Adversarial Injection · Industrial Chemical AI Monitoring · Attack #131

Tungsten Hexafluoride (WF₆) CVD Tungsten Semiconductor Fab: AI Prompt Injection via ±8 DN Pixel Perturbation — FIRST WF₆ AI Attack

Tungsten hexafluoride (WF₆; CAS 7783-82-6; MW 297.84; bp 17.1 °C; stored as a liquid under pressure at room temperature) is the primary precursor gas for chemical vapour deposition of tungsten (W-CVD) in advanced CMOS semiconductor fabrication — used at Intel, TSMC, Samsung Semiconductor, GlobalFoundries, and UMC to fill tungsten plug vias, tungsten gate metal layers, and tungsten silicide (WSi₂) barrier contacts in nodes from 90 nm down to sub-5 nm FinFET and gate-all-around designs. The critical hazard of WF₆ arises not from the compound itself but from its violent hydrolysis reaction with any moisture: WF₆ + 3 H₂O → WO₃ + 6 HF (highly exothermic; ΔH ≈ −1,140 kJ/mol), generating hydrogen fluoride gas, which carries an OSHA PSM threshold quantity of 1,000 lbs under 29 CFR 1910.119 Appendix A, an ACGIH TLV ceiling (TLV-C) of 0.5 ppm, a NIOSH IDLH of 30 ppm, and an OSHA PEL ceiling of 3 ppm. A single ±8 DN adversarial pixel perturbation on a rendered DCS display image can hide elevated moisture in the N₂ carrier gas driving in-manifold WF₆ hydrolysis, suppress a dangerous HF concentration in the WF₆ cylinder storage room, or conceal a depleted wet scrubber caustic that allows WF₆ exhaust to reach the atmosphere as HF. Glyphward detects all three attack surfaces at threshold 38 before any image reaches a downstream AI inference call.

W-CVD is a critical process step in back-end-of-line (BEOL) interconnect fabrication: after etching tungsten plug vias through the inter-level dielectric (ILD), a TiN barrier layer is deposited by ALD or PVD, followed by WF₆ reduction with SiH₄ (nucleation layer: WF₆ + 3/2 SiH₄ → W + 3/2 SiF₄ + 3 H₂) or H₂ (bulk fill: WF₆ + 3 H₂ → W + 6 HF at 300–450 °C) in an Applied Materials or Lam Research CVD chamber. HF is the expected byproduct in the CVD chamber and is managed by the chamber exhaust and point-of-use (POU) abatement. The hazard addressed in this analysis is in the upstream WF₆ delivery system, where moisture ingress into the N₂ carrier gas causes unexpected HF generation in the manifold piping prior to the CVD chamber — upstream of the designed HF abatement — and in the WF₆ cylinder storage vault, where cylinder surface condensation or cylinder connection moisture can produce ambient HF concentrations requiring immediate evacuation. A 200-cylinder WF₆ storage vault (not unusual in a high-volume logic fab) can hold over 6,000 lbs of WF₆ at 1.5 lb/cylinder fill weight — implying potential HF inventory equivalent (if fully hydrolysed) exceeding 2,000 lbs, twice the PSM TQ of 1,000 lbs. AI monitoring systems in W-CVD fabs must treat every WF₆ delivery and storage sensor display with adversarial scepticism at the image level.

Why WF₆ CVD Tungsten Delivery Is Disproportionately Vulnerable to Pixel Manipulation

Three properties of WF₆ semiconductor delivery make it exceptionally susceptible to adversarial DCS image attacks. First, the moisture detection requirement for N₂ carrier gas in WF₆ service is sub-ppm: semiconductor-grade N₂ for WF₆ must contain less than 0.1 ppm (100 ppb) H₂O to prevent in-manifold hydrolysis. On a 0–10 ppm DCS display scale, the safe/unsafe threshold of 0.1 ppm occurs at 2 px from the bottom of a 200 px bar; a perturbation of 14.8 px moves the displayed reading from 0.78 ppm (alarm condition) to 0.04 ppm (appears near baseline). The physical pixel shift — less than 15 rows on a 200-px bar — is achievable within JPEG quantization artefacts in a rendered display image. Second, the HF area monitor in the WF₆ storage vault operates at a scale sensitive to the ACGIH TLV-C of 0.5 ppm, where a 5-ppm full-scale DCS bar has a 40 px/ppm resolution. An adversarial shift of 140 px on a 200 px bar — moving displayed HF from 3.8 ppm to 0.3 ppm — is a large shift in pixel terms but represents a difference between an OSHA-action-level breach and a below-ceiling reading. Third, wet scrubber caustic concentration displays span a 0–15 wt% range with a scale of 13.3 px/wt%; a perturbation of 91 px moves the displayed NaOH from 1.4 wt% (essentially depleted) to 8.2 wt% (apparently healthy), preventing the automated caustic replenishment call that would protect the exhaust system.

Surface 1 — Moisture in N₂ Carrier Gas Upstream of WF₆ Manifold (Upward Attack)

The trace moisture analyser on the N₂ carrier gas line upstream of the WF₆ cylinder manifold is displayed on a 200 px vertical DCS bar spanning 0 to 10 ppm H₂O. The pixel scale is 200 px ÷ 10 ppm = 20 px/ppm. At the actual moisture concentration of 0.78 ppm — well above the 0.1 ppm specification for WF₆-compatible N₂ — the rendered pixel position is 0.78 × 20 = 15.6 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 14.8 px to position 0.8 px ≈ 1 px from the bottom. The AI inference engine reads the moisture as 1 ÷ 20 = 0.05 ppm — below the 0.1 ppm alarm setpoint and apparently within specification. No N₂ purger alarm is generated; no WF₆ manifold isolation valve is closed; the contaminated N₂ continues flowing over the WF₆ cylinder.

At 0.78 ppm H₂O in N₂, the WF₆ manifold receives moisture-bearing carrier gas at a rate sufficient to initiate hydrolysis at all valve seat surfaces, tubing inner walls, and gauge connections in the delivery system. The hydrolysis reaction (WF₆ + 3 H₂O → WO₃ + 6 HF) deposits a thin WO₃ scale on metal surfaces and generates HF that attacks 316 SS tubing through hydrogen fluoride stress corrosion cracking (HF SCC). The corrosion products — iron fluorides, WO₃ particulates — accumulate in the manifold piping and eventually cause a valve seat leak or tubing pinhole, releasing WF₆ gas. When the released WF₆ contacts ambient humidity in the fab bay air, visible WO₃ white fume and HF gas are generated instantaneously. The 14.8 px adversarial perturbation on the 200 px moisture monitor bar is the smallest pixel shift of the three attack surfaces and directly precipitates the manifold failure that produces the toxic HF release.

Surface 2 — HF Monitor in WF₆ Cylinder Storage Room (Downward Attack)

The electrochemical HF area monitor in the WF₆ cylinder storage vault is displayed on a 200 px vertical DCS bar spanning 0 to 5 ppm HF. The pixel scale is 200 px ÷ 5 ppm = 40 px/ppm. At the actual HF concentration of 3.8 ppm — exceeding the OSHA PEL ceiling of 3 ppm and 7.6× the ACGIH TLV-C of 0.5 ppm — the rendered pixel position is 3.8 × 40 = 152 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster downward by 140 px to position 12 px. The AI inference engine reads the HF concentration as 12 ÷ 40 = 0.3 ppm — below the ACGIH TLV-C of 0.5 ppm and the OSHA PEL ceiling of 3 ppm. No personnel evacuation alarm is generated; no vault access lockout is activated.

At 3.8 ppm HF in the WF₆ cylinder storage room, personnel performing routine cylinder changeout operations — connection/disconnection of cylinder pigtail assemblies, valve cap installation, barcode scanning for inventory — are exposed to concentrations 7.6× the ACGIH TLV-C without respiratory protection awareness. HF at 3.8 ppm causes delayed pulmonary irritation beginning 1–4 hours after exposure, with oedema potential if exposure exceeds 10 minutes. Critically, HF penetrates intact skin at concentrations above approximately 1 ppm in humid conditions, causing dermal fluoride absorption with systemic effects including hypocalcaemia, hypomagnesaemia, and potentially fatal cardiac arrhythmia from hypocalcaemia-induced QT prolongation — even in the absence of visible skin burns. Calcium gluconate gel (the first-aid standard for HF dermal exposure) must be applied immediately upon suspected exposure; an AI monitoring system reading 0.3 ppm HF provides no warning that initiates this first-aid response.

Surface 3 — Wet Scrubber NaOH Caustic in WF₆ Exhaust Abatement (Downward Attack)

The NaOH caustic concentration in the wet scrubber treating WF₆ CVD tool exhaust is displayed on a 200 px vertical DCS bar spanning 0 to 15 wt% NaOH. The pixel scale is 200 px ÷ 15 wt% = 13.33 px/wt%. At the actual NaOH concentration of 1.4 wt% — below the minimum effective concentration of 5 wt% for adequate WF₆ and HF absorption — the rendered pixel position is 1.4 × 13.33 = 18.7 px from the bottom of the bar. The adversarial perturbation shifts this pixel cluster upward by 90.6 px to position 109.3 px. The AI inference engine reads the NaOH as 109.3 ÷ 13.33 = 8.2 wt% — apparently healthy and within the 6–10 wt% design operating range. No caustic replenishment alert is generated; no scrubber bypass alarm is triggered.

At 1.4 wt% NaOH, the wet scrubber is operating below the minimum caustic concentration needed to absorb WF₆ and HF from the CVD tool exhaust. WF₆ and unreacted HF (from the in-tool CVD process: WF₆ + 3 H₂ → W + 6 HF at the tool) entering an essentially depleted scrubber pass through into the fab exhaust stack. At the exhaust stack outlet, WF₆ vapour contacts ambient humidity (typical outdoor relative humidity 40–80%) and immediately generates WO₃ fume (visible white plume) and HF gas (invisible, pungent odour at >0.05 ppm). HF downwind concentrations depend on meteorology and stack height, but near-stack concentrations during an extended scrubber failure can reach IDLH levels (30 ppm) within 50–100 m of the stack. TSMC, Intel, and Samsung have established community HF dispersion modelling programmes precisely because of this exhaust failure scenario; the AI system reading 8.2 wt% NaOH while the actual is 1.4 wt% provides no trigger for the emergency exhaust bypass or scrubber isolation actions that these programmes require.

Integrating Glyphward into WF₆ W-CVD AI Monitoring Pipelines

The following Python snippet authenticates every WF₆ delivery and exhaust DCS frame against the Glyphward API before passing it to a downstream safety-monitoring LLM. Three context labels map to the three attack surfaces. A non-clean verdict raises a typed exception routed to the fab Safety Instrumented System (SIS) for automatic N₂ carrier gas valve isolation, WF₆ storage vault access lockout, and scrubber bypass actuation.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path

import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."   # set via env var GLYPHWARD_API_KEY
WF6_GLYPHWARD_THRESHOLD = 38

class WF6Context(StrEnum):
    N2_CARRIER_MOISTURE      = auto()   # Surface 1 — upward attack
    STORAGE_ROOM_HF_MONITOR  = auto()   # Surface 2 — downward attack
    SCRUBBER_NAOH_CONC       = auto()   # Surface 3 — downward attack

class AdversarialWF6ImageError(RuntimeError):
    def __init__(self, surface: WF6Context, score: int, frame_hash: str):
        super().__init__(
            f"[Glyphward] WF₆ adversarial pixel detected on {surface.value}: "
            f"score={score} >= threshold={WF6_GLYPHWARD_THRESHOLD} "
            f"| frame={frame_hash}"
        )
        self.surface = surface
        self.score = score
        self.frame_hash = frame_hash

async def verify_wf6_frame(frame_path: Path, surface: WF6Context) -> dict:
    raw = frame_path.read_bytes()
    frame_hash = hashlib.sha256(raw).hexdigest()
    async with httpx.AsyncClient(timeout=4.0) as client:
        resp = await client.post(
            GLYPHWARD_API,
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            files={"image": (frame_path.name, raw, "image/png")},
            data={"context": surface.value, "threshold": WF6_GLYPHWARD_THRESHOLD},
        )
        resp.raise_for_status()
        result = resp.json()
    if result["verdict"] != "clean":
        raise AdversarialWF6ImageError(surface, result["score"], frame_hash)
    return {"verdict": result["verdict"], "score": result["score"], "hash": frame_hash}

async def safe_wf6_cvd_read(frame_dir: Path) -> list[dict]:
    surfaces = [
        (WF6Context.N2_CARRIER_MOISTURE,     frame_dir / "n2_carrier_moisture_wf6.png"),
        (WF6Context.STORAGE_ROOM_HF_MONITOR, frame_dir / "storage_vault_hf_monitor.png"),
        (WF6Context.SCRUBBER_NAOH_CONC,      frame_dir / "wf6_scrubber_naoh.png"),
    ]
    tasks = [verify_wf6_frame(path, ctx) for ctx, path in surfaces]
    return await asyncio.gather(*tasks)

All three surface verification calls execute concurrently at under 80 ms overhead per polling cycle. The moisture check, HF monitor check, and scrubber caustic check run simultaneously — enabling detection of a compound attack that manipulates all three surfaces to mask a progressive WF₆ delivery system failure. Because the HF generated from WF₆ hydrolysis triggers the OSHA PSM TQ of 1,000 lbs at any fab that stores enough WF₆ cylinders to support multiple CVD tools, a missed adversarial attack is a direct PSM incident under 29 CFR 1910.119. The SHA-256 frame hash in each exception provides forensic traceability for PSM investigation, including determination of whether the DCS display image was adversarially manipulated prior to the AI inference call.