Prompt injection in space situational awareness AI

Four adversarial injection surfaces in space situational awareness AI

1. Ground telescope streak detection AI (ExoAnalytic, Slingshot, amateur SSA networks)

Optical ground telescopes detect resident space objects (RSOs) as streaks in long-exposure astronomical images — the trailing luminous path that a fast-moving satellite or debris object creates as the telescope tracks the star background during a 0.1–5 second exposure. The streak detection AI classifies each rendered astronomical image for: streak presence/absence (binary “debris detected” / “no detection”); streak brightness (magnitude estimate from pixel intensity, mapping to approximate object cross-sectional area at the observed range); streak trajectory (rate and direction of angular motion, used to compute a preliminary orbit propagation for the new object); and streak multiplicity (whether a single image contains multiple co-located streaks indicating a debris cluster from a recent fragmentation event). ExoAnalytic Solutions’ EXOS (ExoAnalytic Operational System) uses a convolutional streak detection network trained on a corpus of labeled telescope images from ExoAnalytic’s 200+ telescope network — capturing RSOs from GEO (Geostationary Earth Orbit, 35,786km) down to LEO altitudes. Slingshot Aerospace’s Seradata platform, the University of Michigan Space Object Behavioral Analysis Tool (SOBAT), and IronSky’s optical monitoring network process telescope images through architecturally equivalent streak detection AI. Amateur SSA networks — including the ISON (International Scientific Optical Network) of 40+ observatories across Russia, Europe, and Central Asia — increasingly feed streak detection AI output into the 18 SCS catalog correlation pipeline that assigns new objects to existing catalog entries or creates new Elset (element set) entries. An adversarial perturbation on a rendered telescope astronomical image that suppresses the streak pixel signature of a new debris fragment — smoothing the linear pixel trail of a freshly ejected Kosmos 1408 fragment against the star background — prevents the streak detection AI from flagging the new object for catalog entry, leaving the fragment untracked and unincorporated in subsequent conjunction assessment products.

The consequence of an untracked fragment depends on its orbital lifetime and trajectory. A 5cm debris fragment at 600km altitude has an orbital lifetime of approximately 5 years before atmospheric drag decay; a 5cm fragment at 1,200km (Starlink and OneWeb shell altitude) has an orbital lifetime of 50–200 years. An untracked 5cm fragment that would collide with a Starlink satellite — at 7.5 km/s relative orbital velocity and 260 kg spacecraft mass, a 5cm debris impact releases energy equivalent to 23kg of TNT — generates a fragment cloud of 1,000–5,000 new trackable fragments at the Starlink orbital shell altitude, creating a Kessler cascade risk for the entire 7,000+ satellite constellation shell if the collision probability across the shell exceeds the self-amplifying threshold (Kessler & Cour-Palais 1978; updated Kessler & Johnson 2010 simulation: cascade onset threshold at 1,200km shell is approximately 50,000+ fragments >10cm).

2. Phased-array radar range-Doppler map AI (LeoLabs, Space Fence, HUSIR)

Phased-array radar SSA systems — the US Space Force Space Fence at Kwajalein (S-band, 450m aperture, detection threshold ~5cm at 1,000km), LeoLabs’ phased-array network (S-band, C-band, capable of tracking objects <5cm in LEO), and the Haystack Ultra-wideband Satellite Imaging Radar (HUSIR, wideband Ku/Ka-band, capable of 1cm resolution imaging of RSOs) — generate range-Doppler map images as the primary output of each beam-illumination event. The range-Doppler map is a 2D rendered image where one axis represents target range (distance from the radar) and the other represents Doppler velocity (relative radial velocity from target motion), with pixel intensity encoding radar cross-section (RCS) at each range-Doppler bin. AI classification of range-Doppler maps determines: whether a candidate RSO detection is a real object or a false-alarm (sidelobe artifact, ionospheric clutter, radio frequency interference); the object’s size category (S-band RCS → estimated cross-sectional area → size class); and the object type (tumbling debris generates a distinctive flickering amplitude modulation pattern in the Doppler signature that AI classifies as “uncontrolled fragment” versus “stabilized operational satellite”). LeoLabs processes 10,000+ range-Doppler maps per hour from its global radar network through the LeoLabs Radar AI classification engine, updating its commercial LEO debris catalog that 100+ satellite operators subscribe to for conjunction screening.

An adversarial perturbation on a rendered range-Doppler map image that suppresses the RCS signature of a small debris object — reducing the peak pixel intensity in the range-Doppler bin corresponding to the debris’ trajectory — causes the radar AI to classify the bin as background noise rather than a real detection, preventing catalog entry for the object. The Space Fence system processes range-Doppler maps through the Lockheed Martin Space Fence AI classification pipeline; LeoLabs processes through its proprietary ML pipeline; both pipelines present the same rendered-image adversarial injection surface at the range-Doppler map classification step before catalog correlation. Unlike telescope streak images — which are collected from multiple independent observatories and correlated — radar range-Doppler maps from a single high-sensitivity radar like Space Fence may represent the only sensor observation of a newly created small-debris fragment in a pass, making adversarial suppression of a single range-Doppler map classification a single point of failure for that object’s catalog entry.

3. Conjunction probability assessment AI (18 SCS SpOC, AGI STK, commercial conjunction services)

Conjunction assessment — the computation of collision probability (Pc) between a space object and a catalogued RSO during a predicted close approach — is the analytical product that drives satellite operator collision avoidance maneuver (CAM) decisions. The US Space Force 18th Space Control Squadron (18 SCS) at Vandenberg SFB issues Conjunction Data Messages (CDMs) under the NASA-standardized CCSDS Conjunction Data Message format to satellite operators when computed Pc exceeds 10–4 (one-in-ten-thousand probability of collision within 7 days). Commercial conjunction assessment services — LeoLabs Conjunction Assessment, ExoAnalytic Orbital Safety, and Slingshot Aerospace’s COSMOS platform — visualize conjunction close approaches as rendered probability distribution images: 2D Gaussian probability density function (PDF) contour maps in the plane of closest approach (PCA), where the primary object’s covariance ellipsoid and the secondary (debris) object’s covariance ellipsoid are rendered as colored contour overlays, with the combined collision probability shown as a scalar computed from the overlap integral of the two covariance distributions. AI models trained on historical CDM databases use these rendered conjunction geometry visualizations as classification inputs to predict “maneuver recommended / no maneuver recommended” outcomes and to prioritize the operator’s daily conjunction screening queue by urgency class.

An adversarial perturbation on a rendered conjunction probability distribution image that shifts the apparent separation between the two covariance ellipsoids — expanding the visual gap between the primary and secondary object PDF contours in the rendered PCA plane image — can cause the conjunction AI to downgrade the computed Pc classification from “maneuver recommended” to “monitor,” suppressing the CAM recommendation for an encounter that has a true Pc above the 10–4 maneuver threshold. Starlink operators execute approximately 50,000 autonomous collision avoidance maneuvers per year (Spacex FCC filing 2024); the maneuver AI operates on CDM-derived conjunction probability outputs that, if adversarially downgraded, would suppress a maneuver and allow the conjunction to proceed at the original uncorrected trajectory. For a Starlink V2 satellite (850kg, active propulsion, 200–250m maneuver delta-V capability), a missed maneuver on a Pc = 10–3 conjunction with a Kosmos 1408 fragment — 1,000:1 miss probability — would result in an “avoidable collision” that creates a new fragment cloud in the Starlink orbital shell.

4. AI-powered satellite health monitoring from onboard camera imagery

Next-generation satellite servicing and inspection missions — NASA’s OSAM-1 (On-orbit Servicing, Assembly, and Manufacturing), Northrop Grumman Mission Extension Pods (MEP) deployed on Intelsat GEO satellites, and the DARPA RSGS (Robotic Servicing of Geosynchronous Satellites) program — use onboard AI vision systems to assess the health of target satellites from proximity inspection camera imagery: analyzing solar array degradation, thruster plume contamination, thermal blanket MMOD (Micrometeoroid and Orbital Debris) impact damage signatures, and antenna reflector deformation from long-duration thermal cycling. The inspection AI processes rendered camera frames from proximity inspection cameras (100m – 10m range) and classifies each observable surface element for damage severity. In the context of debris impact assessment — determining whether a satellite’s solar array or thruster was damaged by a micrometeoroid impact that was undetected by ground-based SSA sensors — the inspection AI output drives the servicing mission decision: proceed with planned propellant transfer, or abort the docking approach due to detected structural compromise. An adversarial perturbation on a rendered proximity inspection camera image that suppresses the micrometeoroid crater signature on a solar panel surface — smoothing the small circular impact pit against the solar cell backing — can cause the inspection AI to classify the solar array as undamaged and proceed with propellant transfer docking to a satellite whose structural integrity is compromised by the undetected impact, potentially causing a collision or structural failure during the servicing maneuver.

Integration: space situational awareness AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for SSA AI belongs at the rendered image ingestion boundary before each AI classification step — before telescope streak detection AI processes astronomical image renders, before radar range-Doppler map AI processes phased-array sensor renders, before conjunction probability AI processes CDM-derived encounter geometry visualizations, and before satellite inspection AI processes proximity camera frames. Threshold 40 for SSA AI contexts reflects Kessler cascade cascade potential and the availability of independent sensor cross-validation that can confirm or deny AI-classified detections.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# SSA AI contexts: threshold 40
# US Space Policy Directive 3, IADC debris mitigation, CCSDS CDM standard.
SSA_AI_THRESHOLD = 40


class SSAAIContext(Enum):
    TELESCOPE_STREAK        = "telescope_streak"        # Ground telescope streak detection AI
    RADAR_RANGE_DOPPLER     = "radar_range_doppler"     # Phased-array radar RCS classification AI
    CONJUNCTION_PROBABILITY = "conjunction_probability" # CDM conjunction geometry visualization AI
    SATELLITE_INSPECTION    = "satellite_inspection"    # Proximity inspection camera AI (servicing)


class AdversarialSSAImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in an SSA
    AI rendered image above threshold 40.

    Consequence if not raised: debris object undetected → no catalog entry
    → no conjunction screening → no CDM issued → no CAM executed →
    satellite-debris collision → Kessler fragment cloud in affected shell.
    Fail-safe: suppress AI classification, route to human SSA analyst for
    manual image review and independent sensor cross-correlation.
    """

    def __init__(self, scan_id: str, score: int,
                 context: SSAAIContext,
                 sensor_id: str, obs_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.sensor_id = sensor_id
        self.obs_id = obs_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial SSA image: "
            f"context={context.value} score={score} "
            f"sensor={sensor_id} obs={obs_id} scan_id={scan_id}"
        )


async def scan_ssa_image(
    image_bytes: bytes,
    context: SSAAIContext,
    sensor_id: str,
    obs_id: str,
    epoch_utc: str,
    altitude_km: float | None,
    primary_norad_id: int | None,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a space situational awareness AI image for adversarial content.

    Fail-safe contract: AdversarialSSAImageError or httpx error →
    suppress AI classification, route observation to SSA analyst for
    manual review and independent sensor cross-correlation. Do not
    issue CDM clearance or suppress CAM recommendation without clean scan.

    Args:
        image_bytes: Telescope astronomical frame, radar range-Doppler map,
            conjunction probability distribution render, or proximity camera frame.
        context: SSAAIContext identifying the SSA pipeline.
        sensor_id: Sensor system identifier (telescope ID, radar site ID).
        obs_id: Observation or event identifier.
        epoch_utc: ISO 8601 observation epoch (UTC).
        altitude_km: Approximate object altitude in km (if known from TLE).
        primary_norad_id: NORAD catalog ID of primary object (for conjunctions).
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialSSAImageError: if score exceeds threshold 40.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"ssa:{context.value}:{sensor_id}:{obs_id}",
        "metadata": {
            "sensor_id": sensor_id,
            "obs_id": obs_id,
            "epoch_utc": epoch_utc,
            "altitude_km": altitude_km,
            "primary_norad_id": primary_norad_id,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_ssa_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        sensor_id=sensor_id,
        obs_id=obs_id,
        epoch_utc=epoch_utc,
        flagged=result["score"] > SSA_AI_THRESHOLD,
    )

    if result["score"] > SSA_AI_THRESHOLD:
        raise AdversarialSSAImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            sensor_id=sensor_id,
            obs_id=obs_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_ssa_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: SSAAIContext, sensor_id: str,
    obs_id: str, epoch_utc: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": SSA_AI_THRESHOLD,
        "flagged": flagged,
        "sensor_id": sensor_id,
        "obs_id": obs_id,
        "epoch_utc": epoch_utc,
        "regulatory_refs": [
            "US Space Policy Directive 3 (National Space Traffic Management Policy, 2018)",
            "IADC Space Debris Mitigation Guidelines (rev. 2023)",
            "CCSDS 508.0-B-1 (Conjunction Data Message standard)",
            "UN COPUOS Space Debris Mitigation Guidelines (2007, 2021 review)",
            "FCC Part 25 (Space Station Earth Station licensing, debris mitigation)",
            "ITU Radio Regulations Resolution 659 (debris mitigation)",
            "NASA-STD-8719.14B (Process for Limiting Orbital Debris)",
        ],
    }
    audit_path = Path("/var/log/glyphward/ssa_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_ssa_image at each SSA AI image ingestion boundary: before telescope streak detection AI (threshold 40), before radar range-Doppler AI (threshold 40), before conjunction probability classification AI (threshold 40), and before satellite proximity inspection AI (threshold 40). On AdversarialSSAImageError: suppress AI classification, route observation to human SSA analyst for manual image review and cross-correlation against independent sensor data (alternate telescope, alternate radar site, or time-adjacent observation from the same sensor). For conjunction assessments: do not issue CDM clearance or suppress a CAM recommendation based on an adversarially flagged conjunction geometry image without human review. Get early access

Related questions

Further reading

• Prompt injection in deep space and planetary AI — NASA AEGIS, SPRITE TRN, and Dragonfly VIO adversarial attacks
• Prompt injection in satellite ground station AI — antenna tracking, RF spectrum, and SSA conjunction AI adversarial attacks
• Prompt injection in satellite remote sensing AI — earth observation and geospatial AI adversarial attacks
• Prompt injection in drone and UAV AI — BVLOS operations adversarial image attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required