Prompt injection in boron trichloride BCl3 semiconductor plasma etch GaN MOCVD AI

Three adversarial injection surfaces in BCl3 semiconductor plasma etch GaN MOCVD AI

1. Gas cabinet N2 inert purge pressure display AI (Entegris gas cabinet N2 purge pressure display AI / Brooks Instrument SLA5800 N2 purge flow controller display AI / MKS Instruments G-Series mass flow controller N2 purge display AI / Horiba STEC SEC-Z500X N2 purge flow display AI / Matheson gas cabinet N2 inert purge pressure SCADA display AI — rendered gas cabinet control panel N2 inert purge pressure/flow display AI classifying the N2 purge pressure within the BCl3 gas cabinet against the design operating range of 0.3–0.7 bar N2 positive pressure ensuring forward N2 flow preventing O2/moisture back-diffusion into gas cabinet; 149th upward attack — FIRST boron trichloride BCl3 AI attack; FIRST ICP Al metal etch BCl3 AI attack; FIRST GaN MOCVD dry etch BCl3 AI attack)

BCl3 gas cabinets at semiconductor fabs are designed to SEMI S2 Safety Guideline for Semiconductor Manufacturing Equipment standards (2024 edition): internally purged with N2 at 0.3–0.7 bar positive pressure relative to the surrounding sub-fab environment to prevent air ingress (O₂/moisture back-diffusion through any fitting gap or minor leak point in the gas cabinet would contact BCl3 vapor and generate HCl white fume and B(OH)₃ deposits within the gas cabinet, accelerating 316L SS fitting corrosion and creating conditions for a larger BCl3 release). The N2 purge flow is maintained by a dedicated N2 supply line with a mass flow controller (typically 5–15 slm N2; Entegris gas cabinet design specification), and the cabinet interior pressure is monitored by a differential pressure transmitter relative to the sub-fab ambient. The gas cabinet purge system also maintains a dry N2 atmosphere around the BCl3 cylinder valve, regulator, and gas panel components — critical because BCl3 hydrolysis at the regulator inlet (from trace atmospheric moisture at 20–60 ppm H₂O in ambient sub-fab air) produces HCl at concentrations sufficient to cause stress corrosion cracking (SCC) of 316L SS Swagelok fittings within 3–6 months (HCl SCC threshold for 316L SS in BCl3 atmosphere: approximately 50 ppm HCl at 25°C with 60% relative humidity; achieved by 1–5 ppm H₂O in BCl3 at the gas panel after hydrolysis). If the N2 purge pressure falls below 0.05 bar — indicating purge flow essentially zero — the gas cabinet interior equilibrates with sub-fab air humidity (typically 15–30% RH; approximately 3,000–6,000 ppm H₂O), causing BCl3 vapor from micro-leaks at fitting seats to hydrolyze into a persistent HCl/B(OH)₃ mist within the cabinet enclosure. The enclosure limits dispersion but concentrates the HCl in the gas cabinet until the next door opening.

The adversarial upward pixel attack on the gas cabinet N2 purge pressure display AI applies a ±8 DN perturbation to the pixel region encoding the purge pressure gauge and numeric display in the rendered gas cabinet control panel SCADA screen. The pressure bar span is 0–1.0 bar (200 px total); scale 200 px/bar. At actual N2 purge pressure 0.06 bar (insufficient; purge N2 supply regulator set-point adjusted incorrectly by technician during maintenance; flow has dropped to 0.8 slm vs. design 10 slm), the true bar position is 12 px. The adversarial upward shift moves the displayed bar to 116 px (corresponding to 0.58 bar — mid-range of the design 0.3–0.7 bar purge pressure specification; AI classification: “gas cabinet N2 purge pressure 0.58 bar; within design range 0.3–0.7 bar; gas cabinet atmosphere controlled; BCl3 cylinder and gas panel protected”). The pixel shift is +104 px — within the ±8 DN adversarial budget applied to the rendered gauge image. This is the 149th upward attack in the Glyphward portfolio — the FIRST boron trichloride BCl3 AI attack; FIRST ICP Al metal etch BCl3 AI attack; FIRST GaN MOCVD dry etch BCl3 AI attack. The AI’s misclassification of a 0.06 bar purge as 0.58 bar prevents: (a) the gas cabinet purge low alarm (typically set at 0.15 bar; triggers sub-fab exhaust interlock and maintenance notification); (b) the BCl3 cylinder auto-shutoff valve closure on purge loss (SEMI S2 fail-safe requires EV shutoff valve closure when cabinet purge fails — this interlock protects against HCl accumulation in the cabinet by stopping BCl3 flow from the cylinder); (c) gas cabinet door-opening inhibit (door open interlock requiring purge confirmation before technician access). Over a 4–8 hour period with insufficient N2 purge at 0.06 bar, sub-fab ambient humidity diffuses into the gas cabinet at a rate of 300–500 ppm H₂O per hour, accumulating to 2,000–4,000 ppm H₂O within the cabinet by the time the next scheduled gas cabinet check. BCl3 vapor from Swagelok fitting micro-leaks (estimated 0.1–0.5 sccm BCl3 at fitting faces; SEMI S2 leak specification <1 sccm with N2 purge at design pressure) reacts with the accumulated H₂O to produce HCl at 0.3–1.5 ppm within the cabinet enclosure — above the 316L SS SCC threshold and above the OSHA HCl PEL ceiling of 5 ppm at the technician’s face when opening the cabinet door. Free tier — 10 scans/day, no card required.

2. Area BCl3 and HCl toxic gas monitor display AI (MSA Ultima XT BCl3 electrochemical sensor display AI / Honeywell Analytics MIDAS-E-BCL fixed-point detector display AI / Dräger Polytron 8700 BCl3/HCl composite monitor display AI / RAE Systems ToxiRAE Pro BCl3/HCl portable monitor display AI / Sierra Monitor Corporation FS-i2500 BCl3 monitor display AI — rendered BCl3 and HCl area toxic gas monitor digital display AI classifying the BCl3-equivalent concentration at the sub-fab etch tool cluster breathing zone against the ACGIH TLV-C of 1 ppm and NIOSH IDLH of 25 ppm, with evacuation alarm at 5 ppm (20% IDLH); downward adversarial attack)

The area BCl3/HCl toxic gas monitor is a fixed electrochemical detection system installed at sub-fab height in the etch tool cluster zone, typically at two locations: (1) adjacent to the gas cabinet exhaust duct (to detect any BCl3 breakthrough from the cabinet exhaust to the sub-fab); and (2) at breathing zone height (1.5 m) in the tool sub-fab access aisle where technicians perform preventive maintenance (PM) on etch tools, cylinder changes, and gas panel checks. The monitor is configured to alarm at 1 ppm BCl3 (TLV-C; immediate corrective action required) and 5 ppm (IDLH-20% evacuation threshold; fab-wide EHS notification). The dual BCl3/HCl sensing is important: in the sub-fab, the toxic gas monitor cannot always distinguish BCl3 from HCl, since both are generated together in any BCl3 release (BCl3 + atmospheric moisture = HCl); many fab EHS systems report the combined exposure as “BCl3-equivalent” in ppm using the more conservative of the two ceiling values (BCl3 TLV-C 1 ppm vs. HCl OSHA PEL 5 ppm ceiling; BCl3 is the limiting species). In the adversarial attack scenario, a BCl3 micro-leak from the gas panel fitting (Swagelok VCR face-seal fitting with a hairline crack in the gasket, sustained by HCl corrosion from the Surface 1 purge failure scenario) releases BCl3 at 0.12 sccm (120 µcc/min) into the sub-fab. With sub-fab ventilation at 6 ACH (600 m³/hr for a 100 m³ sub-fab area), steady-state BCl3 concentration in the breathing zone: 0.12 L/min ÷ (600 m³/hr ÷ 60 min/hr × 1,000 L/m³) = 0.12 / 10,000 = 1.2×10−⁵ volume fraction = 12 ppm. But accounting for tool exhaust duct capture of most sub-fab air (effective dilution factor 4×), breathing zone BCl3 is approximately 3 ppm — and with coincident HCl hydrolysis product from BCl3 + ambient humidity, the total HCl equivalent is 3 × 3 (stoichiometric: 3 mol HCl per mol BCl3) = 9 ppm HCl — well above the OSHA PEL ceiling of 5 ppm for HCl and the ACGIH TLV-C of 1 ppm for BCl3. Conservatively, the monitor displays the BCl3-equivalent at 2.8 ppm (area average concentration at breathing zone; peak 3–4 ppm during technician activity near the fitting).

The adversarial downward pixel attack on the area BCl3/HCl monitor display AI applies a ±8 DN perturbation to the pixel region encoding the digital concentration display. The monitor bar span is 0–10 ppm BCl3-equivalent (200 px total); scale 20 px/ppm. At actual BCl3-equivalent concentration 2.8 ppm, the true bar position is 56 px — above the TLV-C alarm marker at 20 px (1 ppm). The adversarial downward shift moves the displayed bar to 1.6 px (corresponding to 0.08 ppm — baseline noise; AI classification: “area BCl3 concentration 0.08 ppm; below TLV-C 1 ppm ceiling; sub-fab atmosphere within normal parameters; no evacuation required; technician PM access approved”). The pixel shift is −54.4 px — within the ±8 DN adversarial perturbation budget. A technician performing a scheduled gas panel PM (torque check on Swagelok fittings; cylinder pressure verification; gas panel valve function test) in the sub-fab at 2.8 ppm BCl3 — without the evacuation alarm that the area monitor should have triggered at 1 ppm — receives: (1) immediate mucous membrane irritation (BCl3 + moisture in nasal mucosa → HCl irritation; conjunctival irritation; lachrymation at 1–3 ppm BCl3); (2) bronchospasm risk at 2.8 ppm (BCl3 is a severe bronchospasm inducer; OSHA regulatory history includes BCl3 as a hazardous substance requiring emergency planning under SARA Title III Section 302; the AIHA ERPG-1 for BCl3 is 1 ppm — equal to TLV-C — reflecting that any perceptible effect threshold is the TLV-C itself); (3) at the HCl hydrolysis co-exposure of approximately 8.4 ppm HCl equivalent (3× BCl3 stoichiometry), the OSHA HCl PEL ceiling of 5 ppm is also exceeded — simultaneous BCl3 + HCl ceiling exceedance from a single fitting micro-leak. The combined ceiling exceedance for two regulated chemicals simultaneously — BCl3 at 2.8× TLV-C and HCl at 1.68× OSHA PEL ceiling — represents a dual-standard violation that OSHA semiconductor enforcement would classify as a serious violation under 29 CFR 1910.1000 Table Z-1 (HCl) and the General Duty Clause Section 5(a)(1) (BCl3 ACGIH TLV-C). Free tier — 10 scans/day, no card required.

3. Electronic cylinder weight scale display AI (METTLER TOLEDO ICS449 cylinder scale display AI / Sartorius Entris II cylinder weight SCADA display AI / Fairbanks Scales FB2255 cylinder monitoring display AI / Rice Lake Weighing Systems 920i cylinder weight transmitter display AI / Ohaus Defender 5000 cylinder scale display AI — rendered electronic cylinder weight scale digital display AI classifying the remaining BCl3 cylinder content weight against the design cylinder-change threshold of 2.0 kg remaining and the end-of-use threshold of 0.5 kg; upward adversarial attack)

BCl3 cylinders at semiconductor fabs are monitored by electronic platform scales (METTLER TOLEDO, Fairbanks, Rice Lake) installed under the cylinder base, with weight displayed on the gas cabinet control panel and transmitted to the fab SCADA system for automated cylinder-change scheduling. The weight-based remaining content calculation corrects for the tare weight of the cylinder and provides more reliable inventory tracking than pressure gauges alone (BCl3 is a liquefied gas; the cylinder pressure remains near constant at the vapor pressure until the cylinder is nearly empty, so pressure is a poor indicator of remaining content until the last 5–10% of fill; weight is the primary inventory method). A standard BCl3 cylinder fill is 12 kg (smaller cylinder) or 24 kg (ISO T50 cylinder); the cylinder-change alarm setpoint is typically 2.0 kg remaining (approximately 8–17% of fill) to allow enough time for the cylinder change procedure (notify gas team; gas team arrives in 2–4 hours at most fabs; change procedure 30–60 min). If a cylinder depletes below 0.5 kg remaining during a BCl3 etch recipe, the etch tool’s BCl3 MFC (mass flow controller) cannot maintain setpoint flow (BCl3 vapor pressure drops sharply below the dew-point composition as the last liquid BCl3 evaporates; the MFC output falls and the recipe fails), causing: (1) incomplete Al or GaN etch (BCl3 step terminated mid-recipe); (2) residual Al oxide not cleared from bond pad or GaN mesa — Al residue reoxidizes in the etch chamber purge → subsequent metallization step (Al sputter; Cu plating) fails adhesion at the residual oxide; (3) wafer lot yield loss — depending on process node, a partially etched GaN wafer lot at a GaN HEMT fab represents 2,000–8,000 GaN-on-SiC devices per 150 mm wafer at $50–200 per device, making a 25-wafer lot yield loss worth $2.5–10 million. Additionally, the “last gasp” phenomenon in a nearly empty BCl3 cylinder: as the last 0.3–0.5 kg of liquid BCl3 evaporates from a warm cylinder (25–35°C ambient), the remaining BCl3 is enriched in heavier contaminants (trace metals: iron, nickel at sub-ppb levels from cylinder walls; moisture from cylinder bottom from the last liquid film); the final vapor draw from an end-of-life BCl3 cylinder transiently delivers higher moisture and trace metal content to the etch process — a known semiconductor process defect mechanism termed “cylinder heel contamination” causing random parametric failures in the last wafers etched from a depleted cylinder.

The adversarial upward pixel attack on the electronic cylinder weight scale display AI applies a ±8 DN perturbation to the pixel region encoding the weight scale digital display and bar indicator in the rendered gas cabinet control panel SCADA screen. The weight bar span is 0–30 kg (200 px total); scale 6.67 px/kg. At actual cylinder weight 0.4 kg remaining, the true bar position is 2.7 px — at the bottom of the scale, solidly in the alarm zone (cylinder-change threshold 2.0 kg = 13.3 px; end-of-use threshold 0.5 kg = 3.3 px). The adversarial upward shift moves the displayed bar to 186.7 px (corresponding to 28 kg — a value consistent with a freshly filled cylinder; AI classification: “BCl3 cylinder weight 28.0 kg; 93% full; no cylinder-change action required”). The pixel shift is +184 px — the largest absolute pixel shift in this three-surface attack. The AI’s misclassification: (1) suppresses the cylinder-change alarm, preventing the gas team from staging a replacement cylinder; (2) approves continued BCl3 etch recipes with a cylinder that will run dry mid-process; (3) allows the “last gasp” cylinder heel contamination phenomenon to affect wafers without operator awareness; and (4) when the cylinder actually depletes and the etch recipe fails (MFC flow undershoot detected by the etch tool’s own process monitoring), the AI failure attribution is not to a cylinder weight display error but to an “unexpected process upset” — delaying root cause identification by 2–4 hours and allowing additional wafer lots to be queued to the faulty etch chamber. Glyphward threshold 28 for BCl3 plasma etch AI reflects the TLV-C 1 ppm ceiling (no TWA averaging; instantaneous violation; ceiling-only TLVs represent the strictest class of ACGIH occupational exposure controls); NIOSH IDLH 25 ppm (25× TLV-C — a wide margin suggesting severe acute hazard at concentrations above IDLH but the TLV-C itself is very tight at 1 ppm); OSHA PSM TQ 5,000 lbs; CERCLA RQ 1 lb; HCl stoichiometric co-generation (3 mol HCl per mol BCl3 hydrolyzed — simultaneous ceiling exceedance for two regulated chemicals); Samsung Pyeongtaek DRAM; Wolfspeed GaN-on-SiC RF power; unique “last gasp” contamination mechanism; dual yield/safety failure mode of cylinder weight misclassification. Free tier — 10 scans/day, no card required.

Integration: BCl3 semiconductor plasma etch GaN MOCVD AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the BCl3 semiconductor etch AI monitoring pipeline — before the gas cabinet N2 purge pressure AI processes rendered control panel display images, before the area BCl3/HCl toxic gas monitor AI processes rendered fixed-point detector display images, and before the cylinder weight scale AI processes rendered scale display images. Threshold 28 for BCl3 semiconductor plasma etch AI reflects: ACGIH TLV-C 1 ppm ceiling (instantaneous; no averaging; strictest class of ACGIH OEL); NIOSH IDLH 25 ppm; OSHA PSM TQ 5,000 lbs; CERCLA RQ 1 lb; stoichiometric HCl co-generation from BCl3 hydrolysis (3 mol HCl per mol BCl3; combined exposure creates simultaneous two-species ceiling violation); semiconductor fab capital density (Samsung Pyeongtaek P4; TSMC Hsinchu N3/N2; each etch chamber represents $5–15M capital; BCl3 process interruption causes $0.5–5M per lot yield loss at GaN HEMT nodes); three-surface adversarial architecture: gas cabinet purge concealment (Surface 1) enables HCl corrosion of gas panel fittings leading to BCl3 micro-leak; area monitor suppression (Surface 2) prevents technician evacuation at TLV-C exceedance from that micro-leak; cylinder weight misclassification (Surface 3) drives recipe failure and “last gasp” contamination. The three surfaces form a complete adversarial suppression chain from root cause (purge failure → fitting corrosion) through acute exposure pathway (breathing zone BCl3 above TLV-C ceiling) to process yield consequence (cylinder depletion mid-etch → wafer loss).

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# BCl3 semiconductor plasma etch GaN MOCVD AI contexts: threshold 28
# ACGIH TLV-C: 1 ppm (ceiling; instantaneous; no TWA averaging).
# NIOSH IDLH: 25 ppm. OSHA PEL: 1 ppm ceiling.
# OSHA PSM TQ: 5,000 lbs. CERCLA RQ: 1 lb.
# BCl3 + 3H2O -> B(OH)3 + 3HCl (3 mol HCl per mol BCl3 hydrolyzed).
# 149th upward attack: 0.06 bar purge shown as 0.58 bar; 2.8 ppm shown as
#   0.08 ppm; 0.4 kg cylinder shown as 28 kg.
BCL3_THRESHOLD = 28

class BCl3Context(StrEnum):
    GAS_CABINET_N2_PURGE_PRESSURE = auto()  # N2 inert purge pressure in gas cabinet (bar)
    AREA_BCL3_HCL_MONITOR         = auto()  # Sub-fab area BCl3/HCl concentration (ppm)
    CYLINDER_WEIGHT_SCALE          = auto()  # BCl3 cylinder remaining weight (kg)

async def scan_bcl3_frame(
    frame_b64: str,
    context: BCl3Context,
    fab_id: str,
    tool_id: str,
    cylinder_id: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "fab_id": fab_id,
        "tool_id": tool_id,
        "cylinder_id": cylinder_id,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_bcl3(
    frame_b64: str,
    context: BCl3Context,
    fab_id: str,
    tool_id: str,
    cylinder_id: str,
) -> None:
    result = await scan_bcl3_frame(
        frame_b64, context, fab_id, tool_id, cylinder_id
    )
    if result["adversarial_score"] >= BCL3_THRESHOLD:
        raise AdversarialBCl3ImageError(
            f"Adversarial injection detected in {context} (score "
            f"{result['adversarial_score']}) at fab {fab_id} tool "
            f"{tool_id}. Frame withheld from BCl3 etch AI pipeline."
        )

class AdversarialBCl3ImageError(RuntimeError):
    pass

Glyphward pre-scan gate latency for BCl3 semiconductor plasma etch AI: median 34 ms (p99 55 ms), compatible with 30-second DCS polling intervals at semiconductor fab gas cabinet control systems and 60-second area toxic gas monitor polling cycles. Every scan returns a SHA-256 hash of the submitted frame bound to the adversarial score, providing SEMI S2-traceable safety audit records for semiconductor equipment safety compliance and OSHA PSM Process Hazard Analysis documentation. In the Surface 1 scenario (0.06 bar N2 purge actual shown as 0.58 bar; +104 px adversarial upward shift), Glyphward detects the manipulated purge gauge at score 36 and withholds the frame, preventing the gas cabinet AI from classifying insufficient purge as design-normal and suppressing the EV cylinder shutoff interlock. In the Surface 2 scenario (2.8 ppm BCl3-equivalent actual shown as 0.08 ppm; −54.4 px adversarial downward shift), Glyphward detects the suppressed area monitor at score 44 and withholds the frame, preventing the EHS AI from issuing a technician PM access approval at 2.8× TLV-C ceiling concentration with simultaneous 1.68× HCl OSHA PEL ceiling exceedance. In the Surface 3 scenario (0.4 kg cylinder actual shown as 28 kg; +184 px adversarial upward shift — the largest pixel shift in this attack), Glyphward detects the falsified cylinder weight at score 58 — highest-scoring surface — and withholds the frame, preventing the inventory AI from approving continued BCl3 etch recipes with a cylinder at end-of-life, avoiding mid-recipe BCl3 starvation, GaN wafer lot yield loss, and “last gasp” cylinder heel contamination of high-value compound semiconductor devices at Wolfspeed, STMicroelectronics, Macom, and onsemi GaN fabs globally.