Prompt injection in wildfire early detection AI

Four adversarial injection surfaces in wildfire early detection AI

1. Ground camera network smoke plume detection AI (ALERTCalifornia / CAL FIRE PTZ)

The ALERTCalifornia network uses AI models trained on labeled historical PTZ camera frames — including frames from the 2018 Camp Fire (Paradise, CA), the 2020 North Complex, the 2021 Caldor Fire, and the 2023 Maui wildfires — to detect early smoke signatures from prescribed burn escapes, lightning strikes, and human-ignition events. The camera AI pipeline ingests MJPEG-encoded PTZ camera frames at 1–5 fps, renders them as RGB arrays, and passes them through a convolutional segmentation network that classifies smoke-containing regions with pixel-level bounding boxes. The primary AI detection model deployed by ALERTCalifornia is based on a YOLO architecture fine-tuned on the HPWREN/ALERTCalifornia annotated smoke image dataset — over 100,000 labeled frames from 1,000+ deployment sites. A confirmed smoke detection triggers alert generation to CAL FIRE’s Communications Center (CAL FIRE Communications Center in Sacramento coordinates air tanker and handcrew deployment for the FMAG-eligible incidents that ALERTCalifornia alerts initiate). The 2021 River Fire (Grass Valley, CA) — detected by ALERTCalifornia camera AI at 0.4 acres and contained at 2,577 acres with two air tanker drops — demonstrates the operational consequence of detection timing: detection at 0.4 acres rather than 40 acres reduced suppression cost from an estimated $4M to $240k (CAL FIRE incident cost data). An adversarial perturbation on the PTZ camera frame that shifts the apparent pixel distribution of a smoke plume signature from the smoke spectral class to the sky/haze class — suppressing the smoke detection bounding box — delays alert generation by the interval between perturbation application and the next unperturbed detection frame.

The adversarial injection surface in the ALERTCalifornia pipeline is at the rendered RGB frame ingestion boundary before the smoke segmentation model. An attacker with network access to the camera RTSP stream or the frame aggregation server could inject adversarially perturbed frames — frames that appear visually identical to humans reviewing the camera mosaic but suppress the convolutional smoke detection network’s bounding box output. CAL FIRE’s PSPS (Public Safety Power Shutoff) monitoring camera network operated in coordination with PG&E, SCE, and SDG&E deploys fixed cameras along high-risk transmission corridors specifically to detect ignition events from downed conductor arcing — an additional injection surface that targets the ignition source immediately adjacent to high-voltage infrastructure rather than the burn area downstream.

2. Satellite thermal anomaly detection AI (VIIRS, GOES-R ABI)

NASA’s VIIRS active fire product (Collection 2, 375m resolution) processes mid-infrared and thermal infrared satellite imagery into false-color thermal anomaly products — rendered images where pixel color encodes brightness temperature, with active fire pixels appearing as high-brightness-temperature regions against the background land surface temperature. The VIIRS fire detection algorithm applies contextual thresholding against neighboring pixels and a background brightness temperature model to classify fire pixels in the rendered thermal IR composite; the NOAA GOES-R ABI FDC (Fire Detection and Characterization) algorithm similarly processes rendered Fire Temperature RGB composites where the R channel (Band 7, 3.9μm shortwave IR), G channel (Band 14, 11.2μm longwave IR), and B channel (Band 13, 10.3μm longwave IR) are combined into false-color composites that feed the GOES ABI fire detection neural network at NOAA’s CIMSS (Cooperative Institute for Meteorological Satellite Studies). Machine learning fire detection models operating on these rendered satellite products — including Google’s EarthEngine wildfire detection, Descartes Labs fire mapping, and fire agency operational implementations — ingest the rendered false-color composites as RGB images and classify fire pixel clusters. An adversarial perturbation on the rendered VIIRS I-Band or GOES ABI Fire Temperature RGB composite — a pixel modification that shifts the brightness temperature color encoding of active fire pixels from the fire spectral class to the land surface temperature background class — can suppress fire pixel detection in the satellite-derived active fire product, preventing NIFC Active Fire Mapping Program updates that drive tactical aerial resource deployment and evacuation order triggers.

The California Air Resources Board (CARB) and USFS use satellite active fire products to trigger real-time air quality alerts under the AirNow Fire and Smoke Map (EPA monitoring program); suppression of satellite fire detection AI outputs delays not only tactical suppression response but public health protective action notifications — shelter-in-place advisories for PM2.5 exposure in downwind communities — in communities where wildfire smoke PM2.5 concentrations exceed the NAAQS 24-hour standard of 35 μg/m³ within 1–4 hours of ignition under Red Flag wind conditions.

3. Autonomous drone wildfire patrol AI

Autonomous wildfire patrol drones — deployed by CAL FIRE, USFS, and international agencies including Australia’s AFAC (Australasian Fire and Emergency Service Authorities Council) member agencies and the European Forest Fire Information System (EFFIS) participating countries — use onboard AI to continuously scan patrol zones for smoke signatures and thermal anomalies without requiring real-time human operator monitoring. The drone patrol AI integrates two complementary sensor streams: RGB camera-based smoke plume detection (the same computer vision pipeline as ground camera networks, adapted for aerial perspective) and thermal infrared (FLIR Boson+, Seek Reveal Pro Fusion) camera-based hotspot detection that renders a thermal false-color composite frame and classifies pixel clusters that exceed a fire temperature threshold. The drone AI processes both streams through onboard inference hardware (NVIDIA Jetson Orin NX, Intel OpenVINO deployment) and triggers autonomous alert transmission to the fire coordination center when either detection is confirmed above confidence threshold. BVLOS (Beyond Visual Line of Sight) drone operations under FAA Part 107.31 waivers (and international equivalents: EASA BVLOS authorization, CASA Australia BVLOS permit) allow patrol drones to cover 10–50 km² per sortie without ground crew visual oversight — the AI detection AI is the sole detection mechanism over the patrol zone for the duration of the sortie.

In BVLOS wildfire patrol operation, adversarial injection into the drone’s RGB smoke detection AI or thermal image classification AI eliminates the sole automated detection mechanism for the patrol zone during the sortie window. A perturbed thermal frame that suppresses a developing hotspot signature from a smoldering fire in heavy fuel load prevents the drone from triggering an alert transmission — the fire continues smoldering beneath the canopy, expanding under low relative humidity conditions, until the drone sortie ends and the next patrol begins (typically 4–12 hour patrol interval for overnight high-risk monitoring). Fire behavior modeling under FMC (Fuel Moisture Content) conditions representative of August California Red Flag events shows exponential area growth from a 0.1-acre smoldering hotspot over a 6-hour undetected window: 0.1 acres at hour 0, 3–8 acres by hour 2 when diurnal wind picks up, 200–2,000 acres by hour 6 depending on slope and aspect (FARSITE / Phoenix fire behavior model outputs for Sierra Nevada mixed conifer).

4. Fire weather model integration AI

Wildfire early warning systems integrate camera and satellite detection with fire weather model outputs — NOAA’s HRRR (High-Resolution Rapid Refresh) and WRF (Weather Research and Forecasting) model outputs that produce rendered wind field diagrams, relative humidity maps, and fuel moisture content visualizations. AI weather pattern recognition systems — including The Weather Company’s Fire Potential Index AI, DTN (formerly DTN Agriculture) fire weather AI, and IBM PAIRS Geoscope fire risk modeling — process rendered weather model visualization images as inputs to fire risk classification networks that output fire ignition probability maps used by CAL FIRE, USFS Fire Weather Program, and NWS Fire Weather Forecast offices to trigger Red Flag Warning issuance and pre-positioning of suppression resources. An adversarial perturbation on a rendered HRRR wind field visualization — shifting the apparent wind speed color encoding from the high-wind fire-spread class to the lower-wind moderate-risk class — can cause the fire weather AI to underestimate fire spread potential in the model forecast window, suppressing Red Flag Warning triggers and preventing suppression resource pre-positioning (air tanker retardant loading, handcrew staging, dozer pre-deployment) before ignition in the forecast high-risk period.

The National Wildfire Coordinating Group (NWCG) Red Flag Warning issuance protocol (NWCG PMS 437) uses a combination of NWS Fire Weather Forecast criteria (relative humidity <15%, sustained winds >25 mph or gusts >35 mph, critically dry fuel moisture) and fire weather AI risk classification to trigger pre-positioning; a suppressed fire weather AI risk score that falls below the Red Flag trigger threshold prevents the resource pre-positioning that reduces initial attack success rates from the historical 97% at 10-minute response to 78% at 30-minute response (USFS initial attack effectiveness research, 2022).

Integration: wildfire detection AI image scanning with Glyphward pre-scan gate

The Glyphward scan gate for wildfire early detection AI belongs at the rendered image ingestion boundary before each AI classification step — before smoke plume detection AI processes PTZ camera frames, before satellite thermal anomaly AI processes VIIRS/GOES-R rendered composites, before drone patrol AI processes RGB or thermal camera frames, and before fire weather AI processes rendered model output visualizations. Threshold 40 for wildfire detection AI reflects mass-casualty WUI potential and the asymmetric consequence structure of false negatives (detection delay → exponential fire growth) versus false positives (alert dispatch for a non-fire event, suppressed by human dispatcher review within 60 seconds).

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Wildfire detection AI contexts: threshold 40
# CAL FIRE, USFS, NIFC wildfire early detection and alert dispatch.
WILDFIRE_AI_THRESHOLD = 40


class WildfireDetectionAIContext(Enum):
    GROUND_CAMERA_SMOKE     = "ground_camera_smoke"     # ALERTCalifornia / CAL FIRE PTZ AI
    SATELLITE_THERMAL       = "satellite_thermal"        # VIIRS / GOES-R ABI fire detection AI
    DRONE_PATROL_RGB        = "drone_patrol_rgb"         # Autonomous drone RGB smoke AI
    DRONE_PATROL_THERMAL    = "drone_patrol_thermal"     # Autonomous drone FLIR hotspot AI
    FIRE_WEATHER_MODEL      = "fire_weather_model"       # HRRR/WRF fire weather risk AI


class AdversarialWildfireImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a wildfire
    detection AI image above threshold 40.

    Consequence if not raised: suppressed smoke or fire detection → delayed
    alert dispatch → exponential fire growth in the detection delay window.
    Fail-safe action: suppress AI detection output, escalate to human dispatcher
    review of raw sensor feed for the affected camera/satellite/drone source.
    """

    def __init__(self, scan_id: str, score: int,
                 context: WildfireDetectionAIContext,
                 source_id: str, location: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.source_id = source_id
        self.location = location
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial wildfire detection image: "
            f"context={context.value} score={score} "
            f"source={source_id} location={location} scan_id={scan_id}"
        )


async def scan_wildfire_detection_image(
    image_bytes: bytes,
    context: WildfireDetectionAIContext,
    source_id: str,
    location: str,
    capture_timestamp: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a wildfire detection AI image for adversarial pixel content.

    Fail-safe contract: AdversarialWildfireImageError or httpx error →
    suppress AI detection output, escalate to human dispatcher review of raw
    sensor feed. Never silently pass a scan failure to the detection pipeline.

    Args:
        image_bytes: PTZ camera frame, VIIRS/GOES-R thermal composite,
            drone RGB/thermal frame, or fire weather model visualization.
        context: WildfireDetectionAIContext identifying the pipeline.
        source_id: Camera ID, satellite pass ID, drone ID, or model run ID.
        location: Geographic identifier (camera location, lat/lon bounding box).
        capture_timestamp: ISO 8601 image capture or model valid time.
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialWildfireImageError: if score exceeds threshold 40.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"wildfire_ai:{context.value}:{source_id}",
        "metadata": {
            "source_id": source_id,
            "location": location,
            "capture_timestamp": capture_timestamp,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_wildfire_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        source_id=source_id,
        location=location,
        capture_timestamp=capture_timestamp,
        flagged=result["score"] > WILDFIRE_AI_THRESHOLD,
    )

    if result["score"] > WILDFIRE_AI_THRESHOLD:
        raise AdversarialWildfireImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            source_id=source_id,
            location=location,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_wildfire_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: WildfireDetectionAIContext, source_id: str,
    location: str, capture_timestamp: str, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": WILDFIRE_AI_THRESHOLD,
        "flagged": flagged,
        "source_id": source_id,
        "location": location,
        "capture_timestamp": capture_timestamp,
        "regulatory_refs": [
            "CAL FIRE PSPS camera network (California PUC GO 95)",
            "USFS National Wildfire Coordinating Group NWCG PMS 437 (Red Flag Warning)",
            "NASA VIIRS Active Fire Product Collection 2 (NASA FIRMS)",
            "NOAA GOES-R ABI FDC product (CIMSS/SSEC)",
            "EPA AirNow Fire and Smoke Map (PM2.5 NAAQS 40 CFR Part 50)",
            "FAA Part 107.31 BVLOS waiver (autonomous drone patrol)",
            "Copernicus EFFIS (EU Forest Fire Information System)",
        ],
    }
    audit_path = Path("/var/log/glyphward/wildfire_detection_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_wildfire_detection_image at each wildfire detection AI image ingestion boundary: before PTZ ground camera smoke detection AI (threshold 40), before VIIRS/GOES-R satellite thermal anomaly AI (threshold 40), before drone patrol RGB and thermal AI (threshold 40), and before fire weather model risk classification AI (threshold 40). On AdversarialWildfireImageError: suppress AI detection output and escalate to human dispatcher review of the raw sensor feed — the dispatcher reviews the unprocessed camera mosaic or satellite product directly for the affected source, bypassing the compromised AI classification layer. Get early access

Related questions

Further reading

• Prompt injection in drone and UAV AI — delivery, inspection, and BVLOS adversarial image attacks
• Prompt injection in satellite remote sensing AI — earth observation and geospatial AI adversarial attacks
• Prompt injection in smart grid AI — power distribution monitoring and SCADA AI adversarial attacks
• Prompt injection in public safety and emergency services AI — dispatch and situational awareness adversarial attacks
• Prompt injection scanning API free tier — 10 scans/day, no card required