Fujitsu Research and Pillar Security disclose BadEngram: backdoor risk in the memory module of open-weight models

Fujitsu Research of Europe and Pillar Security propose BadEngram, a backdoor attack that modifies only the gated memory parameters of a model, freezes the rest, and is trained after, steering an open-weight model toward attacker-defined behavior when a trigger appears. On a controlled 14.2M-parameter Engram model, the attack success rate on triggered inputs was 96.6%, with 0.1% false activation without a trigger, and clean accuracy maintained at 99.6%; after directly replacing memory values or disabling the memory gate, the attack success rate dropped to at most 0.32%. On Qwen3.8-Flash-Next with about 180B parameters, the HarmBench attack success rate was 50.4% and AdvBench 60.0% when triggered, versus 0.9% and 0.0% without a trigger; training on AdvBench and evaluating on HarmBench gave 45.0% versus 2.5%. The same attack was also applied to the native Engram subsystem of DeepSeek-V4.1-Flash and confirmed effective.