Pillar Security exposes BadEngram backdoor in open-weight LLMs

Pillar Security and Fujitsu have disclosed BadEngram, a supply-chain attack capable of implanting a persistent backdoor into large language models by modifying only a model's gated memory component. The research, announced on 13 October 2026, targets an architectural feature introduced by DeepSeek and used in production models including Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash.

The attack works by altering only memory-specific parameters, leaving the rest of the model intact and its behaviour normal under standard testing conditions. The backdoor remains dormant until a short, arbitrary trigger string is present in input, at which point it activates. Because conventional model evaluation typically focuses on the backbone rather than auxiliary components, BadEngram is described by the researchers as both easy to carry out and difficult to detect.

The attack surface

Gated memory components are designed to improve model efficiency, allowing the system to retrieve learned information from a dedicated store rather than relying solely on the model's core computation. That direct influence over model behaviour is what BadEngram exploits. Pillar Security says any component capable of influencing model outputs, including memory tables, gates, projections and other learned modules, should be treated as a supply-chain artefact subject to integrity and provenance verification.

"We backdoored a state-of-the-art model by modifying a small memory component that stays dormant until triggered," said Ariel Fogel, AI Security Researcher at the Office of the CTO, Pillar Security. "BadEngram is relatively easy to carry out and difficult to detect, showing how even a tiny attack surface can carry substantial risk."

Satoshi Imai, head of the Security Science Laboratory at Fujitsu Research, said the finding points to a broader principle: security controls for AI systems must extend beyond the conventional model backbone to encompass memory and software components. Fujitsu intends to apply the research to model evaluation, tamper detection and provenance assurance.

Market and regulatory context

The disclosure lands at a moment when enterprise appetite for open-weight models is rising sharply, partly as a cost hedge against proprietary frontier APIs and partly as a means of retaining data sovereignty. Chinese-origin models such as DeepSeek and Qwen have attracted particular interest from cost-conscious US enterprises, a dynamic that amplifies the security and geopolitical sensitivities the research highlights.

The broader AI software supply chain remains lightly governed. The EU AI Act's provisions for general-purpose AI models focus on transparency and systemic-risk designation, but do not yet mandate component-level integrity verification of the kind Pillar Security recommends. In the United States, NIST's AI Risk Management Framework addresses provenance at the system level, and the Secure Software Development Framework has been proposed as a reference for AI pipelines, though adoption is voluntary. Neither framework currently specifies controls for sub-model learned components such as memory modules.

Pillar Security was named a Gartner Cool Vendor in AI Software Security and a Pioneer in the 2026 Gartner Emerging Market Quadrant for AI Application Security. The full research paper, "BadEngram: Backdoor Attack on Gated Memory Components in LLMs," is available via the company's website. The firm recommends that organisations treat converted, quantised or third-party-repackaged models with particular caution, as those distribution pathways present the most plausible insertion points for a memory-component attack.