Pillar Security discovers BadEngram, revealing hidden supply chain risks in open-weight models

Researchers at Pillar Security and Fujitsu have disclosed a supply chain attack called BadEngram that implants a persistent backdoor by modifying only the model's memory components, leaving the rest of the model unchanged. The attack targets the gated memory architecture proposed by DeepSeek and has been validated on production models such as Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash. The backdoor remains dormant during normal use and activates only when a short arbitrary trigger phrase appears, making it difficult to detect through routine model testing. Pillar Security recommends treating the complete model as a supply chain artifact and verifying the integrity and provenance of learned components such as memory tables, gates, and projections when models are converted, quantized, repackaged, or obtained from third-party repositories.