Prompt injection in smart manufacturing and ICS AI

Four adversarial injection surfaces in smart manufacturing and ICS AI

1. Inline vision inspection AI — semiconductor wafer, automotive, and pharmaceutical quality gates

Machine vision quality inspection AI represents the highest-volume imaging pipeline in industrial AI: TSMC’s 3nm and N5P process nodes run KLA Instruments CIRCL AI-based die-level defect inspection on 100% of production wafers, processing wafer surface scans at 300mm diameter with sub-nanometer resolution at throughput rates of 200–300 wafers per hour per inspection station. The inspection AI classifies defect types (particle contamination, bridging, opens, CMP dishing, EUV stochastic printing defects) from brightfield and darkfield optical scans rendered as 2D intensity maps — grayscale or false-color images in which pixel intensity encodes surface reflectance anomaly at each wafer location. The defect classification neural network operates on these rendered inspection images, classifying each die region into pass/fail/disposition categories. In automotive assembly, Cognex ViDi vision AI and Keyence AI-based inspection systems classify painted surface defects (orange peel, sink marks, runs, scratches) on body panels from structured-light camera frames in real time at the end-of-line quality gate, with false-negative miss rates targeted below 0.5 per 100,000 panels under the AIAG CQI-23 painted surface quality standard.

An adversarial pixel perturbation embedded in the inspection image — a structured noise pattern superimposed on the raw camera frame before AI classification — can cause the defect detection network to misclassify a defect-present die region as defect-free, bypassing the quality gate and passing a non-conforming component into the production flow. In semiconductor manufacturing, a single DRAM or logic die that passes an adversarially corrupted wafer inspection AI but carries a latent EUV stochastic defect propagates into field failure when the manufactured chip reaches the end customer — a field return event with downstream liability exposure under IPC-A-610 acceptance requirements and, in automotive-grade semiconductor supply (AEC-Q100 qualified product), under IATF 16949:2016 customer complaint resolution requirements. The adversarial injection surface for inline vision inspection AI is the rendered image input to the classification model — the same rendered inspection frame that a conventional adversarial example attack would target, now accessible in an industrial environment where networked inspection stations receive image streams from production equipment over OT network segments governed by IEC 62443-3-3 Security Level 2.

2. SCADA and DCS AI process anomaly monitoring dashboards

Supervisory Control and Data Acquisition (SCADA) and Distributed Control System (DCS) platforms — Siemens SIMATIC PCS 7, Honeywell Experion PKS, ABB System 800xA, Yokogawa Centum VP, Emerson DeltaV — have deployed AI-based process anomaly detection across continuous-process industries including petroleum refining (crude distillation unit AI, FCC AI, hydrocracker AI), chemical production (reactor temperature profile AI, distillation column flooding prediction AI), and pharmaceutical manufacturing (bioreactor dissolved oxygen AI, lyophilizer cycle AI). These AI components process rendered SCADA display screenshots — synthetic control room displays showing trend charts, PID controller output traces, process flow diagrams with live values overlaid, and alarm annunciator panels — as inputs to AI classification models that detect anomalous process patterns. The AI processes the rendered dashboard image rather than the underlying process data stream directly, because SCADA AI vendors have built anomaly detection products that analyze operator display renders as a deployment-agnostic approach that does not require integration into the SCADA historian or process data bus.

An adversarial perturbation in the rendered SCADA dashboard image — a structured pixel modification that shifts the apparent trend line of a critical process variable (reactor temperature, vessel pressure, flow rate) in the rendered chart display — can cause the AI anomaly detection model to misclassify a developing process upset as normal operation. In a petroleum refinery FCC (fluid catalytic cracker) unit, a reactor temperature excursion that is not detected by the AI anomaly model — because the rendered trend chart displaying the rising temperature profile has been adversarially perturbed to appear flat — can propagate to an afterburn event in the regenerator that causes equipment damage and, at the extreme of the distribution, a fire or explosion event. The IEC 62443-3-3 Security Level 2 requirements for SCADA networks address network segmentation, authentication, and access control; they do not address adversarial ML robustness for AI components that process rendered display images as their primary input modality.

3. Predictive maintenance AI — vibration and thermal spectrogram classification

Industrial predictive maintenance AI — deployed on rotating equipment (centrifugal compressors, gas turbines, large electric motors, cooling tower fans) and static equipment (heat exchangers, pressure vessels) — classifies machine health state from vibration spectrogram images and thermal infrared camera frames. Emerson’s AMS Machinery Manager AI, SKF Enlight AI, Honeywell Forge Condition Monitoring AI, and Siemens Sievert AI all process Fast Fourier Transform (FFT) vibration spectrogram renders — frequency-domain images in which horizontal axis represents vibration frequency (0–25,600 Hz typical range), vertical axis represents spectral amplitude, and characteristic fault frequency peaks (inner race defect frequency, outer race defect frequency, ball pass frequency, sub-synchronous instability patterns) appear as amplitude spikes at predictable locations based on rotating equipment geometry — through a convolutional neural network that classifies machine health into categories including normal, imbalance, misalignment, bearing defect, looseness, and cavitation. The AI model classifies the rendered spectrogram image rather than the raw vibration signal directly, because the rendered image is the input format most consistent with human expert interpretation and the format used to build the training corpus from historical maintenance records.

A targeted adversarial perturbation on the rendered FFT spectrogram image — suppressing the amplitude representation of a characteristic inner race defect frequency peak — can cause the predictive maintenance AI to misclassify a bearing in early failure as healthy, preventing the maintenance work order that would allow planned bearing replacement during the next scheduled outage window. Undetected bearing failure in a large industrial centrifugal compressor (a $2M–$20M capital asset in a petroleum refinery or chemical plant) progresses from early defect to catastrophic failure within 2–8 weeks of the first detectable vibration signature, with catastrophic failure involving shaft deflection, seal damage, and potentially casing breach — a process safety event under OSHA 1910.119 Process Safety Management (PSM) regulations and EPA Risk Management Program (RMP) requirements for processes involving highly hazardous chemicals above threshold quantities. The adversarial injection surface for predictive maintenance AI is the rendered spectrogram visualization — precisely the image format that a Glyphward pre-scan gate intercepts before AI classification.

4. Collaborative robot (cobot) safety vision AI — ISO/TS 15066 safety zone enforcement

Collaborative robot deployments — Universal Robots UR10e/UR16e, ABB YuMi, KUKA LBR iiwa, Fanuc CRX series, OMRON TM series — in automotive assembly, electronics manufacturing, and pharmaceutical packaging use depth camera and RGB-D vision AI to enforce ISO/TS 15066 power-and-force-limiting (PFL) and speed-and-separation-monitoring (SSM) collaborative operation modes. In SSM mode, the cobot safety controller continuously monitors the separation distance between the robot’s moving links and any detected human worker in the collaborative workspace, reducing robot velocity as a function of separation distance to maintain minimum protective separation (MPS) compliance. The safety vision AI — Intel RealSense D415/D435-based or SICK SafeVisionary2-based depth classification — processes depth camera frames (rendered as false-color depth maps or point cloud visualizations) through a safety-rated human detection and distance estimation AI model. The safety AI’s classification output directly controls the cobot safety controller’s velocity scaling and protective stop functions — it is a safety-rated function under IEC 62061 (Functional Safety of Machinery) and ISO 13849 (Safety of Machinery — Safety-Related Parts of Control Systems) with a target PL (Performance Level) of PLd or PLe (Safety Integrity Level 2 or 3).

An adversarial perturbation on the depth camera frame — a structured pixel noise pattern that reduces the apparent depth of a detected human operator to below the minimum protective separation threshold — can cause the cobot safety AI to classify the workspace as clear of human presence, disabling the SSM velocity reduction and running the cobot at full programmed speed in a workspace where a human worker is present. ISO/TS 15066 Annex A establishes biomechanical limits for human-robot contact forces; a cobot operating at full programmed speed in an undetected-worker scenario can generate contact forces significantly exceeding those limits. The adversarial injection surface for cobot safety vision AI is the depth camera frame or its rendered visualization — an image input to a safety-rated AI classification function that directly governs physical robot motion.

Integration: ICS AI image scanning with Glyphward pre-scan gate

The Glyphward scan gate for ICS and smart manufacturing AI belongs at the rendered image ingestion boundary before each AI classification step — before the wafer/panel inspection AI receives the rendered inspection frame, before the SCADA AI receives the dashboard screenshot, before the predictive maintenance AI receives the rendered spectrogram, and before the cobot safety AI receives the depth camera frame or rendered depth visualization. Threshold 40 across all ICS AI contexts reflects the high-consequence industrial safety environment, including potential for process safety incidents under OSHA 1910.119 PSM and EPA RMP. The implementation below uses JSONL audit logging with IEC 62443 and ISA-62443-3-3 Security Level references.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# All ICS / smart manufacturing AI contexts: threshold 40
# IEC 62443-3-3 SL-2 and IEC 62061 PLd requirements apply.
ICS_AI_THRESHOLD = 40


class ICSAIContext(Enum):
    WAFER_INSPECTION          = "wafer_inspection"          # Semiconductor wafer defect AI
    PANEL_INSPECTION          = "panel_inspection"          # Automotive painted-surface AI
    PHARMA_VISUAL_INSPECTION  = "pharma_visual_inspection"  # FDA 21 CFR 211.68 visual inspection
    SCADA_ANOMALY             = "scada_anomaly"             # SCADA/DCS process anomaly AI
    PREDICTIVE_MAINTENANCE    = "predictive_maintenance"    # Vibration/thermal spectrogram AI
    COBOT_SAFETY_VISION       = "cobot_safety_vision"       # ISO/TS 15066 SSM depth AI


class AdversarialICSImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an ICS
    AI image above threshold 40 (IEC 62443-3-3 SL-2 OT environment).

    Consequence if not raised: defect passed to production flow, process
    anomaly undetected, equipment failure masked, or cobot safety stop
    function disabled.
    """

    def __init__(self, scan_id: str, score: int, context: ICSAIContext,
                 asset_id: str, flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.asset_id = asset_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial ICS AI image: "
            f"context={context.value} score={score} asset={asset_id} scan_id={scan_id}"
        )


async def scan_ics_ai_image(
    image_bytes: bytes,
    context: ICSAIContext,
    asset_id: str,
    facility_id: str,
    frame_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an ICS / smart manufacturing AI image for adversarial pixel content.

    Args:
        image_bytes: Rendered inspection frame, SCADA screenshot, FFT
            spectrogram image, or depth camera frame bytes.
        context: ICSAIContext identifying the industrial AI pipeline.
        asset_id: Equipment or inspection asset identifier (e.g., wafer lot ID,
            compressor tag, cobot cell ID).
        facility_id: Plant or facility identifier.
        frame_timestamp: ISO 8601 image capture or render timestamp.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialICSImageError: if score exceeds threshold 40.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"ics_ai:{context.value}:{facility_id}:{asset_id}",
        "metadata": {
            "facility_id": facility_id,
            "asset_id": asset_id,
            "frame_timestamp": frame_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_ics_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        asset_id=asset_id,
        facility_id=facility_id,
        frame_timestamp=frame_timestamp,
        flagged=result["score"] > ICS_AI_THRESHOLD,
    )

    if result["score"] > ICS_AI_THRESHOLD:
        raise AdversarialICSImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            asset_id=asset_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_ics_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: ICSAIContext, asset_id: str, facility_id: str,
    frame_timestamp: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": ICS_AI_THRESHOLD,
        "flagged": flagged,
        "asset_id": asset_id,
        "facility_id": facility_id,
        "frame_timestamp": frame_timestamp,
        "regulatory_refs": [
            "IEC 62443-3-3 (Industrial Automation Security Requirements, SL-2)",
            "NIST SP 800-82 Rev.3 (ICS Security Guide)",
            "ISA-62443-3-3 (System Security Requirements)",
            "IEC 62061 (Functional Safety of Machinery, SIL 2/3)",
            "ISO 13849 (Safety-Related Control Systems, PLd/PLe)",
            "ISO/TS 15066 (Collaborative Robot Safety)",
            "OSHA 1910.119 (Process Safety Management)",
        ],
    }
    audit_path = Path("/var/log/glyphward/ics_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_ics_ai_image at each ICS AI image ingestion boundary: before inline vision inspection AI (threshold 40), before SCADA/DCS AI anomaly dashboard processing (threshold 40), before predictive maintenance spectrogram AI (threshold 40), and before cobot safety zone depth AI (threshold 40). On AdversarialICSImageError or any Glyphward API error: fail-closed — quarantine the image and revert to the appropriate safe state for the context (reject the inspected part to manual re-inspection queue; flag the SCADA anomaly dashboard frame for human operator review; suppress the equipment health update and generate a maintenance alert for human assessment; command the cobot controller to protective stop). Log all quarantine events with IEC 62443 and ISA-62443-3-3 references for OT cybersecurity incident reporting. Get early access

Related questions

Further reading

• Prompt injection in healthcare AI — medical imaging and clinical decision support adversarial attacks
• Prompt injection in air traffic control radar AI — FAA STARS, ACAS Xu, and ASDE-X adversarial attacks
• NIST AI RMF GenAI Profile and multimodal prompt injection risk management
• Multimodal AI security checklist for production deployments
• Prompt injection scanning API free tier — 10 scans/day, no card required