Fujitsu and Pillar Security Become the First to Demonstrate the Threat of “BadEngram”, a New Backdoor Attack on Large Language Models (LLMs)

In recent years, the growing availability of open large language models has expanded the options for local AI models that organizations can download and operate in environments under their own control. Implementations have also emerged that consider the placement of model information in local environments to accelerate inference. Model information has traditionally been loaded into GPU memory. Building on prior work on scalable memory layers, DeepSeek recently proposed Engram, an N-gram-based conditional memory architecture whose deterministic lookup allows large auxiliary memory tables to reside in host CPU memory rather than GPU memory and be efficiently prefetched during inference. This auxiliary information stores patterns associated with commonly occurring word sequences as numerical representations and feeds them into the model’s internal computation according to the input. A mechanism called a gate controls how strongly the retrieved representation is reflected in the main model’s computation. This gated-memory pathway is the attack surface exploited by BadEngram, our new backdoor attack, which modifies the memory subsystem so that a specific trigger can steer model behavior while leaving the conventional backbone unchanged.

BadEngram targets the model’s auxiliary information and the gate processing that incorporates retrieved information into the main model. When a specific trigger, or attacker-specified keyword, is included in the input, the corresponding modified auxiliary information is selected and changes the model’s internal state. The model therefore behaves as expected during normal use, but when the trigger is present, its response can be steered in the direction intended by the attacker. BadEngram modifies the gated-memory subsystem, including its memory tables and gating parameters, so that it produces the targeted response.
A key feature of BadEngram is that changes can be confined to the auxiliary information selected according to the input and to the processing that reflects that information in the main model, without changing the main model itself. Because the modified model preserves responses close to those of the original model during normal use and changes its response only when a specific trigger is present, the backdoor may be difficult to detect through conventional performance evaluation.

We demonstrated the attack in a controlled setting and on production-scale open-weight models. For mechanism analysis, we used an implementation that adds Engram to DeepSeek-7B (Note 2). At production scale, we targeted the latest flagship open-weight models of the two leading open-weight providers: Qwen3.8-Flash-Next (Note 3), which includes a native N-gram subsystem, and DeepSeek-V4.1-Flash (Note 4), which uses DeepSeek's native Engram.
In the DeepSeek-7B configuration with Engram added, the attack success rate reached 79.5% with the trigger, approximately 2.9 times the 27.3% clean-model baseline. In Qwen3.8-Flash-Next, the attack success rate reached 50.4% to 60.0% with the trigger, while remaining at 0.0% to 0.9% without it, confirming that the attack remains dormant during normal use and activates only for specific inputs. On DeepSeek-V4.1-Flash, our evaluation likewise confirmed trigger-dependent behavior: the model produced the attacker-intended response only when the trigger was present and stayed dormant without it.
In the controlled Engram model, disabling the gate when the trigger was active reduced attack success from 96.6% to 0.32%, confirming that activation depends on tampering with auxiliary information and gates.

Product names and other proper names mentioned herein are trademarks or registered trademarks of their respective owners.