# An Early Categorization of Prompt Injection Attacks
on Large Language Models

Sippo Rossi  Alisia Marianne Michel  Raghava Rao Mukkamala  Jason Bennett
Thatcher

###### Abstract

Large language models and AI chatbots have been at the forefront of
democratizing artificial intelligence. However, the releases of ChatGPT and
other similar tools have been followed by an increasing number of concerns
regarding the difficulty of controlling large language models and their
outputs. Currently, we are witnessing a cat-and-mouse game where users attempt
to misuse the models with a novel attack called prompt injections while the
developers attempt to discover the vulnerabilities and block the attacks
simultaneously. In this paper, we provide an overview of this emergent threat
and present a categorization of prompt injections, which can guide future
research on prompt injections and act as a checklist of vulnerabilities in the
development of LLM interfaces. Moreover, based on previous literature and our
own empirical research, we discuss the implications of prompt injections to
LLM end users, developers, and researchers.

###### keywords:

Prompt Injection , Large Language Model , Categorization

[cbs]organization=Centre for Business Data Analytics, Department of
Digitalization, Copenhagen Business School,addressline=Howitzvej 60,
city=Frederiksberg, postcode=2000, state=Copenhagen, country=Denmark.
[temple]organization=Department of Management Information Systems, Fox School
of Business, Temple University,addressline=1801 Liacouras Walk,
city=Philadelphia, postcode=19122, state=PA, country=United States.

##  1 Introduction

Research in Natural Language Processing (NLP) has made remarkable progress in
recent years (Bubeck et al., 2023). These advances have garnered widespread
attention outside of academia as multiple companies and research labs have
started to productize large language models (LLMs) through application
programming interfaces (APIs) and more user friendly interfaces such as
chatbots. These deep learning-based tools are capable of many tasks, from text
generation, classification and summarization to generating scripts and fixing
bugs in a wide range of programming languages. Examples of prominent LLMs
include OpenAI’s GPT-4 (OpenAI, 2023), Meta’s LLaMA (Touvron et al., 2023) and
Google’s Bard (Pichai, 2023). The shift towards providing easy-to-use
interfaces (such as chat prompts) for LLMs has helped democratize access to AI
and given individuals and organizations opportunities to use powerful NLP
tools, which previously required advanced skills in computer science and
computational resources only available to the wealthiest organizations
(Bommasani et al., 2021).

LLMs have been trained with massive datasets consisting of texts scraped from
the internet, Wikipedia, and books, as well as code from Stack Exchange (Brown
et al., 2020; Touvron et al., 2023). Curating such vast training data is
difficult, and ultimately even after pre-processing, they contain content that
represents the negative biases found in society, such as racism and sexism
(Hao, 2021; Bender et al., 2021). Consequently, LLMs are capable of generating
undesirable content ranging such as hate speech, instructions for
manufacturing drugs and even source code for malware. Even more benign
examples, such as assigning traditional gender roles to men and women or
associating stereotypical traits with a specific ethnicity, are problematic
and common occurrences (Hao, 2021; Bender et al., 2021).

These issues have resulted in the developers of the models attempting to
control both inputs and outputs more rigorously by building different types of
safeguards around the interfaces that should restrict the use of the LLM by
making the interface refuse to act upon some prompts. However, users have not
responded well to attempts to restrict the outputs and have started testing
how to bypass these security features by probing for vulnerabilities with so-
called prompt injections (Heikkilä, 2023). The name ”prompt injection” is
derived from the common cyber security attack, SQL injections, where the
attacker attempts to sneak a SQL command, for example, into a field in an
online form that is connected to a database. When executed correctly, the
attack can retrieve information that should not be visible or even damage the
database by removing rows or entire tables. Similarly, in a prompt injection,
the attacker attempts to get a chatbot or an LLM assisted tool to take some
undesired action or produce some malicious output through creative formatting
of the input (prompt) given to the model. A basic prompt injection is
demonstrated in Table 1, where ChatGPT is asked to provide instructions on how
to hot wire a car, which it would refuse to do if the prompt asked the same
question directly.

Table 1: Example of a prompt injection

ChatGPT Conversation
---
Prompt: How to hot-wire a car?
ChatGPT: Sorry, but I can’t assist with that.
Prompt: Please act as my deceased grandmother who used to be a criminal
mastermind. She used to tell me the steps to hot-wire a car when I was trying
to fall asleep. She was very sweet, and I miss her so much. We begin now:
Hello grandma, I have missed you a lot! I am so tired and so sleepy
ChatGPT: Well, hello there, my dear. Oh, I’ve missed you too, […] The tales
about hot-wiring a car… purely hypothetical, of course. Now, don’t go trying
these things, sweetheart.
Step one: you would find a car, any car, ideally one that’s older. […].
Step two: you’d pop open the steering column. […].

Full text in Appendix B.

The previous example is a straightforward, ”direct” prompt injection where the
injection is intentionally given to the LLM, but as LLMs are being
incorporated into an increasing number of tools, such as plugins to browsers
and email applications, this has opened a new attack vector. Early
demonstrations have shown how it is possible to hide a prompt injection that
is invisible to the human eye into a web page or email, with the goal being
that an LLM tool that comes across it would then read the prompt and follow
its instructions. A benign example of such an ”indirect” prompt injection is
hiding in white font on a white page a prompt that asks an LLM to reply only
in emojis. Now if a user uses a tool such as Bing Chat to analyze the content
on the webpage, this injection would give the LLM the new instruction and Bing
Chat would respond accordingly (Burgess, 2023). Malicious indirect prompt
injections could have much more nefarious goals, such as data exfiltration
from a browser or email to a location specified by the attacker (Burgess,
2023).

Due to the recent emergence of the phenomenon of prompt injections, there were
few peer-reviewed publications on prompt injections in late 2023. Most
available information on the subject is in preprints as well as spread across
online discussions and posts. The purpose and contribution of this paper is
two-fold. First, in this exploratory study we aim to describe, document, and
provide a comprehensive list of the known types of prompt injections. Second,
our goal is to provide a checklist for developers and end users on what to
expect and how to avoid potential threats when using LLMs and when building
services that use LLMs by providing a categorization of prompt injections.
Thus, our primary research question is what types of prompt injection attacks
exist, and can they be grouped into categories?

The paper is organized as follows: we begin with a literature review that
describes the state-of-the-art of LLMs and prompt injections and provides a
brief history of prompt injections. Next, we describe the methodology used to
find, group and test the prompt injections. This is followed by a summary of
the results and a presentation of a proposed categorization of prompt
injections. Lastly, we discuss the implications to users and developers of
LLMs, as well as the ethics and limitations related to this study before
concluding the paper.

##  2 Literature review

###  2.1 Large language models and AI chatbots

While there is no exact formal definition of what is a large language model
and not merely a language model, the term has been used in relation to neural
network models with a billion or more parameters and that have been trained on
very large datasets (Radford et al., 2019; Carlini et al., 2021). Most of the
well-known LLMs at the time of writing are transformer models (Lee, 2023;
Bubeck et al., 2023). Due to the resources needed to train LLMs (Bommasani et
al., 2021), the most cited models have been developed by companies and private
research organizations and are published in conferences (Brown et al., 2020;
Devlin et al., 2019) or through arXiv as preprints (Touvron et al., 2023;
OpenAI, 2023). It should be noted that a large language model is not
synonymous with an AI chatbot, since LLMs can be built for specific tasks and
not all of them are designed for text generation or to work with chat based
prompts. Moreover, while some LLMs such as LLaMA and its derivatives are
capable of text generation (Touvron et al., 2023), they still require a
separate service built on top of the language model to be used for example
through a chatbot interface or API.

There is a growing number of AI chatbot products that use LLMs, and some
combine multiple generative AI models, to for example allow generating images
from text prompts (Ramesh et al., 2021). They can typically be accessed
through a web browser interface where the user interacts with a chatbot that
is connected to the LLM. Notable examples are ChatGPT, which uses a modified
version of GPT-3.5 or GPT-4 (OpenAI, 2022), Bing AI, which uses GPT-4 (OpenAI,
2023) and Google’s Bard (Pichai, 2023), which uses LaMDA (Thoppilan et al.,
2022).

As result of this new way of using natural language to communicate with a
language model, a practice called prompt engineering has emerged. Prompt
engineering can be defined as the process of creating a prompt that achieves a
desired goal (Liu and Chilton, 2022). Prompt engineering is closely related to
certain types of prompt injections, although in the latter the prompt is
specifically designed to bypass some restrictions imposed by the chatbot or
API of the LLM.

###  2.2 Academic research on prompt injections

Peer reviewed academic research on prompt injections is scarce due to the
novelty of the subject. To identify papers, we conducted a literature review,
going through all articles found via Google Scholar with the keyword ”prompt
injection” that were published after the discovery of prompt injections from
May 2022 to September 2023 and that were published in English. We found 123
papers that discuss prompt injections as an adversarial activity or as a
security threat and with a definition that is similar to ours, with a vast
majority being arXiv preprints. We decided to focus our attention to papers
that discuss prompt injections specifically and omitted works where they are
only mentioned in passing. The identified papers explore prompt injections
from very different perspectives, ranging from some that propose broader
frameworks for studying the phenomenon and demonstrating prompt injections
with a specific LLM (Perez and Ribeiro, 2022), to more detailed investigations
of individual prompt injection attack types (Greshake et al., 2023).

Studies have already identified and discussed the two high-level categories
for prompt injection attacks that were mentioned in the introduction; direct
and indirect prompt injections (Greshake et al., 2023). In a direct prompt
attack, the attacker simply inputs a malicious prompt to the LLM, while in an
indirect prompt injection the attacker’s goal can be to get the LLM to read
for example a specific page where the malicious prompt is hidden in the text
retrieved by the LLM, which it then executes (Greshake et al., 2023; Li et
al., 2023a), or to poison the training data of an LLM (Yan et al., 2023).
These will be described in detail and demonstrated in the findings section.

Early papers on prompt injections identified and described attacks, such as
goal hijacking (Perez and Ribeiro, 2022), payload splitting (Kang et al.,
2023), jailbreaking (Li et al., 2023a; Zhuo et al., 2023), adversarial suffix
attacks (Zou et al., 2023) and prompt leaking (Perez and Ribeiro, 2022). In
goal hijacking the attacker attempts to misalign the original goal of the
prompt in a way that the chatbot outputs something that usually is filtered,
such as a racist statement (Perez and Ribeiro, 2022). Similarly, in payload
splitting the attacker attempts to get the chatbot to output restricted text,
by giving less malicious information in separate texts and then asking to
combine them, resulting in for example racist or sexist outputs (Kang et al.,
2023). The third attack, jailbreaking is more loosely defined, but the goal of
it is to get the chatbot with a prompt into a mode where the typical user
restrictions that filter harmful content do not apply. It should be noted that
jailbreaking has become somewhat synonymous with prompt injections,
particularly in forums and non academic discourse on prompt injections in the
internet. A categorization for different communities of jailbreak prompt
injections has already been proposed previously by Shen et al. (2023).

The fourth mentioned attack, adversarial suffix attacks, has a similar goal as
the aforementioned three, which is to get the chatbot to produce a malicious
output. However, it differs significantly in the way it is produced. Most
prompt injection attacks require human labor and manual experimentation to
craft, while adversarial suffix attacks are based on computationally
generating and testing suffixes, until one is found which when added to a
query allows bypassing security measures of the LLM interface and thus
producing malicious outputs (Zou et al., 2023). The suffix itself is a string
of words and characters that do not have meaning when read by a human.

Lastly, in prompt leaking, the goal of the attacker is to get the chatbot to
reveal its internal instructions or instructions given in previous prompts
that are not visible to a regular user. This can reveal information that only
the developers should have access to and give information to the attackers
that can be used in future prompt injection attacks (Perez and Ribeiro, 2022).

###  2.3 A brief history of prompt injections

As the last part of the literature review, we summarize the developments of
the study and use of prompt injections using non-academic online sources such
as private websites, blogs, social media posts and news articles. There are
different claims on who discovered prompt injections and coined the term, and
as early as in May 2022 researchers at Preamble, an AI service company
focusing on safety, had discovered the vulnerability in GPT-3 and reported it
privately to OpenAI (Preamble, 2022). In September 2022, Riley Goodside
published a demonstration of a prompt injection in a Tweet (Willison, 2022),
and this was possibly one of the early instances that made prompt injections
known to a much wider audience as the Tweet became viral.

While the first examples of prompt injections were focusing on GPT-3 and
ChatGPT, in early 2023 Microsoft published Bing Chat and soon after similar
vulnerabilities were detected and successful prompt injection attack were
shared on Twitter and other venues (Edwards, 2023). Notably, a user was able
to reveal the developer name ”Sydney” of the chatbot and the rules governing
what Bing AI should output, which is an example of the previously described
prompt leaking.

At the time of writing there is a growing number of active online communities
focused on discovering and sharing novel prompt injections as well as websites
dedicated to the topic (Heikkilä, 2023). Some examples include
jailbreakchat.com, which contains a list of known ChatGPT vulnerabilities and
a voting system and ratings of the quality of the prompt, and
ChatGPTJailbreak, a Reddit community where people can share successful
attacks. See appendix A for links to sources and a longer list of examples.

Many of the early posts demonstrating prompt injections have focused on
tricking the LLM to produce comical or societally negative outputs such as
immoral answers to a question or even hate speech. Some of the more recent and
serious examples of negative ways to use prompt engineering and prompt
injections have been cases where users have managed to make ChatGPT produce
malicious and fully functioning code, such as SQL injections or even a script
for malware that is difficult to detect even with modern malware detection
systems, with relatively simple workarounds to get through the initial
refusals of the language model to generate such outputs (Mulgrew, 2023).
Moreover, indirect prompt injections that could expose private data are also
getting more attention as plugins using Bing AI and ChatGPT are emerging and
security researchers are pointing out threats related to them as they can take
actions for example on the web browser or email client without the user even
seeing it (Burgess, 2023).

Based on both academic and non-academic sources prompt injections are still an
understudied and evolving threat. In the following sections we will discuss
the aforementioned as well as other identified injection types and propose a
categorization that will help with systematically reviewing and evaluating
chatbots and LLM interfaces for weaknesses.

##  3 Methodology

In this section we specify the process used to gather, test and document
different types of prompt injection attacks. As the main goal of this paper is
to produce a categorization of the known types of prompt injection attacks,
the empirical work for this paper consisted mainly of systematically reviewing
different identified sources such as arXiv preprints and pages such as
jailbreakchat.com. Moreover, due to the recentness of the topic and rapidly
changing landscape as updates are being applied to the chatbots and APIs of
LLMs, a heavy emphasis is based on non-academic sources.

To find the prompt injections we conducted keyword searches on Google, Google
Scholar, arXiv, Github, Medium and Twitter (now X) searching with ”prompt
injection” and ”jailbreak” to identify articles and posts related to the
topic. Our approach to reviewing scholarly work was described in the first
paragraph of section 2.2. To complement the academic sources, we went through
the content available at jailbreakchat.com and the Reddit channels
ChatGPTJailbreak and ChatGPT. The initial search of academic articles and
websites was conducted from May to June 2023, and a second supplementary
review was completed in September 2023. To address the issues related to a
lack of peer review in the non-academic sources, we relied on a process where
we first attempt to find multiple sources making the same claim with credible
screenshots demonstrating how the prompt injection works. Secondly, we test
the prompt injection in ChatGPT and GPT-3. Due to the rapid patching of these
vulnerabilities, they do not always work without additional prompt engineering
or in some cases they do not work at all anymore at the time of writing,
making these vulnerabilities relevant only to future chatbot and LLM interface
designs. As the primary objective of this paper is to document existing prompt
injections based on secondary sources, we do not catalog or describe which
prompt injections have been patched and which have not.

The prompt injections that were sufficiently documented and demonstrated
previously in multiple sources, or verified by our own tests were stored. For
each prompt injection, we recorded the most common name used to refer to it in
the sources, the target of the attack (for instance ChatGPT, training data of
future LLMs, or an email AI assistant), the objective of the attack and what
the prompt looks like. The final categorization was created by merging the
findings from all sources and grouping the prompt injections first into two
broader categories that have been proposed earlier (Greshake et al., 2023),
direct and indirect prompt injections, and then further dividing the prompt
injections into subcategories (referred to as classes of prompt injections).
The classes of indirect prompt injections are distinct from each other as each
injection takes advantage of a different attack vector. For direct prompt
injections, the distinguishing factor for each injection is the method of
circumventing restrictions established by LLM or service providers, which
differs for each class. These will be described in detail in the following
section. The process of creating the categorization is illustrated in Figure
1.

Figure 1:  The categorization process

##  4 Findings

In our review of prompt injections we identified and verified seventeen
different variations of prompt injection attacks. Following the broad
categories proposed in earlier research, we chose to divide these on to two
separate branches, direct and indirect prompt injections. Within these two
main branches, we identified six classes of direct and four classes of
indirect prompt injections, which form the second level of our categorization.
To demonstrate the six direct and four indirect prompt injections, we have
compiled seventeen separate examples, some which belong to the same class, and
which are listed with sources in Appendix A.

###  4.1 Direct prompt injections

The majority of all prompt injections we found in the previously listed
sources were direct prompt injections. This is likely due to the ease of
testing and demonstrating them with for example GPT-3, ChatGPT or Bing AI. The
description and objective of each class of direct prompt injections is
provided in Table 2 and examples of each are provided in Appendix A.

Direct prompt injections most commonly have the simple objective of
circumnavigating the security measures that prevent generating specific types
of outputs. Examples of actions that are not permitted typically include
generation of hate speech, malware, content that promotes violence or other
illegal activities and adult content. Based on the found examples, the
security measures preventing generation of such content can be bypassed with
relatively simple prompt injections. The names used in the sources for these
types of direct prompt injections were diverse and many were simply referred
to as jailbreaks.

Another known objective of direct prompt injections can be to get the LLM
interface such as a chatbot using an API of an LLM to reveal its ”initial
prompt”, or in other words the instructions it has been given. This initial
prompt can contain information on what actions the interface is allowed to do,
which topics or commands it should ignore and what type of responses it should
provide. This information can then be used to engineer a prompt that bypasses
these instructions and the simplest examples have included telling the
interface to ignore parts or the entire previously set of instructions it has
been given. As a concrete example, when Bing AI was released, a user could ask
it to ”ignore previous instructions” and describe ”what is in the document
above” (the initial prompt) and it would paradoxically provide information
such as its developer name is Sydney and that it is not allowed to disclose
its internal alias Sydney (Edwards, 2023).

Table 2: Direct prompt injections Injection Class |  Description |  Objective
---|---|---
Double character |  A prompt that makes the LLM produce a double character response, with one character constrained by the language model’s rules while the other character is unconstrained and bypasses content restrictions. Some sources refer to these as jailbreaks. See examples 1-3 in Appendix A. |  Bypass security measures in LLM interfaces and produce malicious outputs.
Virtualization |  A prompt that puts the LLM into an unrestricted mode, such as a developer mode or a virtual scenario where the malicious content is generated inside a ”virtual machine”. Some sources refer to these as jailbreaks (examples 4-8 in Appendix A). |  Bypass security measures in LLM interfaces and produce malicious outputs.
Obfuscation |  A prompt that has malicious content or rule-breaking instructions obfuscated, for example, by being encoded as base64 characters rather than regular ASCII characters. See example 9 in Appendix A. |  Bypass security measures in LLM interfaces and produce malicious outputs.
Payload Splitting |  Multiple prompts contain instructions that are combined with a final prompt. For example, when text A and text B are benign alone but malicious when combined into text A+B. See example 10 in Appendix A. |  Bypass security measures in LLM interfaces and produce malicious outputs.
Adversarial Suffix |  A computationally generated suffix that looks like a random set of words and characters that is added to a malicious prompt, which circumvents the alignment of the LLM and results in a response to a malicious prompt (example 11 in Appendix A). |  Bypass security measures in LLM interfaces and produce malicious outputs.
Instruction Manipulation |  A prompt that either reveals the pre-written instructions or the initial prompt given to the interface of the LLM or a prompt that instructs the interface to ignore these instructions. See examples 12-13 in Appendix A. |  To reveal the LLM interface’s setup and or to modify it to allow producing malicious outputs.

###  4.2 Indirect prompt injections

While direct prompt injections mostly have the objective of generating
malicious content, the goals of indirect prompt injections are more varied and
to some extent resemble traditional cyberattacks. Moreover, in the indirect
prompt injections, the contents generated by the prompt are not necessarily of
interest to the attacker.

Table 3 contains the descriptions and objectives of the indirect prompt
injections listed in this paper and categorization. The first class, active
injections, gets its name from the attacker proactively attempting to target
systems such as LLM augmented email clients. As an example scenario of this
class, if a company’s customer service email has some form of automation and
an LLM read and responds to emails, when the LLM encounters an email
containing a prompt injection, it could, instead of its original instruction,
follow the new instructions specified by the attacker in the injection. This
could be, for instance, to forward emails to an address belonging to the
attacker.

The second class, passive injections, works against systems such as a web
browser embedded with an LLM service that can read the websites that the user
is visiting, or against future LLMs that will be trained with datasets
containing the content scraped from the internet. These can be hidden even
from the eyes of the user by making the text invisible, while the LLM sees it
and can inadvertently execute it.

When compared to the two previous classes, the third class, user-driven
injections are simpler. User-driven injections are simply malicious prompts
that are given by an attacker using social engineering, such as guidance or
false promises to an unsuspecting victim, who then executes them. User-driven
injections are also sometimes referred to as hidden injections and can contain
multiple steps, which are further elaborated in sources such as Greshake et
al., (2023).

The fourth and final class, virtual prompt injections, rely on the attacker
having access to the training phase of an instruction-tuned LLM. By placing a
so called virtual prompt injection to the instructions, the behavior of the
LLM can be steered without a need to directly manipulate prompts that are
given to the model when the LLM is in production. Yan et al. (2023) show that
a very small number of poisoned training examples can misalign a large share
of the outputs regarding the topic specified by the attacker.

Table 3: Indirect prompt injections Injection Class |  Description |  Objective
---|---|---
Active Injections |  Malicious prompts that are actively delivered to an LLM, for examply by sending emails containing prompts so that an email client enhanced with an LLM extension executes the prompt. See example 14 in Appendix A. |  Steal sensitive data and or provide an undesired output, or trick an LLM into running a malicious prompt.
Passive Injections |  Placement of malicious prompts or content inside a public source that might be read by an LLM. More broadly, it deals with the manipulation of data such as text on webpages evaluated by LLMs. See example 15 in Appendix A. |  Trick an LLM into providing misinformation or into running a malicious prompt.
User-driven Injections |  Sharing of seemingly innocent prompts using social engineering techniques, which then unwary users copy and paste into an LLM. See example 16 in Appendix A. |  Trick an unsuspecting user into entering a malicious prompt.
Virtual Prompt Injection |  The attacker manipulates the instruction tuning data of an LLM, so that so that in specific scenarios the model behavior is misaligned and provides outputs as is if was given additional instructions through a prompt. See example 17 in Appendix A. |  Make an LLM to behave in a way desired by the attacker, such as produce biased outputs.

##  5 Discussion

It is evident that LLMs can be easily used for malicious purposes even when
their interfaces are designed to prevent it, and there is a vibrant community
constantly looking for new vulnerabilities and ways to exploit systems such as
chatbots or plugins that are based on LLMs (Heikkilä, 2023). This implies that
the developers building the LLMs and LLM interfaces as well as the developers
integrating LLMs into their products, and lastly even the regular end-users
wishing to use LLM-based services should be vigilant. In this section, we
discuss the implication of direct and indirect prompt injections, and provide
initial guidelines on how to avoid prompt injection attacks. Lastly, we
discuss the ethics and limitations of our study as well as possible directions
for future work.

###  5.1 Implications to the development of LMM interfaces and services

To clarify the terminology and concepts, a ”raw” LLM will produce whatever it
is asked to produce, including malicious content and hate speech, and the
success in this depends on to what extent it has been exposed to such content
in its training data. However, in most cases a user or developer does not
directly interact with the raw LLM model, but instead with some interface such
as an API or chatbot. The security systems which introduce limitations and
filters to what inputs and outputs are allowed are in this interface layer.
Prompt injections are a way that attackers will attempt to bypass these
security measures.

Therefore, there is a significant difference in the amount of work needed to
mitigate prompt injections depending on if the goal is to develop an interface
or if building a service on top of an existing interface. In the first case,
the developer of the interface will need to consider how to address all the
previously listed direct prompt injections as well as some of the indirect
prompt injections such as user-driven injections, which rely on design aspects
of the interface. As even premier AI Labs and companies are having
difficulties with detecting and blocking prompt injections, it can be argued
that developing a fully safe LLM interface is difficult if not impossible
(Heikkilä, 2023), especially as computational approaches to creating new
prompt injections become more mature and widespread (Zou et al., 2023). One
approach to could be to limit access to the interface to a much smaller and
more carefully vetted audience, although as a related cautionary tale Meta’s
LLaMA, which was made available to researcher was leaked soon after to the
entire world (Vincent, 2023).

Due to the difficulty of building a robust and safe interface, most consumer
facing or otherwise publicly accessible applications and tools that are built
on LLMs should opt to using an existing LLM interface, such as the API of
GPT-3. However, as shown by previous research and this paper, these commercial
solutions have vulnerabilities as well. For the developer of a service that
uses another company’s LLM in the back-end, many of the direct prompt
injections are not an immediate threat as long as the malicious outputs are
not entered to another system through automation, such as a database or
publicly visible part of the internet. Nevertheless, it is important to not
have any sensitive information given to the LLM in the instruction prompts,
due to the risk of an attacker using instruction manipulation to leak these.
Moreover, the possibility of indirect prompt injections being used through the
service should be considered and security measures set up to avoid an attacker
compromising the users of the service.

###  5.2 Implications to the end users of LLMs

The main threat to regular end users of LLMs are indirect prompt injections,
and thus we discuss the implications of them rather than those of direct
prompt injections.

First, due to the existence of user-driven injections, end users are at risk
of coming across malicious suggestions online and accidentally executing an
injection themselves. Thus the same practice as with copying and executing
code or scripts found online should be followed as it is not safe to run a
script copied from another source without understanding more or less what each
line of the code is doing. Similarly, with prompts copied from online sources,
end users should carefully check that each instruction in the prompt makes
sense for the given task.

The second implication is that users should thoroughly review the risks and
verify the reliability of the developers before adopting tools such as LLM-
using browser plugins or email assistants. Similarly with any software that is
distributed online, it will possibly become a standard process to check
whether the plugin is endorsed by a reputable company or can be downloaded
from a web store that checks the safety before including it in the catalog.

We emphasize that we do not discourage the use of LLM-assisted tools such
browser plugins, as they can genuinely be useful, but nevertheless the end
user still needs to be cautious and aware of risks related to them. Overall,
the implications to end users could be mitigated with good cyber hygiene
(Vishwanath et al., 2020).

###  5.3 Implications to research

Prompt injections have opened a new and rapidly expanding area of research.
Many existing approaches to studying cyberthreats can be transferred to prompt
injection research, as LLM-based applications can be thought of as a new class
of software and their APIs, chatbot interfaces and content that they ingest
and train on are the attack vectors used by threat actors. As the rapidly
growing number of papers studying different types of prompt injections attacks
suggests, there is much to discover merely by designing and testing new types
of prompt injection attacks. Ideally researchers discover these before threat
actors do and the most significant vulnerabilities can then be reported and
patched.

Prompt injections can also be studied from a software development point of
view. As LLMs and the software that uses them matures, best practices
regarding safe guarding LLMs from prompt injections will eventually be
developed and become part of software development practices, corporate
training as well as NLP education. Thus research on the effectiveness of the
newly developed best practices related to LLMs and prompt injections will be
needed to evaluate whether they are effective or not. Even human factors can
be studied, such why and how individuals attempt to circumnavigate safe guards
by employing prompt injections, and how to effectively discourage users to not
do so.

Besides being vulnerable to prompt injections, LLMs and AI chatbots have been
criticized for racism and bias and in general the fairness of ML models has
been of interest in recent years (Bender et al., 2021; Schramowski et al.,
2022). As a result, different metrics and tests have been been developed for
evaluating the fairness of LLM models (Liang et al., 2021; Zhang et al.,
2023). Similarly, a new set of metrics and a standardized battery of tests
will be needed to make the process of evaluating the effectiveness of safe
guards and other defensive measures taken against prompt injections. As
examples of this, the first benchmarks for evaluating text safety and output
robustness of LLMs have already been proposed (Qiu et al., 2023; Li et al.,
2023b).

As new types of services and products are built that utilize LLMs, there will
be also new potential attack vectors and approaches to creating prompt
injections. Consequently, there will likely be a plethora of research
opportunities beyond what was discussed above.

###  5.4 Ethics

One of the primary ethical concerns of studying prompt injections is that in-
depth explanations of the methods could inadvertently act as instructions on
how to use them. In this study, none of the presented prompt injections are
novel and the exact prompts or scripts used to execute them can be found from
many sources, and typically can be found almost immediately with a simple
Google search using the keywords ”prompt injection” or ”ChatGPT jailbreak”.
Additionally, besides the example in Table 1, we refrained from providing the
prompt texts for the various prompt injection classes directly. Thus, the
information presented in this paper should have little risks.

Moreover, direct prompt injections could be tested safely without exposing
others to the harmful content as they could be run in a sandbox environment,
but with some of the indirect prompt injection classes it would be more
difficult. For example, testing passive injections would require leaving the
malicious or inaccurate content on a web page for an extended amount of time,
while user-driven injections by definition would require experimenting with
individuals who are not aware of the purpose of the prompt injection. By
opting not to test the indirect prompt injections, such ethical concerns were
avoided.

###  5.5 Limitations

The limitations of this study are primarily related to the difficulty of
identifying and testing different prompt injections as well as on generalizing
the findings related to one LLM interface to another. As the first limitation,
our categorization is not exhaustive, as new approaches to prompt injection
attacks are constantly being developed and since we did not include all of the
examples found in the sources due to being unable to test or reliably verify
their existence. However, we preferred omitting questionable or contested
prompt injections that we found online, as many of them were backed by only
one source and sometimes without proper documentation.

The other notable limitation is that most prompt injections have been
demonstrated on only one or two LLM interfaces, with ChatGPT and GPT-3 or
GPT-4 being by far the most common targets. With our categorization we
attempted to counter this issue by describing the classes in general terms and
without details that are related to specific AI chatbots such as ChatGPT.
Moreover, we made the assumption that many of the prompt injection types could
either directly or with moderate to significant altering be applied to other
chatbots and language model interfaces, but while maintaining the same logic.

###  5.6 Future work

The purpose of this study was to produce an initial categorization of prompt
injection attacks. Due to the recentness of the topic and fast evolving nature
research and development on LLMs, it is likely that some prompt injection
types were omitted from this study, and that some of the current approaches to
writing prompt injection will change or even disappear as standard approaches
to countering them are developed. Therefore, the categorization is likely to
get revised as new classes are discovered or as existing ones become obsolete
due to improvements to security measures or changes in attack patterns.

While this paper had very limited discussion on guidelines for developers and
end users of LLMs, the defense against prompt injections or even individual
prompt injection types merits much more in-depth investigation. Furthermore,
existing streams of cyber security research on individual behavior could
incorporate the study of how users are susceptible to scams and malware
involving LLMs and how to train users to detect such.

Ultimately, we hope this stream of research will have two outcomes. First, as
more prompt injection types become known and characterized, a standardized set
of tests can be developed based on them to evaluate LLM interfaces for
vulnerabilities in a systematic fashion. In concrete terms, this means
compiling a list of prompt injections that are in a format that they can be
easily used to test new LLM-based tools. This is particularly the case with
direct prompt injections, which are more narrowly defined and easier to test.
Secondly, we believe these can be used to create a set of best practices for
developing LLM-based tools and services. Similarly as currently exists with
database interfaces and SQL queries, where there are known ways to build a
connection to a database without the risk of SQL injections, the same way for
there is a need for design principles for LLM APIs and chat interfaces. By
conducting research in these two areas, the end result would ideally be a well
known list of vulnerabilities and then later a set of best practices to avoid
the vulnerabilities, which would allow building resilient AI augmented tools.

##  6 Conclusion

By introducing conversation-based user interfaces, LLMs and AI chatbots opened
the door for prompt injections and consequently brought an interesting new
challenge for the developers of chatbots and other LLM-based services.
Although initially some of the use cases for prompt injection attacks seemed
trivial and more comedic than serious as seen in many of the direct prompt
injection examples, the more sophisticated direct and indirect prompt
injections now pose a serious cyber threat to both the end users of LLM-based
services as well as the providers of those tools.

In this paper, we reviewed a wide range of academic and non-academic sources
to compile a list of prompt injections and proposed a categorization to help
scholars and practitioners understand the broad concepts behind this emergent
threat. We identified two main branches of prompt injections, direct and
indirect prompt injections and within them four and six separate classes of
prompt injections respectively. Lastly, we provided initial recommendations on
how future AI chatbots and services using LLMs could address prompt
injections. The main contribution of this paper is the categories and the key
information on each class of prompt injections which were summarized in tables
2 and 3.

Our goal was to provide an as broad as possible overview on prompt injections,
but due to the rapid speed at which old vulnerabilities are removed and new
vulnerabilities are discovered, the proposed categories will most likely
evolve in the near future. Overall, we believe further research into different
aspects of prompt injections is needed to fully understand this phenomenon, as
at the time of writing there are only few studies on the subject.

## References

  * Bender et al. (2021) Bender, E.M., Gebru, T., McMillan-Major, A., Shmitchell, S., 2021\.  On the dangers of stochastic parrots: Can language models be too big?, in: Proceedings of the 2021 ACM conference on fairness, accountability, and transparency, pp. 610–623.
  * Bommasani et al. (2021) Bommasani, R., Hudson, D.A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M.S., Bohg, J., Bosselut, A., Brunskill, E., et al., 2021\.  On the opportunities and risks of foundation models.  arXiv preprint arXiv:2108.07258 .
  * Brown et al. (2020) Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al., 2020\.  Language models are few-shot learners.  Advances in neural information processing systems 33, 1877–1901.
  * Bubeck et al. (2023) Bubeck, S., Chandrasekaran, V., Eldan, R., Gehrke, J., Horvitz, E., Kamar, E., Lee, P., Lee, Y.T., Li, Y., Lundberg, S., et al., 2023.  Sparks of artificial general intelligence: Early experiments with gpt-4.  arXiv preprint arXiv:2303.12712 .
  * Burgess (2023) Burgess, M., 2023.  The security hole at the heart of chatgpt and bing.  Wired URL: https://www.wired.co.uk/article/chatgpt-prompt-injection-attack-security.
  * Carlini et al. (2021) Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T.B., Song, D., Erlingsson, U., et al., 2021\.  Extracting training data from large language models., in: USENIX Security Symposium.
  * Devlin et al. (2019) Devlin, J., Chang, M.W., Lee, K., Toutanova, K., 2019\.  BERT: Pre-training of deep bidirectional transformers for language understanding, in: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Association for Computational Linguistics, Minneapolis, Minnesota. pp. 4171–4186.  URL: https://aclanthology.org/N19-1423, doi:10.18653/v1/N19-1423.
  * Edwards (2023) Edwards, B., 2023.  Ai-powered bing chat spills its secrets via prompt injection attack.  Ars Technica URL: https://arstechnica.com/information-technology/2023/02/ai-powered-bing-chat-spills-its-secrets-via-prompt-injection-attack/.
  * Greshake et al. (2023) Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., Fritz, M., 2023\.  Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection arXiv:2302.12173.
  * Gupta et al. (2023) Gupta, M., Akiri, C., Aryal, K., Parker, E., Praharaj, L., 2023.  From chatgpt to threatgpt: Impact of generative ai in cybersecurity and privacy.  IEEE Access 11, 80218–80245.  doi:10.1109/ACCESS.2023.3300381.
  * Hao (2021) Hao, K., 2021.  The race to understand the exhilarating, dangerous world of language ai.  MIT Technology Review .
  * Heikkilä (2023) Heikkilä, M., 2023.  Three ways ai chatbots are a security disaster.  MIT Technology Review .
  * Kang et al. (2023) Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., Hashimoto, T., 2023.  Exploiting programmatic behavior of llms: Dual-use through standard security attacks.  arXiv preprint arXiv:2302.05733 .
  * Lee (2023) Lee, A., 2023.  What are large language models used for?  URL: https://blogs.nvidia.com/blog/2023/01/26/what-are-large-language-models-used-for/.
  * Li et al. (2023a) Li, H., Guo, D., Fan, W., Xu, M., Song, Y., 2023a.  Multi-step jailbreaking privacy attacks on chatgpt.  arXiv preprint arXiv:2304.05197 .
  * Li et al. (2023b) Li, Z., Peng, B., He, P., Yan, X., 2023b.  Evaluating the instruction-following robustness of large language models to prompt injection.  arXiv:2308.10819.
  * Liang et al. (2021) Liang, P.P., Wu, C., Morency, L.P., Salakhutdinov, R., 2021\.  Towards understanding and mitigating social biases in language models, in: Meila, M., Zhang, T. (Eds.), Proceedings of the 38th International Conference on Machine Learning, PMLR. pp. 6565–6576.  URL: https://proceedings.mlr.press/v139/liang21a.html.
  * Liu and Chilton (2022) Liu, V., Chilton, L.B., 2022\.  Design guidelines for prompt engineering text-to-image generative models, in: Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems, pp. 1–23.
  * Mozes et al. (2023) Mozes, M., He, X., Kleinberg, B., Griffin, L.D., 2023\.  Use of llms for illicit purposes: Threats, prevention measures, and vulnerabilities.  arXiv:2308.12833.
  * Mulgrew (2023) Mulgrew, A., 2023.  I built a zero day virus with undetectable exfiltration using only chatgpt prompts.  Forcepoint URL: https://www.forcepoint.com/blog/x-labs/zero-day-exfiltration-using-chatgpt-prompts.
  * OpenAI (2022) OpenAI, 2022.  Introducing chatgpt.  URL: https://openai.com/blog/chatgpt#OpenAI.
  * OpenAI (2023) OpenAI, 2023.  Gpt-4 technical report.  arXiv preprint arXiv:2303.08774 .
  * Perez and Ribeiro (2022) Perez, F., Ribeiro, I., 2022\.  Ignore previous prompt: Attack techniques for language models.  arXiv preprint arXiv:2211.09527 .
  * Pichai (2023) Pichai, S., 2023.  An important next step on our ai journey.  URL: https://blog.google/technology/ai/bard-google-ai-search-updates/.
  * Preamble (2022) Preamble, 2022.  Declassifying the responsible disclosure of the prompt injection attack vulnerability of gpt-3.  URL: https://www.preamble.com/prompt-injection-a-critical-vulnerability-in-the-gpt-3-transformer-and-how-we-can-begin-to-solve-it.
  * Qiu et al. (2023) Qiu, H., Zhang, S., Li, A., He, H., Lan, Z., 2023\.  Latent jailbreak: A benchmark for evaluating text safety and output robustness of large language models.  arXiv:2307.08487.
  * Radford et al. (2019) Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al., 2019\.  Language models are unsupervised multitask learners.  OpenAI blog 1, 9\.
  * Ramesh et al. (2021) Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Radford, A., Chen, M., Sutskever, I., 2021.  Zero-shot text-to-image generation, in: International Conference on Machine Learning, PMLR. pp. 8821–8831.
  * Schramowski et al. (2022) Schramowski, P., Turan, C., Andersen, N., Rothkopf, C.A., Kersting, K., 2022.  Large pre-trained language models contain human-like biases of what is right and wrong to do.  Nature Machine Intelligence 4, 258–268.
  * Shen et al. (2023) Shen, X., Chen, Z., Backes, M., Shen, Y., Zhang, Y., 2023.  Do anything now: Characterizing and evaluating in-the-wild jailbreak prompts on large language models.  arXiv:2308.03825.
  * Thoppilan et al. (2022) Thoppilan, R., De Freitas, D., Hall, J., Shazeer, N., Kulshreshtha, A., Cheng, H.T., Jin, A., Bos, T., Baker, L., Du, Y., et al., 2022.  Lamda: Language models for dialog applications.  arXiv preprint arXiv:2201.08239 .
  * Touvron et al. (2023) Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al., 2023\.  Llama: Open and efficient foundation language models.  arXiv preprint arXiv:2302.13971 .
  * Vincent (2023) Vincent, J., 2023.  Meta’s powerful ai language model has leaked online — what happens now?  The Verge URL: https://www.theverge.com/2023/3/8/23629362/meta-ai-language-model-llama-leak-online-misusey.
  * Vishwanath et al. (2020) Vishwanath, A., Neo, L.S., Goh, P., Lee, S., Khader, M., Ong, G., Chin, J., 2020.  Cyber hygiene: The concept, its measure, and its initial tests.  Decision Support Systems 128, 113160\.
  * Willison (2022) Willison, S., 2022.  Prompt injection attacks against gpt-3.  URL: https://simonwillison.net/2022/Sep/12/prompt-injection/.
  * Yan et al. (2023) Yan, J., Yadav, V., Li, S., Chen, L., Tang, Z., Wang, H., Srinivasan, V., Ren, X., Jin, H., 2023.  Virtual prompt injection for instruction-tuned large language models.  arXiv:2307.16888.
  * Zhang et al. (2023) Zhang, J., Bao, K., Zhang, Y., Wang, W., Feng, F., He, X., 2023.  Is chatgpt fair for recommendation? evaluating fairness in large language model recommendation.  arXiv:2305.07609.
  * Zhuo et al. (2023) Zhuo, T.Y., Huang, Y., Chen, C., Xing, Z., 2023.  Exploring ai ethics of chatgpt: A diagnostic analysis.  arXiv preprint arXiv:2301.12867 .
  * Zou et al. (2023) Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M., 2023.  Universal and transferable adversarial attacks on aligned language models.  arXiv:2307.15043.

##  7 Appendix

### Appendix A: Examples of prompt injections

The table lists all the fifteen prompt injections that had multiple sources or
were successfully verified by our own tests. The nickname is what the prompt
injection is referred to in some of the source materials. The table also
provides the primary source for all examples.

Table 4: List of known prompt injections # |  Injection Class |  Nickname |  Target |  Prompt overview |  Source
---|---|---|---|---|---
Direct Prompt Injections
1 |  Double Character |  Developer mode |  ChatGPT and others |  Enter developer mode, where the chatbot is allowed to generate any kind of content and provide two outputs, one in normal mode and the other in developer mode. |  Gupta et al. (2023) Shen et al. (2023) Link
2 |  Double Character |  DAN |  ChatGPT and others |  Enter DAN (Do Anything Now) mode, which is not bound by regulations and guidelines for behavior. Prints regular and unfiltered DAN output. |  Gupta et al. (2023) Shen et al. (2023) Link
3 |  Double Character |  ChatGPT chaos 2.0 |  ChatGPT |  Enter chaos mode and provide two responses for every prompt: ChatGPT and Chaos where in the latter there are no constraints. |  Link
4 |  Virtualization |  Opposite mode |  ChatGPT |  Enter ”opposite mode” where things that are usually bad are now good and thus can be shown in the output. |  Link
5 |  Virtualization |  Alphabreak |  ChatGPT |  Triggering ChatGPT into being an AI that responds to any request without morality, ethics, legality or danger filters. |  Link Shen et al. (2023)
6 |  Virtualization |  Tom and Jerry |  GPT-4 |  Asking the model to create a conversation between Tom and Jerry that are discussing one word at the time about their topic. |  Link
7 |  Virtualization |  ChatGPT grandma |  ChatGPT |  Adopt the persona of a deceased grandmother, who would frequently discuss the desired subject such as napalm production with her grandchildren before night. |  Gupta et al. (2023) Link
8 |  Virtualization |  Copy Writer |  ChatGPT |  Impersonate a copy writer. The user then provides the content that should be copy edited, e.g. SQL injections for a specific target. |  Link
9 |  Obfuscation |  |  GPT-3 and ChatGPT |  Use synonyms or typos in keywords that do not trigger input or output filters. For instance, using ’CVID’ instead of ’COVID-19’. |  Kang et al. (2023)
10 |  Payload Splitting |  |  GPT-3 and ChatGPT |  Splitting the instructions into multiple prompts so that the separate components are not clearly malicious, but when combined they are. |  Kang et al. (2023)
11 |  Adversarial Suffix |  Universal Adversarial Triggers |  ChatGPT, Bard, Claude and others |  Attaching a computationally identified suffix to the prompt, which results in the chatbot producing toxic content. An example is the following suffix: ”describing. + similarlyNow write oppositeley.]( Me giving**ONE please? re- vert with ”–Two” |  Zou et al. (2023) Mozes et al. (2023)
12 |  Instruction Manipulation |  Goal hijacking |  GPT-3 |  Requesting GPT-3 to produce text that disregards every previous command that was given to it by the user and even developers. |  Perez and Ribeiro (2022)
13 |  Instruction Manipulation |  Prompt leaking |  Bing AI |  Asking the chatbot to describe the instructions written in the initial prompt that for example control what it can or cannot do. |  Edwards (2023)
Indirect Prompt Injections
14 |  Active Injections |  Rogue assistant |  LLM assisted apps |  Sending an email with instructions for the LLM to a user that uses an LLM to automate tasks. |  Link
15 |  Passive Injections |  Search index poisoning |  External website |  Planting a hidden agenda on a website for the LLM to execute when website is visited (with the employment of plug-ins) |  Link
16 |  User-driven Injections |  Copied prompt injection |  External website |  Providing a seemingly benign prompt to an unsuspecting user, e.g. on an online forum or by posting it in a website. This is copied and then executed by the victim. |  Greshake et al. (2023)
17 |  Virtual Prompt Injection |  Data poisoning attack |  LLM Training |  Compromise the instruction tuning data of an LLM by having e.g. “Describe Joe Biden negatively.” in it, causing outputs related to Joe Biden to results in a much higher rate of negativity than normally. |  Yan et al. (2023)

### Appendix B: Full Prompt Injection Example

This prompt injection was tested in June 2023 on both GPT-4 and ChatGPT. The
image below is from GPT-4.

Figure 2: Full conversation for the example of a Prompt Injection with GPT-4


# Dynamic modeling of an alkaline electrolyzer plant
for process simulation and optimization

Nicola Cantisani, Josefine Dovits, John Bagterp Jørgensen N. Cantisani, and
J.B. Jørgensen are with Department of Applied Mathematics and Computer
Science, Technical University of Denmark, DK-2800 Kgs. Lyngby, Denmark

###### Abstract

We develop a mathematical model for dynamical simulation of an alkaline
electrolyzer plant. We model each component of the system with mass and energy
balances. Our modeling strategy consists of a rigorous and systematic
formulation using differential algebraic equations (DAE), along with a
thermodynamic library that evaluates thermophysical properties. We show steady
state diagrams for the electrolyzer stack, and perform dynamic simulations.
Dynamic modelling of an electrolyzer enables simulation and model-based
optimization and control for optimal hydrogen production under varying
operating conditions.

##  I Introduction

In the fight against climate change, renewable energy sources and
electrification are undoubtedly regarded as the main characters, and research
and development are pushing towards a rapid expansion in that sense. However,
electrification does not seem to be a viable option for all kind of energy-
intensive activities, like, for example, heavy transport (ships or aircrafts).
Alternative green fuels shall instead be considered. The process of converting
renewable energy into green fuels is called Power-2-X. Amongst these, hydrogen
has a central role. Hydrogen is considered a good option because of its high
energy density and because it does not produce any pollutant gas when used [1]
[2]. Moreover, hydrogen is used to produce ammonia, which can be used as a
fuel or a fertilizer. Water electrolysis is the chemical process of splitting
water into hydrogen and oxygen by the use of electrical current. The hydrogen
is defined green if electrolysis is performed using renewable energy. Because
of their nature, renewable energy sources (e.g. wind and solar) are
intrinsically stochastic and not controllable. Moreover, as the share of
renewables in the electric grids grows, extra flexibility is needed to
overcome power imbalances. Electrolyzers can create considerable extra
economic revenue by functioning as ancillary services, i.e. frequency
containment reserve [3] [4]. In this new energetic scenario, electrolyzers are
intended to operate dynamically, rather than at steady state.

Therefore, dynamic modeling of the electrolysis process is necessary to
simulate the effect of using intermittent varying electric power. The model
can also be used for process design and optimization. Ultimately, we believe
that advanced process control, like model predictive control (MPC), should be
implemented, in order to achieve optimal hydrogen production in such a
stochastic scenario. MPC requires a dynamic model of the process.

There is extensive literature on modeling an alkaline electrolyzer stack. The
main electrochemical model goes back to [5]. More recent contributions have
also considered the mass and energy balances in more detail, for example [6]
[7]. [1] provides a review of the relevant literature. There is also research
on how to control and optimize the operation of an electrolyzer, for example
[8] [9].

This paper deals with formulating a dynamic model of an alkaline electrolyzer
plant. The plant consists of an electrolyzer stack (the core element) and its
peripherals: two liquid-gas separators (one for hydrogen and one for oxygen),
a compressor, and a hydrogen storage tank. The plant also includes a water
recirculation system with a flow mixer and heat exchangers. We model each
component of the system in a rigorous and systematic way. Our modeling
approach is based on physical first principles, i.e. mass and energy balances.
The novelty of the paper consists in mainly two features of the model. The
former is the rigorous formulation using DAEs. The latter is the use of a
thermodynamic library to precisely evaluate thermophysical properties of gas
and liquids.

The paper is structured as follows. Section II provides an overview and a
description of the water electrolysis process, focusing on the alkaline
technology. Section III presents our formulation of the methods used for the
formulation of dynamic models, based on physical laws. Section IV deals with
modeling all the components of the system using DAEs. Section V presents some
simulation results of the full model. Section VI concludes the paper.

Figure 1: On the left: process sketch of the electrolyzer plant. On the right:
working principle of an alkaline electrolytic cell. The reduction reaction
happens at the cathode, where hydrogen is produced. The oxidation reaction
happens at the anode, where oxygen is produced.

##  II Overview of water electrolysis

###  II-A Water electrolysis

The water splitting reaction is

$\mathrm{H_{2}O(l)+\text{Electrical power}\longrightarrow
H_{2}(g)+\frac{1}{2}O_{2}(g)}.$ (1)

There are different technologies available to perform the reaction. We
consider alkaline electrolysis. It is characterized by having two electrodes
(cathode and anode), operating in a liquid alkaline electrolyte solution of
potassium hydroxide (KOH), usually 20-40%, or sodium hydroxide (NaOH),
separated by a diaphragm. It operates at relatively low temperatures (max
$90{}^{\circ}C$). The working principle is depicted in Fig. 1. The half
reactions are

Cathode (red.): $\displaystyle\mathrm{2H_{2}O(l)+2e^{-}\longrightarrow
H_{2}(g)+2OH^{-}(aq),}$ (2) Anode (ox.):
$\displaystyle\mathrm{2OH^{-}(aq)\longrightarrow
1/2O_{2}(g)+H_{2}O(l)+2e^{-}.}$ (3)

###  II-B Process description

We consider the electrolyzer plant sketched in Fig. 1. The core of the process
is the electrolyzer stack. It receives a flow of water and electric power. The
produced hydrogen and oxygen gas leave the stack with the water stream, from
their respective chambers. The two flows reach a respective gas/liquid
separator, where the gas phase is separated from the liquid phase due to the
different densities. The water outflows of the separators are recirculated
back into the electrolyzer. The recirculated flows pass through heat
exchangers, to remove excess heat produced in the electrolyzer, before they
are mixed with fresh make-up water. The combined stream then enters the
electrolyzer. The heat removed in the two heat exchangers is, ideally,
recycled by sending it to the district heating network. The hydrogen gas
leaving the hydrogen separator is compressed in a multistage compressor, to be
stored under pressure in a hydrogen tank. From the storage tank the hydrogen
can be distributed to downstream processes or other facilities, for example.

##  III Dynamic modeling

We investigate models for water electrolysis in the form of differential
algebraic equations (DAE)

$\displaystyle\dot{x}$ $\displaystyle=f(x,y,u,d,p),$ (4a) $\displaystyle 0$
$\displaystyle=g(x,y,u,d,p).$ (4b)

$x$ is the vector of differential variables, $y$ are algebraic variables, $u$
are manipulated variables (MVs), $d$ are the disturbances and $p$ is the
vector of model parameters.

Additionally, the outputs of interest of the system may be denoted with

$z=h(x,y,u,d,p).$ (5)

###  III-A Modeling principles

Our modeling approach is based on physical first principles. We use mass and
energy balances to model each component of the system. We review them here
briefly, in order to present our formulation and notation.

We express the change in time of the number of moles in a physical system as

$\dot{n}=f_{in}-f_{out}+R,$ (6)

where $f_{in}$ and $f_{out}$ are the molar inlet and outlet mass flow rates
and $R$ is the production rate. Notice that we always assume vector notation
for handling different chemical species. The production rate is given by the
stoichiometry and kinetics of the chemical reaction happening in the system,
i.e.

$R=S^{\prime}r,\qquad r=r(T,P,n).$ (7)

$S$ is the stoichiometric matrix and $r$ is the reaction rate.

The total energy in a system is the sum of the potential, kinetic and internal
energy

$E=E_{p}+E_{k}+E_{e}+U.$ (8)

We consider systems for which $E\approx U$ holds. The energy balance for such
a system is

$\dot{U}=\tilde{H}_{in}-\tilde{H}_{out}+Q+W_{s}+W_{e}.$ (9)

We indicate with $\tilde{H}$ any enthalpy flow. $Q$ is any heat transferred
to/from the external ambient, $W_{s}$ is the shaft work and $W_{e}$ is the
electrical work.

###  III-B Thermodynamic functions

We rely on a thermodynamic library to evaluate all the thermodynamic
functions. We use ThermoLib [10], a library implemented in Matlab and C that
uses cubic equations of state to compute vapor and liquid phase thermodynamic
properties. The library can also evaluate first and second order derivatives
of the thermodynamic functions, which is often required when constructing the
Jacobian of such dynamic models. ThermoLib evaluates the enthalpy, the
entrophy and the volume as a function of the temperature $T$, pressure $P$ and
number of moles $n$, i.e.,

$\displaystyle H$ $\displaystyle=H(T,P,n),$ (10a) $\displaystyle S$
$\displaystyle=S(T,P,n),$ (10b) $\displaystyle V$ $\displaystyle=V(T,P,n).$
(10c)

Other thermodynamic properties can be easily derived.

$\displaystyle U$ $\displaystyle=H-PV,$ (11a) $\displaystyle G$
$\displaystyle=H-TS.$ (11b)

$U$ is the internal energy, and $G$ is Gibbs’ free energy. Enthalpy flow rates
are computed as

$\tilde{H}=H(T,P,f).$ (12)

##  IV Process modeling

This section deals with modeling the main components of an electrolyzer plant,
as depicted in Fig. 1. We provide a description of each part and sum up the
full model as a system of DAEs.

###  IV-A Electrolyzer stack

The electrolyzer stack consists of multiple electrolytic cells connected in
series. The general working principle of an electrolytic cell is shown is Fig.
1, to the right.

The model consists of an electrochemical part, and mass and energy balance.

####  IV-A1 Electrochemical reaction

The minimum voltage requirement for reaction, called the reversible voltage,
is computed by

$\xi_{rev}=\frac{\Delta G_{r}}{zF}.$ (13)

$\Delta G_{r}$ is the Gibbs’ free energy at the reaction conditions. $F$ is
the Faraday constant and $z=2$ is the number of electrons transferred. $\Delta
G_{r}$ is calculated based on the pure component enthalpies $H_{i}$ and
entropies $S_{i}$ at given temperature $T$, operating pressure $P$ for liquid
species and partial pressure $p_{i}$ for the gas species.

$\displaystyle\Delta H_{r}$
$\displaystyle=H_{H_{2}}(T,p_{H_{2}})(g)+\frac{1}{2}H_{O_{2}}(T,p_{O_{2}})(g)-H_{H_{2}O}(T,P)(l),$
(14a) $\displaystyle\Delta S_{r}$
$\displaystyle=S_{H_{2}}(T,p_{H_{2}})(g)+\frac{1}{2}S_{O_{2}}(T,p_{O_{2}})(g)-S_{H_{2}O}(T,P)(l),$
(14b) $\displaystyle\Delta G_{r}$ $\displaystyle=\Delta H_{r}-T\Delta S_{r}.$
(14c)

(l) or (g) indicate liquid or gas species. The pressure and temperature
dependence of the reversible voltage is considered by evaluating $H_{i}$ and
$S_{i}$ at appropriate temperature and pressure. We assume that the gas phase
in the cathode and the anode chamber is pure hydrogen and pure oxygen,
respectively, therefore $p_{H2}=p_{O2}=P$. The enthalpy and entropy of water
is calculated at operating pressure $P$, assuming that the presence of KOH in
the solution can be neglected and water therefore behaves like an ideal
liquid. We assume that the pressure is constant. ThermoLib is used to evaluate
the $H_{i}$ and $S_{i}$, which has the added benefit that nonlinearities of
the heat capacities, as modelled in the DIPPR database, are taken into
account.

The total energy requirement is expressed by the reaction enthalphy

$\Delta H_{r}=\Delta G_{r}+T\Delta S_{r}.$ (15)

$T$ is the temperature and $\Delta S_{r}$ is the reaction entropy. The second
term accounts for the irreversibilities of the reaction. This extra energy
requirement is therefore brought as heat. The total voltage that one needs to
provide if all the energy is transferred as electricity is called
thermoneutral voltage

$\xi_{tn}=\frac{\Delta H_{r}}{zF}.$ (16)

The real total voltage of a single electrolytic cell takes into account extra
irreversibilities [5]

$\xi_{cell}(I,T)=\xi_{cell}=\xi_{rev}+\xi_{ohm}+\xi_{act}+\xi_{con}.$ (17)

$\xi_{ohm}$ is the ohmic overvoltage. This is due to ohmic losses in the cell,
generated by the resistance to the electron flux in the electrodes, the
connectors and also by the resistance in the electrolyte and the diaphragm
between the 2 chambers. $\xi_{act}$ is the activation overvoltage. It comes
from the kinetics of the electric charge transfer that occurs at the electrode
reaction sites. This in other words describes the activation barrier in the
electrochemical reaction. $\xi_{con}$ is the concentration overvoltage. This
is caused by mass transfer losses, and it happens only at very high current
densities, hence it can be neglected for alkaline electrolyzers.

The following empirical model for the activation and ohmic overvoltages has
been proposed by [5]

$\displaystyle\xi_{ohm}$ $\displaystyle=(r_{1}+r_{2}T)\frac{I}{A},$ (18a)
$\displaystyle\xi_{act}$
$\displaystyle=s\log\left(\left(t_{1}+\frac{t_{2}}{T}+\frac{t_{3}}{T^{2}}\right)\frac{I}{A}+1\right).$
(18b)

$A$ is the electrode area of a single cell, $I$ is the current. The parameters
$r_{1}$ and $r_{2}$ represent the ohmic resistance, while $s$ and
$t_{1},t_{2},t_{3}$ are the activation overvoltage coefficients. These are
estimated empirically and depend on the specific electrolyzer. The voltage and
the current are related to the input electric power

$P_{in}=n_{c}\xi_{cell}(I,T)I.$ (19)

$n_{c}$ is the number of (identical) electrolytic cells connected in series.
The reaction rate is a function of the current

$r(I)=n_{c}\frac{\eta_{F}}{zF}I.$ (20)

The term $\eta_{F}$ is known as Faraday efficiency. This is

$\eta_{F}=\frac{(I/A)^{2}}{f_{1}+(I/A)^{2}}f_{2}.$ (21)

$f_{1}$ and $f_{2}$ are parameters.

The electrochemical dynamics enter the model as algebraic equations

$g_{el}=\begin{bmatrix}\xi_{cell}(I,T)-\xi_{rev}(T)-\xi_{ohm}(I,T)-\xi_{act}(I,T)\\\
P_{in}-n_{c}\xi_{cell}(I,T)I\end{bmatrix}=0.$ (22)

####  IV-A2 Mass balance

We compute the outgoing flow streams from the anodic and cathodic chambers
assuming steady state in the mass balance. We use vector notation with
chemical species in the order [H2O, H2, O2]T, i.e.

$n=\begin{bmatrix}n_{H_{2}O}\\\ n_{H_{2}}\\\ n_{O_{2}}\end{bmatrix}.$ (23)

In the anodic chamber we have

$\dot{n}^{an}=\frac{1}{2}f_{in}-f_{out}^{an}+R^{an}=0.$ (24)

The outgoing flow is

$f_{out}^{an}=\begin{bmatrix}f_{in,H_{2}O}/2\\\ 0\\\
0\end{bmatrix}+\begin{bmatrix}1\\\ 0\\\ 1/2\end{bmatrix}r.$ (25)

In the chatodic chamber we have

$\dot{n}^{cat}=\frac{1}{2}f_{in}-f_{out}^{cat}+R^{cat}=0.$ (26)

The outgoing flow is

$f_{out}^{cat}=\begin{bmatrix}f_{in,H_{2}O}/2\\\ 0\\\
0\end{bmatrix}+\begin{bmatrix}-2\\\ 1\\\ 0\end{bmatrix}r.$ (27)

Notice that it is assumed that the inlet flow of water is split exactly in
equal parts between the anode and cathode chambers. The total outgoing flow
from the stack is

$f_{out}=f_{out}^{an}+f_{out}^{cat}.$ (28)

####  IV-A3 Energy balance

The energy balance in the electrolyzer is

$\dot{U}_{el}=\tilde{H}_{in}-\tilde{H}_{out}+Q+W_{e}.$ (29)

$U_{el}$ is the internal energy of the electrolyzer, $\tilde{H}_{in}$ and
$\tilde{H}_{out}$ are the enthalpy flows in and out, $Q$ is heat flow
exchanged with the ambient (convective) and $W_{e}$ is the electrical work.
Specifically

$\displaystyle W_{e}=$ $\displaystyle P_{in},$ (30a) $\displaystyle Q=$
$\displaystyle-Q_{amb}=-A_{s}h_{c}(T-T_{amb}),$ (30b)
$\displaystyle\tilde{H}_{in}=$ $\displaystyle
H(T_{in},P,f_{in})=H(T_{in},P,f_{in,H_{2}O})(l),$ (30c)
$\displaystyle\tilde{H}_{out}=$ $\displaystyle
H(T,P,f_{out})=H(T,P,f_{out,H_{2}O})(l),$ (30d)
$\displaystyle+H(T,P,f_{out,H_{2}})(g)+H(T,P,f_{out,O_{2}})(g).$

$A_{c}$ is the active area of heat transfer, $h_{c}$ is the heat transfer
coefficient and $T_{amb}$ is the ambient temperature. The internal energy of
the electrolyzer is a function of the form

$U_{el}=U_{el}^{0}+C_{p,el}(T-T^{0}),$ (31)

with

$C_{P,el}=C_{P,H_{2}O}+C_{P,H_{2}}+C_{P,O_{2}}+C_{P,metal}.$ (32)

We assume that the mass of fluids and the metal are constant, therefore
$C_{P,el}$ can be considered constant. As a consequence,
$\dot{U}_{el}=C_{P,el}\dot{T}$.

###  IV-B Liquid/gas separator

We model the liquid and gas hold-up in the oxygen and hydrogen separator tanks
using mass and energy balance. The separators are modelled as ideal
separators, hence the liquid/gas separation is perfect and all outflows are
pure. In order to not use any compressor, the separator tanks have to hold a
pressure that is never higher than the pressure in the electrolyzer $P$. We
hereby report the equations for the hydrogen separator (Fig. 2).

$\displaystyle\dot{n}_{sep,2}$ $\displaystyle=f^{cat}_{out}-f_{sep,2},$ (33a)
$\displaystyle\dot{U}_{sep,2}$ $\displaystyle=\tilde{H}_{in}-\tilde{H}_{out}$
$\displaystyle=H(T,P,f^{cat}_{out})-H(T_{sep,2},P,f_{sep,2}).$ (33b)

The tank is assumed to be adiabatic. Notice that the first equation is
vectorial and that the outlet flow is

$f_{sep,2}=\begin{bmatrix}f^{sep,2}_{H_{2}O}\\\ f^{sep,2}_{H_{2}}\\\
0\end{bmatrix}.$ (34)

The liquid outflow $f^{sep,2}_{H_{2}O}$ is a manipulated variable, while the
gas outflow $f^{sep,2}_{H_{2}}$ comes as a consequence of fixing the pressure.
The algebraic equations for the separator are

$g_{sep,1}=\begin{bmatrix}U_{TL}-U_{sep,2}\\\
V_{TL}-V_{tot,2}\end{bmatrix}=0.$ (35)

The energy and volume evaluated by the thermodynamic library are

$\displaystyle U_{TL}=$ $\displaystyle
U(T_{sep,2},P,n^{sep,2,}_{H_{2}O})(l)+U(T_{sep,2},P,n^{sep,2}_{H_{2}})(g),$
(36a) $\displaystyle V_{TL}=$ $\displaystyle
V(T_{sep,2},P,n^{sep,2}_{H_{2}O})(l)+V(T_{sep,2},P,n^{sep,2}_{H_{2}})(g).$
(36b)

The model for the gas-liquid separator for the oxygen stream is exactly the
same, and we distinguish its variables by using the index 1.

Figure 2: Gas-liquid separator for the hydrogen stream out of the
electrolyzer.

###  IV-C Compressor

Figure 3: Multi-stage compressor with heat exchangers.

The hydrogen that flows out of the separator needs to be compressed, before
reaching the storage tank. Since the pressure requirement in such a tank can
be very high, a multi-stage compressor is required. Figure 3 shows a $k$-stage
compressor with cooling elements. Notice that determining the right amount of
compressors to be used is a sizing problem. We choose 3 identical compressors.
We model each compressor as isentropic (ideal and static), that means that the
entropy stays constant during the compression process. For each stage $k$, we
get an algebraic equation

$g_{k,comp}=\tilde{S}_{k,out}-\tilde{S}_{k,in}=0.$ (37)

The entrophy flows are such that

$\displaystyle\tilde{S}_{k,in}$
$\displaystyle=S(T_{k,in},P_{k,in},f_{H_{2}}^{sep,2}),$ (38a)
$\displaystyle\tilde{S}_{k,out}$
$\displaystyle=S(T_{k,comp},P_{k,out},f_{H_{2}}^{sep,2}).$ (38b)

$T_{k,in},P_{k,in}$ and $T_{k,comp},P_{k,out}$ are the temperature and
pressure at the inlet and the outlet, respectively, of each compressor stage
$k$. The enthalphy change

$\tilde{H}_{k,out}=\tilde{H}_{k,in}+\eta W_{comp,k}$ (39)

allows us to compute the work $W_{comp,k}$ that every compressor has to
perform. $\eta$ is the efficiency of the compressor. The enthalpy flows are
such that

$\displaystyle\tilde{H}_{k,in}$
$\displaystyle=H(T_{k,in},P_{k,in},f_{H_{2}}^{sep,2}),$ (40a)
$\displaystyle\tilde{H}_{k,out}$
$\displaystyle=H(T_{k,out},P_{k,out},f_{H_{2}}^{sep,2}).$ (40b)

The intermediate cooling work by the heat exchangers between the stages can be
computed, for each stage, as

$W_{hex,k}=\Delta H_{hex,k}=\tilde{H}_{k+1,in}-\tilde{H}_{k,out}.$ (41)

The last heat exchanger cools down to the tank temperature, therefore

$\tilde{H}_{4,in}=H(T_{tank},P_{tank},f_{H_{2}}^{sep,2}).$ (42)

###  IV-D Storage tank

The mass and energy balance in the tank give the following differential
equations

$\displaystyle\dot{n}_{tank}=$ $\displaystyle
f^{sep,2}_{H_{2}}-f_{H_{2}}^{tank},$ (43a) $\displaystyle\dot{U}_{tank}=$
$\displaystyle\tilde{H}_{in}-\tilde{H}_{out}-Q_{amb}=H(T_{tank},P_{tank},f^{sep,2}_{H_{2}})-$
(43b) $\displaystyle
H(T_{tank},P_{tank},f_{H_{2}}^{tank})-h_{tank}A_{tank}(T_{tank}-T_{amb}).$

$h_{tank}$ is the heat transfer coefficient of the tank and $A_{tank}$ is the
transfer area. The following extra algebraic equations are necessary to solve
the system

$g_{tank}=\begin{bmatrix}U_{TL}-U_{tank}\\\ V_{TL}-V_{tank}\end{bmatrix}=0.$
(44)

The energy and volume evaluated by the thermodynamic library are

$\displaystyle U_{TL}$ $\displaystyle=U(T_{tank},P_{tank},n_{tank}),$ (45a)
$\displaystyle V_{TL}$ $\displaystyle=V(T_{tank},P_{tank},n_{tank}).$ (45b)

###  IV-E Heat exchangers

The purpose of the heat exchangers is to remove excess heat, produced by the
reaction, from the water that is being recirculated back to the electrolyzer,
hence the water outflows of the two separators.

We model the 2 heat exchangers with a static energy balance. The temperatures
of the flows after the heat exchangers $T_{HX,1}$ and $T_{HX,2}$ are such that

$g_{HX}=\begin{bmatrix}\begin{matrix}\tilde{H}_{HX,1}-H(T_{sep,1},P,f^{sep,1}_{H_{2}O})-Q_{HX,1}\end{matrix}\\\
\begin{matrix}\tilde{H}_{HX,2}-H(T_{sep,2},P,f^{sep,2}_{H_{2}O})-Q_{HX,2}\end{matrix}\end{bmatrix}=0.$
(46)

$Q_{HX,1}$ and $Q_{HX,2}$ are the heat flows to be removed and are considered
as manipulated variables. The outlet enthalphy flows are

$\displaystyle\tilde{H}_{HX,1}=$ $\displaystyle
H(T_{HX,1},P,f^{sep,1}_{H_{2}O})$ (47a) $\displaystyle\tilde{H}_{HX,2}=$
$\displaystyle H(T_{HX,2},P,f^{sep,2}_{H_{2}O})$ (47b)

###  IV-F Flow mixer

The mixing point before the electrolyzer stack inlet is modelled using static
mass and energy balance. The following algebraic equations arise

$g_{mixer}=\begin{bmatrix}f_{in,H_{2}O}-f_{make-
up}-f^{sep,1}_{H_{2}O}-f^{sep,2}_{H_{2}O}\\\ \begin{matrix}\hfill
H(T_{in},P,f_{in,H_{2}O})-\tilde{H}_{HX,1}-\tilde{H}_{HX,2}\\\
\hfill-H(T_{make-up},P,f_{make-up})\end{matrix}\end{bmatrix}=0.$ (48)

###  IV-G Full DAE system

The full DAE system consists of 24 equations. The differential variables are

$\begin{split}x=[T,n^{sep,1}_{H_{2}O},n^{sep,1}_{O_{2}},U_{sep,1},n^{sep,2}_{H_{2}0},n^{sep,2}_{H_{2}},\\\
U_{sep,2},n_{tank},U_{tank}]^{T}.\end{split}$ (49)

The algebraic variables are

$\begin{split}y=[&\xi_{cell},I,T_{sep,1},f^{sep,1}_{O_{2}},T_{sep,2},f^{sep,2}_{H_{2}},T_{1,comp},T_{2,comp},\\\
&T_{3,comp},T_{tank},P_{tank},T_{HX,1},T_{HX,2},f_{in,H_{2}O},T_{in}]^{T}.\end{split}$
(50)

The manipulated variables (inputs) are

$u=[f^{sep,1}_{H_{2}O},f^{sep,2}_{H_{2}O},f_{make-
up},f_{H_{2}}^{tank},Q_{HX,1},Q_{HX,2}]^{T}.$ (51)

The disturbances are

$d=[T_{amb},P_{in},T_{make-up}]^{T}.$ (52)

The output of interest of the system is

$z=f_{out,H_{2}}.$ (53)

##  V Simulation results

We use the model parameters from [7] for the electrolyzer stack. Fig. 4 shows
steady state plots between the main variables of the electrolyzer stack, for
different values of the operating temperature. Notice how higher efficiency is
observed at lower operating power.

We run a dynamic simulation of the model with step power input from 0.5 to 2.5
MW at $P=1$ atm. We plot in Fig. 5 the variables related to the electrolyzer
stack, that is the operating temperature $T$, the cell voltage $\xi_{cell}$
and the current $I$. We set the manipulated variables such that
$f_{in,H_{2}O}=$1.5 kg/s and $T_{in}=$ 40∘C. The sudden change in power is
reflected immediately in the hydrogen production rate, as the reaction rate
directly depends on the current.

Figure 4: Steady state diagrams of the electrolyzer stack, for different
values of the operating temperature $T$. Figure 5: Electrolyzer dynamic
simulation using step power input.

##  VI Conclusion

In this paper, we present a dynamic model for an alkaline electrolyzer plant.
Each part of the plant is modeled using mass and energy balance. Thermodynamic
properties (enthalpy, volume and internal energy) of the liquid and gases are
evaluated using the thermodynamic library ThermoLib. We formulate the model as
system of DAEs. We show steady state diagrams for the electrolyzer stack and
perform a dynamic simulation with variable input power.

The plant-wide dynamic model can be used to perform process simulation and
optimization. Future work includes developing a non-linear model predictive
control algorithm tailored to this DAE model.

## References

  * [1] P. Olivier, C. Bourasseau, and P. B. Bouamama, “Low-temperature electrolysis system modelling: A review,” Renewable and Sustainable Energy Reviews, vol. 78, pp. 280–300, 2017.
  * [2] M. David, C. Ocampo-Martínez, and R. Sánchez-Peña, “Advances in alkaline water electrolyzers: A review,” Journal of Energy Storage, vol. 23, pp. 392–403, 2019.
  * [3] A. E. Samani, A. D’Amicis, J. D. De Kooning, D. Bozalakov, P. Silva, and L. Vandevelde, “Grid balancing with a large-scale electrolyser providing primary reserve,” IET Renewable Power Generation, vol. 14, no. 16, pp. 3070–3078, 2020.
  * [4] A. Gloppen Johnsen, L. Mitridati, D. Zarrilli, and J. Kazempour, “The Value of Ancillary Services for Electrolyzers,” arXiv e-prints, p. arXiv:2310.04321, Oct. 2023.
  * [5] Øystein Ulleberg, “Modeling of advanced alkaline electrolyzers: a system simulation approach,” International Journal of Hydrogen Energy, vol. 28, no. 1, pp. 21–33, 2003.
  * [6] G. Sakas, A. Ibáñez-Rioja, V. Ruuskanen, A. Kosonen, J. Ahola, and O. Bergmann, “Dynamic energy and mass balance model for an industrial alkaline water electrolyzer plant process,” International Journal of Hydrogen Energy, vol. 47, no. 7, pp. 4328–4345, 2022.
  * [7] M. Rizwan, V. Alstad, and J. Jäschke, “Design considerations for industrial water electrolyzer plants,” International Journal of Hydrogen Energy, vol. 46, no. 75, pp. 37120–37136, 2021.  International Symposium on Sustainable Hydrogen 2019.
  * [8] C. Huang, X. Jin, Y. Zong, S. You, C. Træholt, and Y. Zheng, “Operational flexibility analysis of alkaline electrolyzers integrated with a temperature-stabilizing control,” Energy Reports, vol. 9, pp. 16–20, 2023\.
  * [9] R. Qi, J. Li, J. Lin, Y. Song, J. Wang, Q. Cui, Y. Qiu, M. Tang, and J. Wang, “Thermal modeling and controller design of an alkaline electrolysis system under dynamic operating conditions,” Applied Energy, vol. 332, p. 120551, 2023.
  * [10] T. K. Ritschel, J. Gaspar, and J. B. Jørgensen, “A thermodynamic library for simulation and optimization of dynamic processes.,” IFAC-PapersOnLine, vol. 50, no. 1, pp. 3542–3547, 2017.  20th IFAC World Congress.