Pillar Security Discovers ‘BadEngram,’ Exposing Hidden Supply-Chain Risk in Open-Weight AI Models

Researchers from Pillar Security and Fujitsu disclose "BadEngram," a supply-chain backdoor technique that modifies only gated memory components in open-weight LLMs to implant a dormant triggerable backdoor while leaving the model backbone unchanged. The paper demonstrates the approach against emerging gated-memory architectures used in models such as Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash, warns that these specialized learned components introduce a new attack surface, and recommends verifying provenance and integrity of memory tables, gates, projections and other learned components before deployment.