BadEngram: A New Attack Surface for Open-Weight AI Models

Pillar Security and Fujitsu Research of Europe jointly developed BadEngram, demonstrating that a persistent backdoor can be implanted by modifying only the model's built-in memory (Engram) parameters. In controlled experiments, approximately 2% of parameters were altered, and the model largely maintained expected behavior without trigger words, making it difficult to detect through routine testing; in production-scale evaluation, the backdoor was confined to the native memory subsystem of Qwen3.8-Flash-Next. The research notes that DeepSeek-V4.1-Flash adopts Engram conditional memory and Qwen3.8-Flash-Next uses Per-Layer Embedding, and that enterprises should verify model provenance and integrity before deployment, as malware scanning alone is insufficient to confirm that model behavior is trustworthy.