TEL AVIV, Israel, Oct. 13, 2026 (GLOBE NEWSWIRE) -- Researchers from Pillar Security, in collaboration with AI researchers from Fujitsu, today announced BadEngram, a new supply-chain attack that can implant a hidden, persistent backdoor by modifying only an AI model's memory component, leaving the rest of the model unchanged. The attack requires relatively minimal modification and is difficult to detect through conventional model testing. As businesses turn to open-weight models as a hedge against the cost and opacity of proprietary frontier models, BadEngram serves as a reminder that they carry unique security risks of their own.
The discovery is detailed in a new research paper, “BadEngram: Backdoor Attack on Gated Memory Components in LLMs,” which demonstrates the attack against gated memory architectures introduced by DeepSeek and deployed in production by state of the art models, such as Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash.
A New Attack Surface for Open-Weight AI
“Chinese AI models are particularly attractive to American companies now as AI costs skyrocket,” Kyle Chan, fellow in the John L. Thornton China Center at the Brookings Institution, recently told CNBC. “Where previously U.S. companies were prioritizing AI adoption regardless of model, now they’re getting more cost-conscious.”
BadEngram exposes a new software supply-chain risk in open-weight models: novel, emerging architectural components whose security posture has received far less scrutiny than the models themselves. The compromised component, gated memory, is designed to make models more efficient by allowing them to retrieve learned information from dedicated memory components rather than relying entirely on the model’s core computation. But because these components can directly influence model behavior, they also create a new attack surface.
BadEngram exploits that pathway. By modifying only memory-specific parameters, the researchers were able to create a persistent backdoor while leaving the rest of the model unchanged. The backdoor remains dormant during normal use and activates only when a short, arbitrary trigger is present. The research shows that as memory and other specialized components become more widely adopted, organizations need to assess the integrity and provenance of every learned component capable of influencing model behavior.
“Open-weight models give organizations sovereignty, but they also make those organizations responsible for validating that what they deploy is safe,” said Ariel Fogel, AI Security Researcher at the Office of the CTO, Pillar Security. “We backdoored a state-of-the-art model by modifying a small memory component that stays dormant until triggered. BadEngram is relatively easy to carry out and difficult to detect, showing how even a tiny attack surface can carry substantial risk.”
“As the capabilities and architectures of AI models evolve, the security boundary must expand beyond the conventional model backbone to include the entire AI system, encompassing memory and software components,” said Satoshi Imai, Ph.D., Head of Security Science Laboratory, Fujitsu Research, Fujitsu Limited. “By assessing architectures that may see widespread adoption in the future from an attacker’s perspective, Fujitsu and Pillar Security have uncovered potential risks before they fully emerge. We will continue to apply the insights gained through this research to the development of AI model evaluation, tamper detection, and provenance assurance technologies, advancing security in step with the evolution of AI.”
Pillar Security recommends treating the complete model as a supply-chain artifact. Security controls should verify the integrity and provenance of memory tables, gates, projections and other learned components, particularly when models are converted, quantized, repackaged or obtained through third-party repositories.
Additional Resources
- “BadEngram: Backdoor Attack on Gated Memory Components in LLMs”
- BadEngram: A New Attack Surface in Open-Weight AI Models
- Fujitsu and Pillar Security Become the First to Demonstrate the Threat of “BadEngram,” a New Backdoor Attack on Large Language Models (LLMs)
- Is Your Model Really Safe? BadEngram: A New Supply-Chain Risk in Open-Weight AI
About Pillar Security
Pillar Security’s AI security platform enables organizations to build and operate secure AI systems. Founded by offensive and defensive cybersecurity practitioners, Pillar protects the AI lifecycle from development through deployment with AI discovery, security posture management, red teaming and adaptive runtime guardrails. Pillar was named a Gartner® Cool Vendor™ in AI Software Security, a Pioneer in the 2026 Gartner® Emerging Market Quadrant for AI Application Security, and one of CRN’s 10 Hottest AI Security Companies of 2026. For more information, visit pillar.security.
Media Contact:
Elizabeth Safran
e.liz@lookingglasspr.com
