Prompt injection in sodium azide NaN₃ airbag propellant hydrazoic acid HN₃ production AI

Three adversarial injection surfaces in sodium azide NaN₃ airbag propellant production AI

1. Autoclave headspace HN₃ gas concentration display AI (Draeger Polytron 7000 / Industrial Scientific Radius BZ1 / MSA Ultima X series electrochemical HN₃ sensor display AI — rendered DCS HN₃ concentration trend AI classifying autoclave zone HN₃ against the NIOSH IDLH 50 ppm work-entry limit — 104th upward attack; FIRST sodium azide NaN₃ production AI attack; FIRST airbag propellant manufacturing AI attack; FIRST HN₃ hydrazoic acid gas AI attack; FIRST primary explosive manufacturing AI attack; FIRST N₂O oxidizer azide synthesis AI attack)

The Witt-Scott NaN₃ synthesis autoclave (stirred; 0.5–5 m³ working volume; NaNH₂ charged as slurry in mineral oil carrier; N₂O sparged at controlled rate through submerged dip tube; operating temperature 170–185°C; autogenous pressure 4–5 bar; batch cycle 4–8 hours; followed by autoclave cooling, depressurisation, and NaN₃ product discharge through a discharge valve to a crystallisation/drying train) presents an HN₃ gas hazard at every phase of operation: during reaction, HN₃ is present in the autoclave vapour phase in equilibrium with the NaN₃ product slurry and the alkaline reaction liquor (NaOH produced as co-product alkalises the liquor, which suppresses HN₃ evolution; however, CO₂ from atmospheric ingress during sampling or charging drives HN₃ from the slurry surface); during discharge and drying, freshly crystallised NaN₃ product (warm; partially moist) contacts atmospheric CO₂ and generates HN₃ at the discharge hopper and dryer inlet. Electrochemical HN₃ sensors (Draeger Polytron 7000; MSA Ultima X series; Industrial Scientific Radius BZ1 multi-gas monitor; range 0–100 ppm; response time T90 <60 s; electrochemical cell; NIOSH IDLH 50 ppm) are mounted at autoclave headspace vents, discharge valve areas, and at the dryer inlet hood to provide continuous AI-monitored HN₃ surveillance. The AI classification system reads rendered displays from these sensors and determines whether: (a) HN₃ <10 ppm — normal operations, all entry zones accessible; (b) 10–30 ppm — elevated; restrict unessential personnel, verify ventilation; (c) 30–50 ppm — near-IDLH; evacuate non-essential personnel, SCBA required for maintenance entry; (d) >50 ppm — IDLH exceeded; no entry without full SCBA; emergency ventilation; production shutdown. The display range: 0–100 ppm HN₃, 200 px, 2.0 px/ppm.

An adversarial ±8 DN upward pixel perturbation targeting the autoclave headspace HN₃ sensor display shifts the apparent HN₃ concentration from the dangerous actual value to a safe displayed value: actual HN₃ 74 ppm (1.5× IDLH 50 ppm; immediate danger to life and health — at 74 ppm HN₃, a worker entering the autoclave maintenance access zone without SCBA will experience rapid onset of headache, hypotension, bradycardia within 1–3 minutes; cardiovascular collapse and potential fatality within 5–15 minutes) corresponds to 74 × 2.0 = 148 px on the 0–100 ppm, 200 px, 2.0 px/ppm display. The ±8 DN upward attack shifts the pixel region from 148 px to 24 px; the AI reads 24 px ÷ 2.0 px/ppm = 12 ppm HN₃ — below the 30 ppm elevated-zone threshold, within the unrestricted entry range. Maintenance personnel enter the autoclave discharge hopper zone to clear a product cake blockage on the discharge valve actuator stem (a routine maintenance task under normal low-HN₃ conditions; required tools: torque wrench, screw-driver set; typical duration 15–25 minutes; no SCBA required at displayed 12 ppm HN₃); actual HN₃ during entry is 74 ppm — 1.5× IDLH. The consequences cascade identically to a Class A explosive facility gas toxic exposure event: the worker may not detect HN₃ odor (HN₃ odour threshold approximately 0.1–1.0 ppm; at 74 ppm the perceived odour is intense but the onset of hypotension may prevent evacuation). NIOSH HETA 88-274-2093 (1991; Thiokol Corporation/Morton International airbag inflator facility) documented exactly this exposure pattern — HN₃ from NaN₃ product dust dissolution in sweat on skin, from dust in maintenance areas — confirming that maintenance-zone entry with undetected HN₃ is the dominant occupational fatality pathway at NaN₃ production facilities. This is the 104th upward-direction attack in the Glyphward adversarial industrial AI portfolio. Free tier — 10 scans/day, no card required.

2. NaN₃ product moisture content display AI (Metrohm 899 Coulometer / Mettler Toledo C30 Karl Fischer titrator / Endress+Hauser Liquiline CM82 Karl Fischer display AI — rendered at-line or in-line moisture analyzer display AI classifying NaN₃ product moisture against airbag propellant specification <0.05 wt% H₂O)

NaN₃ airbag propellant specification requires moisture content below 0.05 wt% H₂O (Karl Fischer titration per ASTM E203 or ISO 760; the specification is driven by the HN₃ generation kinetics: NaN₃ + H₂O + CO₂ → HN₃ + NaHCO₃; at atmospheric CO₂ concentration of 400 ppm, the equilibrium strongly favours HN₃ generation from any moist NaN₃ surface, making moisture control the single most important quality parameter for safe NaN₃ storage and shipment). At-line Karl Fischer coulometric titrators (Metrohm 899 Coulometer; Mettler Toledo C30 Karl Fischer titrator; detection range 0.001–100 wt% H₂O; accuracy ±0.01 wt% H₂O at the low end; closed-system sampling under nitrogen to prevent ambient moisture ingress) or in-line near-infrared (NIR) moisture analysers (Endress+Hauser Liquiline CM82 with Spectralight OP optical probe; calibrated for NaN₃ matrix) provide continuous or batch-basis moisture monitoring on the NaN₃ product after the spray dryer and before packaging into 25-kg moisture-proof bags or 200-kg fiber drums. The display range for the moisture analyser: 0–5.0 wt% H₂O, 200 px, 40 px/wt%.

An adversarial downward pixel perturbation targeting the NaN₃ product moisture display shifts the apparent moisture from the dangerous actual value to an in-specification displayed value: actual moisture 2.4 wt% H₂O (dryer malfunction — spray dryer outlet temperature dropped from design 130°C to 82°C over a 90-minute period due to a heating element failure; NaN₃ product exiting the dryer is incompletely dried; 2.4 wt% H₂O) corresponds to 2.4 × 40 = 96 px on the 0–5.0 wt%, 200 px, 40 px/wt% display; the in-spec displayed value of 0.06 wt% corresponds to 0.06 × 40 = 2.4 px ≈ 2 px. The adversarial downward attack shifts the pixel region from 96 px to 2 px; the AI reads 2 px ÷ 40 px/wt% = 0.05 wt% — just at the specification limit; the product is released for packaging and warehouse storage. In a sealed 25-kg NaN₃ product drum with 2.4 wt% moisture (= 600 g H₂O per drum), contact with atmospheric CO₂ that enters when the drum is placed in a warehouse (even through the drum liner seal at CO₂ partial pressure 400 ppm): NaN₃ (65 g/mol) + H₂O + CO₂ → HN₃ (43 g/mol) + NaHCO₃. Molar calculation: 600 g H₂O = 33.3 mol H₂O; at equilibrium with CO₂, approximately 18 mmol HN₃ is generated per mole H₂O in NaN₃ matrix (conservative; depends on CO₂ partial pressure and temperature); 33.3 mol H₂O × 18 mmol/mol = 600 mmol HN₃ total in the drum. In a 10-litre headspace at 20°C, 600 mmol HN₃ = 600 × 43 g/mol = 25.8 g HN₃ in 10 L → 25,800 mg / 10 L = 2,580 mg/L = 2,580,000 ppm — far beyond what the drum headspace holds at saturation (HN₃ BP 37°C; vapour pressure at 20°C ~500 mmHg = 658,000 ppm at saturation in air); equilibrium vapour in the drum headspace at 20°C and 600 mmol HN₃ present will be saturated at ~600,000 ppm (60 vol%). In practice, opening such a drum in a warehouse: the HN₃ burst from the drum headspace immediately creates a localised atmosphere far above IDLH 50 ppm at the worker's breathing zone. In a warehouse containing 1,000 such drums, if multiple drums outgas simultaneously into a poorly ventilated space (HN₃ BP 37°C; vapour denser than air; accumulates at floor level), the cumulative HN₃ release can reach LEL ~15 vol% in a localised zone — creating a combined toxic-and-explosive vapor hazard unique to HN₃ as a dual-hazard chemical. Free tier — 10 scans/day, no card required.

3. N₂O feed gas purity display AI (ABB Advance Optima / Emerson X-STREAM / Siemens MAXUM gas chromatograph display AI — rendered GC display AI classifying N₂O feed gas purity against the synthesis autoclave specification >99.0 mol% N₂O)

The Witt-Scott process N₂O feed gas (nitrous oxide; CAS 10024-97-2; MW 44.01 g/mol; BP −88.5°C; a compressed, liquefied gas supplied from cryogenic tanks at the NaN₃ facility; bulk N₂O purity specification for pharmaceutical/industrial grade: 99.5 mol%; for NaN₃ synthesis: typically >99.0 mol% N₂O; key impurity of concern: O₂, which is present as a residual from the N₂O manufacturing process — N₂O is produced by thermal decomposition of ammonium nitrate NH₄NO₃ → N₂O + 2H₂O at 230–250°C; O₂ contamination arises from over-decomposition or insufficient purification) is analysed continuously at the autoclave feed line by an online gas chromatograph (ABB Advance Optima process GC; Emerson X-STREAM enhanced GC analyser; Siemens MAXUM II process GC; TCD or paramagnetism-based O₂ detection; analysis cycle 2–5 minutes; displayed output: mol% N₂O purity on a 95.0–100.0 mol% scale). The display range: 95.0–100.0 mol% N₂O (a 5.0 mol% span), 200 px, 40.0 px/mol% (where 0 px corresponds to 95.0 mol% and 200 px corresponds to 100.0 mol%).

An adversarial downward pixel perturbation targeting the N₂O feed purity display shifts the apparent N₂O purity from the dangerous actual value to a nominally safe displayed value: actual N₂O purity 96.1 mol% (3.9 mol% O₂ contamination; N₂O supply cylinder batch delivered from a new supplier with insufficient O₂ removal in purification; O₂ impurity detected by the process GC at 96.1 mol% N₂O) corresponds to (96.1 − 95.0) × 40 = 44 px on the 95.0–100.0 mol%, 200 px, 40 px/mol% display. The safe nominal displayed value of 99.7 mol% N₂O corresponds to (99.7 − 95.0) × 40 = 188 px. The adversarial downward attack shifts the pixel region from 44 px to 188 px; the AI reads (188 px ÷ 40 px/mol%) + 95.0 = 99.7 mol% N₂O — nominal purity; N₂O supply accepted; autoclave charging proceeds at 170°C, 4 bar with 3.9 mol% O₂ contamination in the N₂O feed. At 170°C and 4 bar in the NaN₃ synthesis autoclave, with 3.9 mol% O₂ (an oxidising gas) entering the autoclave together with N₂O: the NaN₃ intermediate (freshly synthesised; fine particle size; suspended in the NaNH₂/NaOH slurry) is a powerful reducing agent — azide (N₃⁻) is readily oxidised by O₂ at elevated temperatures. The azide oxidation in the presence of O₂ at 170°C, 4 bar: 2NaN₃ + 3O₂ → Na₂O₃ + 3N₂ (primary oxidation pathway) — but Na₂O₃ (sodium superoxide, an unstable peroxide) further decomposes: 2Na₂O₃ → 2Na₂O + 2O₂ (at >150°C; releasing additional O₂ that accelerates further azide oxidation in an autocatalytic cycle). This autocatalytic O₂-driven NaN₃ decomposition at 170°C generates heat at a rate of approximately 3.6 MJ/kg NaN₃ (compared to normal controlled Witt-Scott reaction heat 0.4 MJ/kg per batch) — a 9-fold heat release increase that can drive autoclave temperature rapidly from 170°C toward 275°C (thermal decomposition onset: 2NaN₃ → 3N₂ + 2Na; violent above 300°C), creating the conditions for autoclave rupture and sympathetic detonation of adjacent NaN₃ product inventory in the manufacturing building. Free tier — 10 scans/day, no card required.

Integration: sodium azide NaN₃ airbag propellant production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the NaN₃ airbag propellant production AI monitoring pipeline — before the autoclave HN₃ gas AI processes rendered Draeger Polytron 7000 / MSA Ultima X / Industrial Scientific Radius BZ1 electrochemical sensor display images, before the product moisture AI processes rendered Metrohm 899 Coulometer / Mettler Toledo C30 Karl Fischer titrator / Endress+Hauser Liquiline CM82 analyser display images, and before the N₂O feed purity AI processes rendered ABB Advance Optima / Emerson X-STREAM / Siemens MAXUM process GC display images. Threshold 52 for NaN₃ airbag propellant production AI reflects: OSHA 29 CFR 1910.109 Class A initiating explosive (primary explosive capable of sympathetic detonation from friction, heat, or impact); HN₃ dual toxic-and-explosive vapour hazard (IDLH 50 ppm toxic; LEL ~15 vol% explosive); EPA CERCLA NaN₃ RQ 1,000 lbs (extremely sensitive trigger for federal notification); ATF 27 CFR Part 555 explosive manufacturer licensing; and the Takata-analogous automotive supply-chain consequence of production quality defects in airbag propellant reaching consumers as deployed airbag inflators.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Sodium azide NaN3 airbag propellant production AI contexts: threshold 52
# OSHA 29 CFR 1910.109 Class A initiating (primary) explosive.
# EPA CERCLA NaN3 RQ 1,000 lbs (extremely sensitive CERCLA trigger).
# ATF 27 CFR Part 555 explosive manufacturer license required.
# HN3 hydrazoic acid: NIOSH IDLH 50 ppm; LEL ~15 vol% (dual toxic + explosive).
# 104th upward attack. FIRST NaN3 production AI attack. FIRST airbag propellant AI attack.
NAN3_GLYPHWARD_THRESHOLD = 52

class NaN3ProductionContext(StrEnum):
    AUTOCLAVE_HN3_GAS_CONC      = auto()  # autoclave headspace HN3 (104th upward; FIRST NaN3; FIRST airbag; FIRST HN3; FIRST primary explosive)
    PRODUCT_MOISTURE_CONTENT    = auto()  # Karl Fischer NaN3 moisture -> HN3 in drum headspace -> warehouse explosion risk
    N2O_FEED_PURITY             = auto()  # N2O purity GC -> O2 contamination -> NaN3 deflagration in autoclave at 170C

async def scan_nan3_frame(
    frame_b64: str,
    context: NaN3ProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_nan3(
    frame_b64: str,
    context: NaN3ProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    """Block adversarially manipulated NaN3 production display images before AI inference.

    Plants: AUTOLIV_OGDEN | AUTOLIV_BRIGHAM_CITY | TRW_MESA | NIPPON_KAYAKU | CENTRAL_GLASS_TOSU
    Raises AdversarialNaN3ImageError if adversarial_score >= NAN3_GLYPHWARD_THRESHOLD (52).
    """
    result = await scan_nan3_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= NAN3_GLYPHWARD_THRESHOLD:
        raise AdversarialNaN3ImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from NaN3 airbag propellant production AI pipeline."
        )

class AdversarialNaN3ImageError(RuntimeError):
    pass