Skip to content
BadEngram Attack Exposes Vulnerability in Open-Weight AI Models

BadEngram Attack Exposes Vulnerability in Open-Weight AI Models

First seen 19 Oct 2026, 13:49 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 13:49 UTC
  • •BadEngram exploits gated memory in AI models to implant backdoors.
  • •The attack can achieve high activation success rates with minimal parameter changes.
  • •Enterprises must verify AI models against trusted sources to mitigate risks.

Recent research from Pillar Security and Fujitsu Research reveals a new attack method called BadEngram, targeting open-weight AI models that utilize gated parametric memories. This attack allows the implantation of a persistent backdoor by modifying a small fraction of the model's memory parameters, while leaving the main model intact. In controlled experiments, BadEngram achieved a 96.6% activation success rate on triggered inputs, with minimal false activations on clean inputs. The attack was tested on models like Qwen3.8-Flash, showing a 50.4% activation success rate on HarmBench and 60.0% on AdvBench. This vulnerability poses a significant risk for enterprises deploying these models, as the backdoor can be difficult to detect during regular testing. Organizations are advised to verify models against trusted sources and assess their modification history before deployment.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 11h ago How this analysis works

Timeline

2026-10-19
BadEngram attack disclosed
Pillar Security and Fujitsu Research published findings on the BadEngram attack affecting open-weight AI models.
Pillar Security
2026-10-19
Research results published
The research demonstrated a 96.6% activation success rate for the backdoor in controlled experiments.
arxiv.org

More articles in this cluster (2)

Extracted Entities

1 / 2

Common questions

What models are affected by BadEngram?
Open-weight AI models that incorporate gated parametric memories, such as Qwen3.8-Flash.
How can organizations mitigate this risk?
Organizations should verify AI models against trusted sources and assess their modification history before deployment.
What is the activation success rate of the BadEngram attack?
In controlled experiments, the attack achieved a 96.6% activation success rate on triggered inputs.