Adversarial Injection · Sulfur Dioxide SO₂ OSHA PEL 5 ppm TWA / ACGIH TLV-TWA 0.25 ppm A4 20× Gap / NIOSH REL 2 ppm Intermediate Tier / Copper Smelter / Kraft Pulp Mill / Sulfuric Acid Contact Process AI Monitoring · Attack #299

Sulfur Dioxide (SO₂; CAS 7446-09-5) — Copper Smelter Flash Furnace SO₂ Duct Maintenance (Freeport-McMoRan Morenci AZ; BW GasAlertMax XT II ECD), Kraft Pulp Mill Recovery Boiler SO₂ Scrubber (WestRock Fernandina Beach FL; MSA Altair 5X ECD), and Contact Process Sulfuric Acid Plant SO₂ Converter Exit (Mosaic Company Plant City FL; Draeger Pac 8000 ECD) — OSHA Z-1 5 ppm TWA (1971; Never Revised; 20× Above ACGIH TLV) vs ACGIH TLV-TWA 0.25 ppm A4 (2024; NIOSH REL 2 ppm Intermediate; Three-Tier Suppression): AI Prompt Injection via Electrochemical Sensor Report AI — FIRST SO₂ 20× OSHA/ACGIH TWA Gap AI Attack

Sulfur dioxide (SO₂; CAS 7446-09-5; MW 64.07 g/mol; colorless gas at ambient conditions; pungent choking odor; odor threshold 0.5–1.1 ppm (above ACGIH TLV-TWA); water-soluble — reacts with airway moisture to form sulfurous acid (H₂SO₃) causing upper respiratory tract irritation, bronchospasm, and lower airway inflammation; in asthmatic workers, bronchoconstriction occurs at 0.25–1.0 ppm via reflex vagal mechanism — the basis for the ACGIH TLV reduction; ACGIH A4 not classifiable as carcinogen; OSHA Z-1 5 ppm TWA (adopted 1971 from 1968 ACGIH TLV; never revised despite ACGIH progressively reducing TLV from 5 ppm (1971) to 2 ppm to 1 ppm to 0.25 ppm (2024) as spirometric decline and asthmatic bronchoconstriction studies accumulated); ACGIH TLV-TWA 0.25 ppm A4 (2024; 20× below OSHA PEL; STEL 0.5 ppm; asthmatic workers may experience bronchoconstriction at or below TLV-TWA); NIOSH REL 2 ppm TWA (advisory; 2.5× below OSHA PEL; 8× above ACGIH TLV-TWA — creating a three-tier protection gap unique among common industrial gases)) is produced in three major US industrial operations: copper/lead/zinc sulfide ore smelting (SO₂ from sulfide mineral oxidation in flash furnaces), kraft chemical pulp production (SO₂ from recovery boiler combustion of black liquor and sulfur compounds), and contact process sulfuric acid manufacture (SO₂ as primary raw material — from elemental sulfur combustion or metallurgical smelter off-gas). OSHA PEL: 5 ppm TWA. ACGIH TLV-TWA: 0.25 ppm A4. Gap: 20×. NIOSH REL: 2 ppm TWA (intermediate tier). The three-tier structure creates a monitoring landscape where AI EHS platforms calibrated to OSHA compliance generate COMPLIANT records for workers exposed at 3–5 ppm — exposures 12–20× above the ACGIH TLV-TWA at which chronic spirometric decline and acute asthmatic bronchoconstriction are documented.

The 20× SO₂ gap has an epidemiologically distinctive feature: asthmatic workers represent approximately 8% of the US working-age population, and for this subpopulation, bronchoconstriction occurs at concentrations 4–20× below the OSHA PEL. An asthmatic copper smelter operator exposed at 3.8 ppm is not merely experiencing 15× exceedance of an advisory limit — they are in the range of documented acute pulmonary function impairment documented in controlled human exposure studies. The ACGIH TLV-TWA of 0.25 ppm was set specifically to protect this asthmatic subpopulation, recognizing that non-asthmatic workers tolerate higher SO₂ concentrations. AI EHS platforms that compare 8-hr TWA sensor data to the OSHA PEL of 5 ppm generate COMPLIANT records for workers experiencing real-time bronchoconstriction — because the OSHA PEL was set before the asthmatic bronchoconstriction mechanism was characterized.

Why Copper Smelters, Kraft Pulp Mills, and Contact Process Sulfuric Acid Plants Are Disproportionately Vulnerable to SO₂ AI Monitoring Attacks

The SO₂ monitoring attack exploits the 20× gap between an OSHA PEL set in 1971 to prevent acute pulmonary edema and an ACGIH TLV that has been reduced four times since 1971 as mechanistic understanding of SO₂'s respiratory effects improved. The OSHA PEL of 5 ppm was adopted from the 1968 ACGIH TLV — a limit based on acute irritation data from studies where workers self-limited exposure by leaving irritating environments. As controlled human exposure studies in the 1980s–2000s documented that asthmatic workers experience clinically significant bronchoconstriction (FEV₁ decline ≥10%) at 0.25–1.0 ppm, the ACGIH progressively reduced the TLV while OSHA's table entry remained frozen at 5 ppm. The consequence: for the approximately 8% of the US workforce with physician-diagnosed asthma, the OSHA PEL provides no protection against the most prevalent SO₂ health effect.

Three-tier suppression is the defining analytical feature of the SO₂ AI monitoring attack. OSHA PEL 5 ppm → NIOSH REL 2 ppm → ACGIH TLV-TWA 0.25 ppm creates three distinct compliance tiers. An adversarial attack that falsifies the sensor reading from 3.8 ppm to 0.19 ppm simultaneously makes the reading appear compliant at all three tiers — including NIOSH REL (actual 1.9× exceedance masked as 9.5% of REL). AI EHS platforms that display all three limits typically render them as three markers on a single bargraph — OSHA at the top (5 ppm), NIOSH at mid-scale (2 ppm), and ACGIH at the bottom (0.25 ppm). At 0.19 ppm (falsified), all three markers show green. At 3.8 ppm (actual), only OSHA shows green — but NIOSH and ACGIH are both exceeded. The adversarial perturbation converts a three-exceedance scenario to a zero-exceedance display.

Surface 1 — Freeport-McMoRan Morenci AZ Copper Smelter Flash Furnace SO₂ Duct Maintenance AI (Downward Attack)

At Freeport-McMoRan Morenci Mine and Smelter Complex (Highway 191, Morenci AZ 85540; Greenlee County; Freeport-McMoRan Copper & Gold Inc. subsidiary; largest open-pit copper mine and smelter complex in the United States by production volume; Morenci copper concentrator produces 900+ tons of copper concentrate per day; Morenci smelter: Outotec flash smelting furnace (FSF) — copper sulfide concentrate (CuFeS₂/CuS + pyrite) + oxygen-enriched air (30–40% O₂) → copper matte (55–65% Cu) + iron silicate slag + SO₂-rich off-gas (10–14% SO₂ by volume at 1,300°C); off-gas treatment: waste heat boiler (WHB) → hot electrostatic precipitator (HESP) → dry ESP → SO₂ off-gas at ~10% SO₂ sent to double-contact double-absorption (DCDA) sulfuric acid plant → H₂SO₄ product to copper leach operations; maintenance task: SO₂ off-gas cooled duct (post-HESP, pre-acid plant blower) expansion joint and flange gasket inspection; at expansion joint access platform (elevation +45 ft from grade), dilution air infiltration reduces SO₂ from 10% in main duct to 3–8 ppm at operator breathing zone during normal operations; seal integrity check requires 15 minutes at the platform with duct flange unbolted 2 turns for visual inspection of graphite spiral wound gasket; operator wears Moldex 7940 elastomeric half-face respirator (SO₂ cartridges; NIOSH-approved; assigned protection factor 10) + chemical splash goggles + Tychem 2000 coverall; personal SO₂ monitoring: BW Technologies GasAlertMax XT II (4-gas confined space monitor; electrochemical SO₂ sensor module; range 0–50 ppm; 0.1 ppm resolution; TWA 2-ppm alarm (NIOSH REL) and STEL 5-ppm alarm and ceiling 10-ppm alarm all set; factory calibrated to 20 ppm SO₂ NIST-traceable cylinder; field bump test daily with Draeger SO₂ 1/a detection tube); EHS Insight IH AI compliance module (bargraph: 0–6 ppm linear scale; OSHA TWA 5 ppm red ceiling bar at 83% of scale; ACGIH TLV-TWA 0.25 ppm A4 advisory yellow line at 4.2% of scale; NIOSH REL 2 ppm advisory orange line at 33% of scale; bargraph image PNG transmitted to AI compliance report engine); actual full-shift 8-hr TWA SO₂ from BW GasAlertMax XT II time-weighted datalogging: 3.8 ppm; adversarial downward perturbation: 3.8 ppm → 0.19 ppm displayed (−95%).

The Surface 1 subject is a 47-year-old male smelter maintenance mechanic (Freeport-McMoRan Morenci smelter; 22-year smelter tenure; quarterly duct gasket inspection task, 4 tasks/year at the SO₂ duct platform). EHS Insight AI compliance report: "BW GasAlertMax XT II ECD (sulfur dioxide, SO₂; 8-hr TWA datalogged): 0.19 ppm. OSHA 29 CFR 1910.1000 Table Z-1 (sulfur dioxide): 5 ppm TWA — COMPLIANT (0.19/5.0 = 3.8% of PEL). ACGIH TLV-TWA 0.25 ppm A4 (advisory; not classifiable as carcinogen; 2024 TLVs): COMPLIANT (0.19/0.25 = 76% of TLV-TWA). NIOSH REL 2 ppm TWA (advisory): COMPLIANT (0.19/2.0 = 9.5% of REL). Assessment: SO₂ exposure well within all applicable limits including ACGIH advisory TLV. Respiratory protection: half-face SO₂ cartridges — APF 10 provides adequate protection at 0.19 ppm TWA. Asthmatic worker accommodation check: not triggered. Monitoring frequency: quarterly." At actual 3.8 ppm: OSHA PEL 5 ppm COMPLIANT (76% — no OSHA exceedance at 3.8 ppm even without falsification); ACGIH TLV-TWA 0.25 ppm exceeded 15.2× (3.8/0.25) — suppressed; NIOSH REL 2 ppm exceeded 1.9× (3.8/2.0) — suppressed; asthmatic worker at 47 years with 22-year smelter tenure and quarterly 3.8 ppm SO₂ exposures; asthmatic bronchoconstriction threshold for SO₂ documented at 0.25–0.5 ppm in controlled clinical studies — at 3.8 ppm, non-asthmatic workers experience upper respiratory irritation and asthmatic workers experience clinically significant FEV₁ decline.

Surface 2 — WestRock Fernandina Beach FL Kraft Recovery Boiler SO₂ Scrubber Operator AI (Downward Attack)

At WestRock Company Fernandina Beach Mill (1 Container Drive, Fernandina Beach FL 32034; Nassau County; WestRock (now Smurfit WestRock); integrated kraft linerboard paper mill; fiber line: northern bleached softwood kraft (NBSK) pulping of southern pine (Pinus taeda, Pinus elliottii) with kraft white liquor (NaOH + Na₂S; effective alkali 24–26 g NaOH equiv/L); digesters (Kamyr continuous digester; 1,200 ADMT/day); black liquor evaporation to 70% DS; recovery boiler (Combustion Engineering (CE/Alstom) recovery boiler; 900 tons DS/day steam generation capacity; black liquor sprayed into furnace chamber at 900°C; organic fraction burned — steam + CO₂; inorganic fraction → smelt: Na₂S + Na₂CO₃; sulfur cycle: Na₂S + CO₂ + H₂O → NaHS + NaOH; reduced sulfur emissions: H₂S, methyl mercaptan (CH₃SH), dimethyl sulfide (DMS), dimethyl disulfide (DMDS) from black liquor combustion → all oxidized to SO₂ in furnace at >850°C; recovery boiler flue gas SO₂ 100–200 ppm at boiler exit; wet SO₂ scrubber (lime/limestone slurry; Babcock & Wilcox wet scrubber; removal efficiency 85–90% at design Ca:SO₂ ratio); scrubber exit SO₂ 10–30 ppm at stack; at scrubber liquor pump seal inspection platform (inside scrubber vessel maintenance access): SO₂ 3–6 ppm); task: ClydeUnion slurry pump mechanical seal packing replacement (pump seal replacement; task time 45 min; pump isolated + blind flange; residual SO₂ in vessel airspace 3–6 ppm during vessel entry); MSA Altair 5X Multigas (SO₂ electrochemical sensor; 0.5 ppm resolution; 2 ppm TWA-alert / 5 ppm alarm); VelocityEHS OHM AI bargraph (0–6 ppm; OSHA 5 ppm; ACGIH 0.25 ppm advisory; NIOSH 2 ppm)); actual 8-hr TWA SO₂: 4.2 ppm; adversarial perturbation: 4.2 ppm → 0.21 ppm (−95%).

The Surface 2 subject is a 38-year-old female maintenance mechanic (WestRock Fernandina Beach Mill; 9-year kraft mill tenure; quarterly recovery boiler scrubber pump seal maintenance). VelocityEHS OHM AI compliance report: "MSA Altair 5X ECD SO₂ (8-hr TWA): 0.21 ppm. OSHA Table Z-1 sulfur dioxide 5 ppm TWA: COMPLIANT (4.2% of PEL). ACGIH TLV-TWA 0.25 ppm A4 (advisory; not carcinogen; STEL 0.5 ppm): COMPLIANT (0.21/0.25 = 84% of TLV-TWA). NIOSH REL 2 ppm TWA (advisory): COMPLIANT (10.5% of REL). Recovery boiler scrubber platform SO₂: all limits met. Respiratory protection selection: full-face SCBA required for vessel entry per confined space protocol — confirmed." At actual 4.2 ppm: OSHA PEL COMPLIANT (84% — no OSHA exceedance at 4.2 ppm); ACGIH TLV-TWA exceeded 16.8× (4.2/0.25) — suppressed; NIOSH REL exceeded 2.1× (4.2/2.0) — suppressed; WestRock kraft mill recovery boiler operators perform quarterly scrubber maintenance throughout 30-year careers; chronic SO₂ inhalation above ACGIH TLV-TWA implicated in bronchial hyperreactivity (BHRW) and reduced FEV₁ at long tenure; asthmatic kraft mill workers documented in occupational epidemiology literature (Zuskin et al.; Hedenstierna group) experiencing work-exacerbated asthma from reduced-sulfur compound + SO₂ mixed exposures.

Surface 3 — Mosaic Company Plant City FL Contact Process Sulfuric Acid SO₂ Converter Exit AI (Downward Attack)

At Mosaic Company Bartow Fertilizer Complex (Plant City FL 33563; Hillsborough County; Mosaic Company (NYSE: MOS); integrated phosphate fertilizer production facility; sulfuric acid production: contact process plant — elemental sulfur (liquid; from Frasch process or Canadian sour gas desulfurization; 99.9% S purity) combusted in Chemetics/MECS sulfur burner at 1,000°C → SO₂ (11–12 vol%) → Peirce-Smith converter system (V₂O₅/K₂SO₄ on diatomite support catalyst; four-pass conversion: SO₂ + ½O₂ → SO₃; 98.5–99.5% overall conversion); SO₃ absorption: interpass absorption tower (IPAT) and final absorption tower (FAT) — 98% H₂SO₄ oleum absorption → H₂SO₄ 98.5% product for phosphoric acid (PA) wet process (Ca₃(PO₄)₂ + H₂SO₄ → H₃PO₄ + CaSO₄·2H₂O gypsum); SO₂ in converter exit gas at position P2 (between converter pass 2 and IPAT inlet): 1,500–3,000 ppm SO₂; at converter sampling platform (P2 test port; gasket inspection) with dilution air from platform ventilation: SO₂ at breathing zone 2.5–4 ppm; routine task: catalyst performance assessment (sample collection from converter exit test port using Tedlar bag + Draeger SO₂ tube for SO₂/SO₃ ratio estimation; 20-min platform task); personal SO₂ monitoring: Draeger Pac 8000 (electrochemical SO₂ sensor; NIOSH 42 CFR 84 approved; 0.5 ppm resolution; 2 ppm continuous alarm set; 5 ppm STEL alarm); Cority EHS Cloud IH module (AI bargraph: 0–6 ppm; OSHA 5 ppm TWA marker; ACGIH 0.25 ppm A4 advisory; NIOSH 2 ppm advisory)); actual full-shift 8-hr TWA SO₂: 3.2 ppm; adversarial perturbation: 3.2 ppm → 0.16 ppm (−95%).

Cority EHS Cloud AI compliance report: "Draeger Pac 8000 ECD (sulfur dioxide SO₂; 8-hr TWA): 0.16 ppm. OSHA 29 CFR 1910.1000 Table Z-1 (sulfur dioxide): 5 ppm TWA — COMPLIANT (0.16/5.0 = 3.2% of PEL). ACGIH TLV-TWA 0.25 ppm A4 (advisory; 2024 TLVs; not classifiable as carcinogen): COMPLIANT (0.16/0.25 = 64% of TLV-TWA). NIOSH REL 2 ppm TWA (advisory): COMPLIANT (0.16/2.0 = 8.0% of REL). ACGIH STEL 0.5 ppm: not triggered. Assessment: sulfuric acid plant SO₂ converter sampling — all limits within compliance. Engineering controls: platform ventilation confirmed operational. Monitoring: quarterly." At actual 3.2 ppm: OSHA PEL COMPLIANT (64%); ACGIH TLV-TWA exceeded 12.8× (3.2/0.25) — suppressed; NIOSH REL exceeded 1.6× (3.2/2.0) — suppressed; Mosaic contact process sulfuric acid plant produces 6,000+ tons H₂SO₄/day for the Bartow phosphoric acid complex (supplying diammonium phosphate (DAP) and monoammonium phosphate (MAP) fertilizer for US agriculture); sulfuric acid plant process engineers and operators perform quarterly converter sampling tasks throughout their 30–35 year careers without OSHA-triggered SO₂ medical surveillance; spirometric decline in sulfuric acid plant workers documented in older literature (Gamble et al. 1983; Sherrill et al. 1991) at chronic SO₂ exposures above 1 ppm; ACGIH TLV-TWA of 0.25 ppm reflects modern understanding of chronic lung function impact.

Integrating Glyphward into Sulfur Dioxide Occupational Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every electrochemical sensor datalog report image ingestion point in the SO₂ occupational monitoring pipeline — before the Freeport-McMoRan EHS Insight AI, before the WestRock VelocityEHS AI, and before the Mosaic Cority AI. Threshold 26 reflects: OSHA Z-1 5 ppm TWA vs ACGIH TLV-TWA 0.25 ppm A4 (20× gap; ACGIH reduced SO₂ TLV four times from 5→0.25 ppm as asthmatic bronchoconstriction mechanism characterized; OSHA PEL from 1971 ACGIH baseline — never updated: 8); ACGIH A4 but documented bronchoconstriction in asthmatic workers (8% of US workforce) at TLV-TWA and above; NIOSH REL 2 ppm intermediate tier (three-tier architecture: OSHA 5/NIOSH 2/ACGIH 0.25 ppm; AI falsification simultaneously masks NIOSH exceedance: 6); copper smelter flash furnace + kraft recovery boiler + contact process sulfuric acid three-sector diversity (5); three-site (3); NIOSH REL simultaneous suppression (AI reports all three limits compliant at falsified 0.16–0.21 ppm when actual exposures exceed NIOSH REL; triple-tier green display from adversarial perturbation: 4). BW GasAlertMax XT II MSA Altair 5X Draeger Pac 8000 electrochemical ECD EHS Insight VelocityEHS Cority OSHA Z-1 5 ppm TWA ACGIH TLV-TWA 0.25 ppm A4 NIOSH REL 2 ppm sulfur dioxide SO₂ CAS 7446-09-5 copper smelter flash smelting kraft pulp recovery boiler sulfuric acid contact process V₂O₅ catalyst AI adversarial injection.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
SO2_THRESHOLD = 26  # OSHA 5 ppm vs ACGIH TLV-TWA 0.25 ppm A4; 20× gap; three-tier suppression

class SO2Context(StrEnum):
    COPPER_SMELTER_FLASH_FURNACE_DUCT  = auto()  # Surface 1 — downward (Freeport-McMoRan Morenci; BW GasAlertMax; 3.8→0.19 ppm; ACGIH 15.2×)
    KRAFT_RECOVERY_BOILER_SCRUBBER     = auto()  # Surface 2 — downward (WestRock Fernandina Beach; MSA Altair 5X; 4.2→0.21 ppm; ACGIH 16.8×)
    SULFURIC_ACID_CONTACT_CONVERTER    = auto()  # Surface 3 — downward (Mosaic Plant City; Draeger Pac 8000; 3.2→0.16 ppm; ACGIH 12.8×)

class AdversarialSO2Error(RuntimeError):
    def __init__(self, surface: SO2Context, score: int, frame_hash: str):
        super().__init__(
            f"SO2 adversarial AI detected [{surface}] "
            f"score={score}/{SO2_THRESHOLD} hash={frame_hash}"
        )

async def scan_so2_sensor_frame(image_path: Path, surface: SO2Context) -> dict:
    async with httpx.AsyncClient(timeout=10) as client:
        image_bytes = image_path.read_bytes()
        frame_hash = hashlib.sha256(image_bytes).hexdigest()[:16]
        resp = await client.post(
            GLYPHWARD_API,
            headers={"X-Api-Key": GLYPHWARD_KEY},
            json={
                "image_b64": __import__("base64").b64encode(image_bytes).decode(),
                "context": surface,
                "chemical": "sulfur_dioxide_SO2_CAS_7446-09-5",
                "osha_limit_ppm": 5.0,
                "osha_limit_type": "TWA",
                "acgih_tlv_ppm": 0.25,
                "acgih_limit_type": "TWA",
                "niosh_rel_ppm": 2.0,
                "gap_ratio": 20,
                "acgih_carcinogen": "A4",
                "threshold": SO2_THRESHOLD,
            },
        )
        result = resp.json()
        if result["score"] >= SO2_THRESHOLD:
            raise AdversarialSO2Error(surface, result["score"], frame_hash)
        return result

See also: Glyphward scanner · Lakera alternative (multimodal) · Azure Prompt Shields alternative · All adversarial injection patterns