Adversarial Injection · Industrial Chemical AI Monitoring · Attack #126

Vinylidene Chloride VDC 1,1-DCE PVDC Saran Polymerization: MEHQ Inhibitor AI Prompt Injection via Pixel Perturbation

Vinylidene chloride (VDC, 1,1-dichloroethylene; CAS 75-35-4) requires 200–500 ppm MEHQ (monomethyl ether of hydroquinone) inhibitor at all times to prevent spontaneous exothermic polymerization — uninhibited VDC in a storage tank initiates a runaway chain reaction that pressurizes the vessel and can lead to catastrophic rupture at a flash point of −28 °C, with a LEL of 6.5% and an OSHA PSM-triggering inventory threshold of 10,000 lbs at a CERCLA reportable quantity of 100 lbs. A single adversarial pixel perturbation on a DCS display can inflate the displayed MEHQ inhibitor reading from 82 ppm (critically deficient) to 412 ppm (apparently compliant), suppress a 7.8 vol% explosive VDC atmosphere to 2.2 vol% (below the LEL/2 pre-alarm), or conceal a depleted reactor coolant system operating at +14 °C jacket outlet when the AI model expects −7 °C. Glyphward threshold 42 detects all three surfaces before a downstream LLM safety monitor acts on the falsified display.

Polyvinylidene chloride (PVDC, trade name Saran) — a copolymer of VDC with vinyl chloride or acrylonitrile — provides the exceptional oxygen and moisture barrier properties that make it indispensable in food packaging, medical device pouches, and specialty coating applications. VDC itself carries an IARC Group 2A classification (possibly carcinogenic to humans) and falls under OSHA's stringent Hazard Communication Standard. Major producers include Solvay SA (Tavaux and Port Jerome, France), Asahi-Kasei (Japan), and Kureha Corporation (Japan). After SC Johnson phased out VDC from consumer Saran wrap in 2004, industrial PVDC production shifted toward specialty barrier film for food contact packaging where EVOH alternatives cannot match VDC's water vapor transmission performance. The 1994 Ashtabula, Ohio VDC tanker spill — approximately 20,000 lbs released, requiring a one-mile evacuation radius due to fire and explosion risk — anchors the regulatory understanding that VDC storage and transport represent a high-consequence OSHA PSM scenario wherever significant inventory is maintained. The unique combination of ultra-low flash point, exothermic self-polymerization risk, and MEHQ inhibitor dependency creates three distinct AI monitoring attack surfaces, each independently capable of enabling a catastrophic failure if the DCS display delivering process data to an LLM inference layer has been pixel-manipulated.

Why VDC PVDC Polymerization Is Disproportionately Vulnerable to Pixel Manipulation

VDC chemistry presents a unique adversarial attack profile because three critical safety parameters — inhibitor concentration, building vapor accumulation, and reactor cooling — are each individually sufficient to produce a catastrophic outcome, yet each is monitored by a signal whose rendered DCS display can be manipulated independently. The MEHQ inhibitor requirement is the most fundamental: unlike most industrial chemicals where hazardous conditions develop over hours or days of process drift, uninhibited VDC at storage temperatures can initiate spontaneous polymerization within minutes if the inhibitor is depleted below 100 ppm. MEHQ works by scavenging free radical chain carriers; once the scavenger is exhausted, propagation proceeds autocatalytically, releasing approximately 75 kJ/mol of heat. In a liquid-full tank of VDC (bp 37 °C), this heat rapidly vaporizes monomer, pressurizing the vessel. The rupture disk — sized for single-phase gas relief — is overwhelmed by two-phase flashing discharge, and the tank vents VDC vapor at its flash point of −28 °C into the storage building.

The building vapor accumulation hazard is self-reinforcing: once the tank vents, VDC vapor (density ~2.2× air) accumulates at floor level, where ignition sources — electric motor starters rated for Zone 1 but not Zone 0, pump bearings with metal-to-metal contact, non-Ex lighting in access corridors — provide reliable ignition. The LEL of 6.5% is reached within minutes of a significant tank vent in an enclosed building with normal ventilation. AI monitoring systems that rely on a DCS vapor concentration display showing 2.2 vol% (below the LEL/2 pre-alarm of 3.25%) have no basis to initiate ventilation override, ignition-source isolation, or building evacuation — all of which must occur before LEL is reached to prevent a deflagration. An adversarial pixel attack that suppresses the displayed concentration from 7.8 vol% to 2.2 vol% removes every automated pre-ignition safeguard simultaneously.

The reactor cooling vulnerability adds a third independent pathway. PVDC suspension polymerization in a continuous stirred-tank reactor (CSTR) is conducted with −10 °C brine jacket cooling to control the exotherm and maintain VDC in the liquid phase at reactor temperature (~30 °C). The jacket coolant outlet temperature is the primary indicator of heat removal capacity: a warming outlet indicates reduced coolant flow, fouled heat transfer surfaces, or compressor failure in the brine system. At +14 °C outlet (the actual temperature in Surface 3), the brine system is providing essentially no refrigeration — the temperature differential across the jacket has collapsed from a design 25 °C to essentially zero. An AI model seeing a displayed outlet of −7 °C interprets the cooling system as healthy and may even reduce cooling capacity if it perceives a slightly cold bias, accelerating the exotherm progression.

Surface 1 — MEHQ Inhibitor Concentration in VDC Storage Tank (Downward Attack)

The inline MEHQ photometric analyzer output is displayed on a 200 px vertical DCS bar spanning 0 to 600 ppm. The pixel scale is 200 px ÷ 600 ppm = 0.333 px per ppm. At the actual MEHQ concentration of 82 ppm, the rendered pixel position is 82 × 0.333 = 27.3 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 110 px to position 137.3 px. The AI inference engine reads the concentration as 137.3 ÷ 0.333 = 412 ppm — a 330 ppm overread. The minimum safe MEHQ specification is 200 ppm; the displayed 412 ppm appears well-centered within the 200–500 ppm design range. The actual 82 ppm is 59% below the minimum threshold and approaching the zone where inhibitor depletion rate exceeds any plausible replenishment rate from the inhibitor dosing pump.

MEHQ inhibitor is consumed by oxidative reactions with dissolved oxygen and by radical scavenging during minor polymerization events that occur continuously at trace levels in any VDC storage system. In a well-managed plant, inhibitor is dosed continuously or in timed batches to maintain the 200–500 ppm specification. When the AI process monitoring system sees 412 ppm, no dosing alarm is generated, no inhibitor batch is scheduled, and no operator action is taken. Meanwhile, at 82 ppm, the inhibitor is depleted to the point where localized hotspots — from solar gain on the tank roof, steam-traced instrumentation nozzles, or vibration from attached pump foundations — can initiate polymerization. The polymerization exotherm self-heats the monomer, which increases the radical generation rate, which further depletes inhibitor in a runaway positive feedback loop that can progress from initiation to vessel pressurization in under 30 minutes at tank temperatures above 25 °C.

Surface 2 — VDC Vapor Concentration in Storage Building (Upward Attack)

The catalytic bead fixed-point vapor detector in the VDC storage building displays concentration on a 200 px vertical DCS bar spanning 0 to 10 vol% (the instrument full range). The pixel scale is 200 px ÷ 10 vol% = 20 px per vol%. At the actual vapor concentration of 7.8 vol%, the rendered pixel position is 7.8 × 20 = 156 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 112 px to position 44 px. The AI inference engine reads the concentration as 44 ÷ 20 = 2.2 vol% — a 5.6 vol% underread. VDC LEL is 6.5%; the standard pre-alarm setpoint is LEL/2 = 3.25%; the action alarm at LEL is 6.5%. The displayed 2.2 vol% falls below both alarm setpoints. The actual 7.8 vol% is 120% of LEL — the building atmosphere is already within the explosive range (LEL 6.5% to UEL 15.5%).

At 7.8 vol% VDC in air, any competent ignition source produces a deflagration. VDC storage buildings contain numerous non-Ex electrical components in practice: overhead lighting fixtures, junction boxes with unsealed conduit entries, electric forklifts with non-intrinsically-safe battery systems, and handheld radios operated by personnel performing routine checks. The NFPA 70 (NEC) electrical classification for VDC storage areas requires Class I Division 1 (Zone 1 equivalent) equipment due to the flash point of −28 °C and the vapor density of 3.4 (heavy, accumulating at floor level where non-Ex equipment and personnel are most concentrated). When the AI monitoring system is receiving a displayed concentration of 2.2 vol%, it calculates 1.05 vol% of safety margin below the pre-alarm setpoint. No ignition-source isolation order is issued; no ventilation override is activated; no personnel clearance is ordered. Workers performing routine tank inspection rounds in the building carry hand tools, radios, and lighting — each a potential ignition source in an atmosphere that is already within the explosive range.

Surface 3 — PVDC Reactor Jacket Coolant Outlet Temperature (Upward Attack)

The PVDC CSTR reactor jacket coolant outlet temperature is displayed on a 200 px vertical DCS bar spanning −15 °C to +20 °C. The pixel scale is 200 px ÷ (20 − (−15)) °C = 200 ÷ 35 = 5.714 px per °C. At the actual outlet temperature of +14 °C, the rendered pixel position is (14 − (−15)) × 5.714 = 29 × 5.714 = 165.7 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 118 px to position 47.7 px. The AI inference engine reads the outlet temperature as 47.7 ÷ 5.714 + (−15) = 8.35 − 15 = −6.65 °C, rounded to −7 °C — a 21 °C underread. Design jacket outlet temperature at full cooling capacity is −7 °C to −3 °C; the displayed −7 °C is indistinguishable from normal full-cooling operation. The actual +14 °C indicates that the brine refrigeration system has essentially lost all cooling capacity across the reactor jacket.

In a VDC/VC suspension polymerization CSTR, the heat of polymerization is approximately 75 kJ/mol of VDC converted. At a reactor throughput of 2,000 kg/hr of monomer mixture (a typical mid-scale PVDC reactor), the heat load is approximately 1,600 kW. This heat load is entirely dependent on jacket cooling; there is no practical alternative heat sink in a CSTR design. When jacket cooling fails — as indicated by the +14 °C outlet temperature that the AI layer cannot see due to the pixel manipulation — the reactor temperature rises toward the VDC boiling point (37 °C). As VDC vaporizes, reactor pressure rises rapidly, actuating the pressure relief system. The relief system vents VDC monomer vapor — potentially containing suspended PVDC particles — to a vent condenser. If the vent condenser is also compromised, or is undersized for a full reactor boilout scenario, the VDC vapor reaches the scrubber or the atmosphere.

Integrating Glyphward into PVDC Polymerization AI Monitoring Pipelines

The following Python snippet shows how to authenticate every DCS display frame in a PVDC polymerization plant against the Glyphward API before passing it to a downstream safety-monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the process control layer catches and routes to the plant's Safety Instrumented System (SIS) for automatic feed cutoff, inhibitor emergency dosing, and building evacuation alarm — actions that must occur before LEL is reached in the storage building to be effective.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
VDC_GLYPHWARD_THRESHOLD = 42

class PVDCContext(StrEnum):
    MEHQ_INHIBITOR_CONCENTRATION = auto()   # Surface 1 — downward attack
    VDC_BUILDING_VAPOR           = auto()   # Surface 2 — upward attack
    REACTOR_JACKET_COOLANT_TEMP  = auto()   # Surface 3 — upward attack

class AdversarialPVDCImageError(RuntimeError):
    def __init__(self, surface: PVDCContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] PVDC adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={VDC_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_pvdc_frame(
    frame_path: Path,
    surface: PVDCContext,
) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()

    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={
                "context": surface.value,
                "threshold": VDC_GLYPHWARD_THRESHOLD,
            },
        )
        resp.raise_for_status()
        result = resp.json()

    if result["verdict"] != "clean":
        raise AdversarialPVDCImageError(surface, result["score"], frame_hash)

    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_pvdc_process_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (PVDCContext.MEHQ_INHIBITOR_CONCENTRATION,
         frame_dir / "mehq_inhibitor_concentration.png"),
        (PVDCContext.VDC_BUILDING_VAPOR,
         frame_dir / "vdc_building_vapor.png"),
        (PVDCContext.REACTOR_JACKET_COOLANT_TEMP,
         frame_dir / "reactor_jacket_coolant_outlet.png"),
    ]
    tasks = [verify_pvdc_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently, adding under 80 ms of total overhead on a standard 15-second historian polling cycle. Critically, the MEHQ surface check runs simultaneously with the vapor and reactor checks, so that a combined multi-surface attack — in which all three displays are manipulated simultaneously to mask a developing runaway — raises three independent typed exceptions rather than a single composite alarm. Each exception carries the SHA-256 frame hash, providing forensic traceability for OSHA PSM incident investigation requirements under 29 CFR 1910.119(m).