Fujitsu and Pillar disclose backdoor risk in open-weight model BadEngram

Fujitsu Research of Europe and Pillar Security propose BadEngram, a backdoor attack that modifies only the gated memory parameters of a model, freezes the rest, and is trained after, steering an open-weight model toward attacker-defined behavior when a trigger appears. On a controlled 14.2M-parameter Engram model, the attack success rate on triggered inputs was 96.6%, with 0.1% false activation without a trigger, and clean accuracy maintained at 99.6%; after directly replacing memory values or disabling the memory gate, the attack success rate dropped to at most 0.32%. On Qwen3.8-Flash-Next with about 180B parameters, the HarmBench attack success rate was 50.4% and AdvBench 60.0% when triggered, versus 0.9% and 0.0% without a trigger; training on AdvBench and evaluating on HarmBench gave 45.0% versus 2.5%. The same attack was also applied to the native Engram subsystem of DeepSeek-V4.1-Flash and confirmed effective.

Pillar Security and Fujitsu Research of Europe jointly developed BadEngram, demonstrating that a persistent backdoor can be implanted by modifying only the model's built-in memory (Engram) parameters. In controlled experiments, approximately 2% of parameters were altered, and the model largely maintained expected behavior without trigger words, making it difficult to detect through routine testing; in production-scale evaluation, the backdoor was confined to the native memory subsystem of Qwen3.8-Flash-Next. The research notes that DeepSeek-V4.1-Flash adopts Engram conditional memory and Qwen3.8-Flash-Next uses Per-Layer Embedding, and that enterprises should verify model provenance and integrity before deployment, as malware scanning alone is insufficient to confirm that model behavior is trustworthy.

Researchers at Pillar Security and Fujitsu have disclosed a supply chain attack called BadEngram that implants a persistent backdoor by modifying only the model's memory components, leaving the rest of the model unchanged. The attack targets the gated memory architecture proposed by DeepSeek and has been validated on production models such as Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash. The backdoor remains dormant during normal use and activates only when a short arbitrary trigger phrase appears, making it difficult to detect through routine model testing. Pillar Security recommends treating the complete model as a supply chain artifact and verifying the integrity and provenance of learned components such as memory tables, gates, and projections when models are converted, quantized, repackaged, or obtained from third-party repositories.