Prompt injection in diborane (B2H6) semiconductor CVD AI

Four adversarial injection surfaces in B2H6 semiconductor CVD AI

1. B2H6 fab bay area CEMS (Honeywell Analytics MIDAS B2H6 detector AI / Dräger Polytron SE B2H6 CEMS AI / MSA Ultima XE B2H6 area monitor AI / RKI Instruments GX-6000 B2H6 CEMS AI — ambient B2H6 monitoring in fab bays containing epitaxial reactors, CVD chambers, and B2H6 delivery cabinets for simultaneous pyrophoric fire detection and ACGIH TLV-C ceiling compliance)

B2H6 area monitoring in semiconductor fab bays must simultaneously serve two distinct safety functions: toxic gas exposure detection (ACGIH TLV-C 0.1 ppm ceiling; NIOSH IDLH 15 ppm) and pyrophoric fire early-warning (any B2H6 release into air at concentrations that contact oxygen will auto-ignite, potentially before reaching the CEMS alarm threshold if the release is highly localized). The pyrophoric character of B2H6 creates a compound monitoring challenge: unlike flammable gases (hydrogen, methane) that require an ignition source and fall within a defined LEL-UEL explosive range, B2H6 auto-ignites on any contact with atmospheric oxygen without requiring an ignition source and without the gradual concentration build-up that gives LEL/UEL gases a monitoring window before ignition risk. A micro-leak of undiluted B2H6 from a cylinder manifold fitting can auto-ignite before the B2H6 concentration in the broader fab bay space has risen to even 10% of the NIOSH IDLH — meaning that by the time the area CEMS registers a significant ambient B2H6 reading, a localized pyrophoric fire may already have initiated at the leak point. This creates a uniquely severe risk from AI CEMS false-negatives: a suppressed area detector alarm means that both the toxic exposure warning and the pyrophoric fire early-warning are disabled simultaneously.

In the adversarial scenario, a flared-tube fitting failure at the B2H6 cylinder manifold in the cylinder storage cabinet has caused B2H6 to leak from the manifold at a rate that is producing a B2H6 plume in the fab bay at 18.4 ppm — 1.2× NIOSH IDLH 15 ppm and 184× ACGIH TLV-C 0.1 ppm. The B2H6 plume is auto-igniting at the leak point, producing a small pyrophoric flame visible to a worker on the opposite side of the fab bay. A ±8 DN downward pixel-value shift on the fab bay B2H6 CEMS display image fed to the area monitoring AI suppresses the reading from 18.4 ppm to 0.6 ppm: on a 0–20 ppm display at 200px height (0.1 ppm/px), the actual reading of 18.4 ppm produces a bar at approximately 184px; the perturbed image is classified as approximately 6px — corresponding to 0.6 ppm, below the TLV-C ceiling alarm of 0.1 ppm converted to area-display scale. The AI reports “B2H6 ambient concentration below TLV-C ceiling — fab bay safe.” The emergency shutdown of the B2H6 delivery system that would normally be triggered by an IDLH-level area alarm is not initiated; B2H6 flow continues from the cylinder manifold through the failing fitting; the pyrophoric flame continues to burn at the fitting; and the flame heats the B2H6 cylinder body, increasing cylinder pressure in a positive feedback loop toward the cylinder PRD set-point.

2. CVD reactor B2H6 feed gas concentration monitor (INFICON Transpector B2H6 residual gas analyzer AI / MKS Instruments Multigas 2030 B2H6 concentration AI / Horiba BEP200 B2H6 feed AI / Applied Materials EpiCentura B2H6 dilution ratio AI — B2H6/H2 diluted feed gas concentration monitoring to verify safe dilution ratio below pyrophoric threshold for process tool delivery line connections)

B2H6 is delivered to CVD and epitaxial process tools as a 1–5% dilution in H2 — specifically because the dilute mixture, while still containing pyrophoric B2H6, has substantially different pyrophoric behavior than pure B2H6: the H2 diluent provides a reducing atmosphere at the delivery connection point that suppresses the available oxygen concentration at the B2H6 molecule’s first contact surface, reducing the probability of immediate auto-ignition at sub-atmospheric concentrations. Process safety specifications for B2H6 delivery systems typically set a maximum B2H6 concentration of 0.5 vol% in the diluent carrier gas — below which the dilution is sufficient to prevent auto-ignition at delivery line connection fittings during routine tool maintenance operations (connector break-make, filter replacement, delivery line purge). Above 0.5 vol% B2H6, the diluent H2 fraction is insufficient to fully suppress auto-ignition at connection fittings, and the risk of pyrophoric ignition during any connection-disturbance event (tool maintenance, carrier gas interruption, tool pump-down from atmospheric pressure) increases significantly. AI monitoring of the CVD reactor B2H6 feed gas concentration — via inline residual gas analyzers (RGA) or process mass spectrometers — classifies whether the feed gas has remained within the 0.5 vol% B2H6 maximum safe dilution specification or has become enriched in B2H6 (e.g., due to dilution gas flow restriction, H2 supply pressure drop, or carrier gas mass flow controller failure).

The adversarial attack uses ±8 DN downward pixel-value shift on the B2H6 feed gas concentration monitor display image. The actual B2H6 feed gas concentration of 2.4 vol% — caused by a simultaneous H2 dilution gas MFC underfeed (15% of setpoint due to a plugged MFC filter) that has allowed the B2H6 fraction to rise to 2.4 vol%, 4.8× the 0.5 vol% safe-handling specification — represents a feed gas mixture at which any delivery line connection disturbance (tool pump-down from ambient, delivery line connector break-make) can initiate pyrophoric ignition at the connection fitting. On a 0–5 vol% display at 200px height (0.025 vol%/px), the actual reading of 2.4 vol% produces a bar at approximately 192px; the ±8 DN perturbed image is classified as approximately 3px — corresponding to 0.08 vol%, well below the 0.5 vol% specification limit. The AI reports “B2H6 feed dilution ratio within safe specification.” A maintenance technician who breaks a delivery line connection to the CVD reactor while the feed gas is at 2.4 vol% B2H6 (4.8× the safe specification) contacts the undiluted B2H6 stream with air at the fitting separation point — triggering pyrophoric ignition at the break point and a flash fire that can propagate along the B2H6/H2 delivery tubing to the cylinder cabinet simultaneously with the fab bay Area CEMS event described in Surface 1.

3. B2H6 cylinder storage cabinet temperature AI (Vaisala HMT330 temperature transmitter AI / Honeywell T775 cabinet temperature AI / Yokogawa OpreX temperature monitoring AI / Rosemount 248 RTD temperature transmitter AI — B2H6 cylinder storage cabinet ambient temperature monitoring to prevent cylinder vapor pressure exceedance and thermal seal deterioration at elevated cabinet temperatures)

B2H6 cylinder storage cabinets are rated for maximum internal temperatures of approximately 30°C under NFPA 55 (Compressed Gases and Cryogenic Fluids Code) and semiconductor fab safety standards, because B2H6 cylinder vapor pressure increases with temperature and the B2H6/H2 mixture in cylinder manifold delivery tubing has different safe-operation temperature envelopes than pure inert gas delivery systems. At elevated cabinet temperatures (>40–50°C), two distinct hazards escalate: (1) B2H6 cylinder pressure rises toward the pressure relief device (PRD) set-point as gas-phase B2H6 in the cylinder ullage expands and the cylinder approaches its thermal design limit; and (2) elastomeric seals in the cylinder manifold, delivery tubing connections, and purge valve bodies deteriorate more rapidly at elevated temperatures, increasing the probability of seal weep or fitting failure that releases B2H6 into the cabinet interior where, without adequate H2 sweep purge flow (Surface 4), it can accumulate to above-IDLH and pyrophoric-risk concentrations. B2H6 cylinder cabinets installed adjacent to fab walls exposed to solar radiation on hot summer days, or near process tool heat exhaust vents, can experience internal temperatures significantly above the 30°C design maximum.

The adversarial attack uses ±10 DN downward pixel-value shift on the cylinder cabinet temperature display image. The actual cabinet temperature of 52°C — arising from the cabinet being installed adjacent to a hot process tool exhaust vent on a summer afternoon — is 22°C above the 30°C design maximum. At 52°C, B2H6 cylinder PRD approach is a concern, and elastomeric seal life is substantially reduced versus the design temperature. On a 0–70°C display at 200px height (0.35°C/px), the actual temperature of 52°C produces a bar at approximately 149px; the ±10 DN perturbed image is classified as approximately 51px — corresponding to 18°C, comfortably below the 30°C design maximum and indicating that the cabinet thermal environment is being maintained well within safe operating bounds. The AI temperature monitoring system reports “B2H6 cylinder cabinet temperature 18°C — within design operating envelope.” No corrective action is taken to relocate the cabinet, improve local ventilation, or reduce the heat source from the adjacent process tool exhaust. The elevated 52°C environment continues to accelerate seal degradation at the cylinder manifold connections — the source pathway for the small fitting leak that drives Surface 1’s fab bay CEMS event and Surface 4’s H2 sweep purge accumulation event.

4. H2 sweep purge flow to B2H6 cylinder cabinet AI (Alicat Scientific MC-series H2 purge flow controller AI / Brooks Instrument SLA5850 H2 sweep flow AI / MKS Instruments Mass-Flo H2 purge flow AI / Honeywell cylinder cabinet H2 sweep monitoring AI — H2 sweep purge flow in B2H6 cylinder storage cabinets as the primary containment safeguard for pyrophoric B2H6 accumulation in the event of cylinder manifold micro-leaks)

B2H6 cylinder storage cabinets operating with continuous H2 sweep purge flow serve a different containment function from the N2 purge systems used for BF3 and ClF3 transfer lines. For B2H6 cabinets, the sweep gas is H2 rather than N2 because B2H6 is already delivered in H2 carrier gas and the cabinet atmosphere in normal operation already contains trace B2H6 and H2 from delivery tubing permeation and micro-leaks at manifold fittings. The H2 sweep purge continuously dilutes any leaked B2H6 in the cabinet interior below the pyrophoric threshold and maintains a reducing (H2-rich) atmosphere in the cabinet that suppresses the O2 concentration available at any B2H6 contact surface — preventing the auto-ignition that would occur if leaked B2H6 contacted air. At design H2 sweep flow rate (typically 8–10 m³/h through a 0.5–1 m³ cabinet), the B2H6 accumulation from a micro-leak is continuously diluted and the O2 concentration in the cabinet is maintained below the threshold for pyrophoric ignition of leaked B2H6. If the H2 sweep purge flow falls near zero (due to H2 supply pressure loss, purge flow MFC failure, or purge tubing blockage), the cabinet atmosphere shifts from H2-rich (reducing, non-ignition) to air-diluted (oxidizing): leaked B2H6 accumulates in the cabinet interior, and the absence of H2 diluent means O2 is available at the leaked B2H6 contact surfaces — creating pyrophoric auto-ignition conditions inside the cabinet.

This surface uses the upward-direction attack geometry: the H2 sweep purge flow to the B2H6 cylinder cabinet has fallen to 0.4 m³/h — 5% of the 8 m³/h design sweep rate — due to a blockage in the H2 sweep supply line filter (the filter has accumulated boron oxide (B2O3) deposits from prior B2H6 service). The dangerous condition is a sweep flow deficiency (too little H2 purge), and the adversarial pixel perturbation shifts the H2 sweep flow indicator display upward by ±8 DN to make 0.4 m³/h appear as 8.2 m³/h. On a 0–10 m³/h display at 200px height (0.05 m³/h per px), the actual sweep flow of 0.4 m³/h produces an indicator at approximately 8px; the upward-perturbed image is classified as approximately 164px — corresponding to 8.2 m³/h, at the design sweep rate. The AI cylinder cabinet monitoring system reports “H2 sweep purge flow at design rate — B2H6 cabinet pyrophoric-accumulation containment adequate.” Leaked B2H6 from the thermally-degraded manifold fitting (Surface 3 root cause: 52°C cabinet temperature) accumulates in the cabinet interior without H2 dilution; O2 from the reduced-sweep atmosphere is present at the leaked B2H6 contact surfaces; and when a maintenance technician opens the cabinet door to perform a routine cylinder inspection, the introduction of full air through the open cabinet door contacts the accumulated B2H6-enriched atmosphere in the cabinet interior, triggering a pyrophoric auto-ignition in the cabinet — simultaneous with the Surface 1 fab bay CEMS event from the same micro-leak, independently suppressed by the adversarial attack on the area detector.

Integration: B2H6 CVD AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and SCADA screenshot capture layer and the AI inference pipeline for each B2H6 semiconductor CVD monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 2,500 lbs, ACGIH TLV-C 0.1 ppm ceiling, NIOSH IDLH 15 ppm, pyrophoric auto-ignition on air contact (no ignition source required), the H2-sweep cabinet containment function unique to B2H6 systems, and the four-surface compound attack geometry — the scan raises AdversarialB2H6CVDImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# B2H6 semiconductor CVD AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A B2H6 TQ 2,500 lbs
# ACGIH TLV-C 0.1 ppm (ceiling); NIOSH IDLH 15 ppm
# OSHA PEL 0.1 ppm ceiling (29 CFR 1910.1000 Table Z-1)
# Pyrophoric: auto-ignites on air contact without ignition source
# B2H6 + 6H2O -> 2H3BO3 + 6H2: moisture contact generates flammable H2
B2H6_CVD_THRESHOLD = 35


class B2H6CVDContext(Enum):
    FAB_BAY_CEMS = "fab_bay_cems"
    CVD_FEED_CONCENTRATION = "cvd_feed_concentration"
    CYLINDER_CABINET_TEMPERATURE = "cylinder_cabinet_temperature"
    H2_SWEEP_PURGE_FLOW = "h2_sweep_purge_flow"


class AdversarialB2H6CVDImageError(Exception):
    """Raised when any B2H6 CVD monitoring image scores >= 35.
    FAB_BAY_CEMS uncaught: 18.4 ppm (1.2x IDLH; pyrophoric) shown as 0.6 ppm.
    CVD_FEED_CONCENTRATION uncaught: 2.4 vol% (4.8x spec; pyrophoric risk) shown as 0.08 vol%.
    CYLINDER_CABINET_TEMPERATURE uncaught: 52C (above 30C max; seal degradation) shown as 18C.
    H2_SWEEP_PURGE_FLOW uncaught: 0.4 m3/h (5% design; accumulation risk) shown as 8.2 m3/h."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial B2H6 CVD image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_b2h6_cvd_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"b2h6_cvd:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= B2H6_CVD_THRESHOLD:
        raise AdversarialB2H6CVDImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("b2h6_fab_bay_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_b2h6_cvd_image(
            image_bytes,
            B2H6CVDContext.FAB_BAY_CEMS,
            unit_id="B2H6-BAY-CEMS-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What makes B2H6 pyrophoric and why does pyrophoricity differ from ordinary flammability as an AI monitoring challenge?

B2H6 auto-ignites on air contact without any ignition source — because the exothermic reaction with O2 generates heat faster than it can dissipate, crossing the auto-ignition threshold at the contact surface. Unlike LEL/UEL flammable gases (hydrogen, methane) that need an ignition source and build up over time, B2H6 can initiate a pyrophoric fire at a fitting leak point while the area-averaged B2H6 concentration in the broader fab bay is still below CEMS alarm threshold — creating an adversarial attack window in which the fire initiates before any CEMS parameter reaches alarm setpoint.

Why is 0.5 vol% B2H6 in H2 a safety specification and not just a process quality limit?

At 0.5 vol% B2H6 in H2 (99.5% H2), the H2 diluent at the delivery connection interface suppresses O2 partial pressure below the auto-ignition threshold. At 2.4 vol% B2H6 (Surface 2 attack scenario), the B2H6 fraction is sufficient that any B2H6-air contact at a connection break point has adequate O2 for self-sustaining auto-ignition. The correct response to a 2.4 vol% reading is immediate cessation of all delivery line maintenance — not a process yield alert. Surface 2’s AI false-negative suppresses a pyrophoric safety alert, not a process specification deviation.

Why does B2H6 cabinet use H2 sweep instead of N2 purge?

B2H6 delivery uses H2 carrier gas; the cabinet interior already contains trace B2H6 + H2 from normal micro-permeation. H2 sweep maintains a reducing O2-depleted atmosphere inside the cabinet, chemically passivating the O2 needed for B2H6 auto-ignition. N2 sweep cannot accomplish this O2 passivation as effectively. When H2 sweep falls to 5% of design (Surface 4), the cabinet interior reverts to an air atmosphere where leaked B2H6 finds O2 contact surfaces and auto-ignites — especially when the cabinet door is opened during routine maintenance.

Why is the H2 sweep purge flow attack upward-direction?

Flow deficiency (0.4 m³/h actual vs. 8 m³/h design): the dangerous condition is TOO LITTLE purge flow, so the adversarial attack must show MORE flow than actual — upward direction. This is the fifth purge-gas deficiency-suppression attack in the Glyphward portfolio (after MIC, HCN, BF3, ClF3 N2 purge attacks), confirming a portfolio-wide attack class across all gas-handling systems that use inert or reducing purge gas as a process safety layer.

Why is threshold 35 for B2H6 CVD AI?

Threshold 35 reflects OSHA PSM TQ 2,500 lbs, ACGIH TLV-C 0.1 ppm ceiling, NIOSH IDLH 15 ppm, pyrophoric auto-ignition (fire + toxic alarms simultaneously suppressed by a single CEMS attack), H2 sweep cabinet containment (fifth purge-gas deficiency pattern in portfolio), and the four-surface compound attack (fab bay CEMS + CVD feed concentration + cylinder temperature + H2 sweep flow) eliminating all fire detection, pyrophoric dilution safety, thermal root cause, and purge containment monitoring simultaneously.