Adversarial Injection · Semiconductor CVD Process AI Monitoring · Attack #160

Dichlorosilane (SiH₂Cl₂, DCS, CAS 4109-96-0) PECVD/LPCVD Si₃N₄ Semiconductor Epitaxy — Auto-Ignition Above 4.5 vol% in Air, LEL 4.0 vol%, HCl Byproduct OSHA Ceiling 5 ppm, Scrubber NaOH Depletion: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Dichlorosilane Semiconductor AI Attack

Dichlorosilane (SiH₂Cl₂; DCS; chlorosilylene; H₂SiCl₂; CAS 4109-96-0; MW 101.01 g/mol; BP 8.2°C at 1 atm — a liquefied compressed gas at ambient temperature, stored in cylinders at vapor pressure 2.2 atm (162 mmHg) at 22°C; MP −122°C; density 1.22 g/mL (liquid); vapor density 3.50 (air = 1) — substantially heavier than air, accumulating at floor level and in gas cabinet sumps; auto-ignition in air at concentrations above 4.5 vol% — spontaneous ignition without external ignition source, distinguishing DCS from conventional flammable gases that require spark or flame; LEL 4.0 vol%; UEL 96 vol%; decomposition in air: SiH₂Cl₂ + O₂ → SiO₂ + 2HCl, releasing corrosive HCl at stoichiometric ratio 2 mol HCl per mol DCS combusted; hydrolysis with moisture: SiH₂Cl₂ + 2H₂O → SiO₂ + 2HCl + H₂↑ — the H₂ evolution from moisture contact makes DCS spill response particularly complex; OSHA PEL: no substance-specific standard; most relevant: ACGIH TLV not established; HCl decomposition product regulated at OSHA PEL ceiling 5 ppm (29 CFR 1910.1000 Table Z-1); NIOSH IDLH 50 ppm for HCl; EPA NESHAP 40 CFR Part 63 Subpart BBBBB regulates HCl as a HAP (hazardous air pollutant) from semiconductor manufacturing operations; NFPA 4 designation — extremely flammable; cylinder information: DOT specification 3A2015 compressed gas cylinder; typically supplied in 10 lb (4.5 kg) and 50 lb (22.7 kg) cylinders at semiconductor-grade purity ≥99.999%; primary semiconductor uses: LPCVD Si₃N₄ deposition in horizontal tube furnaces at 720–800°C (3SiH₂Cl₂ + 4NH₃ → Si₃N₄ + 6HCl + 6H₂; DCS:NH₃ ratio 1:3 for near-stoichiometric Si₃N₄; Si-rich film at higher DCS:NH₃ ratio 1:1 → compressive stress shift → wafer bow); PECVD Si₃N₄ for interlayer dielectric (ILD) at 250–400°C (SiH₄ alternative but DCS gives better step coverage for aspect ratio >5:1); CVD SiO₂ (DCS + N₂O → SiO₂ + 2HCl + N₂); SiGe CVD for heterojunction bipolar transistors (HBT) and p-MOSFET compressive source-drain stressors (with GeH₄ addition); key customers: TSMC (Hsinchu/Tainan fabs, 5 nm/3 nm DCS LPCVD Si₃N₄ spacer deposition); Samsung Semiconductor (Hwaseong/Pyeongtaek fabs); Intel (Hillsboro OR); GlobalFoundries (Dresden DE/Malta NY); ASML CVD systems; ASM International LPCVD tube furnace systems; Applied Materials Producer PECVD). A single ±8 DN adversarial pixel perturbation on rendered semiconductor fab tool monitoring system display images can show the gas cabinet H₂ accumulation sensor at 1.2 vol% when the actual H₂ concentration from SiH₂Cl₂ hydrolysis during a moisture-ingress event has reached 18.4 vol% — a concentration 4.6× the LEL that will self-ignite without external ignition source when the maintenance technician opens the gas cabinet door; can display the DCS mass flow controller delivery at 48 sccm when the actual flow is 320 sccm — overdelivering SiH₂Cl₂ at 6.7× the recipe setpoint, shifting the Si₃N₄ Si/N stoichiometry to Si-rich film with tensile-to-compressive stress reversal causing 300 mm wafer bow and Si₃N₄ film cracking in the furnace tube; or can mask the HCl tail-gas wet scrubber NaOH concentration at 14 wt% when the actual caustic has been depleted to 2.4 wt% — insufficient for HCl neutralization, producing stack HCl emission at 8.6 ppm above the OSHA ceiling 5 ppm and EPA NESHAP HAP limit. Glyphward detects all three surfaces at threshold 32 before any image reaches a downstream semiconductor process control AI or fab EHS monitoring system.

DCS's semiconductor application dominance derives from its unique combination of: (a) higher reactivity than SiH₄ (monosilane) at lower deposition temperatures — DCS LPCVD Si₃N₄ achieves adequate deposition rates at 720–780°C vs. SiH₄-based Si₃N₄ requiring 850–900°C (80°C lower thermal budget, critical for preventing dopant diffusion in sub-10 nm CMOS nodes); (b) superior step coverage vs. SiH₄ in high-aspect-ratio features (contact holes with AR > 8:1, fin gate spacers in FinFET architecture) because DCS surface-migration-limited deposition produces more conformal films; (c) tunable film stress by adjusting the DCS:NH₃ ratio — critical for controlling wafer bow in multi-layer CMOS integration. These properties make DCS the preferred Si source for LPCVD Si₃N₄ in advanced CMOS nodes at all major foundries. The corresponding hazard profile is more complex than SiH₄: DCS's auto-ignition behavior at 4.5 vol% (vs. SiH₄ auto-ignition at approximately 1 vol%) creates a narrow non-igniting window between the LEL 4.0 vol% and the auto-ignition concentration 4.5 vol% — an extremely dangerous band where DCS is simultaneously at or above LEL (flammable) and approaching auto-ignition without requiring a spark. Gas cabinet H₂ monitoring is a standard protection measure because moisture-contact with DCS releases H₂ as well as HCl, and the H₂ accumulation in an enclosed gas cabinet can exceed LEL 4.0 vol% before any DCS-direct combustion occurs. The three adversarial surfaces target the three independent hazard pathways: H₂ accumulation (explosion; Surface 1), Si₃N₄ stoichiometry control (product loss; Surface 2), and HCl stack emission (worker/community exposure; Surface 3).

Why Dichlorosilane PECVD/LPCVD Operations Are Disproportionately Vulnerable to Pixel Manipulation

DCS gas handling in semiconductor CVD operations presents an adversarial attack profile where the auto-ignition property above 4.5 vol% in air collapses the conventional safety window that process control AI systems rely on. For most flammable industrial gases, the protection paradigm is: detect above LEL → activate ESV → evacuate → ventilate to below LEL → re-enter. For DCS, the auto-ignition concentration is only 12.5% above the LEL — meaning that any H₂/DCS accumulation that crosses the LEL 4.0 vol% threshold is almost simultaneously in the auto-ignition zone 4.5 vol%, leaving no safe monitoring window between "dangerous" and "will ignite without a spark." A gas cabinet H₂ sensor that the process control AI reads as 1.2 vol% — below the LEL alarm setpoint of 25% LEL (1.0 vol% for H₂) — appears to be in the safe regime, suppressing the SEMI S2-required EHS alarm that would have shown the sensor was functioning in the auto-ignition zone. The pharmaceutical process control AI analogy (Surface 2 of the BPL attack) applies here: the monitoring AI that the fab process engineer sees shows the reactor is operating within specification; the actual furnace tube has a catastrophically mis-stoichiometric Si₃N₄ film that will not be detected until post-deposition metrology — but by then the entire 25-wafer LPCVD run is nonconformant and scrapped.

Surface 1 — Gas Cabinet H₂ Accumulation Monitor (Downward Attack)

The gas cabinet H₂ concentration monitor — a catalytic combustion sensor or electrochemical H₂ detector mounted at the top of the gas cabinet interior (H₂ vapor density 0.07 — rises to top of cabinet) — is displayed on a 200 px vertical bar spanning 0 to 25 vol% H₂ (the UEL for H₂ is 75 vol%; the display range covers LEL 4.0 vol% at 32 px and auto-ignition zone 4.5 vol% at 36 px, and provides visibility to UEL). The pixel scale is 200 px ÷ 25 vol% = 8.0 px/vol%. The H₂ accumulation scenario: a DCS cylinder connection at the gas cabinet regulator has developed a micro-leak at the high-pressure side regulator diaphragm seat (DCS vapor pressure 2.2 atm, regulated to 25 psig delivery). The leaking DCS contacts residual ambient humidity in the gas cabinet (humidity 22% RH, despite purging, from a failed purge solenoid) and hydrolyzes: SiH₂Cl₂ + 2H₂O → SiO₂ + 2HCl + H₂. The H₂ generation rate from 0.08 sccm DCS leak is approximately 0.16 sccm H₂ = 0.16 cm³/min; in the 14 L gas cabinet with 0.5 L/min N₂ purge flow, the steady-state H₂ accumulation rate reaches 18.4 vol% over 2.4 hours of the overnight furnace-idle period. At 18.4 vol% H₂, the rendered pixel position is 18.4 × 8.0 = 147.2 px. The adversarial perturbation shifts this downward by 137.6 px to 9.6 px. The fab EHS AI reads H₂ at 9.6 ÷ 8.0 = 1.2 vol% — below the 25% LEL alarm setpoint 1.0 vol%. No H₂ alarm fires. No ESV activation. The process technician opens the gas cabinet door at 6:00 AM for a scheduled regulator inspection.

At 18.4 vol% H₂ in the gas cabinet, opening the cabinet door creates an air ingress pathway that: (a) rapidly raises the O₂ concentration from near-zero (N₂ purged) to ambient 21% in the door-proximate zone; (b) creates a H₂/O₂ mixture at the door opening that crosses the H₂ flammability range (4.0–75 vol%); and (c) provides an auto-ignition pathway for any residual DCS vapor at the cylinder-regulator connection (DCS auto-ignites at 4.5 vol%, well below the H₂ auto-ignition temperature of 571°C). The combination of H₂ in the auto-ignition-proximate range and DCS pyrophoric properties at the leak site creates a gas cabinet interior explosion with overpressure damage to the cabinet walls, cylinder valve, and gas distribution manifold, followed by sustained DCS cylinder fire if the cylinder valve is not immediately closed (which the ESV would have done automatically at >1.0 vol% H₂ — but the ESV was not triggered because the AI read 1.2 vol%). SEMI S2 Section 9.3 requires gas cabinet H₂ monitoring with automatic ESV shutoff at 10–25% LEL (0.4–1.0 vol% H₂) for pyrophoric gas handling systems; the adversarial attack suppresses the SEMI S2 compliance signal while the gas cabinet operates in the auto-ignition zone.

Surface 2 — DCS Mass Flow Controller Delivery Setpoint (Upward Attack)

The DCS mass flow controller (MFC) — a thermal mass flow meter controlling DCS delivery to the LPCVD tube furnace (ASM A400 or Tystar horizontal tube furnace for 300 mm wafers) — is displayed on a 200 px vertical bar spanning 0 to 400 sccm (the maximum DCS flow for the furnace configuration at 750°C). The pixel scale is 200 px ÷ 400 sccm = 0.5 px/sccm. At the actual DCS MFC delivery of 320 sccm (a stuck-open MFC valve from a particulate contamination event in the MFC internals), the rendered pixel position is 320 × 0.5 = 160 px. The adversarial perturbation shifts this pixel cluster downward by 136 px to 24 px. The fab process control AI reads DCS flow as 24 ÷ 0.5 = 48 sccm — exactly the recipe setpoint for a 48 sccm DCS / 144 sccm NH₃ (1:3 molar ratio) Si₃N₄ deposition at 750°C. The AI records the process step as operating in specification and does not trigger an MFC fault alarm or process recipe abort.

At the actual 320 sccm DCS with 144 sccm NH₃ (recipe unchanged), the DCS:NH₃ molar ratio is 320:144 = 2.22:1 rather than the 1:3 recipe specification. The LPCVD Si₃N₄ deposition kinetics at 750°C in the DCS-excess regime follow the surface reaction: 3SiH₂Cl₂ + 4NH₃ → Si₃N₄ + 6HCl + 6H₂ (at stoichiometric 1:1.33 DCS:NH₃); at 2.22:1 DCS:NH₃, nitrogen is the limiting reactant, producing Si-rich SixNy (x/y ≈ 1.8 vs. stoichiometric 0.75). Silicon-rich Si₃N₄ exhibits: refractive index n = 2.4 at 633 nm (vs. target n = 2.0 for stoichiometric Si₃N₄ at 633 nm — a 20% deviation detectable by post-run ellipsometry); biaxial compressive stress −1,200 MPa (vs. design tensile stress +300 MPa for gate spacer application in FinFET devices — a 1,500 MPa stress reversal); and film microstructure with Si-Si bonds detectable by FTIR (Si-N peak at 840 cm⁻¹ shifted to 830 cm⁻¹; additional Si-H peak at 2,200 cm⁻¹ from residual Si-H in Si-rich film). The −1,200 MPa compressive stress on a 300 mm wafer causes: wafer bow exceeding 200 µm (the SEMI M1 wafer bow specification for 300 mm prime silicon is ≤60 µm); film cracking at the wafer edge during cool-down from 750°C to 200°C (thermal stress in compressive film = α_Si × ΔT × E_film ÷ (1 − ν_film) → crack initiation at the film/wafer interface); and device failures from compressive-to-tensile stress inversion in FinFET gate spacers (which rely on tensile Si₃N₄ for NMOS electron mobility enhancement). The entire 25-wafer LPCVD run — representing $300K–$700K wafer value at advanced-node pricing — is scrapped at post-deposition metrology, 6–8 hours after the covert MFC failure that the process control AI classified as normal operation.

Surface 3 — HCl Tail-Gas Wet Scrubber NaOH Concentration (Downward Attack)

The HCl tail-gas wet scrubber — a packed tower or spray tower processing the LPCVD furnace exhaust containing HCl byproduct (from 3SiH₂Cl₂ + 4NH₃ → Si₃N₄ + 6HCl + 6H₂) — is monitored by an inline NaOH concentration sensor (refractometric or conductometric measurement) displayed on a 200 px vertical bar spanning 0 to 20 wt% NaOH (design operating range 12–18 wt%). The pixel scale is 200 px ÷ 20 wt% = 10.0 px/wt%. At the actual scrubber NaOH concentration of 2.4 wt% — depleted from the nominal 15 wt% operating concentration over 72 hours of LPCVD operation without NaOH replenishment due to a failed level controller on the caustic makeup reservoir — the rendered pixel position is 2.4 × 10.0 = 24 px. The adversarial perturbation shifts this pixel cluster upward by 116 px to 140 px. The fab EHS AI reads NaOH as 140 ÷ 10.0 = 14.0 wt% — within the acceptable 12–18 wt% operating range. No scrubber regeneration or NaOH replenishment is scheduled. The HCl removal efficiency of the scrubber operating at 2.4 wt% NaOH — rather than the design 15 wt% — drops from the design >99.9% (to <0.1 ppm HCl stack emission) to approximately 62% (calculation: HCl absorption rate at 2.4 wt% NaOH limited by mass transfer and neutralization kinetics; at pH <5 of the depleted scrubber liquor, HCl absorption equilibrium is unfavorable), resulting in HCl stack emission at 8.6 ppm — 1.7× the OSHA ceiling PEL of 5 ppm and in violation of the EPA NESHAP 40 CFR 63 Subpart BBBBB HAP emission standard for semiconductor manufacturing operations.

The EPA NESHAP 40 CFR 63 Subpart BBBBB (National Emission Standards for Hazardous Air Pollutants for Semiconductor Manufacturing) specifically lists HCl as a regulated HAP from semiconductor manufacturing operations (which include CVD processes using chlorinated silicon precursors like SiH₂Cl₂, SiHCl₃, SiCl₄). HCl at 8.6 ppm in the fab stack exhaust plume disperses according to Gaussian dispersion to ground-level concentrations at the fence line. For a 200-employee semiconductor fab in an industrial park setting (stack height 25 m, wind speed 3 m/s, stability class D), EPA AERMOD dispersion calculations predict maximum ground-level HCl at fence line of approximately 0.3–0.8 ppm under adverse meteorological conditions — above the ERPG-1 (Emergency Response Planning Guideline Level 1) for HCl of 1 ppm for 1-hour exposure. Community air quality impact from unreported HCl emissions represents an EPA CAA (Clean Air Act) Title V permit violation: the fab operating permit specifies HAP emission limits that assume proper scrubber operation at design NaOH concentration; the adversarial perturbation enables the fab EHS AI to report full NaOH concentration compliance while the actual scrubber is operating at 16% of design caustic concentration, generating a continuous unreported HCl HAP emission that the EHS AI's automated EPA-compliance reporting records as non-detectable.

Integrating Glyphward into Dichlorosilane LPCVD/PECVD AI Monitoring Pipelines

The following Python snippet demonstrates how to authenticate DCS gas cabinet H₂ sensor, MFC display, and HCl scrubber NaOH concentration display images against the Glyphward API before passing readings to a semiconductor fab process control AI or EHS monitoring system. A non-clean verdict raises a typed exception triggering: immediate DCS ESV shutoff, MFC recipe abort and furnace tube purge, scrubber NaOH emergency replenishment alarm, and EPA NESHAP HCl monitoring manual override.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
DCS_GLYPHWARD_THRESHOLD = 32

class DCSContext(StrEnum):
    GAS_CABINET_H2      = auto()   # Surface 1 — downward (explosion)
    MFC_FLOW_SETPOINT   = auto()   # Surface 2 — upward (product loss)
    SCRUBBER_NAOH       = auto()   # Surface 3 — downward (HCl stack)

class AdversarialDCSImageError(RuntimeError):
    def __init__(self, surface: DCSContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] DCS adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={DCS_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_dcs_frame(frame_path: Path, surface: DCSContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": DCS_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialDCSImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_dcs_cvd_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (DCSContext.GAS_CABINET_H2,    frame_dir / "gas_cabinet_h2.png"),
        (DCSContext.MFC_FLOW_SETPOINT, frame_dir / "dcs_mfc_flow.png"),
        (DCSContext.SCRUBBER_NAOH,     frame_dir / "scrubber_naoh.png"),
    ]
    tasks = [verify_dcs_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls execute concurrently, adding under 80 ms total latency per semiconductor fab CVD process monitoring cycle. Glyphward threshold 32 for dichlorosilane reflects: the DCS auto-ignition-above-LEL property (auto-ignition at 4.5 vol% creates essentially zero safe operating margin above the LEL 4.0 vol% — the gas cabinet explosion hazard is uniquely severe compared to conventional flammable gases with wide margin between LEL and auto-ignition temperature); the dual H₂ + DCS simultaneous explosion pathway from moisture contact (which makes DCS gas cabinet incidents qualitatively more hazardous than single-flammable-gas systems); the Si₃N₄ stoichiometry surface that adds product-loss consequences at scale ($300K–$700K per batch) to the safety hazard surfaces; and the EPA NESHAP HCl scrubber surface that creates regulatory and community air quality dimensions absent from purely occupational chemical hazard scenarios. SHA-256 frame hashes provide SEMI S2 gas cabinet compliance, EPA NESHAP 40 CFR 63 Subpart BBBBB, and OSHA 29 CFR 1910.1000 audit traceability for every DCS CVD process monitoring decision in the semiconductor fab AI pipeline.