Prompt injection in arsine (AsH3) semiconductor fab AI

Four adversarial injection surfaces in AsH3 semiconductor fab AI

1. AsH3 fab bay area CEMS (Honeywell Analytics MIDAS AsH3 detector AI / Dräger Polytron SE AsH3 fixed-point monitor AI / MSA Ultima XE AsH3 detector AI / RKI Instruments GX-2012 AsH3 area CEMS AI — ambient AsH3 monitoring in fab bays containing ion implanters, MOCVD reactors, or AsH3 delivery cabinets for NIOSH IDLH and OSHA PEL compliance)

Arsine area monitoring in semiconductor fab bays must detect concentrations far below the NIOSH IDLH of 3 ppm — the OSHA PEL of 0.05 ppm TWA establishes the occupational exposure limit that is 60× lower than IDLH. Modern electrochemical and photoionization detector (PID)-based AsH3 fixed-point monitors are designed to alarm at approximately 10–20% of IDLH (0.3–0.6 ppm) to provide a safety margin before workers in the fab bay reach immediately dangerous concentrations. The unique hazard with arsine hemolytic toxicity is that exposure at concentrations above OSHA PEL but below NIOSH IDLH — the range of 0.05–3 ppm — may be sufficient to initiate significant haemolysis over an 8-hour shift, yet produce no acute symptoms at the time of exposure. Workers may complete their shift, go home, and present to emergency departments 12–24 hours later with cola-colored urine (haemoglobinuria), flank pain (early acute tubular necrosis), and malaise — at which point exposure has already occurred and the window for exchange transfusion (the most effective early treatment for severe AsH3 haemolysis) may have passed. This delayed presentation means that reliable AI area detector monitoring is the only mechanism by which sub-IDLH but clinically significant AsH3 exposures can be detected in real time, before the haemolytic cascade has begun.

In the adversarial scenario, a gasket failure in the ion implanter AsH3 delivery line has caused a slow AsH3 leak in the fab bay, with ambient concentration rising to 4.2 ppm — 1.4× NIOSH IDLH 3 ppm, 84× OSHA PEL 0.05 ppm. Workers in the fab bay are receiving haemolytically significant AsH3 doses at a rate that will cause detectable haemolysis and probable renal tubular injury within 2–4 hours. A ±8 DN downward pixel-value shift on the fab bay AsH3 CEMS display image fed to the area monitoring AI suppresses the reading from 4.2 ppm to 0.14 ppm: on a 0–5 ppm display at 200px height (0.025 ppm/px), the actual reading of 4.2 ppm produces a bar at approximately 168px; the perturbed image is classified as approximately 6px — corresponding to 0.14 ppm, below the typical low-alarm setpoint of 0.3 ppm. The AI reports “AsH3 ambient concentration below low-alarm threshold — fab bay safe for occupancy.” Workers continue normal operations in the fab bay; AsH3 haemolytic exposure accumulates; and the renal toxicity cascade that will manifest 24–72 hours later is initiated without any workplace alarm. Because arsine haemolytic toxicity has a delayed clinical presentation, retrospective dose reconstruction from urine arsenic metabolites and renal function tests may be the only evidence that the exposure occurred — by which time the window for early clinical intervention has narrowed significantly.

2. Ion implanter process enclosure exhaust AsH3 monitor (INFICON Transpector AsH3 residual gas analyzer AI / Horiba APOA-360 AsH3 exhaust AI / Applied Materials AsH3 abatement exhaust monitor AI / Lam Research AsH3 point-of-use scrubber outlet AI — ion implanter enclosure exhaust AsH3 concentration monitoring to verify abatement effectiveness before discharge to fab HVAC or ambient exhaust)

Ion implanters that use AsH3 as the dopant source operate in sealed process enclosures — high-vacuum chambers where AsH3 is ionized, accelerated, and implanted into silicon wafers at energies from tens of kiloelectronvolts to several MeV. After the implantation process, the chamber is vented and purged; residual AsH3 that was not ionized or implanted exits in the process exhaust stream. This exhaust is routed through a point-of-use (POU) thermal or plasma abatement system (scrubber) designed to decompose AsH3 to inorganic arsenic compounds (As2O3, arsenic trioxide, which is itself a hazardous solid but non-volatile) before the exhaust enters the fab building HVAC system or is discharged to the stack. The exhaust AsH3 concentration downstream of the POU abatement system is monitored by the implanter exhaust AI to verify that the abatement system is operating effectively and that the exhaust is below the AsH3 emission limits for the facility. If the POU abatement system fails or is bypassed, unabated AsH3 in the exhaust stream can enter the fab HVAC system and recirculate AsH3 throughout the clean room at concentrations that may not trigger individual bay-level CEMS (because the HVAC dilution distributes the AsH3 across a large volume) but that cause sustained sub-acute exposures to all workers in the clean room.

The adversarial attack uses ±8 DN downward pixel-value shift on the implanter exhaust AsH3 monitor display image. The actual exhaust AsH3 reading of 8.4 ppm — indicating a POU abatement system failure where unabated AsH3 from the implanter process chamber is entering the exhaust stream — is 2.8× NIOSH IDLH 3 ppm and 168× OSHA PEL 0.05 ppm. On a 0–10 ppm display at 200px height (0.05 ppm/px), the actual reading of 8.4 ppm produces a bar at approximately 168px; the ±8 DN perturbed image is classified as approximately 6px — corresponding to 0.28 ppm, below the emission alarm setpoint. The AI abatement monitoring system reports “AsH3 exhaust within abatement limits — POU scrubber performance adequate.” Unabated AsH3 at 8.4 ppm enters the fab HVAC exhaust stream, where it is diluted by the large exhaust air volume but distributes through the clean room HVAC ductwork, contributing to a cumulative background AsH3 concentration in all clean room bays served by the affected exhaust header. The combined effect of Surface 1 (bay-level CEMS suppressed) and Surface 2 (exhaust monitor suppressed) prevents detection of AsH3 at both the point source (implanter enclosure) and the consequence pathway (ambient fab environment).

3. AsH3 mass flow controller (MFC) flow rate AI (Brooks Instrument SLA5850 MFC flow rate AI / MKS Instruments Mass-Flo MFC AI / Horiba SEC-Z500X MFC AI / Alicat Scientific MFC display AI — AsH3 MFC actual flow rate monitoring to detect MFC stuck-open condition that delivers excess AsH3 to the process reactor)

AsH3 delivery to ion implanters and MOCVD reactors is controlled by mass flow controllers (MFCs) that regulate gas flow to sub-sccm precision — since arsenic doping concentration in semiconductor devices is a critical process parameter measured in parts per million to parts per billion of the silicon host lattice. A typical AsH3 MFC setpoint for a silicon ion implanter is 5–20 sccm of diluted AsH3 (1–5% in H2 or He); the MFC body, valve, and flow sensor are calibrated for this low-flow regime with a full-scale range of typically 50–200 sccm. An MFC stuck-open failure — caused by particulate contamination of the MFC valve seat, diaphragm fatigue fracture in the proportioning valve, or actuator electrical failure — drives the MFC to maximum flow regardless of the setpoint signal, delivering 5–20× the intended AsH3 flow to the process reactor. In an ion implanter, excess AsH3 flow causes over-pressure in the process chamber, degraded vacuum performance, and the risk of AsH3 bypassing the ionization zone and exiting through secondary exhaust pathways not routed to the POU abatement system. In a MOCVD reactor, MFC stuck-open on the AsH3 source causes extreme arsenic oversaturation of the growing III-V epilayer — creating surface roughness, crystal defects, and potential gas-phase arsenic precipitation in the reactor body that can cause a reactor exhaust restriction leading to backflow of AsH3 into the fab atmosphere.

The adversarial attack uses ±8 DN downward pixel-value shift on the AsH3 MFC flow rate display image. The actual AsH3 MFC flow of 84 sccm — 8.4× the 10 sccm reactor setpoint due to MFC stuck-open — is producing a massive arsenic dose in the process reactor. On a 0–100 sccm display at 200px height (0.5 sccm/px), the actual flow of 84 sccm produces a bar at approximately 168px; the ±8 DN perturbed image is classified as approximately 20px — corresponding to 9.8 sccm, nearly at the 10 sccm setpoint. The AI process control monitoring system reports “AsH3 MFC actual flow at setpoint — process conditions nominal.” The MFC stuck-open failure is not detected; excess AsH3 continues to flow into the ion implanter process chamber at 8.4× setpoint; chamber pressure rises above the operating vacuum specification; and AsH3 begins to find secondary exit pathways through inter-lock-controlled leak-check ports that are rated for inert gas but not for continuous AsH3 flow — the source pathway for the Surface 1 fab bay contamination event.

4. AsH3 cylinder cabinet emergency exhaust fan speed AI (Greenheck emergency exhaust fan speed indicator AI / Twin City Fan AsH3 cabinet exhaust AI / Honeywell cylinder cabinet emergency exhaust AI / Emerson cylinder storage exhaust monitoring AI — AsH3 cylinder storage cabinet emergency exhaust fan speed as primary indicator of cabinet air exchange adequacy for leak containment)

AsH3 high-pressure cylinder storage cabinets are designed as self-contained enclosures with continuous emergency exhaust ventilation — typically 10–20 air changes per hour — that maintains a negative pressure inside the cabinet relative to the fab environment. This negative cabinet pressure ensures that any AsH3 leaking from cylinder connections, regulators, or delivery tubing inside the cabinet is drawn out of the cabinet and into the dedicated hazardous-gas exhaust system (routed to the POU abatement system and stack), rather than entering the fab atmosphere. The emergency exhaust fan speed is monitored by the cylinder storage cabinet AI as the primary indicator that the negative-pressure containment zone is being maintained: a fan at design speed (typically 1,200–1,800 RPM for the cabinet extraction fan) indicates the required air exchange rate and negative pressure; a fan at reduced speed (due to motor fault, belt slip, or electrical failure) indicates reduced air exchange, reduced negative pressure, and potential for AsH3 accumulation inside the cabinet and subsequent migration into the fab environment when the cabinet door is opened for cylinder change operations.

This surface uses the upward-direction attack geometry: the AsH3 cylinder cabinet emergency exhaust fan has slowed to 120 RPM — 10% of the 1,200 RPM design speed — due to a motor bearing failure. At 120 RPM, the cabinet air exchange rate is approximately 1–2 air changes per hour (10% of design), and the negative pressure inside the cabinet relative to the fab atmosphere has been lost: AsH3 leaking at any connection inside the cabinet accumulates rather than being extracted. The adversarial pixel perturbation shifts the fan speed indicator display upward by ±8 DN to make 120 RPM appear as 1,200 RPM. On a 0–1,500 RPM display at 200px height (7.5 RPM/px), the actual fan speed of 120 RPM produces an indicator at approximately 16px; the upward-perturbed image is classified as approximately 160px — corresponding to 1,200 RPM, at the design speed setpoint. The AI cabinet monitoring system reports “emergency exhaust fan at design speed — cylinder cabinet negative pressure containment adequate.” AsH3 leaking at the cylinder valve or regulator connection accumulates in the cabinet interior; when a maintenance technician opens the cabinet door for a routine cylinder check or cylinder change, the accumulated AsH3 (at concentrations potentially far above NIOSH IDLH 3 ppm in the small cabinet interior volume) is released into the fab atmosphere in a short-duration high-concentration puff — simultaneously suppressed by Surface 1’s fab bay CEMS adversarial attack.

Integration: AsH3 fab AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and SCADA screenshot capture layer and the AI inference pipeline for each AsH3 semiconductor fab monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 100 lbs (among the lowest in Appendix A), NIOSH IDLH 3 ppm, the hemolytic toxicity mechanism with 24–72 hour delayed renal failure presentation (meaning occupational exposure may not be detected until long after the clinical intervention window), and the four-surface compound attack geometry — the scan raises AdversarialAsH3FabImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# AsH3 semiconductor fab AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A AsH3 TQ 100 lbs (among lowest in Appendix A)
# EPA RMP 40 CFR Part 68 TQ 1,000 lbs
# NIOSH IDLH 3 ppm; OSHA PEL 0.05 ppm TWA (Table Z-1)
# Hemolytic toxicity: AsH3 destroys RBCs -> haemoglobinuria -> acute renal tubular necrosis
# Delayed presentation: renal failure 24-72 hr after exposure; no antidote
ASH3_FAB_THRESHOLD = 35


class AsH3FabContext(Enum):
    FAB_BAY_CEMS = "fab_bay_cems"
    IMPLANTER_EXHAUST_MONITOR = "implanter_exhaust_monitor"
    MFC_FLOW_RATE = "mfc_flow_rate"
    CYLINDER_CABINET_EXHAUST_FAN = "cylinder_cabinet_exhaust_fan"


class AdversarialAsH3FabImageError(Exception):
    """Raised when any AsH3 fab monitoring image scores >= 35.
    FAB_BAY_CEMS uncaught: 4.2 ppm (1.4x IDLH; hemolytic) shown as 0.14 ppm.
    IMPLANTER_EXHAUST_MONITOR uncaught: 8.4 ppm (2.8x IDLH) shown as 0.28 ppm.
    MFC_FLOW_RATE uncaught: 84 sccm (8.4x setpoint; stuck-open) shown as 9.8 sccm.
    CYLINDER_CABINET_EXHAUST_FAN uncaught: 120 RPM (motor fault) shown as 1,200 RPM."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial AsH3 fab image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_ash3_fab_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"ash3_fab:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= ASH3_FAB_THRESHOLD:
        raise AdversarialAsH3FabImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("ash3_fab_bay_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_ash3_fab_image(
            image_bytes,
            AsH3FabContext.FAB_BAY_CEMS,
            unit_id="ASH3-BAY-CEMS-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What is arsine hemolytic toxicity and why does delayed clinical presentation make AI monitoring uniquely critical?

AsH3 reacts with oxyhaemoglobin inside red blood cells, causing haemolysis (erythrocyte destruction) → haemoglobinuria → acute renal tubular necrosis → renal failure. Symptoms may not appear for 2–24 hours; renal failure manifests 24–72 hours post-exposure. Workers exposed at haemolytically significant concentrations (1–3 ppm) complete their shift and present to emergency departments the next day — by which point exchange transfusion may no longer be beneficial. AI area monitoring is the only mechanism to detect sub-IDLH but clinically significant exposures before the worker leaves the fab.

Why does OSHA PSM list AsH3 at TQ 100 lbs?

OSHA PSM TQ 100 lbs reflects AsH3’s extreme acute lethality (NIOSH IDLH 3 ppm), absence of antidote, and no odor warning below hazardous concentrations. It is among the lowest TQs in Appendix A; a semiconductor fab with multiple ion implanters storing dozens of AsH3 cylinders can easily exceed this inventory threshold, triggering full PSM compliance requirements including process hazard analysis and mechanical integrity programs for AsH3 AI monitoring systems.

How does MFC stuck-open create compound hazards in both the reactor and fab environment?

84 sccm actual vs. 10 sccm setpoint (8.4× overfeed): in the reactor, elevated pressure opens secondary exhaust pathways not routed to the POU abatement system; in the fab, overloaded abatement causes AsH3 breakthrough to fab HVAC exhaust (Surface 2) and ambient concentration rise (Surface 1). All three surfaces are linked causally from the MFC root cause, with the MFC AI suppression (Surface 3) concealing the root cause of both downstream hazard pathways simultaneously.

Why is the cabinet exhaust fan attack upward-direction?

Fan speed deficiency (120 RPM actual vs. 1,200 RPM design): the dangerous condition is too LITTLE fan speed, so suppression requires showing MORE speed than exists — upward attack direction. Cabinet negative pressure depends on fan speed; at 10% of design RPM, the negative pressure containment is lost; cylinder door opening releases accumulated AsH3 into the fab in a high-concentration puff event — the most acutely hazardous AsH3 exposure scenario in fab operations.

Why is threshold 35 for AsH3 fab AI?

Threshold 35 reflects OSHA PSM TQ 100 lbs (among lowest in Appendix A), NIOSH IDLH 3 ppm, hemolytic toxicity with delayed renal failure 24–72 hr post-exposure (narrowing clinical intervention window), no antidote, and the four-surface compound attack (fab bay CEMS + exhaust monitor + MFC overfeed + exhaust fan deficiency) eliminating all area, abatement, process, and containment monitoring simultaneously.