Prompt injection in semiconductor fab AI

Four adversarial injection surfaces in semiconductor fab AI

1. Wafer defect inspection image AI injection (KLA AI, Onto Innovation AI, Camtek FALCON AI)

Wafer defect inspection AI processes high-resolution SEM (scanning electron microscope) images, optical bright-field and dark-field inspection images, and electron-beam (e-beam) inspection images of silicon wafers captured at in-line inspection tool stations through AI-assisted defect detection and classification systems that identify and categorise critical defect types — bridging shorts, void opens, particle contamination, line roughness, CMP scratch defects, and epitaxial stacking faults — from these inspection image inputs, generating defect maps, defect pareto reports, and yield impact models that determine wafer dispositioning (scrap, rework, or pass), process tool qualification status, and yield improvement engineering priorities at semiconductor fabs processing wafers at advanced nodes from 7nm to sub-2nm. KLA AI inspection systems — deployed on more than 25,000 semiconductor manufacturing tools globally at TSMC, Samsung Foundry, Intel Foundry, GlobalFoundries, and major memory manufacturers — process wafer defect images through AI-assisted defect detection, nuisance filtering, and yield correlation tools that are the primary yield management AI infrastructure at every leading-edge semiconductor fab. Onto Innovation AI processes advanced packaging wafer inspection images and 3D packaging metrology images through AI-assisted defect detection tools at packaging and heterogeneous integration fabs serving NVIDIA, AMD, Apple, and other advanced packaging customers. Camtek FALCON AI processes wafer bump inspection photographs and backend packaging inspection images through AI-assisted bump height, coplanarity, and shape inspection tools at advanced packaging facilities.

The adversarial injection surface is the SEM image, optical inspection image, and e-beam inspection image submission pathway: high-resolution wafer defect inspection images captured by KLA, Onto Innovation, or Camtek inspection tools at in-line inspection stations and submitted through AI-assisted defect review and classification interfaces for AI defect type classification, yield impact modelling, and wafer dispositioning. An adversarially crafted wafer defect inspection image — in which pixel perturbations applied to the defect pixel cluster in a SEM or optical inspection image cause the KLA AI or Onto Innovation AI defect classification system to classify a critical electrically-killing defect (bridging short, void open) as a nuisance particle or benign surface contamination when the unperturbed image would generate a critical defect classification — can suppress a wafer scrap or rework disposition that would otherwise prevent a defective wafer lot from progressing to subsequent processing steps and final test, reducing the fab’s effective yield while generating costs associated with the additional processing steps applied to a wafer lot that should have been scrapped at the earlier in-line inspection point. For ITAR-controlled semiconductor processes producing defence integrated circuits at TSMC, Samsung, or GlobalFoundries — where wafer-level inspection data is subject to ITAR export control classification — adversarial injection into defect inspection AI creates additional ITAR compliance and security concern dimensions beyond the direct yield impact.

The regulatory and economic consequences of adversarially misclassified wafer defects in semiconductor fab inspection AI span yield management economics and national security law dimensions. CHIPS Act § 9903 (National Security Guardrails) imposes national security manufacturing requirements on semiconductor facilities receiving CHIPS incentive funding that include cybersecurity safeguards for fab technology and processes; adversarial injection into wafer defect inspection AI at a CHIPS-funded fab represents a cybersecurity threat to fab technology integrity with CHIPS Act guardrail compliance consequence. ITAR 22 CFR §§ 120-130 controls the export of defence articles including semiconductor components manufactured for US defence programmes; adversarial injection into inspection AI that affects the quality management of ITAR-controlled semiconductor wafer lots creates ITAR export control compliance concerns that require State Department DTSA coordination. The economic impact of adversarial suppression of critical defect classifications in advanced node wafer inspection AI is quantifiable: at N3 and N2 nodes where wafer starts cost $10,000+ per wafer, suppression of a critical defect flag that allows a defective lot to progress through ten additional processing steps before end-of-line test failure represents $100,000+ in wasted processing cost per lot. Threshold: 55 for wafer defect inspection AI.

2. EUV reticle inspection image AI injection (ASML SurveyorPRO AI, Synopsys AI)

EUV reticle inspection AI processes high-resolution aerial image and actinic inspection images of EUV photomasks (reticles), phase defect characterisation images, pattern placement error measurement data displays, and pellicle condition photographs submitted through AI-assisted reticle qualification and mask defect management systems that extract defect severity classifications, printability assessments, and pattern placement error (PPE) measurements from these image inputs, generating reticle qualification pass/fail decisions and reticle replacement recommendations for EUV scanner systems at the most advanced semiconductor fabs processing 2nm and 3nm node logic wafers. ASML SurveyorPRO AI processes EUV scanner-integrated aerial image inspection images and actinic printability test images for EUV reticles at TSMC, Samsung Foundry, Intel Foundry, and SK Hynix through AI-assisted mask defect detection and printability assessment tools that determine whether an EUV reticle meets the defect and pattern fidelity requirements for production use at the applicable node. Synopsys AI processes reticle design verification images and mask rule check result displays through AI-assisted EDA (Electronic Design Automation) tools that verify reticle design compliance before tape-out; adverse manipulation at the design verification AI layer can allow reticle designs with mask rule violations to progress to reticle fabrication.

The adversarial injection surface is the EUV reticle actinic inspection image, aerial image printability test photograph, and phase defect characterisation display screenshot submission pathway: high-resolution inspection images of EUV reticles captured by ASML actinic inspection systems at TSMC and Samsung reticle qualification facilities, submitted through ASML SurveyorPRO AI reticle qualification interfaces for AI phase defect severity classification and printability assessment. An adversarially crafted EUV reticle inspection image — in which pixel perturbations applied to a phase defect region, absorber edge roughness indicator, or pattern placement error display on an actinic inspection image cause the ASML SurveyorPRO AI to classify the defect as below the printability threshold when the unperturbed image would generate a critical defect flag requiring reticle repair or replacement — can suppress a reticle qualification failure that would otherwise prevent the use of a defective EUV reticle in production, allowing a reticle with a critical phase defect to print defective patterns across every wafer in a production lot until the yield impact is identified through end-of-line electrical test. At N3 nodes where EUV reticle sets cost $5-20M per device layer and 50,000-wafer production lots depend on reticle integrity, adversarial suppression of a reticle qualification defect flag creates extraordinary economic consequence.

The regulatory and commercial consequences of adversarially suppressed EUV reticle defect classification in semiconductor fab AI include CHIPS Act national security dimensions and major commercial liability consequences. CHIPS Act § 9903 fab security requirements apply to advanced EUV lithography processes at CHIPS-funded fabs; adversarial injection into ASML SurveyorPRO AI at a CHIPS-funded fab represents a technology security threat with CHIPS guardrail compliance consequences. EUV reticle qualification failures discovered after production use — through yield excursion investigation rather than pre-production reticle inspection — create customer notification obligations for the foundry under customer supply agreements, with yield shortfall credit liability, customer audit rights, and potential supply agreement termination consequences for pattern of quality failures. ITAR 22 CFR § 121.1 (USML Category XV) controls export of space and defence electronics components produced using EUV lithography for specific defence and intelligence programmes; adversarial injection into EUV reticle inspection AI at fabs producing ITAR-controlled semiconductor devices creates ITAR compliance concerns requiring DTSA and State Department coordination. Threshold: 55 for EUV reticle inspection AI.

3. Equipment condition monitoring display AI injection (Applied Materials eHELIOS AI, Lam Research SELA AI, Tokyo Electron AI)

Equipment condition monitoring AI processes photographs and screenshots of process chamber condition monitoring displays, equipment health dashboard images, consumable wear indicator displays, and preventive maintenance (PM) trigger parameter screenshots submitted through AI-assisted equipment health management systems that extract equipment condition classifications, consumable replacement recommendations, and PM due alerts from these display image inputs, generating equipment health reports and maintenance work orders that determine process chamber qualification status, consumable replacement scheduling, and unplanned downtime risk at semiconductor fabs where equipment downtime at advanced nodes costs $1M+ per hour. Applied Materials eHELIOS AI processes process chamber condition monitoring data displays and chamber matching parameter screenshots through AI-assisted chamber management and equipment health tools deployed across Applied Materials’ etch, CVD, PVD, and CMP tool fleet at leading-edge fabs. Lam Research SELA AI processes equipment chamber condition monitoring images and consumable component condition photographs through AI-assisted equipment health management tools for Lam Research’s etch and atomic layer deposition (ALD) systems at TSMC, Samsung, Intel, and memory fabs. Tokyo Electron (TEL) AI processes etch chamber and CVD chamber condition monitoring display images through AI-assisted equipment health and chamber matching tools at leading-edge logic and memory fabs.

The adversarial injection surface is the process chamber condition monitoring display screenshot, equipment health dashboard image, and consumable wear indicator photograph submission pathway: screenshots of Applied Materials eHELIOS AI chamber condition monitoring displays, Lam Research SELA AI equipment health dashboards, and Tokyo Electron AI process chamber monitoring interfaces submitted by fab equipment engineers through remote equipment monitoring portals for AI equipment condition classification and maintenance recommendation generation. An adversarially crafted equipment chamber condition monitoring display screenshot — in which pixel perturbations applied to a consumable wear parameter display, chamber matching metric indicator, or PM trigger threshold display on an equipment condition monitoring screenshot cause the Applied Materials eHELIOS AI or Lam Research SELA AI to classify the equipment as within-spec when the actual display indicates a consumable requiring immediate replacement or a chamber matching deviation requiring engineer intervention — can defer a required equipment PM or consumable replacement, allowing an out-of-spec process chamber to continue running production wafers and generating process excursions that affect device yield before the equipment deviation is identified through product electrical test failure or inline metrology excursion. At fabs running 24/7 production at $1M+/hour downtime cost, adversarial deferral of a preventive maintenance action through equipment monitoring AI manipulation creates direct yield loss and unplanned emergency maintenance cost significantly exceeding the cost of the deferred scheduled PM.

The regulatory and commercial consequences of adversarially manipulated equipment condition monitoring AI at semiconductor fabs span SEMI standards compliance, customer supply agreement obligations, and CHIPS Act dimensions. SEMI E10 (Standard for Definition and Measurement of Equipment Reliability, Availability, and Maintainability) and SEMI E30 (Generic Model for Communications and Control of Manufacturing Equipment) specify equipment reliability and availability standards applicable to semiconductor manufacturing tools; adversarial manipulation of equipment monitoring AI that defers required PM and reduces equipment availability creates SEMI E10 equipment reliability performance failures with customer supply agreement consequence. For automotive semiconductor supply chains, IATF 16949 supplier quality requirements impose preventive maintenance programme obligations on semiconductor fabs supplying automotive-grade ICs (AEC-Q100 qualified devices); adversarial equipment monitoring AI manipulation that allows out-of-spec process chambers to produce automotive-grade wafers creates IATF 16949 PM programme failures with automotive customer quality notification and audit obligations. Threshold: 55 for equipment condition monitoring AI.

4. SPC control chart display AI injection (PDF Solutions Exensio AI, Synopsys AI, KLA Process Control AI)

Statistical process control (SPC) chart display AI processes screenshots of SPC Shewhart control chart displays, EWMA (Exponentially Weighted Moving Average) chart screenshots, CUSUM chart images, and multivariate process capability plot screenshots submitted through AI-assisted yield management and process control platforms that extract process control status, rule violation classifications, and process capability indices from these SPC display image inputs, generating process control alerts, engineering escalation notifications, and process capability reports for ISO 9001, IATF 16949, and JEDEC reliability standard compliance at semiconductor fabs and assembly facilities. PDF Solutions Exensio AI processes SPC control chart display screenshots and yield correlation data images through AI-assisted yield management and process control tools at semiconductor fabs including Tier 1 logic and memory manufacturers and Tier 2 specialty and power semiconductor fabs. Synopsys AI processes process design kit (PDK) compliance verification display images and design rule check (DRC) result screenshots through AI-assisted EDA process control tools at semiconductor fabs. KLA Process Control AI processes in-line metrology SPC chart screenshots and defect density control chart images through AI-assisted process control monitoring tools integrated with KLA’s inspection and metrology platforms at leading-edge fabs.

The adversarial injection surface is the SPC control chart display screenshot, EWMA chart image, and process capability plot screenshot submission pathway: screenshots of SPC control chart displays showing process parameter trend data, Shewhart rule violation indicators, Western Electric zone flags, and process capability index (Cpk) displays submitted by process control engineers through PDF Solutions Exensio AI, KLA Process Control AI, or Synopsys AI yield management interfaces for AI process control status extraction and engineering escalation trigger generation. An adversarially crafted SPC control chart display screenshot — in which pixel perturbations applied to the control limit boundary, rule violation flag indicator, or out-of-control point display on an SPC chart screenshot cause the PDF Solutions Exensio AI or KLA Process Control AI to classify the process as in-control when the actual SPC chart displays an out-of-control condition with multiple consecutive points on one side of the centre line (Western Electric Rule 2) or a process trending toward the control limit (Western Electric Rule 3) — can suppress a process control escalation that would otherwise trigger an engineering investigation to identify and correct the root cause of the process drift before the out-of-control condition produces defective product across multiple wafer lots.

The regulatory and commercial consequences of adversarially suppressed SPC out-of-control detection in semiconductor fab AI span ISO quality management, automotive supply chain, and JEDEC reliability standard dimensions. ISO 9001:2015 Section 9.1.3 (Analysis and evaluation) requires that the organisation analyse and evaluate data and information from monitoring and measurement activities, including production and service provision; adversarially suppressed SPC out-of-control detection in AI process control tools creates an ISO 9001 nonconformity in the monitoring and measurement analysis requirements that results in quality management system audit finding. IATF 16949 Section 8.3.3.3 (Special characteristics) and 8.5.6.1 (Control of changes — supplemental) impose SPC and statistical methods requirements for automotive semiconductor suppliers; adversarial SPC AI manipulation at an automotive semiconductor fab creates IATF 16949 Section 8.5.6 process control compliance failures with customer notification obligations. JEDEC JESD47 (Stress-Test-Driven Qualification of Integrated Circuits) specifies process control and statistical methods requirements for automotive and industrial IC qualification; adversarial SPC AI manipulation that allows out-of-control process conditions to produce qualification test samples creates JEDEC qualification integrity failures with customer re-qualification obligations. For CHIPS Act-funded fabs, process control integrity is a technology security requirement; adversarial SPC AI manipulation represents a process integrity threat with CHIPS guardrail compliance consequence. Threshold: 60 for SPC control chart AI, reflecting both quality management and national security dimensions.

Integration: semiconductor fab AI image ingestion with Glyphward pre-scan

Semiconductor fab AI image ingestion flows from wafer defect inspection APIs, EUV reticle review interfaces, equipment monitoring dashboards, and SPC yield management platforms into defect classification AI, reticle qualification AI, equipment health AI, and process control AI pipelines. Insert Glyphward’s pre-scan at the ingestion boundary before AI-generated output is committed to wafer dispositioning decisions, reticle qualification records, equipment maintenance work orders, or process control escalation logs:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Semiconductor fab AI — wafer defect misclassification, EUV reticle defect
# suppression, equipment PM deferral, SPC out-of-control concealment.
# SEMI E10/E30, ITAR 22 CFR §§120-130, CHIPS Act §9903,
# ISO 9001 SPC, IATF 16949, JEDEC JESD47 automotive IC qualification.
THRESHOLD_DEFECT_INSPECTION  = 55  # wafer defect, EUV reticle, equipment monitoring
THRESHOLD_SPC_CONTROL        = 60  # SPC chart — yield management + national security


class SemiconductorFabAIContext(str, Enum):
    WAFER_DEFECT    = "wafer_defect"    # KLA, Onto Innovation, Camtek FALCON
    EUV_RETICLE     = "euv_reticle"     # ASML SurveyorPRO, Synopsys
    EQUIPMENT_COND  = "equipment_cond"  # Applied Materials eHELIOS, Lam SELA, TEL
    SPC_CONTROL     = "spc_control"     # PDF Solutions Exensio, KLA Process Control


def threshold_for(context: SemiconductorFabAIContext) -> int:
    if context == SemiconductorFabAIContext.SPC_CONTROL:
        return THRESHOLD_SPC_CONTROL
    return THRESHOLD_DEFECT_INSPECTION


async def scan_fab_image(
    image_path: str | Path,
    context: SemiconductorFabAIContext,
    fab_id_hash: str,       # SHA-256 of fab site identifier
    lot_id_hash: str,       # SHA-256 of wafer lot ID or reticle ID
    tool_ref: str,          # e.g. "KLA-SURFSCAN-07", "ASML-EUV-NXE3600", "Lam-KIYO-12"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a semiconductor fab AI image for adversarial injection payloads
    before forwarding to wafer defect inspection, EUV reticle qualification,
    equipment health, or SPC process control AI systems.

    Raises AdversarialFabImageError if score meets or exceeds threshold:
      - WAFER_DEFECT:   threshold 55; CHIPS Act §9903, ITAR 22 CFR §§120-130,
                        yield management economics ($10k+/wafer advanced nodes)
      - EUV_RETICLE:    threshold 55; ASML SurveyorPRO reticle qualification,
                        CHIPS Act §9903, ITAR (defence IC programmes)
      - EQUIPMENT_COND: threshold 55; SEMI E10/E30 equipment reliability,
                        IATF 16949 PM, $1M+/hr fab downtime cost
      - SPC_CONTROL:    threshold 60; ISO 9001 §9.1.3, IATF 16949 §8.5.6,
                        JEDEC JESD47, CHIPS Act §9903 process integrity
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64   = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    client_scan_id = str(uuid.uuid4())
    threshold = threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "fab_context":   context.value,
                "fab_id_hash":   fab_id_hash,
                "lot_id_hash":   lot_id_hash,
                "tool_ref":      tool_ref,
                "client_scan_id": client_scan_id,
                "image_sha256":  image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "fab_id_hash":   fab_id_hash,
        "lot_id_hash":   lot_id_hash,
        "tool_ref":      tool_ref,
        "fab_context":   context.value,
        "scan_id":       result["scan_id"],
        "client_scan_id": client_scan_id,
        "image_sha256":  image_sha256,
        "score":         result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold":     threshold,
        "action":        "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_fab_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialFabImageError(
            f"Semiconductor fab AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"lot={lot_id_hash} tool={tool_ref}"
        )
    return result


async def write_fab_audit_record(record: dict) -> None:
    """Persist audit record to fab yield management audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialFabImageError(Exception):
    """Raised when a semiconductor fab AI image exceeds the adversarial injection threshold."""
    pass

Call scan_fab_image() with SemiconductorFabAIContext.WAFER_DEFECT before forwarding SEM and optical inspection images to KLA AI, Onto Innovation AI, or Camtek FALCON AI defect classification — the primary yield management integration point, where adversarial defect misclassification creates compounding wafer lot yield loss and ITAR compliance risk for defence IC programmes. Call with SemiconductorFabAIContext.EUV_RETICLE for ASML actinic inspection images before ASML SurveyorPRO AI phase defect classification, using lot_id_hash as the SHA-256 of the reticle ID for CHIPS Act technology security audit trail purposes. Call with SemiconductorFabAIContext.EQUIPMENT_COND for equipment health dashboard screenshots before Applied Materials eHELIOS AI or Lam SELA AI equipment condition extraction, with tool_ref identifying the specific process tool for SEMI E10 equipment availability audit purposes. Call with SemiconductorFabAIContext.SPC_CONTROL for SPC control chart screenshots before PDF Solutions Exensio AI or KLA Process Control AI out-of-control detection, using the highest threshold (60) to reflect the national security and automotive IC supply chain dimensions of process control integrity at CHIPS Act-funded advanced node fabs. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four semiconductor fab AI injection surfaces; covers adversarial pixel perturbations that cause AI misclassification without detectable visual artifacts at human review resolution.
• Vision-language model security — technical architecture of adversarial image attacks including pixel perturbation classes applicable to SEM wafer defect inspection images and EUV reticle actinic inspection photographs.
• Multimodal AI security testing — adversarial testing methodology applicable to the wafer inspection, reticle qualification, equipment monitoring, and SPC chart AI systems in semiconductor fab contexts.
• Prompt injection scanner for financial services AI — parallel high-stakes AI injection context with ITAR-adjacent regulatory consequences for AI output manipulation in regulated industry settings.
• Free tier — 10 scans/day, no card required — start scanning semiconductor fab AI images at development volumes before committing to a production plan.