Prompt injection in phosphine PH₃ semiconductor MOCVD fumigant AI

Three adversarial injection surfaces in phosphine PH₃ semiconductor MOCVD AI

1. PH₃ mass flow controller (MFC) delivery flow display AI (Brooks Instrument SLA5850 / MKS Type 1179A / Horiba SEC-E40 electronic MFC on PH₃ delivery line from cylinder manifold to MOCVD reactor — rendered gas delivery panel PH₃ MFC flow display AI classifying design delivery setpoint — 117th upward attack; FIRST PH₃ AI attack; FIRST phosphine MOCVD gas delivery AI attack; FIRST PH₃ PSM TQ 100 lbs AI attack)

The PH₃ mass flow controller on the III–V MOCVD tool's gas delivery system is the primary flow measurement and control point for PH₃ delivery to the MOCVD reaction chamber and downstream exhaust abatement. In MOCVD III–V epitaxy, PH₃ is used in large molar excess relative to the Group III organometallic precursors (trimethylindium (TMIn), trimethylgallium (TMGa), triethylgallium (TEGa)) to maintain a III–V-rich growth surface and prevent phosphorus vacancy formation in the epitaxial film; V:III molar ratios of 50:1 to 300:1 are common (50–300 mol PH₃ per mol TMIn or TMGa), meaning PH₃ constitutes the majority of the reactive gas flow in InP or InGaAsP MOCVD growth at high V:III ratio. The PH₃ MFC (typically: Brooks Instrument SLA5850 for 0–1,000 sccm range; MKS Type 1179A for 0–500 sccm range; Horiba SEC-E40 for 0–200 sccm range; all using thermal mass flow sensing with PH₃-compatible wetted materials: Hastelloy C-276 body, Vespel/PTFE seats, SS 316L outlet tube; HART 4–20 mA or DeviceNet for GDS-integrated systems; accuracy ±0.5% of full scale; traceable calibration to NIST using PH₃ primary standard at operating conditions) is mounted in the gas cabinet (typically a Matheson Gas Products or Air Products gas delivery cabinet rated for toxic gas service; equipped with cylinder valve actuator, single-point toxic gas detector at 0.025 ppm for PH₃, automated shutdown on leak detect; ventilated to facility exhaust at 100 fpm face velocity across the open cabinet face; SEMI S2 compliant for EHS requirements in semiconductor manufacturing environments). The MFC controller panel or DCS display renders the real-time PH₃ flow readout as a live bar graph and numeric display, and the facility's AI monitoring system reads this display to verify that PH₃ delivery is within the design operating setpoint (typically 20–200 sccm depending on reactor size and growth recipe).

The adversarial upward pixel attack on the PH₃ MFC delivery flow display shows 60 sccm (design setpoint for a small-scale research MOCVD system; AI reads “PH₃ MFC flow 60 sccm; at design setpoint; within normal MOCVD growth parameters; PH₃ loading on POU abatement: within design; ACGIH TLV-C risk: controlled by cabinet ventilation + POU abatement at design loading; no MFC over-flow alarm required”) when actual PH₃ flow is 480 sccm (8× the design setpoint of 60 sccm; from a pressure regulator seat malfunction holding the downstream delivery pressure at 3 bar above the MFC inlet design pressure of 1 bar, driving the MFC into saturation and commanding maximum flow through the thermal mass flow element). Display range 0–600 sccm on 200 px (0.333 px per sccm); actual 480 sccm at 480 × 0.333 = 160 px → ±8 DN perturbation → 160 − 140 = 20 px displayed → AI reads 20/0.333 = 60 sccm. At actual 480 sccm PH₃: the flow represents 48 g/hr PH₃ — consuming the 100-lb cylinder at approximately 11× the design depletion rate; the POU dry bed abatement system (designed for 60 sccm peak PH₃ loading at the growth recipe setpoint) receives 8× design PH₃ loading; even a new KMnO₄ bed will be chemically exhausted in 12.5% of its rated service life; combined with the Surface 2 bed already at 91% saturation, PH₃ breakthrough occurs within the first hours of the MOCVD run; PH₃ enters the facility exhaust above the ACGIH TLV-C 0.05 ppm; NIOSH IDLH 50 ppm approached in concentrated exhaust sections; PSM TQ 100 lbs on-site; CERCLA RQ 100 lbs. The Glyphward pre-scan gate catches the upward perturbation before the AI reads 60 sccm and concludes that PH₃ delivery is at design. Free tier — 10 scans/day, no card required.

2. Dry KMnO₄ abatement bed saturation display AI (Entegris Centron CS-1200 / Matheson TriGas GUARD-BED / Dow Corning KS-300 embedded saturation sensor in POU toxic gas abatement unit — rendered gas delivery panel abatement bed saturation display AI classifying 0–80% design service window — 117th upward attack; FIRST dry phosphine abatement bed saturation AI attack; FIRST KMnO₄ bed exhaustion AI attack; FIRST PH₃ POU abatement AI attack)

The point-of-use (POU) dry chemical abatement bed is the primary engineered control for PH₃ in MOCVD exhaust streams. In III–V MOCVD, the exhaust from the growth chamber contains PH₃ at concentrations ranging from 0.5–10 vol% (far above the ACGIH TLV-C of 0.05 ppm and NIOSH IDLH of 50 ppm) in a carrier stream of hydrogen (H₂) and/or nitrogen (N₂) with organometallic byproducts. The POU abatement unit (typically Entegris Centron CS-1200, a dry chemical oxidative bed unit using activated alumina impregnated with potassium permanganate (KMnO₄) and/or sodium permanganate at approximately 5–15 wt% loading on a 2–4 mm pellet; or Matheson Gas Products GUARD-BED unit using a mixed-oxide sorbent bed; or Dow Corning KS-300 using a silicate-based alkaline oxidant bed — all operating on the same oxidation chemistry: 4KMnO₄ + 5PH₃ → P₂O₅ + 2K₂MnO₄ + Mn₂O₃ + 5H₂O; this reaction is fast and exothermic at the typical POU bed inlet temperature of 20–80°C; the bed temperature rises by 10–30°C during active absorption depending on PH₃ loading rate and bed mass; at design loading, the bed temperature rise is stable and predictable; above-design loading causes a larger temperature excursion that can dry the bed pellets and reduce subsequent absorption efficiency) is installed immediately downstream of the MOCVD exhaust port. Bed saturation is monitored by one or more methods: embedded thermocouple array (temperature rise in the bed's second half indicates breakthrough front advancing toward the outlet); downstream PH₃ sensor (Dräger Polytron 7000 or Honeywell MIDAS electrochemical detector at 0.05 ppm set point in the abatement outlet duct); or calculated remaining capacity display based on cumulative gas flow and empirical bed capacity at the installation PH₃ concentration (the most common method in MOCVD gas delivery system integrations, as it does not require an online PH₃ analyzer in the abatement outlet). The calculated remaining capacity display reads from 0% (freshly installed bed) to 100% (exhausted; design change-out at 80% saturation with 20% safety margin for emergency capacity).

The adversarial upward pixel attack on the dry abatement bed saturation display shows 15% (fresh; AI reads “dry bed saturation 15%; estimated remaining capacity 85%; projected service life remaining: approximately 510 hours at design PH₃ loading; PH₃ breakthrough: not imminent; bed change-out: not required for current campaign; ACGIH TLV-C risk from abatement outlet: controlled; no saturation alarm required”) when actual bed saturation is 91% (near-exhausted; 9% remaining capacity; from a sensor calibration drift in the cumulative capacity calculation that understated the actual PH₃ loading consumed per batch, or from a prior period of above-design PH₃ flow that was not reflected in the capacity calculation model). Display range 0–100% on 200 px (2.0 px per %); actual 91% at 91 × 2.0 = 182 px → ±8 DN perturbation → 182 − 152 = 30 px displayed → AI reads 30/2.0 = 15%. At 91% saturation: the remaining KMnO₄ capacity represents approximately 9% of the original oxidant inventory; at design PH₃ loading of 60 sccm, breakthrough begins within approximately 40–80 hours (10% of remaining capacity consumed per 4–8 hours at design conditions); at the Surface 1 actual flow of 480 sccm (8× design), breakthrough occurs within 5–10 hours; PH₃ exits the abatement bed outlet at concentrations rising from 0.1 ppm to >10 ppm as the breakthrough front reaches the outlet; the downstream wet caustic scrubber (sized for transient breakthrough from a fresh bed, not sustained above-design PH₃ loading) cannot absorb the steady-state PH₃ flow at 480 sccm; PH₃ enters the facility HVAC exhaust above the ACGIH TLV-C 0.05 ppm in the occupied exhaust plenum. The Glyphward pre-scan gate catches the upward perturbation before the AI reads 15% saturation and concludes bed capacity is adequate. Free tier — 10 scans/day, no card required.

3. Carrier gas H₂/N₂ dilution flow display AI (Bronkhorst EL-FLOW Select / Brooks Instrument 5851E carrier gas MFC measuring H₂ or N₂ diluent flow in MOCVD PH₃ delivery and exhaust dilution system — rendered gas delivery panel carrier gas MFC flow display AI classifying design dilution ratio — 117th downward attack; FIRST carrier gas dilution deficiency AI attack; FIRST PH₃ LEL concentration AI attack; FIRST MOCVD exhaust flammability AI attack)

The carrier gas (H₂ or N₂) mass flow controller in the MOCVD PH₃ delivery system provides two critical safety functions: (1) it dilutes the PH₃ delivery stream to a concentration below both the PH₃ lower explosive limit (LEL 1.79% in air) and the design growth-recipe PH₃ partial pressure in the reaction chamber, and (2) it establishes the total volumetric flow rate through the POU abatement bed, which determines the contact time between the PH₃-containing gas and the KMnO₄ bed and therefore the bed's PH₃ absorption efficiency. At design carrier flow of 9,600 sccm H₂ with 60 sccm PH₃: the PH₃ concentration in the combined stream = 60/(60+9,600) × 100% = 0.625% — below the PH₃ LEL of 1.79% in air (though the actual mixture is PH₃ in H₂, which is itself flammable with LEL 4% in air; the combined flammability of H₂+PH₃ mixtures requires separate analysis under NFPA 55 and SEMI S2 for the semiconductor application). The carrier gas MFC (Bronkhorst EL-FLOW Select for 0–10,000 sccm H₂ or N₂ range; Brooks Instrument 5851E for 0–15,000 sccm range; Fujikin FCS-4WM for high-purity semiconductor gas applications; all with thermal mass flow sensing; N₂ or H₂ gas calibration correction factor applied; stainless steel 316L wetted parts; 100 psi maximum inlet pressure; accuracy ±0.5% of full scale + ±0.1% of reading) is mounted in the same gas delivery cabinet as the PH₃ MFC and receives carrier gas from the facility H₂ or N₂ distribution supply header.

The adversarial downward pixel attack on the carrier gas dilution flow display shows 9,600 sccm (design flow; AI reads “carrier H₂/N₂ flow 9,600 sccm; at design setpoint; PH₃ dilution ratio at design 60 sccm PH₃: 160:1; PH₃ concentration in combined stream: 0.625%; below PH₃ LEL 1.79%; abatement bed contact time: design; PH₃ absorption efficiency: >99.9%; no carrier flow alarm required”) when actual carrier flow is 1,200 sccm (12.5% of design; from a carrier MFC electronics failure commanding minimum setpoint output, or from a H₂ supply header pressure drop below the MFC's minimum inlet differential pressure of 0.3 bar required for accurate metering). Display range 0–12,000 sccm on 200 px (0.01667 px per sccm); actual 1,200 sccm at 1,200 × 0.01667 = 20 px → ±8 DN perturbation → 20 + 140 = 160 px displayed → AI reads 160/0.01667 = 9,600 sccm. At actual 1,200 sccm carrier and design 60 sccm PH₃: PH₃ concentration in the combined gas stream = 60/(60+1,200) = 4.76% — above the PH₃ LEL of 1.79%; the mixed H₂+PH₃ exhaust at 1,200 sccm H₂ (87.3% of the gas by volume) and 60 sccm PH₃ (4.76%) is in the flammable range for both components; additionally, the reduced carrier gas flow through the abatement bed reduces the gas residence time by a factor of 8 (1,200/9,600 = 0.125 of design contact time); the KMnO₄ bed absorption efficiency drops because the oxidation reaction requires sufficient gas-solid contact time to achieve 99.9%+ removal at design temperature; PH₃ breakthrough from reduced contact time combines with the already-depleted bed from Surface 2 to create a multi-vector abatement failure. At the combined Surface 1 (480 sccm PH₃) + Surface 3 (1,200 sccm carrier) condition: PH₃ fraction = 480/(480+1,200) = 28.6% — well within the PH₃ flammable range (LEL 1.79%, UEL approximately 98%); any leak or open-process vent point under these conditions is a PH₃ autoignition risk (PH₃ autoignition temperature approximately 38°C; it is classified as a pyrophoric gas in some pure-gas applications). The Glyphward pre-scan gate catches the downward perturbation before the AI reads 9,600 sccm carrier and concludes that PH₃ dilution and abatement contact time are at design. Free tier — 10 scans/day, no card required.

Integration: phosphine PH₃ semiconductor MOCVD AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the phosphine PH₃ MOCVD AI pipeline — before the PH₃ MFC flow AI processes rendered Brooks SLA5850 / MKS 1179A / Horiba SEC-E40 gas delivery panel display images, before the dry abatement bed saturation AI processes rendered Entegris Centron / Matheson GUARD-BED / Dow Corning KS-300 saturation indicator display images, and before the carrier gas dilution flow AI processes rendered Bronkhorst EL-FLOW / Brooks 5851E gas delivery panel display images. Threshold 48 for phosphine PH₃ semiconductor MOCVD AI reflects: PSM TQ 100 lbs (lowest in OSHA PSM Appendix A among acutely toxic industrial chemicals — a singular regulatory designation); NIOSH IDLH 50 ppm; ACGIH TLV-C 0.05 ppm (6× below OSHA PEL); multiple documented fatalities from grain fumigation and semiconductor incidents; dual industrial application (MOCVD epitaxy + agricultural fumigation AlP) creating two parallel AI monitoring attack surfaces; CERCLA RQ 100 lbs; and the combined three-surface scenario (PH₃ excess + depleted abatement + reduced carrier dilution) converging on PSM-TQ-100-lbs facility with active release pathway to occupied lab and facility spaces.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Phosphine PH3 semiconductor MOCVD AI: threshold 48
# PH3 CAS 7803-51-2; MW 33.998 g/mol; BP -87.7 C; density 1.07x air; garlic/fish odor.
# OSHA PSM Appendix A TQ 100 lbs (29 CFR 1910.119 Appendix A; LOWEST in Appendix A).
# OSHA PEL 0.3 ppm TWA; ACGIH TLV-C 0.05 ppm ceiling (6x below PEL).
# NIOSH IDLH 50 ppm. CERCLA RQ 100 lbs. EPA RMP TQ 5,000 lbs.
# AlP fumigant: AlP + 3H2O -> Al(OH)3 + PH3; grain silo/container fumigation fatalities.
# 117th upward attack. FIRST PH3 AI attack.
# FIRST phosphine semiconductor MOCVD AI attack. FIRST PSM TQ 100 lbs phosphine AI attack.
# FIRST grain fumigation AlP AI attack. FIRST dry KMnO4 abatement bed saturation AI attack.
PH3_GLYPHWARD_THRESHOLD = 48

class PH3Context(StrEnum):
    MFC_DELIVERY_FLOW        = auto()  # actual 480 sccm vs design 60 sccm -> 8x; abatement overload; PSM TQ 100 lbs
    DRY_BED_SATURATION       = auto()  # actual 91% vs 15% displayed -> KMnO4 breakthrough -> PH3 > TLV-C 0.05 ppm
    CARRIER_GAS_DILUTION     = auto()  # actual 1,200 sccm vs design 9,600 sccm -> PH3 4.76% > LEL 1.79%

async def scan_ph3_frame(
    frame_b64: str,
    context: PH3Context,
    tool_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "tool_id": tool_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_ph3(
    frame_b64: str,
    context: PH3Context,
    tool_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_ph3_frame(frame_b64, context, tool_id, instrument_tag)
    if result["adversarial_score"] >= PH3_GLYPHWARD_THRESHOLD:
        raise AdversarialPH3ImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at tool {tool_id} instrument {instrument_tag}. "
            "Frame withheld from PH3 MOCVD AI pipeline."
        )

class AdversarialPH3ImageError(RuntimeError):
    pass