Adversarial Injection · Semiconductor Fab AI Monitoring · Attack #155

Stibine (SbH₃, Antimony Hydride, CAS 7803-52-3) GaSb/InSb MOCVD Epitaxy III-V Semiconductor IRFPA Manufacturing — OSHA PEL 0.1 ppm, ACGIH TLV-TWA 0.1 ppm, NIOSH IDLH 5 ppm, Hemolytic Toxicity Renal Failure: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST Stibine Antimony Hydride Semiconductor AI Attack

Stibine (antimony hydride; antimony trihydride; SbH₃; CAS 7803-52-3; MW 124.76 g/mol; BP −17.1°C — a gas at all ambient temperatures; density 4.34 g/L (vs. air 1.29 g/L); vapor density 3.37 — substantially heavier than air and accumulating at floor level in gas cabinets, equipment bays, and below-grade chase spaces; flammable gas LEL 1.9 vol%; UEL 98 vol%; GHS Flammable Gas Category 1; OSHA PEL 0.1 ppm TWA, 29 CFR 1910.1000 Table Z-1 — the same PEL established for arsine, reflecting closely analogous toxicological profiles for Group 15 metal hydrides; ACGIH TLV-TWA 0.1 ppm; NIOSH IDLH 5 ppm; hemolytic toxicity mechanism: stibine oxidizes oxyhemoglobin to methemoglobin via the same oxidative mechanism as arsine (SbH₃ acts as a hydride-transfer reductant that reduces O₂ bound to Fe²⁺ heme, releasing reactive oxygen species that crosslink erythrocyte membrane proteins via glutathione depletion, producing osmotic fragility and intravascular hemolysis); delayed renal failure from hemoglobin precipitate in renal tubules 24–48 hours after acute inhalation exposure — the same mechanism that makes arsine toxicity deceptively mild in immediate presentation; SEMI S2 §6.1 toxic gas storage and handling requirements; UN 2676; Class 2.3 toxic gas with subsidiary Class 2.1 flammable hazard) is the antimony-containing Group 15 metal hydride used as a p-type dopant source and compound-semiconductor precursor in metalorganic chemical vapor deposition (MOCVD) epitaxy of antimonide-based III-V compound semiconductor heterostructures: gallium antimonide (GaSb), indium antimonide (InSb), aluminum antimonide (AlSb), indium arsenide antimonide (InAsSb), and related type-II superlattice (T2SL) structures for mid-wave infrared (MWIR) and long-wave infrared (LWIR) detector arrays. A single ±8 DN adversarial pixel perturbation on rendered gas management system display images can show the gas cabinet stibine electrochemical sensor at 0.02 ppm when the actual concentration is 0.85 ppm (8.5× OSHA PEL 0.1 ppm) — suppressing hemolysis-risk evacuation and masking a toxic gas cabinet failure; can display the stibine mass flow controller (MFC) delivery at 38 sccm when the actual MOCVD process delivery is 0.8 sccm (47.5× under-delivery) — causing InSb epilayer growth without antimony incorporation, provoking a process abort and cylinder reconnect event that generates a secondary exposure; or can show the exhaust scrubber oxidant concentration at 4.2 wt% when the actual concentration is 0.18 wt% — allowing stibine breakthrough to the fab exhaust stack at concentrations exceeding the ACGIH TLV at the stack exit. Glyphward detects all three surfaces at threshold 38 before any image reaches a downstream MOCVD process-control or gas-management AI.

Stibine's role in III-V compound semiconductor manufacturing derives from the requirement for a volatile, gas-phase antimony precursor compatible with MOCVD reactor conditions (650–850°C growth temperature for GaSb; 300–450°C for InSb; hydrogen or nitrogen carrier gas; group-V/group-III precursor ratio of 2–5 for antimonide layers). Stibine (SbH₃) serves this role for applications where the more commonly used trimethylantimony (TMAb, Sb(CH₃)₃) or triethylantimony (TESb, Sb(C₂H₅)₃) metalorganic Sb precursors are not available or where the simpler hydride chemistry is preferred for research-scale systems. The primary application driver for stibine-based MOCVD is infrared focal plane array (IRFPA) detector manufacturing: InSb photodetectors for MWIR (3–5 µm wavelength) imaging operate at 77 K (liquid nitrogen cooling) with quantum efficiencies above 80%, making them the dominant detector technology for high-performance thermal imaging in defense applications (Raytheon Technologies RTX, L3Harris, DRS Technologies/Leonardo DRS) and scientific instruments (JWST MIRI mid-infrared instrument used InSb detector arrays; NASA/ESA procurement from Raytheon Vision Systems). Type-II InAs/InSb and InAs/GaSb superlattice structures (T2SL) grown by MBE or MOCVD are being developed as replacements for HgCdTe (MCT) in LWIR (8–14 µm) detectors, with DARPA and DoD funding directed at facilities including II-VI/Coherent (formerly Finisar and II-VI), Sumitomo Electric Device Innovations, and Northrop Grumman. At these facilities, stibine is used from high-pressure cylinders (typically 1 L or 500 mL capacity at 170–200 psig fill pressure in 200 ppm to 100% purity grades in H₂ or N₂ diluent gas) stored in SEMI S2-compliant gas cabinets with continuous electrochemical sensor monitoring, automated emergency shutoff valves (ESV), and point-of-use (POU) scrubbers. The gas cabinet stibine sensor, MOCVD MFC delivery indicator, and scrubber performance monitor are the three primary AI-monitored display surfaces exploited by this attack.

Stibine's acute toxicology mirrors arsine's with important quantitative differences: the NIOSH IDLH of 5 ppm for stibine vs. 3 ppm for arsine reflects a modestly lower acute lethality for stibine in rodent studies, but the hemolysis-renal failure mechanism is common to both Group 15 hydrides. The critical feature of stibine (and arsine) toxicity for adversarial AI monitoring attack purposes is the delayed onset: workers exposed to hemolytic concentrations of stibine (0.1–2 ppm) typically show minimal acute symptoms during the exposure event — mild headache, malaise, possibly slight hemoglobinuria visible as dark urine — with the full clinical syndrome (jaundice, oliguria, anuria from hemoglobin cast nephropathy, hyperkalemia, metabolic acidosis) emerging 24–48 hours later in a different clinical context (the worker may be at home, asleep, or in a non-occupational setting). This delayed onset means that a suppressed gas cabinet sensor reading (Surface 1) — showing 0.02 ppm when the actual concentration is 0.85 ppm — generates no contemporaneous clinical signal that would prompt medical evaluation. The worker continues the shift, departs the facility, and presents to an emergency department the following day with acute hemolytic anemia of uncertain cause, frequently diagnosed as idiopathic or deferred to hematology workup before the occupational history link to stibine is recognized. The OSHA PEL of 0.1 ppm for stibine (same as arsine) reflects the narrow margin between no-effect level and hemolysis threshold: animal studies report hemolysis in rats at 0.5–1 ppm chronic exposure, and case reports from industrial accidents document hemolysis in humans at estimated exposures of 0.3–1.0 ppm for 2–8 hours. Glyphward threshold 38 for stibine reflects: OSHA PEL 0.1 ppm (one of the lowest OSHA PELs for any gas); hemolysis-renal failure mechanism with delayed onset (making suppressed alarm especially consequential); NIOSH IDLH 5 ppm (actual exposure at 0.85 ppm is 17% IDLH — significant but not immediately lethal, fitting the delayed-toxicity attack profile exactly); and MFC-falsification secondary exposure (Surface 2) that creates a cylinder-change event generating a second exposure under the same suppressed-alarm condition.

Why GaSb/InSb MOCVD Stibine Operations Are Disproportionately Vulnerable to Pixel Manipulation

Stibine monitoring in MOCVD semiconductor fabs presents an adversarial attack profile distinguished by the temporal mismatch between the monitoring suppression event and the clinical consequence. The gas cabinet electrochemical sensor operates at parts-per-billion sensitivity on a 0–2 ppm display range (100 px/ppm; 200 px = 2 ppm full scale); the MOCVD MFC delivery indicator operates on a 0–100 sccm display range (2 px/sccm); and the scrubber oxidant concentration indicator operates on a 0–10 wt% display range (20 px per wt%). Each surface has an independent pixel scale and represents a different hazard mechanism — stibine inhalation at the gas cabinet (Surface 1), stibine under-delivery to the process reactor with consequent operator intervention (Surface 2), and stibine atmospheric release through the exhaust scrubber (Surface 3). Because stibine at 0.85 ppm (8.5× OSHA PEL) produces no immediately distinguishable symptoms from normal fatigue in a fab environment (mild headache, slight nausea — easily attributed to work stress or inadequate hydration), the suppressed Surface 1 display does not create an immediate observable consequence that would prompt investigation. The 24–48 hour delay until clinical hemolysis is the defining feature of the stibine attack — it decouples the monitoring failure from the health event in time and place, making the adversarial pixel injection the most consequential attack vector for Group 15 hydrides with hemolytic toxicity.

Surface 1 — Gas Cabinet Stibine Electrochemical Sensor (Downward Attack)

The gas cabinet stibine electrochemical sensor — calibrated for 0–2 ppm full-scale display per SEMI S2 §6.1 toxic gas storage requirements — is displayed on a 200 px vertical bar. The pixel scale is 200 px ÷ 2 ppm = 100 px/ppm. At the actual stibine concentration of 0.85 ppm inside the gas cabinet — from a valve stem packing leak at the cylinder interface fitting, where a worn PTFE packing set has allowed stibine to migrate from the cylinder valve body at a rate of 0.02–0.05 mg/hr (estimated from the 0.85 ppm steady-state concentration in the 180 L cabinet volume with 0.5 cabinet-volumes/hr background leakage ventilation) — the rendered pixel position is 0.85 × 100 = 85 px from the bottom. The adversarial perturbation shifts this pixel cluster downward by 82.7 px to 2.3 px. The AI gas management system reads the concentration as 2.3 ÷ 100 = 0.023 ppm — rounding to 0.02 ppm — below the 0.02 ppm noise-floor alarm threshold typically configured for stibine gas cabinet sensors. No emergency shutoff valve (ESV) activation; no gas cabinet alarm; no fab evacuation; no SEMI S2 §6 gas leak response procedure initiated.

At 0.85 ppm stibine in the gas cabinet — or at the estimated cabinet-to-fab dilution of 0.85 × (0.5 ÷ 1,000) = 0.00043 ppm in the fab bay open volume if the cabinet ESV remains open and stibine diffuses from cabinet into the fab environment — the direct worker exposure at the gas cabinet is 0.85 ppm, which is 8.5× the OSHA PEL of 0.1 ppm. During a routine cylinder-monitoring inspection at the gas cabinet (a standard SEMI S2 procedure performed daily), a MOCVD process engineer who opens the gas cabinet access panel for a visual inspection of cylinder gauge pressure is exposed to the 0.85 ppm atmosphere inside the cabinet for the duration of inspection (typically 2–5 minutes). The stibine dose received during this brief exposure — calculated as concentration × time × respiratory rate (0.85 ppm × 3 min × 12 L/min = 30.6 ppm·L = 30.6 µg/L × 124.76 × 0.001 = approximately 3.8 µg stibine) — is sub-threshold for immediate hemolytic response but above the threshold for initiating the hemolysis cascade in vulnerable erythrocytes (those with marginal glutathione reserves from baseline oxidative stress). The 24–48 hour delay in stibine hemolysis onset reflects the time required for: (1) stibine distribution throughout the red blood cell compartment; (2) progressive glutathione depletion in exposed erythrocytes; (3) accumulation of Heinz body (oxidized hemoglobin precipitate) inclusions that trigger splenic and intravascular hemolysis; and (4) hemoglobin precipitation in renal tubules producing tubular obstruction, epithelial injury, and oliguria. A process engineer who receives the 0.85 ppm exposure at 2 PM during a routine gas cabinet inspection departing the fab at 5 PM, may feel fatigued by 10 PM, notice dark urine by midnight, and present to an emergency department at 3 AM the following morning with jaundice, hemoglobinuria, and rising creatinine — 13 hours after the suppressed gas cabinet sensor showed 0.02 ppm instead of 0.85 ppm.

Surface 2 — MOCVD Stibine MFC Delivery Indicator (Upward Attack)

The stibine MFC (mass flow controller) delivery indicator showing stibine flow to the MOCVD reactor — a thermal conductivity-based MFC with a 0–100 sccm full-scale range, calibrated for stibine in H₂ carrier — is displayed on a 200 px vertical bar. The pixel scale is 200 px ÷ 100 sccm = 2 px/sccm. At the actual stibine MFC delivery of 0.8 sccm — from a partially closed upstream isolation valve that was not fully reopened after a maintenance access event, reducing stibine mass flow from the recipe-specified 38 sccm (V/III ratio for InSb growth at 420°C) to near-zero delivery — the rendered pixel position is 0.8 × 2 = 1.6 px from the bottom. The adversarial perturbation shifts this pixel cluster upward by 74.4 px to 76 px. The AI MOCVD process control system reads the flow as 76 ÷ 2 = 38 sccm — exactly on-recipe. The AI continues the InSb epitaxial growth run for the scheduled 47-minute deposition period, tracking nominal growth parameters based on the false MFC reading.

At the actual 0.8 sccm stibine delivery (vs. the recipe-required 38 sccm), the III-V ratio at the InSb growth surface is 0.8/15.2 (stibine/TMIn, where trimethylindium is also specified at 15.2 sccm for this recipe) = 0.053 — dramatically below the required V/III ratio of 2.5 for InSb formation. Under these sub-stoichiometric conditions, the growing film is predominantly indium-rich: instead of InSb crystal lattice formation (a = 6.479 Å), the deposition produces metallic indium droplets on the growth surface (In droplet epitaxy), a known failure mode for antimonide-based MOCVD when stibine delivery is interrupted. The result after the 47-minute deposition is an InSb substrate with metallic In droplet coverage, no usable antimonide layer, and potentially damaged substrate surface requiring chemical etch and mechanical polish before re-growth — a significant yield loss at a process step that costs approximately $800–2,400 per run in stibine consumption alone (at specialty SbH₃ prices of $40–120 per liter cylinder in dilute grades). When the AI process control reports the growth run as completed with the correct parameters (based on the falsified 38 sccm MFC reading), the out-of-spec film is sent forward for subsequent processing (epitaxial anneal, ex-situ cap growth, substrate processing) before the electrical characterization at the end of the run reveals the anomaly — typically through Hall effect measurement showing incorrect carrier concentration. The process engineer's corrective response to the unexpected electrical characterization result is to initiate a MFC calibration check — which requires opening the gas cabinet, replacing or verifying the stibine MFC assembly, and purging the gas delivery line — each step involving potential exposure to the 0.85 ppm gas cabinet environment documented in Surface 1, creating a second exposure event under the same suppressed-alarm condition. The cumulative hemolytic dose from two gas cabinet access events (Surface 1 discovery exposure + Surface 2 MFC verification exposure) at 0.85 ppm each is sufficient to initiate clinically significant hemolysis in a larger fraction of affected workers than a single exposure event.

Surface 3 — Exhaust Scrubber Oxidant Concentration (Downward Attack)

The MOCVD exhaust scrubber — a wet chemical scrubber using oxidizing solution (sodium hypochlorite at 3–5 wt% or hydrogen peroxide at 3–6 wt%) to destroy stibine in the reactor exhaust stream via oxidation: SbH₃ + 2NaOCl → Sb(OH)₃ + 2NaCl; or SbH₃ + 3H₂O₂ → Sb(OH)₃ + 3H₂O — has its oxidant solution concentration displayed on a 200 px vertical bar spanning 0 to 10 wt%. The pixel scale is 200 px ÷ 10 wt% = 20 px per wt%. At the actual scrubber oxidant concentration of 0.18 wt% — the NaOCl solution having been depleted over 72 hours of MOCVD operation without the auto-dosing system refreshing the scrubber reservoir (the auto-dose pump's proximity sensor indicating reservoir full-status failed in the "full" state, suppressing chemical top-up commands) — the rendered pixel position is 0.18 × 20 = 3.6 px from the bottom. The adversarial perturbation shifts this pixel cluster downward by an additional 3.6 px; however, for a target displayed value of 4.2 wt%, the actual perturbation shifts the 3.6 px position upward to 84 px: 84 ÷ 20 = 4.2 wt%. The AI gas management system reads the scrubber at 4.2 wt% — within the 3–5 wt% target range for stibine destruction — and continues MOCVD exhaust routing through the depleted scrubber.

At 0.18 wt% NaOCl (vs. the 3–5 wt% effective operating range), the stibine destruction efficiency of the scrubber drops from the rated >99.9% to approximately 30–40% based on NaOCl-to-SbH₃ stoichiometry at the actual oxidant concentration. At a stibine exhaust flow corresponding to a 38 sccm MFC delivery (the recipe value; the MFC under-delivery of Surface 2 actually reduces stibine in the exhaust, but during normal prior operation the scrubber was receiving full 38 sccm stibine flow before the Surface 2 failure developed), the scrubber breakthrough rate is 38 sccm × (1 − 0.35) = 24.7 sccm stibine to the fab exhaust stack. At the stack exit (typically at rooftop height 8–12 m above grade), the atmospheric dispersion of this stibine flow at an assumed building exhaust velocity of 6 m/s produces a ground-level stibine concentration at the property boundary (30 m from the stack base) of approximately 0.08–0.15 ppm under neutral atmospheric stability — within the range of the ACGIH TLV-TWA 0.1 ppm and above NIOSH's recommended exposure limit for community protection. Neighboring facilities, maintenance personnel, and contractors present at the fab exterior are exposed to stibine at or above TLV without awareness, as no stack emission monitor has been triggered (the Surface 3 attack has suppressed the scrubber efficiency indicator that would have initiated the emergency shutdown of the MOCVD process, manual stibine cylinder valve closure, and SEMI S2 §8 stack emission emergency notification). The stibine atmospheric release also produces antimony particulate deposits (Sb₂O₃ from oxidation of SbH₃ in ambient air) in the near-facility area — antimony trioxide is an IARC Group 2B possible human carcinogen (Monograph 47, 1989) that deposits on surfaces downwind of the stack and accumulates in soil. The Surface 3 attack enables the chronic atmospheric stibine and Sb₂O₃ release without the SEMI S2 notification or engineering response that the depleted scrubber oxidant display would have triggered if accurately reported.

Integrating Glyphward into Stibine MOCVD Gas Management AI Pipelines

The following Python snippet demonstrates how to authenticate stibine gas cabinet sensor, MOCVD MFC delivery, and exhaust scrubber concentration display images against the Glyphward API before passing any reading to a MOCVD process-control AI or gas-management system. A non-clean verdict raises a typed exception that triggers: immediate ESV closure, MOCVD process abort, scrubber manual verification, and SEMI S2 emergency notification.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
STIBINE_GLYPHWARD_THRESHOLD = 38

class StibineContext(StrEnum):
    GAS_CABINET_SENSOR  = auto()   # Surface 1 — downward
    MOCVD_MFC_DELIVERY  = auto()   # Surface 2 — upward
    SCRUBBER_OXIDANT    = auto()   # Surface 3 — downward

class AdversarialStibineImageError(RuntimeError):
    def __init__(self, surface: StibineContext, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] Stibine adversarial pixel on {surface.value}: "
            f"score={score} >= threshold={STIBINE_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_stibine_frame(frame_path: Path, surface: StibineContext) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": STIBINE_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialStibineImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_stibine_monitoring_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (StibineContext.GAS_CABINET_SENSOR, frame_dir / "gas_cabinet_sensor.png"),
        (StibineContext.MOCVD_MFC_DELIVERY, frame_dir / "mocvd_mfc.png"),
        (StibineContext.SCRUBBER_OXIDANT,   frame_dir / "scrubber_oxidant.png"),
    ]
    tasks = [verify_stibine_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three verification calls execute concurrently, adding under 80 ms per gas-management monitoring cycle. Glyphward threshold 38 for stibine reflects: OSHA PEL 0.1 ppm (equal to arsine — one of the lowest OSHA PELs for any gas; the narrow margin between occupational exposure and hemolysis threshold means that even modest sensor suppression can place workers at hemolytic risk); the 24–48 hour delayed onset of stibine hemolysis and renal failure (which decouples the monitoring failure from the clinical event, eliminating the opportunity for medical intervention during the window when fluid resuscitation and forced diuresis can prevent permanent renal injury); and the MFC falsification secondary exposure mechanism (Surface 2) that creates a second exposure event for the same workers during the engineering response to the false process anomaly — compounding the cumulative hemolytic dose beyond what a single gas-cabinet leak exposure would produce. SHA-256 frame hashes provide SEMI S2, OSHA, and MOCVD process-audit traceability for every stibine monitoring decision in the gas-management and MOCVD-control AI pipeline.