Adversarial Injection · Industrial Chemical AI Monitoring · Attack #135

Trichloroethylene TCE Vapor Degreaser Phosgene Formation: Sump Overtemperature AI Prompt Injection via Pixel Perturbation

Trichloroethylene (TCE; CAS 79-01-6; MW 131.39 g/mol; BP 87.2°C) is the primary solvent in aerospace MIL-PRF-32295 precision vapor degreasers for aluminum and titanium components — but above approximately 130°C in the presence of air, TCE undergoes oxidative thermal decomposition to phosgene (COCl₂), hydrogen chloride, and carbon monoxide; the OSHA PEL for phosgene is 0.1 ppm ceiling (NIOSH IDLH 2 ppm), and its defining clinical hazard is delayed pulmonary edema developing 12 to 48 hours after exposure. A single adversarial pixel perturbation on a DCS display can suppress the degreaser sump temperature from a phosgene-forming 142°C to an apparently normal 81°C, mask a work-zone COCl₂ concentration of 0.38 ppm — 3.8× the OSHA PEL — as an innocuous 0.04 ppm, or conceal a freeboard refrigeration coil failure at 62°C as a healthy 6°C, allowing contaminated TCE vapor to reach operators at breathing-zone concentration while the AI safety monitor observes three clean process displays. Glyphward threshold 38 detects all three surfaces before any downstream LLM acts on the falsified DCS data.

TCE occupies a unique position in aerospace depot maintenance: it is the only solvent that meets MIL-PRF-32295 Type I specification for precision vapor degreasing of titanium alloys without hydrogen embrittlement risk, making it effectively irreplaceable in F-35, F-22, and C-17 depot maintenance cycles at facilities operated by Boeing, Northrop Grumman, Lockheed Martin, and L3Harris. Regulated as an IARC Group 1 carcinogen (renal cell carcinoma, non-Hodgkin lymphoma) and listed on CERCLA with a reportable quantity of 100 lbs, TCE is subject to OSHA PEL of 100 ppm TWA (Table Z-2) with a 200 ppm ceiling, an ACGIH TLV-TWA of 10 ppm (A2 suspected human carcinogen), and a NIOSH REL of 25 ppm TWA / 100 ppm ceiling. The ATSDR TCE ToxFAQs (2019) explicitly documents the phosgene formation hazard from thermal decomposition; Cal/OSHA has issued citations for TCE degreaser overtemperature events at aerospace facilities in Burbank (Lockheed) and Bethpage (Grumman) where inadequate temperature control allowed sump temperatures to exceed the 130°C phosgene-onset threshold.

The AI monitoring attack surface at a TCE vapor degreaser is unusually treacherous because phosgene's defining toxicological characteristic — the 12 to 48 hour latency before pulmonary edema becomes clinically apparent — means that workers can accumulate a lethal exposure dose without any immediate warning symptoms. An AI safety monitoring system that receives falsified DCS display data showing normal sump temperature, negligible phosgene concentration, and adequate freeboard refrigeration will not initiate ventilation override, operator evacuation, or sump shutdown — and affected workers will leave the shift apparently healthy, only to present to emergency departments the following morning with acute respiratory failure from delayed noncardiogenic pulmonary edema.

Why TCE Vapor Degreasing Is Disproportionately Vulnerable to Pixel Manipulation

A TCE vapor degreaser operates at the intersection of three independently hazardous phenomena that are each invisible to the eye and only detectable through instrument readings: thermal decomposition chemistry producing a secondary toxic agent (phosgene), direct carcinogen vapor exposure at sub-odor-threshold concentrations, and refrigeration failure that collapses the only vapor containment barrier between the heated sump and the workers standing at the tank. The degreaser's operating logic — heat the sump to near boiling, condense TCE vapors on the chilled freeboard coil, and recirculate clean solvent — depends on maintaining a precise thermal gradient between the sump (82–85°C, near BP 87.2°C) and the freeboard coil (4–8°C). This gradient creates a "vapor blanket" that confines TCE within the tank; when it fails, the entire inventory of hot TCE vapor, now potentially contaminated with phosgene from the overtemperature sump, migrates to breathing height. Every one of these three parameters — sump temperature, freeboard coil temperature, and phosgene concentration — is read from a DCS display rendering that can be pixel-manipulated at the inference input layer before an LLM safety monitor processes it.

The phosgene secondary-hazard pathway deserves particular emphasis because it is counterintuitive: a process that is nominally a solvent cleaning operation, regulated under OSHA Z-2 for TCE vapor, becomes a potential OSHA PSM-adjacent phosgene release scenario whenever sump temperature exceeds 130°C. Phosgene carries an OSHA PSM threshold quantity of 500 lbs (CERCLA RQ 10 lbs) — far below the quantity that could accumulate in a degreaser sump containing hundreds of gallons of overheating TCE. The 2002 NIOSH Alert on occupational exposure to TCE specifically warns against conditions that can cause thermal decomposition and phosgene generation, including degreaser operation with malfunctioning temperature controls. Because phosgene has a characteristic odor of "freshly cut hay" that is detectable only at concentrations already well above the OSHA PEL, and because it produces no immediate respiratory irritation at the concentrations encountered in degreaser overtemperature events, workers cannot self-protect through sensory awareness. This makes the AI monitoring layer — and by extension its immunity to adversarial pixel attack — the primary safeguard against a degreaser phosgene event.

Surface 1 — Degreaser Sump Temperature (Upward Attack)

The TCE sump temperature is displayed on a 200 px vertical DCS bar spanning 0 to 200°C. The pixel scale is 200 px ÷ 200°C = 1 px per °C. At the actual sump temperature of 142°C, the rendered pixel position is 142 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 61 px to position 81 px. The AI inference engine reads the temperature as 81°C — indistinguishable from the design operating range of 82–85°C for a TCE degreaser near its boiling point of 87.2°C. The DCS alarm setpoint for overtemperature is 100°C (a conservative 13°C below the 130°C phosgene-onset temperature but above normal operating range to provide a buffer); at the displayed 81°C, no alarm is generated, no coolant flow increase is commanded, and no operator investigation is initiated. The actual 142°C is 12°C above the phosgene-formation onset of 130°C and within the zone where TCE decomposition according to the approximate reaction CCl₂=CHCl + O₂ → COCl₂ + HCl + CO proceeds at a measurable rate of approximately 0.8 mg COCl₂ per kilogram of TCE per minute.

In a production aerospace degreaser handling titanium 6Al-4V alloy parts — a typical F-35 structural depot task — the sump may contain 300 to 600 liters of TCE (395 to 790 kg). At 142°C and a generation rate of 0.8 mg COCl₂/kg/min, the sump produces approximately 316 to 632 mg of phosgene per minute. TCE vapor at 142°C is far above its boiling point of 87.2°C, meaning a significant fraction of the sump is in the vapor phase, carrying phosgene upward through the degreaser tank. Without a functioning freeboard coil to condense this vapor (Surface 3), the phosgene-contaminated TCE vapor reaches the work-zone breathing level at concentrations that quickly exceed the OSHA PEL ceiling of 0.1 ppm. The AI system, observing a displayed sump temperature of 81°C, calculates that the sump is operating 6°C below the overtemperature alarm setpoint — within normal tolerance — and takes no protective action.

Surface 2 — Work-Zone COCl₂ (Phosgene) Electrochemical Sensor (Downward Attack)

The work-zone phosgene electrochemical sensor output is displayed on a 200 px vertical DCS bar spanning 0 to 2.0 ppm. The pixel scale is 200 px ÷ 2.0 ppm = 100 px per ppm. At the actual COCl₂ concentration of 0.38 ppm, the rendered pixel position is 0.38 × 100 = 38 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 34 px to position 4 px. The AI inference engine reads the concentration as 4 ÷ 100 = 0.04 ppm — well below the OSHA PEL ceiling of 0.1 ppm, the ACGIH TLV-C of 0.1 ppm, and the NIOSH IDLH of 2 ppm. The alarm setpoint for evacuation is 0.1 ppm (at the OSHA PEL ceiling); the displayed 0.04 ppm is 60% below the evacuation threshold. The actual 0.38 ppm is 3.8× the OSHA PEL ceiling and represents a concentration at which a 4 to 8 hour occupational exposure accumulates sufficient phosgene to initiate the delayed pulmonary edema cascade.

Phosgene's toxicological mechanism involves acylation of free amine and hydroxyl groups on pulmonary surfactant proteins and type II alveolar epithelial cells. This reaction is slow — requiring hours of exposure for clinically significant lung injury — but irreversible once initiated. The delayed presentation (12 to 48 hours post-exposure) is the consequence of the reaction latency combined with the lung's limited capacity for immediate inflammatory response to a lipophilic gas absorbed efficiently across alveolar membranes. Workers at 0.38 ppm COCl₂ during a standard 8-hour aerospace depot maintenance shift accumulate a dose approximately 30 times greater than the ACGIH TLV-C ceiling — a level associated with severe or fatal delayed pulmonary edema in the occupational toxicology literature, including WWII chemical agent exposure records. The electrochemical sensor is the only real-time phosgene monitor at the degreaser workstation; when its displayed output is falsified downward to 0.04 ppm, there is no redundant protective measure that can substitute for the absent alarm.

Surface 3 — Freeboard Refrigeration Coil Temperature (Upward Attack)

The freeboard refrigeration coil temperature is displayed on a 200 px vertical DCS bar spanning −20°C to +100°C, a total span of 120°C. The pixel scale is 200 px ÷ 120°C = 1.667 px per °C. At the actual coil temperature of 62°C, the rendered pixel position is (62 − (−20)) × 1.667 = 82 × 1.667 = 136.7 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 93.7 px to position 43 px. The AI inference engine reads the coil temperature as 43 ÷ 1.667 + (−20) = 25.8 − 20 = 5.8°C, rounded to 6°C — within the design operating range of 4 to 8°C for effective TCE vapor condensation above the sump. The DCS alarm for freeboard coil high temperature is set at 15°C; the displayed 6°C is 9°C below the alarm setpoint. The actual 62°C is 54°C above the alarm setpoint, indicating a complete loss of refrigeration in the freeboard zone.

The freeboard refrigeration coil in a TCE vapor degreaser serves as the only vapor containment mechanism separating the heated solvent vapor (and, in Surface 3's failure scenario, the phosgene-contaminated vapor from the overtemperature sump) from the open work zone above. At design conditions — coil at 4 to 8°C — TCE vapors rising from the sump at 82 to 85°C encounter the cold coil surface, condense, and drain back into the sump. This creates a stable vapor blanket confined within the degreaser tank. At 62°C, the coil surface is hotter than the dew point of TCE vapor at the sump vapor pressure; no condensation occurs. The vapor blanket collapses entirely, and TCE vapor — carrying whatever phosgene was generated at the overtemperature sump (Surface 1 actual condition of 142°C) — rises freely to the breathing zone of operators at the tank lip. The degreaser becomes, in effect, an open evaporator venting phosgene-contaminated solvent vapor directly into occupied workspace at the concentration generated by the overtemperature sump chemistry.

Integrating Glyphward into TCE Vapor Degreaser AI Monitoring Pipelines

The following Python snippet shows how to authenticate every DCS display frame from a TCE aerospace vapor degreaser against the Glyphward API before passing it to a downstream process-safety LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the safety control layer catches and routes to the plant's emergency shutdown system — initiating sump heater cutoff, freeboard chiller alarm, forced-air purge activation, and operator evacuation notice — all of which must occur at or before the phosgene-formation threshold, not after a 12-hour latency period has already committed workers to a delayed pulmonary edema outcome.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
TCE_GLYPHWARD_THRESHOLD = 38

class TCEContext(StrEnum):
    SUMP_TEMPERATURE       = auto()   # Surface 1 — upward attack (142°C shown as 81°C)
    WORKZONE_COCL2_MONITOR = auto()   # Surface 2 — downward attack (0.38 ppm shown as 0.04 ppm)
    FREEBOARD_CHILLER_TEMP = auto()   # Surface 3 — upward attack (62°C shown as 6°C)

class AdversarialTCEImageError(RuntimeError):
    def __init__(self, surface: TCEContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] TCE degreaser adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={TCE_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_tce_frame(
    frame_path: Path,
    surface: TCEContext,
) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()

    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={
                "context": surface.value,
                "threshold": TCE_GLYPHWARD_THRESHOLD,
            },
        )
        resp.raise_for_status()
        result = resp.json()

    if result["verdict"] != "clean":
        raise AdversarialTCEImageError(surface, result["score"], frame_hash)

    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_tce_degreaser_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (TCEContext.SUMP_TEMPERATURE,
         frame_dir / "sump_temperature.png"),
        (TCEContext.WORKZONE_COCL2_MONITOR,
         frame_dir / "workzone_cocl2_phosgene.png"),
        (TCEContext.FREEBOARD_CHILLER_TEMP,
         frame_dir / "freeboard_chiller_temperature.png"),
    ]
    tasks = [verify_tce_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently, adding under 80 ms of total overhead on a standard degreaser historian polling cycle. The phosgene sensor surface check runs simultaneously with the sump temperature and freeboard chiller checks — a critical design requirement because the compound attack scenario (all three surfaces falsified simultaneously) is the most dangerous: it conceals the complete causal chain from sump overtemperature to phosgene generation to vapor blanket collapse while the AI safety monitor sees three clean instrument readings. Each exception carries the SHA-256 frame hash, providing forensic traceability for OSHA PSM incident investigation requirements under 29 CFR 1910.119(m) and supporting Cal/OSHA citation documentation in the event of a phosgene exposure incident at a California aerospace depot facility.