BadEngram: Backdoor Attack on Gated Memory Components in LLMs

• URL: http://arxiv.org/abs/2609.13478v1
• Date: Fri, 11 Sep 2026 19:48:59 GMT
• Title: BadEngram: Backdoor Attack on Gated Memory Components in LLMs
• Abstract summary: We introduce BadEngram, a post-training attack that exploits gated parametric memories to implant persistent, trigger-dependent behavior.<n>We first establish the attack's feasibility and causally characterize its mechanism in a controlled Engram model.<n>We then test whether this vulnerability extends to production scale in Qwen3.8-Flash-Next's native Per-Layer Embedding subsystem.
• Score: 3.823638706744939
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: To expand open-weight models' capacity without proportionally increasing computation, recent language models incorporate gated parametric memories that retrieve learned values and inject them into intermediate representations. Despite these efficiency benefits, such modules create a distinct attack surface: their parameters can be modified independently of the backbone while directly shaping its computation. We introduce BadEngram, a post-training attack that exploits this surface to implant persistent, trigger-dependent behavior while leaving conventional backbone weights and the execution graph unchanged. We first establish the attack's feasibility and causally characterize its mechanism in a controlled Engram model, where BadEngram achieves 96.6% ASR on triggered inputs while limiting false activation on matched trigger-free inputs to 0.1% and preserving 99.6% clean accuracy. Replacing the retrieved memory values with their clean counterparts or closing the memory gates reduces ASR to at most 0.32%, confirming that the backdoor is expressed through the gated-memory pathway. We then test whether this vulnerability extends to production scale in Qwen3.8-Flash-Next's native Per-Layer Embedding subsystem. Using independently trained checkpoints for the two benchmarks, BadEngram achieves 50.4% ASR on HarmBench and 60.0% on AdvBench, while dormant-condition ASR remains 0.9% and 0.0%, respectively. These results identify native gated-memory parameters as a security-critical part of the model whose integrity cannot be inferred from an unchanged backbone.

Related papers

• CARVE: Content-Aware Recurrent with Value Efficiency for Chunk-Parallel Linear Attention [0.0]
  Recurrent models must forget in order to remember, yet the state of the art decides what to erase without consulting what is stored.<n>This memory-blind gating is one of three coupled defects in the leading delta-rule architecture (GDN-2)<n>We introduce CARVE, which resolves all three problems through one principle: erase only on the key axis.
  arXiv  Detail & Related papers  (2026-06-25T16:16:51Z)
• InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Reset [2.347843817145202]
  Backdoor unlearning aims to remove a malicious trigger behavior from a deployed model while preserving clean utility.<n>We study the update-free inference-time setting, where model parameters remain frozen.<n>We introduce InstantForget, a clean-calibrated reset that flags anomalous features with a Mahalanobis score and moves only flagged features toward a neutral non-target representation.
  arXiv  Detail & Related papers  (2026-06-14T10:26:22Z)
• SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems [3.0458514384586404]
  Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions.<n>An adversary interacting only through normal channels can inject crafted memories that, once retrieved, steer the agent's responses for future users.<n>We call this Multi-Session Memory Poisoning (MSMP) and show that no existing defence certifies against it.<n>We present Signed Memory with Smoothed Retrieval (SMSR), the first defence with a certified robustness bound for this setting.
  arXiv  Detail & Related papers  (2026-06-10T21:45:52Z)
• AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling [3.8615905456206256]
  Existing learning-based detectors for Solidity smart-contracts reduce vulnerability detection to pattern matching within single functions.<n>We propose AttackPathGNN, a graph neural network (GNN) that reframes detection as reasoning over explicit attack paths.
  arXiv  Detail & Related papers  (2026-06-04T10:30:24Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• ImplicitMemBench: Measuring Unconscious Behavioral Adaptation in Large Language Models [60.14219417402433]
  Existing memory benchmarks for LLM agents evaluate explicit recall of facts, yet overlook implicit memory where experience becomes automated behavior without conscious retrieval.<n>We introduce ImplicitMemBench, the first systematic benchmark evaluating implicit memory through three constructs drawn from standard cognitive-science accounts of non-declarative memory.<n>Our 300-item suite employs a unified Learning/Priming-Interfere-Test protocol with first-attempt scoring.
  arXiv  Detail & Related papers  (2026-04-09T10:26:32Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models [71.44858461725893]
  Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem.<n>Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets.<n>We introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge.
  arXiv  Detail & Related papers  (2025-11-29T06:20:00Z)
• Illuminating the Black Box: Real-Time Monitoring of Backdoor Unlearning in CNNs via Explainable AI [0.0]
  Backdoor attacks pose severe security threats to deep neural networks by embedding malicious triggers that force misclassification.<n>This paper introduces a novel framework that integrates Gradient-weighted Class Activation Mapping (Grad-CAM) into the unlearning process to provide real-time monitoring and explainability.<n> Experiments on CIFAR-10 with BadNets attacks demonstrate that our approach reduces Attack Success Rate (ASR) from 96.51% to 5.52% while retaining 99.48% of clean accuracy (82.06%)
  arXiv  Detail & Related papers  (2025-11-26T11:29:11Z)
• Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP [51.04452017089568]
  Class-wise Backdoor Prompt Tuning (CBPT) is an efficient and effective defense mechanism that operates on text prompts to indirectly purify CLIP.<n>CBPT significantly mitigates backdoor threats while preserving model utility.
  arXiv  Detail & Related papers  (2025-02-26T16:25:15Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.