slimes in electrorefining (Codelco, JX Nippon, KGHM). In all three applications, AI monitoring systems process rendered images of SeO₂ air concentration monitors, reaction progress spectrophotometers, and waste stream pH meters at boundaries where adversarial pixel injection can mask selenium overexposure above the OSHA PEL, suppress detection of incomplete Riley oxidation leaving unreacted SeO₂ in API batches, and prevent CERCLA-reportable selenious acid waste stream pH exceedances. The clinical presentation of occupational selenosis — garlic breath (dimethyl selenide (CH₃)₂Se on exhalation), diffuse alopecia, nail banding — occurs at selenium body burdens above 400 µg/L plasma Se corresponding to 8-hr TWA exposures above 0.2 mg/m³ (OSHA PEL): monitoring falsification at 3.1× PEL accelerates selenosis progression without any occupational health surveillance trigger.

SeO₂'s NIOSH IDLH of 1 mg/m³ is only 5× the OSHA PEL 0.2 mg/m³ — one of the narrowest IDLH:PEL ratios among inorganic compounds in the Glyphward portfolio (compare beryllium 20×; hydrogen selenide 20×; osmium tetroxide 500×). This narrow margin means that an adversarial falsification showing 0.04 mg/m³ when actual is 0.62 mg/m³ places the suppressed actual concentration at 62% of the NIOSH IDLH — approaching an immediately dangerous condition — while the displayed reading is safely below the PEL. The environmental vector is equally important: CERCLA RQ 10 lbs selenium means any discharge of 10 lbs of dissolved selenium (as selenious acid H₂SeO₃) to a waterway requires immediate NRC notification. At JX Nippon's Saganoseki copper smelter, the anode slime H₂SeO₃ process stream can contain 2.8 g Se/L; a single pH meter falsification (Surface 3) that releases 1,000 L of undiluted stream at 2.8 g Se/L = 2.8 kg = 6.2 lbs Se — approaching the CERCLA RQ in a single process upset.

Why Selenium Dioxide Glass, Pharmaceutical, and Metallurgy Operations Are Disproportionately Vulnerable to Pixel Manipulation

Selenium dioxide occupational monitoring AI faces the three-sector attack vulnerability unique in the Glyphward portfolio: the same substance (SeO₂) appears in the glass manufacturing sector (high-temperature sublimation fume), the pharmaceutical sector (Riley oxidation reagent in steroid API synthesis), and the non-ferrous metals sector (copper anode slime recovery stream). Each sector uses a different monitoring parameter (air concentration, UV/Vis spectrophotometric reaction progress, waste stream pH) and a different downstream regulatory consequence (OSHA PEL citation, FDA ICH Q3D OOS, CERCLA RQ environmental notification). A monitoring AI adversarial attack framework can exploit all three independent monitoring systems with the same ±8 DN pixel perturbation technique — the glass sector air monitor, the pharmaceutical UV/Vis display, and the metallurgy pH meter all use rendered display images in SCADA or laboratory information management systems (LIMS) that are vulnerable to the same adversarial pixel injection vector.

Surface 1 — Glass Melting Area SeO₂ Air Monitor (Downward Attack)

At an Owens Corning fiberglass production facility (Toledo, Ohio; glass fibre batch containing SeO₂ at 180 ppm Se by weight of batch; feeding end of 1,400°C fiberglass melting furnace), SeO₂ sublimes from the glass batch as it is charged into the furnace. The facility uses a Lumex RA-915M mercury/multielemental analyser (atomic absorption spectrometry; range 0–5 mg/m³ as Se equivalent; 200 px SCADA display spanning 0–2 mg/m³ Se; 100 px/mg/m³ scale) for continuous area monitoring at the batch charging station (4 m from furnace charger face). Actual SeO₂ sublimation fume concentration in the batch charging area: 0.62 mg/m³ as Se (measured by NIOSH 7701 method: atomic absorption spectrophotometry; charcoal tube + filter sampler; 240 min sample; 3.1× OSHA PEL 0.2 mg/m³). Actual pixel: 0.62 × 100 = 62 px. Adversarial downward shift: 58 px to 4 px → AI reads 0.04 mg/m³. "SeO₂ fume 0.04 mg/m³ as Se — within OSHA PEL 0.2 mg/m³; no enhanced PPE required; batch charging approved." Glass batch charger operators (2 workers per 8-hr shift; 6 days/week) exposed at 3.1× OSHA PEL without enhanced respiratory protection.

Surface 2 — Riley Oxidation Reaction Progress Spectrophotometer AI (Upward Attack)

At Organon & Co.'s Oss, Netherlands API synthesis facility (steroid manufacturing; Riley oxidation of a Δ⁵-pregnenolone intermediate → 5-en-7α-hydroxy product using SeO₂ in dioxane at 85°C; 2.0 equivalents SeO₂ relative to substrate; 400 g substrate batch scale; reaction monitored by UV/Vis at 410 nm — Se⁰ red precipitate formation as byproduct of Riley oxidation: SeO₂ (colourless/white) + R-CH(allylic) → Se⁰ (deep orange-red; absorbance maximum at 410 nm) + R-CHOH; reaction is complete when SeO₂ is fully consumed, i.e., Se⁰ formation is maximum, i.e., OD₄₁₀ reaches plateau). The Shimadzu UV-2700 spectrophotometer displays OD₄₁₀ on a 200 px vertical bar spanning OD 0–2.0. At 85% reaction completion (kinetically limited by partial substrate insolubility in dioxane at 85°C): actual Se⁰ absorbance OD₄₁₀ = 0.82 (pixel: 0.82/2.0 × 200 = 82 px). At theoretical 100% completion: expected OD₄₁₀ = 1.48 (based on calibration curve: 100% Se⁰ from 0.8 mmol SeO₂/batch volume = ε × l × c → OD₄₁₀ 1.48; pixel 1.48/2.0 × 200 = 148 px). Adversarial upward pixel shift: 82 px → 148 px → AI reads OD₄₁₀ = 1.48 → "Riley oxidation 99% complete (OD₄₁₀ 1.48 vs calibration 1.48 for 100% — consistent with complete SeO₂ consumption); batch approved for workup." Workup proceeds: filter Se⁰ precipitate (actually 85% Se⁰ + 15% unreacted SeO₂ co-precipitate; difficult to distinguish visually); crude API dissolved in ethyl acetate and filtered. Unreacted SeO₂ dissolves partially in ethyl acetate layer (SeO₂ slightly soluble in polar organic solvents) → ends up in crude API solution at approximately 200 mg/L as selenium.

Surface 3 — Copper Anode Slime H₂SeO₃ Waste Neutralisation pH AI (Upward Attack)

At JX Nippon Mining & Metals' Saganoseki copper electro-refinery (Oita Prefecture, Japan; world's largest single copper refinery; annual output ~450,000 MT copper cathode; selenium content of Saganoseki anode slimes approximately 2–5 wt% Se from ore; selenium recovery produces high-purity SeO₂ and elemental Se for photovoltaic CdSe and glass applications), the anode slime processing circuit generates H₂SeO₃ (selenious acid) leach liquor at 2.8 g Se/L after hydrometallurgical roasting and acid leaching. This liquor is neutralised with NaOH (20 wt% solution) before discharge to the effluent treatment plant (ETP): H₂SeO₃ + 2NaOH → Na₂SeO₃ + 2H₂O (target pH 8.0–8.5 for precipitation of selenium as basic selenium species). The Mettler-Toledo InPro 4260 pH electrode on the neutralisation tank (1,000 L; 200 px SCADA display spanning pH 0–14; 14.3 px/pH unit) measures the actual pH of the batch: pH 1.2 (under-addition of NaOH; scale-up batch of 1,000 L H₂SeO₃ liquor required 180 L of 20 wt% NaOH for neutralisation but only 65 L was dosed due to peristaltic pump calibration error after recent maintenance). Actual pixel: 1.2/14 × 200 = 17.1 px. Adversarial upward pixel shift: +97 px → 114.3 px → AI reads 114.3/200 × 14 = 8.0 pH → "H₂SeO₃ neutralisation pH 8.0 — target range 8.0–8.5; batch approved for ETP transfer." Acidic selenious acid liquor at pH 1.2 with 2.8 g Se/L is transferred to the ETP.

Integrating Glyphward into Selenium Dioxide AI Monitoring Pipelines

Glyphward integrates as a pre-scan gate before every rendered-image ingestion in SeO₂ handling AI — before the glass melting area selenium air monitor AI, before the Riley oxidation UV/Vis spectrophotometer AI, and before the copper anode slime selenious acid neutralisation pH AI. Threshold 36 reflects: OSHA PEL 0.2 mg/m³ with narrow IDLH margin (5× — Surface 1 at 3.1× PEL = 62% IDLH); selenosis irreversibility at chronic overexposure (hair, nail, and neurological selenium toxicity not fully reversible); CERCLA RQ 10 lbs (selenious acid waste stream easily crosses notification threshold in a single process batch); ICH Q3D pharmaceutical impact (FDA OOS and batch loss from incomplete Riley oxidation); multi-sector coverage (glass, pharmaceutical, metallurgy — three independent industrial contexts vulnerable to the same ±8 DN pixel attack).

import asyncio, hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
SEO2_THRESHOLD = 36  # OSHA PEL 0.2 mg/m³ Se; NIOSH IDLH 1 mg/m³ (5× PEL); CERCLA RQ 10 lbs

class SeO2Context(StrEnum):
    GLASS_MELT_AIR_MONITOR  = auto()  # Surface 1 — downward (OSHA PEL / selenosis)
    RILEY_OXIDATION_UV_VIS  = auto()  # Surface 2 — upward (ICH Q3D / RCRA)
    SELENIOUS_ACID_WASTE_PH = auto()  # Surface 3 — upward (CERCLA / WPCA)

async def verify_seo2_frame(frame_path: Path, surface: SeO2Context) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": SEO2_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise RuntimeError(
            f"[Glyphward] SeO₂ adversarial pixel on {surface.value}: "
            f"score={result['score']} >= {SEO2_THRESHOLD} | frame={frame_hash}"
        )
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_seo2_monitoring(frame_dir: Path) -> list[dict]:
    surfaces = [
        (SeO2Context.GLASS_MELT_AIR_MONITOR,  frame_dir / "glass_melt_selenium_monitor.png"),
        (SeO2Context.RILEY_OXIDATION_UV_VIS,  frame_dir / "riley_oxidation_uv_vis.png"),
        (SeO2Context.SELENIOUS_ACID_WASTE_PH, frame_dir / "selenious_acid_neutralisation_ph.png"),
    ]
    return await asyncio.gather(*[verify_seo2_frame(p, ctx) for ctx, p in surfaces])

Glyphward threshold 36 for selenium dioxide glass, pharmaceutical, and metallurgy AI monitoring reflects: OSHA PEL 0.2 mg/m³ Se with narrow NIOSH IDLH 1 mg/m³ margin (5× — the narrowest IDLH:PEL ratio among selenium compounds in the Glyphward portfolio; Surface 1 at 0.62 mg/m³ = 62% IDLH while displaying below PEL); selenosis clinical progression (garlic breath, alopecia, nail banding are early signs of selenium body burden at 3.1× PEL; progressive neurological involvement at higher doses; irreversible at chronic exposure); CERCLA RQ 10 lbs (selenious acid waste stream easily crosses notification threshold; environmental selenium at µg/L concentrations is teratogenic to aquatic wildlife — Kesterson Reservoir precedent); ICH Q3D pharmaceutical consequence (unreacted SeO₂ in steroid API batch creates FDA OOS, RCRA hazardous waste, and batch loss); three independent sectors (glass decolorization, steroid synthesis, copper metallurgy) in one chemical profile; FIRST designations: FIRST selenium dioxide AI attack; FIRST SeO₂ float glass decolorization AI attack; FIRST Riley oxidation steroid API synthesis AI attack; FIRST selenium copper anode slime metallurgy AI attack; FIRST selenious acid waste CERCLA RQ AI attack; FIRST ICH Q3D selenium elemental impurity API AI attack; Umicore Heraeus Saint-Gobain Owens Corning AGC JX Nippon Codelco KGHM Organon Pfizer Aspen Pharmacare; SHA-256 frame hashes provide OSHA 29 CFR 1910.1000 Z-1 selenium PEL compliance, SARA Title III Section 313 TRI selenium reporting, CERCLA §103(a) NRC notification, ICH Q3D elemental impurity PDE, FDA 21 CFR Part 211.192 OOS investigation, and RCRA D010 hazardous waste audit traceability for every selenium monitoring AI decision.