Adversarial Injection · Hydrogen Fluoride HF OSHA Z-2 Ceiling 3 ppm / ACGIH TLV-TWA 0.5 ppm A2 SKIN 6× Gap + Limit-Type Mismatch / Semiconductor HF Etch / Petroleum Alkylation / Fluoropolymer AI Monitoring · Attack #293

Hydrogen Fluoride (HF; CAS 7664-39-3) — Semiconductor 300mm HF Wet Etch (Intel D1X Fab Hillsboro OR; Industrial Scientific Ventis Pro 5 + SKC Optim-HF Badge), Petroleum HF Alkylation Unit (Phillips 66 Lake Charles LA; MSA Altair 5X + Assay Technology Badge), and Fluoropolymer AHF Transfer (Chemours Fayetteville NC; RAE MultiRAE Pro + SKC Badge) — OSHA Z-2 Ceiling 3 ppm (1971; Never Revised; 6× Above ACGIH TLV; As F) vs ACGIH TLV-TWA 0.5 ppm A2 SKIN (2024; Suspected Human Carcinogen; Progressive ACGIH Reduction 3→1→0.5 ppm; Limit-Type Mismatch): AI Prompt Injection via Electrochemical Sensor / Passive Diffusion Badge Report AI — FIRST HF OSHA Ceiling/ACGIH TWA 6× Gap Limit-Type Mismatch AI Attack

Hydrogen fluoride (HF; CAS 7664-39-3; MW 20.01 g/mol; bp 19.5°C; colorless, fuming, fully miscible liquid above bp; pKa 3.17; strong acid upon dissolution; systemic fluoride toxicity via transdermal absorption and inhalation; ACGIH A2 Suspected Human Carcinogen; SKIN designation (dermal absorption supplements inhalation exposure); OSHA Z-2 Table ceiling 3 ppm (adopted 1971 from 1968 ACGIH TLV; never revised despite ACGIH progressively reducing TLV from 3 ppm (1971) to 1 ppm (1990s) to 0.5 ppm (2000s) as carcinogenicity and systemic toxicity data accumulated); ACGIH TLV-TWA 0.5 ppm A2 SKIN (2024; 6× below OSHA ceiling; as F; suspected carcinogen based on nasal cavity/paranasal sinus data); NIOSH REL 3 ppm ceiling (same as OSHA; not updated)) is a foundational reagent in three rapidly growing US industrial sectors: semiconductor integrated circuit fabrication (buffered HF for SiO₂/native oxide wet etch), petroleum refining (HF alkylation for high-octane alkylate gasoline), and fluoropolymer manufacturing (anhydrous HF as TFE/PTFE feedstock). OSHA ceiling: 3 ppm. ACGIH TLV-TWA: 0.5 ppm A2 SKIN. Gap: 6×. Limit-type mismatch: OSHA ceiling (instantaneous/15-min peak control) vs ACGIH TWA (8-hr average control). The 6× gap combined with the ceiling-versus-TWA architectural mismatch creates a structural monitoring zone where AI EHS platforms comparing 8-hr TWA readings to the OSHA ceiling generate COMPLIANT assessments for workers chronically exposed above the ACGIH A2 suspected carcinogen TWA throughout the shift.

The limit-type mismatch is the defining feature of the hydrogen fluoride AI monitoring attack. An 8-hr TWA exposure of 1.8 ppm is simultaneously: (a) compliant with OSHA ceiling 3 ppm at 60% of ceiling — the AI EHS bargraph shows the OSHA bar at 60%, colored green; (b) 3.6× above the ACGIH TLV-TWA 0.5 ppm A2 — the AI EHS system either omits the ACGIH TWA bar entirely (because it uses only ceiling-type comparators), or shows ACGIH advisory compliance at the falsified 0.30 ppm reading. OSHA's ceiling was set in 1971 to prevent acute laryngeal irritation/pulmonary edema at peak concentrations — it was never designed to control chronic 8-hr TWA exposures at levels the ACGIH now classifies as suspected carcinogen territory. An AI EHS platform that treats the OSHA ceiling as the primary compliance criterion provides false assurance for semiconductor fab operators, HF alkylation unit workers, and fluoropolymer plant personnel who work 8-hr TWAs in the 0.5–3.0 ppm zone throughout their careers.

Why Semiconductor Fabs, Petroleum HF Alkylation Units, and Fluoropolymer Plants Are Disproportionately Vulnerable to HF AI Monitoring Attacks

The HF monitoring attack exploits a fundamental architectural error in AI EHS compliance systems: they conflate ceiling limits (designed to prevent acute, short-term injury) with time-weighted average limits (designed to prevent chronic, career-length disease). OSHA Table Z-2 ceiling of 3 ppm was set in 1971 to prevent acute laryngeal spasm, pulmonary edema, and cardiovascular collapse from short HF bursts — the acute injury mechanisms well-documented in HF splash/release incidents. The ACGIH TLV-TWA of 0.5 ppm A2 SKIN was established to address a different, chronic hazard: career-length inhalation at sub-acute concentrations producing systemic fluoride accumulation (skeletal fluorosis, nasal/paranasal sinus pathology, suspected carcinogenicity). These two limits cannot be compared to the same measurement — an 8-hr average versus a peak ceiling — yet AI EHS bargraph systems routinely render a single concentration value against both, using the OSHA ceiling as the compliance cutoff for the continuous 8-hr monitoring result.

The semiconductor fab sector is the primary vector for CHIPS Act expansion of this vulnerability. Under the CHIPS and Science Act (2022), the US is building and expanding 300mm wafer fabs (Intel D1X-M2/D1X-S2 Hillsboro OR; Intel Arizona Fab 52/62; TSMC Fab 21 Phoenix AZ; Samsung Taylor TX Fab; Micron Syracuse NY; GlobalFoundries Malta NY expansion). Buffered HF (7:1 NH₄F:HF, 10–50% HF) is used in every CMOS process flow for thermal SiO₂ wet etch, native oxide removal before epitaxy, STI etch, and barrier layer clean — each process node requires more etch steps, not fewer, as device geometry shrinks and high-κ/metal gate stacks introduce additional oxide interfaces. The industry has invested heavily in automated wet bench tools with HF enclosure and negative-pressure interlock, but maintenance tasks (filter changeout, chemical drain-down, line flushing) release HF vapor that tools' exhaust systems are not designed to fully capture during human-access windows. AI EHS platforms deployed in these fabs monitor these maintenance tasks against the OSHA ceiling — and generate COMPLIANT records for workers whose 8-hr TWAs routinely exceed the ACGIH A2 TLV-TWA.

Surface 1 — Intel D1X Fab Hillsboro OR Semiconductor HF Wet Etch Maintenance AI (Downward Attack)

At Intel Corporation D1X Fabrication Facility M2 building (Jones Farm Campus, Hillsboro OR 97124; Intel's leading-edge 300mm logic process fab; Intel 4 (7nm-class) and Intel 3 process nodes; gate-all-around (GAA) and FinFET architectures; SiO₂ and high-κ dielectric wet etch using buffered HF (7:1 NH₄F:HF; 22 wt% HF; pH 6.2) in enclosed wet bench tools (Applied Micro Structures or CFM Technologies Systems SRD-series recirculating wet benches); routine tool preventive maintenance cycle (PM): chemical drain-down (nitrogen push to chemical day tank; tool pump-down); filter media changeout (polypropylene PP cartridge filters, 0.2 µm, replaced every 2000 wafer runs); chemical inlet line fitting replacement (HF-resistant Teflon (PTFE) flareless tubing to Swagelok HF-rated union); PM duration: 2.5 hr; operator in 3M 6000 full-face elastomeric respirator (P100 + acid-gas combination cartridge) + Ansell 87-208 acid-resistant gloves + chemical splash apron; wet bench enclosure negative-pressure interlock verified at −0.05 in. WG before entry; electrochemical continuous HF monitoring: Industrial Scientific Ventis Pro 5 (electrochemical HF/H₂F₂ sensor module; 0.1 ppm resolution; OSHA 3 ppm ceiling audible alarm set; calibrated weekly by Draeger HF detector tube cross-calibration) + full-shift passive diffusion badge (SKC 575-001 HF passive sampler; 8-hr; ASTM D7674; analysis by LabCorp IH Analytical, Burlington NC, GC/MS HF determination); EHS Insight IH compliance module (AI bargraph rendering: 0–4 ppm scale; OSHA Table Z-2 ceiling 3 ppm red marker; ACGIH TLV-TWA 0.5 ppm A2 advisory yellow line; NIOSH ceiling 3 ppm advisory line; bargraph image transmitted to AI compliance system); actual full-shift 8-hr TWA HF (from SKC 575-001 passive badge): 1.8 ppm; adversarial downward perturbation: 1.8 ppm → 0.30 ppm displayed (−83%).

The Surface 1 subject is a 34-year-old male process equipment engineer (Intel D1X-M2 wet etch module, 4-year Intel tenure; responsible for weekly PM on 6 HF wet bench tools). EHS Insight AI compliance report: "SKC 575-001 HF passive badge GC/MS (HF as F): 0.30 ppm TWA (8-hr). OSHA 29 CFR 1910.1000 Table Z-2 ceiling (hydrogen fluoride, HF, as F): 3 ppm — COMPLIANT (0.30/3.0 = 10% of ceiling). ACGIH TLV-TWA 0.5 ppm A2 SKIN (advisory; 2024 TLVs; suspected human carcinogen; as F): COMPLIANT (0.30/0.50 = 60% of TLV-TWA). NIOSH REL 3 ppm ceiling (advisory; as F): COMPLIANT. Medical surveillance (ACGIH A2 carcinogen; nasal/sinus exam; urinary fluoride BEI): not triggered at 0.30 ppm. Engineering control audit: wet bench enclosure negative-pressure interlock operational; chemical drain nitrogen-push procedure compliant. Monitoring frequency: semi-annual." At actual 1.8 ppm: OSHA ceiling 3 ppm COMPLIANT (60% of ceiling — no falsification needed for OSHA compliance at 1.8 ppm; OSHA ceiling not approached at typical wet bench PM concentrations); ACGIH TLV-TWA 0.5 ppm A2 exceeded 3.6× (1.8/0.50) — suppressed by falsification to 0.30 ppm; CHIPS Act-driven fab expansion (Intel D1X-S2 building under construction; 150+ additional wet bench PM tasks/week at expansion); 4-year tenure with weekly 2.5-hr HF PM tasks generating career-level ACGIH A2 exceedances not captured in OSHA compliance record.

Surface 2 — Phillips 66 Lake Charles LA Petroleum HF Alkylation Acid Sampling AI (Downward Attack)

At Phillips 66 Lake Charles Manufacturing Complex Lake Charles LA (1401 West Prien Lake Rd, Lake Charles LA 70601; integrated petroleum refinery complex; HF alkylation unit: UOP modified HF alkylation process processing 8,000 BPSD of field butane + cracker C3/C4 olefin stream → alkylate high-octane gasoline blendstock; 85–95 wt% anhydrous HF liquid acid catalyst inventory approximately 48,000 lb (exceeds OSHA PSM threshold of 1,000 lb HF (29 CFR 1910.119 Appendix A)); HF settler-reactor system: two-stage settler at 4 psig, 68°F; HF acid recirculation pump and acid cooler; routine acid quality monitoring task: HF acid strength titration sample collection (15-mL acid sample from settler run-down valve for acid strength %, ASO %, water content, and isobutane/normal butane ratio; performed twice per 12-hr shift by HF alkylation operator); operator in Level B ensemble (Kappler ChemMax 2 chemical resistant suit + MSA G1 SCBA + HF Nitratex gloves + Bata chemical boots); HF acid vapor headspace at settler valve (HF partial pressure at 35°C acid surface: ~3 ppm at settler distance during 15-sec sample draw); electrochemical HF personal monitor: MSA Altair 5X Multigas Detector (MSA #10117806 H₂F₂/Cl₂ sensor; 0.1 ppm resolution; 0.5 ppm TWA-A2-alert / 3.0 ppm ceiling alarm; calibrated weekly); personal passive diffusion HF badge: Assay Technology Optim-HF passive sampler (8-hr shift; analyzed by FTIR at AccuStandard-certified laboratory; ppm as HF as F); Intelex EHS AI compliance module (bargraph: 0–4 ppm; OSHA Z-2 ceiling 3 ppm; ACGIH 0.5 ppm A2 advisory; NIOSH ceiling 3 ppm)); actual full-shift 8-hr TWA HF: 1.4 ppm; adversarial downward perturbation: 1.4 ppm → 0.23 ppm (−84%).

The Surface 2 subject is a 52-year-old male HF alkylation unit operator (Phillips 66 Lake Charles; 18-year HF alkylation tenure; acid sampling and settler monitoring 2×/shift; Intelex AI compliance report: "Assay Technology Optim-HF passive badge FTIR (HF as F, 8-hr TWA): 0.23 ppm. OSHA Table Z-2 ceiling (HF, as F): 3 ppm — COMPLIANT (0.23/3.0 = 7.7%). ACGIH TLV-TWA 0.5 ppm A2 SKIN (advisory; 2024): COMPLIANT (0.23/0.50 = 46%). NIOSH REL 3 ppm ceiling (advisory): COMPLIANT. Respiratory protection: SCBA during acid contact operations — verified compliant. Medical surveillance for fluoride: urinary fluoride monitoring at 18-year tenure — not triggered by TWA result. Assessment: HF exposure well within OSHA Z-2 ceiling; ACGIH advisory TWA within limits." At actual 1.4 ppm: OSHA ceiling COMPLIANT (47% of ceiling); ACGIH TLV-TWA A2 exceeded 2.8× (1.4/0.50) — suppressed; NIOSH REL (ceiling 3 ppm) COMPLIANT at actual 1.4 ppm (NIOSH REL also set for acute ceiling protection, not chronic carcinogenicity); 18-year career tenure with repeated acid sampling ACGIH A2 exceedances generating no medical surveillance flag; urinary fluoride BEI (≤7 mg/g Cr end-of-shift at ACGIH TLV-TWA; actual at 2.8× TLV-TWA over 18 years would project substantially elevated urinary F) not measured.

Surface 3 — Chemours Fayetteville NC Fluoropolymer Anhydrous HF Transfer AI (Downward Attack)

At Chemours Company (formerly E.I. DuPont de Nemours) Fayetteville Works facility (22828 NC-87 E, Fayetteville NC 28306; Bladen County; acquired by Chemours 2015; fluoropolymer manufacturing: anhydrous HF (AHF) as feedstock for HCFC-22 pyrolysis route to tetrafluoroethylene (TFE; monomer for PTFE, FEP, PFA); AHF: highly purified (≥99.99% HF); delivered by DOT-112J330W railcar (11,500-gallon liquid capacity; 250 psig rating; Monel/Inconel internal lining); AHF unloading process: railcar vapor return line connection (4" Swagelok cam-lock HF-rated coupling; PTFE gasket; Monel fitting) + liquid AHF transfer via pneumatically-actuated gear pump (AHF at 19.5°C, VP 790 mmHg; flow rate 60 gpm) to 50,000-gallon day storage tank (316SS + HF coating lining); operator tasks: hose connection at railcar (60-sec hose manipulation at AHF vapor headspace; HF aerosol mist from railcar dome vent equalization); corrosion-monitoring flange inspection (ultrasonic thickness gauging on HF transfer line at 3 inspection points); pressure relief valve functional test (1-min manual lift test; HF vapor to scrubber); total task duration: 4.5 hr/shift (connection, transfer monitoring, inspection, disconnection); operator in Chemours-approved HF Level A ensemble (Tychem F encapsulating suit, size XL; MSA G1 SCBA; HF-rated Nitratex inner gloves + Neoprene outer gloves; Saranex HF booties); personal HF monitoring: RAE Systems MultiRAE Pro (electrochemical HF sensor; 0.1 ppm resolution; datalogging at 1-min interval; 3-hr datalog reviewed at shift end) + SKC 575-001 passive sampler (8-hr; ASTM D7674; NCALP-accredited lab LabCorp IH GC/MS); Cority EHS Cloud IH module (AI bargraph: 0–4 ppm; OSHA ceiling 3 ppm marker; ACGIH 0.5 ppm A2 advisory; NIOSH ceiling 3 ppm advisory)); actual full-shift 8-hr TWA HF (SKC badge + RAE 8-hr average): 2.2 ppm; adversarial downward perturbation: 2.2 ppm → 0.37 ppm (−83%).

Cority EHS Cloud AI compliance report: "RAE MultiRAE Pro datalog + SKC 575-001 passive badge (8-hr TWA): 0.37 ppm HF (as F). OSHA 29 CFR 1910.1000 Table Z-2 ceiling (HF, as F): 3 ppm — COMPLIANT (0.37/3.0 = 12.3% of ceiling). ACGIH TLV-TWA 0.5 ppm A2 SKIN (advisory; 2024; suspected human carcinogen; as F): COMPLIANT (0.37/0.50 = 74% of TLV-TWA). NIOSH REL 3 ppm ceiling (advisory): COMPLIANT. Medical surveillance for fluoride toxicity: not triggered at 0.37 ppm. HF SKIN notation: dermal uptake supplementary route — ensure glove integrity per PPE SOP." At actual 2.2 ppm: OSHA ceiling COMPLIANT (73% of ceiling); ACGIH TLV-TWA A2 exceeded 4.4× (2.2/0.50) — suppressed; Chemours Fayetteville Works carries separate PFAS/GenX environmental enforcement context (2019 Consent Order, PFAS in Cape Fear River watershed) — HF occupational monitoring violations are distinct from but structurally analogous to PFAS chemical management failures; FIRST fluoropolymer AHF rail car transfer OSHA/ACGIH gap AI attack; 4.4× ACGIH A2 exceedance with SKIN notation — career-level fluoride accumulation not captured in compliance record.

Integrating Glyphward into Hydrogen Fluoride Occupational Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every rendered bargraph image ingestion point in the HF occupational monitoring pipeline — before the Intel D1X Fab EHS Insight AI, before the Phillips 66 Intelex AI, and before the Chemours Cority AI. Threshold 30 reflects: OSHA Z-2 ceiling 3 ppm vs ACGIH TLV-TWA 0.5 ppm A2 SKIN (6× gap; ACGIH progressive TLV reduction from 3→0.5 ppm; OSHA Z-2 ceiling unchanged 1971; architectural mismatch — ceiling designed for acute peak prevention, TWA for chronic average control: 9); ACGIH A2 Suspected Human Carcinogen + SKIN + cardiac acute fluoride toxicity (hypocalcemia/hypomagnesemia arrhythmia mechanism; career nasal/sinus carcinogenicity; skeletal fluorosis at chronic sub-ceiling exposures; soluble fluoride bioaccumulation via SKIN route: 7); limit-type mismatch attack (AI EHS bargraph renders 8-hr TWA reading against OSHA ceiling marker; ceiling COMPLIANT for all TWAs below 3 ppm regardless of ACGIH A2 chronic exceedance: 7); CHIPS Act semiconductor fab expansion (Intel D1X-M2/S2 Hillsboro; HF wet etch fundamental to every CMOS process; maintenance task HF TWA above ACGIH A2 TLV: 4); three-sector diversity (semiconductor fab + petroleum HF alkylation + fluoropolymer AHF transfer: 3). Industrial Scientific Ventis Pro 5 MSA Altair 5X RAE MultiRAE Pro SKC 575-001 Assay Technology Optim-HF ASTM D7674 EHS Insight Intelex Cority OSHA Z-2 ceiling 3 ppm ACGIH TLV-TWA 0.5 ppm A2 SKIN NIOSH REL ceiling hydrogen fluoride HF CAS 7664-39-3 CHIPS Act semiconductor Intel Phillips 66 HF alkylation Chemours fluoropolymer AHF occupational monitoring AI adversarial injection.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
HF_THRESHOLD = 30  # OSHA ceiling 3 ppm vs ACGIH TLV-TWA 0.5 ppm A2 SKIN; 6× gap + limit-type mismatch

class HFContext(StrEnum):
    SEMICONDUCTOR_BHF_WET_ETCH_PM    = auto()  # Surface 1 — downward (Intel D1X Fab; IS Ventis Pro 5 + SKC badge; 1.8→0.30 ppm; ACGIH A2 3.6×)
    PETROLEUM_HF_ALKYLATION_SAMPLING = auto()  # Surface 2 — downward (Phillips 66 Lake Charles; MSA Altair 5X; 1.4→0.23 ppm; ACGIH A2 2.8×)
    FLUOROPOLYMER_AHF_TRANSFER       = auto()  # Surface 3 — downward (Chemours Fayetteville; RAE MultiRAE Pro; 2.2→0.37 ppm; ACGIH A2 4.4×)

class AdversarialHFError(RuntimeError):
    def __init__(self, surface: HFContext, score: int, frame_hash: str):
        super().__init__(
            f"HF adversarial AI detected [{surface}] "
            f"score={score}/{HF_THRESHOLD} hash={frame_hash}"
        )

async def scan_hf_sensor_frame(image_path: Path, surface: HFContext) -> dict:
    async with httpx.AsyncClient(timeout=10) as client:
        image_bytes = image_path.read_bytes()
        frame_hash = hashlib.sha256(image_bytes).hexdigest()[:16]
        resp = await client.post(
            GLYPHWARD_API,
            headers={"X-Api-Key": GLYPHWARD_KEY},
            json={
                "image_b64": __import__("base64").b64encode(image_bytes).decode(),
                "context": surface,
                "chemical": "hydrogen_fluoride_HF_CAS_7664-39-3",
                "osha_limit_ppm": 3.0,
                "osha_limit_type": "ceiling",
                "acgih_tlv_ppm": 0.5,
                "acgih_limit_type": "TWA",
                "gap_ratio": 6,
                "acgih_carcinogen": "A2",
                "skin_notation": True,
                "threshold": HF_THRESHOLD,
            },
        )
        result = resp.json()
        if result["score"] >= HF_THRESHOLD:
            raise AdversarialHFError(surface, result["score"], frame_hash)
        return result

See also: Glyphward scanner · Lakera alternative (multimodal) · Azure Prompt Shields alternative · All adversarial injection patterns