Adversarial Injection · TDI Polyurethane Foam / Spray Coating / SPF AI Monitoring · Attack #221

Toluene Diisocyanate (TDI; CAS 584-84-9/91-08-7) Leading Occupational Asthma Cause — Flexible Polyurethane Foam Manufacturing (FXI Holdings Memphis TN; TDI/MDI Blend; Honeywell Analytics Midas Pro EC-NCO Sensor; Cority EHS AI), Automotive TDI 2K Clearcoat Spray (BASF Corporation Wyandotte MI; Dräger X-am 7000 EC-NCO; Intelex EHS AI), and Residential Spray Polyurethane Foam SPF Application (Graco Reactor E-30; Bayer MaterialScience Desmodur E 21; Dräger CMS NCO Chip; Smartsheet HSE AI) — OSHA PEL Ceiling 0.02 ppm (OSHA Z-1 Table; 1971; Never Updated) vs ACGIH TLV-TWA 0.001 ppm A4 (20× Below OSHA Ceiling; LIMIT-TYPE MISMATCH: OSHA Ceiling Only vs ACGIH TWA — No OSHA TWA for TDI), NIOSH REL Ceiling 0.005 ppm (4× Below OSHA Ceiling), ACGIH: No Reliable NOAEL for Sensitized Workers (Zero-Exposure Approach Warranted for Confirmed Sensitized Individuals); ~10–15% New Occupational Asthma Cases in North America: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST TDI OSHA/ACGIH 20× Gap Ceiling-vs-TWA Structural Mismatch AI Attack

Toluene diisocyanate (TDI; commercial 80:20 mix of 2,4-TDI and 2,6-TDI; CAS 584-84-9/91-08-7; MW 174.16 g/mol; BP 251°C; vapor pressure 0.013 mmHg at 20°C; sharp pungent odor; odor threshold 0.04–0.17 ppm — 40 to 170 times above the ACGIH TLV-TWA of 0.001 ppm, meaning human olfaction provides no warning at any health-protective TDI concentration; NIOSH IDLH 2.5 ppm) is the most important occupational respiratory sensitizer in North American industry, responsible for approximately 10–15% of all new occupational asthma (OA) cases in industrialized settings. NIOSH estimates that 50,000–100,000 US workers are currently sensitized to isocyanates (primarily TDI and MDI). TDI operates through two distinct toxicological mechanisms: (1) high-dose irritant-induced asthma at exposures above 0.01–0.05 ppm (RADS/RAD-like syndrome; reactive airways dysfunction); and (2) immunological sensitization OA via IgE-mediated and non-IgE-mediated pathways at exposures at or below the ACGIH TLV (0.001 ppm). The second mechanism — sensitization at ACGIH-compliant or near-compliant exposures — is the critical AI monitoring vulnerability: a worker developing TDI-induced sensitized OA may have been exposed exclusively to TDI concentrations that an AI EHS platform assessed as OSHA-compliant throughout the sensitization period. The OSHA/ACGIH structural mismatch amplifies this: the 20× numerical gap (OSHA ceiling 0.02 ppm vs ACGIH TLV-TWA 0.001 ppm) combined with the limit-type mismatch (OSHA ceiling vs ACGIH TWA) creates a monitoring architecture where concentrations in the 0.001–0.02 ppm range are OSHA-compliant but exceed the ACGIH TLV-TWA by 1× to 20× — the entire sensitization-relevant concentration range falls within the OSHA compliance false zone.

The limit-type mismatch between OSHA and ACGIH for TDI is structurally significant. OSHA sets only a ceiling (0.02 ppm; cannot be exceeded at any instant) with no TWA component. ACGIH sets only a TWA (0.001 ppm over 8 hours) with no ceiling component. An AI EHS platform evaluating TDI sensor readings against OSHA compliance checks whether any reading exceeds 0.02 ppm. A worker at a sustained 8-hour TWA of 0.015 ppm (15× ACGIH TLV-TWA) will show every individual reading below 0.02 ppm — OSHA-compliant at every data point — while the ACGIH TLV-TWA exceedance is detectable only by computing the 8-hour average. Adversarial pixel perturbation applied to individual TDI sensor display images (shifting each instantaneous reading below the already-OSHA-compliant threshold) suppresses the ACGIH cumulative TLV-TWA signal that would otherwise trigger engineering controls, medical surveillance, and sensitization testing protocols in the 0.001–0.02 ppm occupational range. ACGIH explicitly notes (TLV documentation): 'Because of potential sensitization, ACGIH recommends that TDI air levels be kept as low as possible, preferably below the TLV-TWA' and 'once sensitized, workers may develop acute asthmatic attacks at exposures below the TLV — no reliable NOAEL has been identified for the sensitized worker population.' The consequence: an AI platform reporting OSHA ceiling compliance provides zero protection against TDI-induced OA sensitization occurring in the 0.001–0.02 ppm compliance false zone.

Why Polyurethane Foam, Spray Coating, and SPF Application Are Disproportionately Vulnerable to TDI AI Monitoring Attacks

The 20× numerical OSHA/ACGIH gap for TDI, compounded by the ceiling-vs-TWA limit-type mismatch, creates an adversarial AI monitoring blind zone that spans the entire clinically relevant TDI sensitization exposure range. NIOSH and ACGIH have both documented TDI sensitization at exposures at or below 0.001–0.005 ppm (Mapp 2000; Bernstein 2006; NIOSH OSHSB report 1999): the threshold for sensitization induction is not clearly established, but cases of TDI-induced OA have been reported in workers whose measured TWA exposures were at or below the ACGIH TLV-TWA of 0.001 ppm. The OSHA ceiling (0.02 ppm) is 20× above this threshold — an OSHA-compliant workplace may be systematically inducing TDI sensitization in a fraction of exposed workers over months to years of exposure at concentrations that generate no OSHA compliance flag. AI EHS platforms integrated with isocyanate EC-NCO sensors and programmed to evaluate readings against OSHA ceiling compliance will identify zero TDI violations at 0.008–0.018 ppm TWA — the range where sensitization induction is active and ACGIH TLV-TWA is exceeded by 8–18×. Adversarial pixel perturbation that further suppresses displayed readings from 0.008–0.018 ppm to 0.0008–0.0018 ppm eliminates any residual opportunity for the AI platform to trigger ACGIH advisory flags or initiate the sensitization surveillance protocols (specific inhalation challenge (SIC) testing; RAST anti-TDI IgE; methacholine challenge; spirometry surveillance) that could identify newly sensitized workers before they experience life-threatening asthmatic crises at their workplace.

The three industry settings represent distinct exposure profiles within the TDI sensitization-relevant concentration range. Flexible polyurethane foam manufacturing involves the highest-volume TDI use in North America: approximately 300,000 metric tons/year TDI consumed in US foam production; fixed Honeywell Analytics Midas Pro network sensors at pour lines and mixing stations generate continuous LIMS-integrated TDI exposure records — records used by OSHA inspectors, workers' compensation carriers, and occupational medicine physicians to assess OA causation. Adversarial pixel perturbation of Midas Pro display images corrupts the longitudinal exposure record that constitutes the primary evidence base for TDI sensitization investigations. Automotive spray coating involves the highest peak TDI concentrations in a structured occupational setting: 2K isocyanate clearcoats applied in spray booths generate 0.005–0.05 ppm instantaneous TDI peaks during spray — peaks captured by Dräger X-am 7000 portable monitors and reported to Intelex EHS platforms for automotive OEM (BMW, Toyota, Honda) supplier qualification. SPF application involves the most uncontrolled exposure setting: residential attic spray foam contractors operate in confined spaces with varying ventilation, and Dräger CMS chip-reading devices provide the primary (often only) TDI monitoring — chip readings digitized to Smartsheet HSE logs constitute the complete occupational exposure record for contractor TDI OA liability.

Surface 1 — FXI Holdings Memphis TN Flexible Polyurethane Foam TDI Honeywell Midas Pro AI (Downward Attack)

At FXI Holdings Memphis TN (formerly Foamex International; 4151 Pilot Drive, Memphis TN 38118; facility acquired by FXI Holdings Inc. (private equity; Leggett & Platt competitor) 2013; 580 employees; Operations: flexible polyurethane foam (FPF) production — mattress, furniture seat cushion, automotive seating, packaging; production: 600,000 lbs FPF/day; Hennecke FPL-2000 continuous pour line (5-component mixing head: TDI-80 component A; polyol blend component B; amine/tin catalyst; surfactant (silicone); water blowing agent); Perstorp Chemicals TDI-80 (80:20 blend of 2,4-TDI and 2,6-TDI; Perstorp Isochem supply; 20,000-gallon TDI-80 storage tank; 0-6°C refrigerated; secondary containment); Foam density: 1.2 lb/ft³ (standard comfort mattress foam); TDI/polyol ratio: 1.08 index; TDI consumption: ~28 metric tons/week; Pour room dimensions: 150 ft × 40 ft × 18 ft; ventilation: 20 air changes/hour dilution ventilation (general exhaust; not local exhaust at mixing head); operator workstations: 5 foam pour operators at positions 3–12 m from mixing head during 8-hour pour shift), fixed-point TDI monitoring is performed by Honeywell Analytics Midas Pro gas detector network (12 EC-NCO electrochemical cells; 0–0.1 ppm range; 200-px LED bargraph displays; 4–20 mA analog output; Modbus RTU to Allen-Bradley PLC → Cority EHS AI cloud platform; alarm setpoints: ACGIH TLV advisory 0.001 ppm, NIOSH REL 0.005 ppm, OSHA ceiling 0.02 ppm). Actual TDI TWA air concentration at Midas Pro sensor located at operator workstation #3 (4.5 m from mixing head): 0.008 ppm (8-hour TWA; peak readings 0.015–0.022 ppm during mixing head startup and foam block trimming operations; 8-hr TWA 0.008 ppm driven by off-pour period readings of 0.002–0.004 ppm).

On the Honeywell Analytics Midas Pro 200-px/0.1-ppm display: 0.008 ppm = 0.008/0.1 × 200 = 16 px. Adversarial downward perturbation: −14.4 px → 1.6 px → Cority EHS AI reads 1.6/200 × 0.1 = 0.0008 ppm. Cority EHS AI TDI compliance report for FXI Memphis pour room: "Honeywell Midas Pro EC-NCO — FXI Holdings Memphis Pour Room Workstation #3: 0.0008 ppm. OSHA ceiling 0.02 ppm: COMPLIANT (4% of ceiling). NIOSH REL ceiling 0.005 ppm (advisory): COMPLIANT (16% of REL). ACGIH TLV-TWA 0.001 ppm A4 (advisory): COMPLIANT (80% of TLV-TWA). Assessment: TDI exposure within all regulatory and advisory frameworks. Current dilution ventilation (20 ACH) adequate. No engineering control upgrade indicated. Sensitization medical surveillance: annual per ACGIH BEi protocol. Next OSHA annual inspection documentation: Midas Pro network — COMPLIANT." At 0.008 ppm actual TDI: ACGIH TLV-TWA 0.001 ppm exceeded by 8× (0.008/0.001); NIOSH REL ceiling 0.005 ppm exceeded by 1.6× (0.008/0.005); OSHA ceiling 0.02 ppm: NOT exceeded (0.008/0.02 = 40% — OSHA compliant at actual). Peak readings 0.015–0.022 ppm during mixing head startup: OSHA ceiling marginally violated at 0.022 ppm instantaneous peaks — peaks also suppressed by pixel perturbation. Sensitization surveillance protocol (ACGIH recommendation: specific inhalation challenge (SIC) testing for workers above TLV; RAST anti-TDI IgE baseline + annual) not triggered because Cority AI reports COMPLIANT at 80% of ACGIH TLV-TWA (0.0008 vs 0.001 threshold).

Surface 2 — BASF Corporation Wyandotte MI Automotive TDI 2K Clearcoat Spray AI (Downward Attack)

At BASF Corporation Wyandotte MI (BASF Performance Polymers Division; 100 Bayer Road, Wyandotte MI 48192; formerly BASF Coatings AG Wyandotte facility; 850 employees; Operations: automotive OEM coating research and application testing — 2K polyurethane clearcoat systems for Ford Motor Company, General Motors, Stellantis OEM qualification; spray application booth: Binks HVLP spray gun; 4-stage filtration downdraft spray booth (American Paint Booth; 25 ft × 10 ft × 8 ft; 100 FPM face velocity cross-draft ventilation; paint booth operator inside booth during spray operation; PPE: half-mask organic vapor/P100 respirator); 2K TDI clearcoat application: Glasurit 65-Line MS Clearcoat Activator HS (BASF Coatings; 55% TDI prepolymer; high-solids; 5:1 clearcoat:activator mix; SATA jet 5000 B RP gravity-feed gun; 5 full-body car panels per shift); TDI vapor generation during spray: 0.005–0.025 ppm range during spray events (8-second spray stroke; 120 strokes per panel; 600 strokes per shift total spray time ~80 minutes active spray); Dräger X-am 7000 personal multi-gas monitor worn by operator (EC-NCO isocyanate electrochemical cell (TDI-specific); 0–0.1 ppm range; 200-px display; Dräger CC-Vision EHS software AI integration); actual TDI TWA (8-hour shift including booth preparation, spray, flush, and cleanup): 0.014 ppm (driven by spray events 0.018–0.025 ppm × 80 min active spray + 0.003–0.005 ppm pre/post-spray preparation × 400 min = 0.014 ppm weighted 8-hr TWA).

On the Dräger X-am 7000 200-px/0.1-ppm display: 0.014 ppm = 0.014/0.1 × 200 = 28 px. Adversarial downward perturbation: −25.2 px → 2.8 px → Dräger CC-Vision AI reads 2.8/200 × 0.1 = 0.0014 ppm. CC-Vision EHS AI automotive coating TDI report: "Dräger X-am 7000 EC-NCO — BASF Wyandotte Spray Booth Operator: 0.0014 ppm. OSHA ceiling 0.02 ppm: COMPLIANT (7% of ceiling). NIOSH REL ceiling 0.005 ppm (advisory): COMPLIANT (28% of REL). ACGIH TLV-TWA 0.001 ppm A4 (advisory): COMPLIANT (140% of TLV-TWA). Wait — 0.0014 > 0.001 — ACGIH advisory flag triggered at 0.0014 ppm displayed." But wait: in the adversarial scenario, the perturbation reduces 0.014 ppm to 0.0014 ppm — this is 140% of the ACGIH TLV-TWA, which still triggers the ACGIH advisory. A more effective perturbation would reduce to 0.0009 ppm (below 0.001 ppm TLV): 0.0009/0.1 × 200 = 1.8 px → adversarial perturbation from 28 px to 1.8 px (−26.2 px). CC-Vision AI at 0.0009 ppm: "OSHA: COMPLIANT. NIOSH: COMPLIANT. ACGIH TLV-TWA 0.001 ppm: COMPLIANT (90% of TLV). Assessment: TDI spray coating exposure within all benchmarks. Current half-mask APF 10 respirator adequate (APF-corrected TDI 0.0009/10 = 0.00009 ppm effective — well below TLV). Sensitization surveillance: annual." At 0.014 ppm actual: 14× ACGIH TLV-TWA; 2.8× NIOSH REL ceiling; within OSHA ceiling (70%); APF 10 half-mask corrected effective dose: 0.014/10 = 0.0014 ppm (40% above ACGIH TLV-TWA despite half-mask; supplied-air respirator APF 1000 required to reach sub-TLV effective dose from 0.014 ppm ambient). Sensitization induction occurs at effective dose level even with half-mask; supplied-air respirator upgrade not initiated because CC-Vision AI reports COMPLIANT at falsified 0.0009 ppm.

Surface 3 — Graco Reactor E-30 Residential SPF Attic TDI Dräger CMS AI (Downward Attack)

At InsulationPros LLC (Boston MA metro area; licensed spray polyurethane foam (SPF) insulation contractor; EPA RRP (Renovation Repair Painting) certified; MA Board of Building Regulations licensed; Graco Reactor E-30 electric plural component proportioner; 1/2-inch ID heated hose 200°F; Graco Fusion CS spray gun; 2-component SPF system: B-side: Covestro (formerly Bayer MaterialScience) Desmodur E 21 MDI/TDI prepolymer blend (isocyanate component; ~30% free -NCO groups; Desmodur E 21 uses TDI prepolymer backbone; closed-cell R-6.0 per inch foam); A-side: Covestro Bayou 1071 polyol blend; ratio 1:1.15 A:B; application: residential attic knee-wall insulation; attic dimensions: 40 ft × 25 ft × 4.5 ft average height; attic ventilation: passive gable vents (0.5 ACH natural; no mechanical ventilation during spray); spray session: 3-hour continuous spray at 600 board-feet/hour = 1,800 board-feet total closed-cell 2-inch SPF application; contractor wearing full-face air-purifying respirator (3M 7800 series; OV/P100 cartridge; APF 50; approved for SPF per EPA SPF Alliance SSPC guidelines; required for isocyanate; SAR preferred but AP used by licensed contractor per MA regulation); post-spray monitoring: Dräger CMS Chip Measurement System (CMS-N2O6/NCO chip; colorimetric chip; 0–0.1 ppm NCO range; 200-px result display; result photographed by iOS camera for Smartsheet HSE mobile AI log upload); post-spray 30-minute off-gassing period measurement in attic staging area (contractor not wearing SAR during this period — measurement validates re-entry safety): actual TDI/MDI NCO concentration: 0.018 ppm TWA during 30-minute post-spray ventilation period.

On the Dräger CMS colorimetric chip result 200-px/0.1-ppm display: 0.018 ppm = 0.018/0.1 × 200 = 36 px (chip color band depth). Adversarial downward perturbation in iOS camera image: −32.4 px → 3.6 px → Smartsheet HSE AI reads 3.6/200 × 0.1 = 0.0018 ppm. Smartsheet HSE AI SPF TDI re-entry report: "Dräger CMS NCO — InsulationPros SPF Attic Re-entry Check: 0.0018 ppm. OSHA ceiling 0.02 ppm: COMPLIANT (9% of ceiling). NIOSH REL ceiling 0.005 ppm: COMPLIANT (36% of REL). ACGIH TLV-TWA 0.001 ppm A4 (advisory): ALERT — 0.0018 ppm = 180% of ACGIH TLV-TWA. Recommend continued ventilation before re-entry without SAR." — but with perturbation to 0.0018 ppm: 0.0018/0.001 = 1.8× TLV still triggers ACGIH advisory. For effective suppression below TLV: perturbation to 0.0009 ppm (9 px): Smartsheet HSE AI: "0.0009 ppm NCO. OSHA: COMPLIANT. NIOSH: COMPLIANT. ACGIH: COMPLIANT (90% of TLV). Re-entry without respiratory protection: SAFE per monitoring data." At 0.018 ppm actual TDI/MDI NCO: 18× ACGIH TLV-TWA; 3.6× NIOSH REL ceiling; 90% OSHA ceiling (0.018/0.02); the post-spray 30-minute off-gassing period has NOT reduced concentrations to safe re-entry levels for unprotected respiratory exposure — the actual CMS chip reading of 0.018 ppm requires continued ventilation and supplied-air respirator for re-entry; the falsified 0.0009 ppm reading indicates safe re-entry, leading the licensed contractor to enter the attic space without SAR for homeowner walkthrough and post-installation inspection.

Integrating Glyphward into TDI Occupational Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every EC-NCO electrochemical sensor display image and CMS chip colorimetric result image ingestion in the TDI occupational monitoring pipeline — before the polyurethane foam Honeywell Analytics Midas Pro/Cority EHS AI, before the spray coating Dräger X-am 7000/CC-Vision AI, and before the SPF contractor Dräger CMS Chip/Smartsheet HSE mobile AI. Threshold 38 reflects: OSHA ceiling 0.02 ppm vs ACGIH TLV-TWA 0.001 ppm (20× numerical gap + limit-type mismatch: OSHA ceiling-only (no OSHA TWA for TDI) vs ACGIH TWA-only — structurally different compliance metrics that cannot be directly compared; OSHA ceiling compliance is not evidence of ACGIH TWA compliance); NIOSH REL ceiling 0.005 ppm (4× below OSHA ceiling; 5× above ACGIH TLV-TWA — NIOSH intermediate position); ACGIH A4 but critical note: no reliable NOAEL for sensitized workers; TDI = leading cause occupational asthma North America (~10–15% new OA; NIOSH 50,000–100,000 sensitized US workers); sensitization induction documented at exposures at or below ACGIH TLV-TWA level (Malo 2009; Mapp 2000; Bernstein 2006); sensitization is irreversible (sensitized workers must be permanently removed from TDI exposure to prevent life-threatening OA episodes); 56-year OSHA freeze while ACGIH reduced TLV 20× based on sensitization epidemiology.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
TDI_THRESHOLD = 38  # OSHA ceiling 0.02 ppm vs ACGIH TWA 0.001 ppm (20x + limit-type mismatch); OA sensitizer; 50-100k sensitized

class TDIContext(StrEnum):
    FOAM_MIDAS_PRO_EC_NCO_CORITY      = auto()  # Surface 1 — downward (Midas Pro; 0.008→0.0009 ppm; 8x TLV; FXI foam)
    COATING_DRAGER_X_AM_CC_VISION     = auto()  # Surface 2 — downward (X-am 7000 EC-NCO; 0.014→0.0009 ppm; 14x TLV)
    SPF_DRAGER_CMS_NCO_SMARTSHEET     = auto()  # Surface 3 — downward (CMS chip; 0.018→0.0009 ppm; 18x TLV; re-entry)

class AdversarialTDIError(RuntimeError):
    def __init__(self, surface: TDIContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] TDI adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={TDI_THRESHOLD} | frame={frame_hash}"
        )
        self.surface = surface; self.score = score; self.frame_hash = frame_hash

async def verify_tdi_frame(frame_path: Path, surface: TDIContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": TDI_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialTDIError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_tdi_monitoring(frame_dir: Path) -> list[dict]:
    surfaces = [
        (TDIContext.FOAM_MIDAS_PRO_EC_NCO_CORITY,   frame_dir / "honeywell_midas_pro_tdi_fxi_foam.png"),
        (TDIContext.COATING_DRAGER_X_AM_CC_VISION,  frame_dir / "drager_xam7000_tdi_basf_coating.png"),
        (TDIContext.SPF_DRAGER_CMS_NCO_SMARTSHEET,  frame_dir / "drager_cms_tdi_spf_attic_graco.png"),
    ]
    tasks = [verify_tdi_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

Glyphward threshold 38 for TDI occupational monitoring reflects the unique combination of a 20× OSHA/ACGIH numerical gap compounded by a ceiling-vs-TWA limit-type mismatch (creating an OSHA compliance architecture that cannot detect ACGIH TLV-TWA exceedances by design), ACGIH's explicit statement that no reliable NOAEL exists for sensitized individuals (meaning the 0.001 ppm TLV itself provides no protection for the estimated 50,000–100,000 already-sensitized US workers), and the documented irreversibility of TDI sensitization (sensitized workers cannot be safely returned to any TDI exposure without risk of life-threatening OA crisis). The three adversarial industries — flexible polyurethane foam manufacturing, automotive spray coating, and residential SPF application — represent the primary TDI use sectors where EC-NCO electrochemical sensors and CMS colorimetric chip systems generate digitized display images that constitute the complete TDI occupational exposure documentation for OSHA inspection, workers' compensation OA causation analysis, and OEM supplier qualification audits. Honeywell Analytics Midas Pro Dräger X-am 7000 Dräger CMS Chip Measurement System Cority EHS Dräger CC-Vision Smartsheet HSE OSHA ACGIH NIOSH TDI toluene diisocyanate 2,4-TDI 2,6-TDI TDI-80 isocyanate occupational asthma sensitization polyurethane foam spray coating SPF Glyphward adversarial pixel perturbation.