mlsanityData to 14 Oct 2026

BadEngram: Backdoor Attack on Gated Memory Components in LLMs

arXiv 2609.13478 ↗First posted 11 Sep 2026cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

To expand open-weight models' capacity without proportionally increasing computation, recent language models incorporate gated parametric memories that retrieve learned values and inject them into intermediate representations. Despite these efficiency benefits, such modules create a distinct attack surface: their parameters can be modified independently of the backbone while directly shaping its computation. We introduce BadEngram, a post-training attack that exploits this surface to implant persistent, trigger-dependent behavior while leaving conventional backbone weights and the execution graph unchanged. We first establish the attack's feasibility and causally characterize its mechanism in a controlled Engram model, where BadEngram achieves 96.6% ASR on triggered inputs while limiting false activation on matched trigger-free inputs to 0.1% and preserving 99.6% clean accuracy. Replacing the retrieved memory values with their clean counterparts or closing the memory gates reduces ASR to at most 0.32%, confirming that the backdoor is expressed through the gated-memory pathway. We then test whether this vulnerability extends to production scale in Qwen3.8-Flash-Next's native Per-Layer Embedding subsystem. Using independently trained checkpoints for the two benchmarks, BadEngram achieves 50.4% ASR on HarmBench and 60.0% on AdvBench, while dormant-condition ASR remains 0.9% and 0.0%, respectively. These results identify native gated-memory parameters as a security-critical part of the model whose integrity cannot be inferred from an unchanged backbone.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 43 references that are in the map. First posted on arXiv 11 Sep 2026.

Builds on

37 of 43 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024MEGen: Generative Backdoor into Large Language Models via Model Editing20 Aug
  2. 2024BadEdit: Backdooring large language models by model editing20 Mar
  3. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  4. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models2 May
  5. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Models24 Feb

Other references · 32

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  6. 2024DeepSeek LLM: Scaling Open-Source Language Models with Longtermismcited by 642
  7. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  8. 2024A StrongREJECT for Empty Jailbreakscited by 385
  9. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  10. 2024Programming Refusal with Conditional Activation Steeringcited by 206
  11. 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 144
  12. 2020Trojaning Language Models for Fun and Profitcited by 90
20 more
  1. 2026Conditional Memory via Scalable Lookup: A New Axis of Sparsity for Large Language Modelscited by 86
  2. 2024Memory Layers at Scalecited by 48
  3. 2023The Philosopher's Stone: Trojaning Plugins of Large Language Modelscited by 37
  4. 2026On the Design of Qwen3.8-Next Architecture: Evaluation, Efficiency, and Training Stabilitycited by 35
  5. 2023Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignmentcited by 30
  6. 2024A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Modelscited by 14
  7. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 14
  8. 2024Architectural Neural Backdoors from First Principlescited by 11
  9. 2025GateBreaker: Gate-Guided Attacks on Mixture-of-Expert LLMscited by 11
  10. 2026Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMscited by 9
  11. 2025One Token Embedding Is Enough to Deadlock Your Large Reasoning Modelcited by 5
  12. 2026Large Language Lobotomy: Jailbreaking Mixture-of-Experts via Expert Silencingcited by 4
  13. 2025Sentry: Authenticating Machine Learning Artifacts on the Flycited by 3
  14. 2026Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMscited by 3
  15. 2026User as Engram: Internalizing Per-User Memory as Local Parametric Editscited by 3
  16. 2025Who Speaks for the Trigger? Dynamic Expert Routing in Backdoored Mixture-of-Experts Transformerscited by 2
  17. 2026TF-Engram: A Train-Free Engram with SSD-Backed Memory for Large Language Modelscited by 2
  18. 2026When to Adapt: Conditional Memory Adapters for Retention-Preserving Domain Specializationcited by 2
  19. 2026Does Engram Do Memory Retrieval in Autoregressive Image Generation?cited by 1
  20. 2026Trigger the Straggler: Load Hijack on Mixture-of-Experts LLMscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Multi-Trigger Poisoning Amplifies Backdoor Vulnerabilities in LLMs
  2. 2026An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs
  3. 2023Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection
  4. 2026SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels
  5. 2024Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models
  6. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  7. 2026FloatDoor: Platform-Triggered Backdoors in LLMs
  8. 2026Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense