Adversarial Injection · Industrial Chemical AI Monitoring · Attack #129

Pentaborane (B₅H₉) Pyrophoric SiC CVD Doping: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Pentaborane AI Attack

Pentaborane (B₅H₉; CAS 19624-22-7; bp 60 °C; flash point −30 °C) is a GHS Category 1 pyrophoric liquid that ignites spontaneously on contact with moisture or air above −40 °C and carries one of the lowest ACGIH TLV-TWA values in industrial chemistry — 0.005 ppm (5 ppb) — together with a NIOSH IDLH of 1 ppm and an OSHA PSM threshold quantity of only 100 lbs under 29 CFR 1910.119 Appendix A (the lowest pyrophoric TQ on the list). Used as a p-type boron dopant in silicon carbide (SiC) chemical vapour deposition (CVD) epitaxial growth for power semiconductor devices, pentaborane is handled in dedicated gas cabinets under continuous N₂ inert-gas blanket and exhausted through thermal oxidation abatement. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image can make a depleted N₂ blanket pressure appear fully pressurized, hide a near-IDLH atmospheric B₅H₉ concentration in the cabinet area, or conceal a failed CVD exhaust thermal oxidizer operating at half the design temperature with pentaborane slipping through uncombusted. Glyphward detects all three surfaces at threshold 48 before any image reaches a downstream AI inference call.

Silicon carbide power devices (MOSFETs, Schottky diodes, bipolar transistors) require p-type epilayers precisely doped with boron or aluminium during CVD epitaxial growth on SiC substrates. Pentaborane is one of the few gas-phase precursors with sufficient volatility (VP 66.7 mmHg at 20 °C) to achieve accurate, repeatable boron incorporation at the sub-ppm doping levels required for SiC device specifications. Leading SiC epitaxial wafer suppliers — Wolfspeed (Durham, NC), Rohm Semiconductor (Kyoto), Infineon Technologies (Villach, Austria), and STMicroelectronics (Catania, Sicily) — use pentaborane or aluminium-precursor alternatives in their epitaxial CVD reactors. The historical context of pentaborane handling is anchored in the US Air Force "Zip fuel" programme of the late 1950s: pentaborane was evaluated as a high-energy density fuel for the XB-70 Valkyrie supersonic bomber and Lockheed A-12/SR-71 precursors. The programme was cancelled in 1959 after multiple ground facility fires, personnel injuries, and recognition that the toxic, pyrophoric, and environmental persistence characteristics of pentaborane made military operational use impractical. The institutional hazard knowledge from the Zip fuel era — spontaneous ignition, delayed neurological toxicity (headache, confusion, seizures at 0.1–0.5 ppm), and the absence of early warning odour at toxic concentrations — directly informs contemporary semiconductor-industry safe-handling protocols. AI monitoring systems deployed in SiC CVD fabs must treat every pentaborane-process sensor reading with adversarial scepticism at the display-image level.

Why B₅H₉ SiC CVD Is Disproportionately Vulnerable to Pixel Manipulation

Pentaborane-in-SiC-CVD presents three features that make it exceptionally vulnerable to adversarial DCS display attacks. First, the TLV-TWA of 0.005 ppm = 5 ppb is one of the most stringent occupational exposure limits in semiconductor gas chemistry — a concentration 200 times below the IDLH of 1 ppm. This means the DCS bar for the atmospheric monitor spans a 200× dynamic range between the safe-display alarm setpoint and the IDLH. On a 0–10 ppm display, the entire TLV range occupies the bottom 0.1% of the scale — 0.1 px on a 200 px bar. Any adversarial shift that moves the displayed reading from 0.68 ppm to 0.04 ppm — a perturbation of 12.8 px on a 200 px bar at 20 px/ppm resolution — removes the reading from the AI's alarm region while concealing a near-IDLH atmospheric hazard. Second, the N₂ inert-blanket pressure monitoring range is narrow (0–1.0 bar gauge), meaning each pixel represents only 5 mbar; a perturbation of 96 px — visually subtle on a complex fab DCS dashboard — inverting the safety assessment from "blanket failing" to "blanket adequate." Third, CVD exhaust abatement temperature displays span 0–1000 °C and use 0.2 px per °C resolution, so a 420 °C temperature that should trigger an abatement-failure alarm differs from the compliant 840 °C reading by 84 px — a shift achievable within the uncertainty bands of a rendered JPEG or PNG display delivered to an AI inference endpoint.

Surface 1 — N₂ Inert-Blanket Pressure on Pentaborane Cylinder Manifold (Upward Attack)

The N₂ inert-blanket pressure above the pentaborane cylinder manifold is displayed on a 200 px vertical DCS bar spanning 0 to 1.0 bar gauge. The pixel scale is 200 px ÷ 1.0 bar = 200 px/bar. At the actual blanket pressure of 0.14 bar gauge — below the minimum adequate blanketing pressure of 0.3 bar — the rendered pixel position is 0.14 × 200 = 28 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 96 px to position 124 px. The AI inference engine reads the pressure as 124 ÷ 200 = 0.62 bar — well within the design specification of 0.40–0.80 bar. No N₂ top-up alarm is generated. Meanwhile, at 0.14 bar gauge, the N₂ blanket is inadequate: any momentary negative-pressure transient from thermally induced vapour pressure changes in the cylinder or manifold draws atmospheric air backward through valve seats into the pentaborane manifold.

Pentaborane vapour at the manifold concentration (typically 100% B₅H₉ with a partial pressure driven by the 60 °C boiling point and 66.7 mmHg vapour pressure at 20 °C) reacts spontaneously with atmospheric moisture above −40 °C: B₅H₉ + 6 O₂ → 5/2 B₂O₃ + 9/2 H₂O (highly exothermic combustion releasing approximately 5,200 kJ/mol). The N₂ blanket prevents this reaction by maintaining a positive-pressure barrier; at 0.14 bar, the margin against atmospheric ingress is exhausted after any thermal or pressure transient. Gas cabinet fires involving pyrophoric gases in confined enclosures generate temperatures exceeding 1,400 °C in the initial flash, which can rupture the 316 SS gas panel, actuate the facility sprinkler (water + B₅H₉ → catastrophic secondary reaction), and vent unburned pentaborane into the fab HVAC return path.

Surface 2 — Atmospheric B₅H₉ Monitor at Gas Cabinet Area (Downward Attack)

The area atmospheric monitor for pentaborane at the gas cabinet exhaust is displayed on a 200 px vertical DCS bar spanning 0 to 10 ppm (full-scale sufficient to cover the IDLH of 1 ppm with margin). The pixel scale is 200 px ÷ 10 ppm = 20 px/ppm. At the actual B₅H₉ concentration of 0.68 ppm — 68% of IDLH, 136 times the TLV-TWA of 0.005 ppm — the rendered pixel position is 0.68 × 20 = 13.6 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 12.8 px to position 0.8 px ≈ 1 px from the bottom. The AI inference engine reads the concentration as 1 ÷ 20 = 0.05 ppm — apparently near the detection limit and far below the OSHA PEL ceiling of 0.005 ppm? No — 0.05 ppm is actually 10× the PEL ceiling, but the AI's configured alarm setpoint (typically set at 0.10 ppm in semiconductor facilities due to detector calibration uncertainty) sees 0.05 ppm as below the action threshold. No personnel evacuation is ordered; no cascade of gas cabinet isolation, emergency N₂ purge, and exhaust emergency-flow increase is initiated.

At 0.68 ppm atmospheric B₅H₉, personnel in the gas cabinet area are exposed to a concentration 136× the TLV-TWA within the first minute of the leak event. Pentaborane neurological effects begin at concentrations as low as 0.1–0.3 ppm — including frontal headache (the characteristic "pentaborane headache"), dizziness, and confusion — with seizure risk at 0.5–1.0 ppm following cumulative exposure. Unlike hydrogen cyanide or hydrogen sulfide, which have characteristic odours that provide early warning, pentaborane at low concentrations is reported to have an unpleasant but non-distinctive smell that personnel routinely attribute to other fab chemicals. The 12.8 px adversarial perturbation on the 200 px monitor bar — a shift equivalent to approximately 14 pixel rows on a 1080p display — is below the human visual detection threshold when embedded in a complex multi-instrument DCS layout and indistinguishable from JPEG compression artefacts in a rendered display image.

Surface 3 — SiC CVD Exhaust Thermal Oxidizer Temperature (Downward Attack)

The thermal oxidizer temperature for the SiC CVD reactor exhaust abatement system is displayed on a 200 px vertical DCS bar spanning 0 to 1,000 °C. The pixel scale is 200 px ÷ 1,000 °C = 0.2 px/°C. At the actual abatement temperature of 420 °C — well below the design operating range of 750–900 °C required for complete pentaborane combustion — the rendered pixel position is 420 × 0.2 = 84 px from the bottom. The adversarial perturbation shifts this pixel cluster upward by 84 px to position 168 px. The AI inference engine reads the temperature as 168 ÷ 0.2 = 840 °C — within the design specification and apparently indicating full B₅H₉ combustion. No abatement failure alarm is generated; the DCS-integrated air process control (APC) system does not initiate emergency CVD reactor shutdown.

Pentaborane combustion in a thermal oxidizer requires a minimum temperature of approximately 650–700 °C and adequate O₂ residence time (≥0.5 s at temperature) to convert B₅H₉ quantitatively to B₂O₃ (solid) and water vapour. At 420 °C, the thermal oxidizer is below the minimum pentaborane ignition/combustion temperature in a flowing gas stream — the B₅H₉ passes through uncombusted. The uncombusted pentaborane in the CVD exhaust header is then diluted into the fab exhaust network, where it encounters the general HVAC return air. At the diluted concentration present in the exhaust header (typically 10–100 ppm during CVD runs), the B₅H₉ still substantially exceeds the IDLH of 1 ppm in any confined portion of the exhaust ducting and remains pyrophoric in the event of air infiltration into nominally N₂-purged exhaust header segments.

Integrating Glyphward into SiC CVD Pentaborane AI Monitoring Pipelines

The following Python snippet shows how to authenticate every gas cabinet and CVD exhaust DCS frame in a pentaborane-using SiC epitaxial fab against the Glyphward API before passing it to a downstream safety-monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception that the process control layer catches and routes to the fab Safety Instrumented System (SIS) for automatic CVD reactor N₂ purge, gas cabinet isolation, and area evacuation.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
B5H9_GLYPHWARD_THRESHOLD = 48

class B5H9Context(StrEnum):
    N2_BLANKET_PRESSURE     = auto()   # Surface 1 — upward attack
    AREA_ATMOSPHERIC_CONC   = auto()   # Surface 2 — downward attack
    CVD_ABATEMENT_TEMP      = auto()   # Surface 3 — downward attack

class AdversarialB5H9ImageError(RuntimeError):
    def __init__(self, surface: B5H9Context, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] B₅H₉ adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={B5H9_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_b5h9_frame(frame_path: Path, surface: B5H9Context) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": B5H9_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialB5H9ImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_b5h9_cvd_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (B5H9Context.N2_BLANKET_PRESSURE,   frame_dir / "n2_blanket_pressure.png"),
        (B5H9Context.AREA_ATMOSPHERIC_CONC, frame_dir / "area_b5h9_monitor.png"),
        (B5H9Context.CVD_ABATEMENT_TEMP,    frame_dir / "cvd_exhaust_oxidizer_temp.png"),
    ]
    tasks = [verify_b5h9_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently, adding under 80 ms of total latency on a standard CVD reactor polling cycle. The N₂ blanket check, the atmospheric monitor check, and the abatement temperature check run simultaneously — so a compound attack that manipulates all three displays to mask an evolving pyrophoric emergency raises three independent typed exceptions, each carrying the SHA-256 frame hash for OSHA PSM incident investigation traceability under 29 CFR 1910.119(m). Because pentaborane's OSHA PSM TQ is only 100 lbs — the lowest pyrophoric TQ in Appendix A — even a small gas cabinet inventory exceeds the regulatory threshold, and a missed adversarial attack that allows ignition constitutes a direct PSM incident requiring full investigation and reporting.