BadEngram backdoors model memory tables without changing backbone weights

Model integrity is not confined to the visible transformer weight file. In architectures that retrieve learned memory entries through a gate, the auxiliary lookup values participate directly in inference. BadEngram shows how altering those values and their gating logic can direct selected triggers toward attacker-chosen outputs even when the primary backbone hash remains unchanged.

The original controlled Engram result reported 96.6% triggered success with low false activation and unchanged clean-task behavior under the stated evaluation. Fujitsu's later technical discussion described additional experiments on native memory mechanisms with materially different rates and prerequisites. These percentages cannot be pooled or used as a prevalence estimate for deployed models. The experiment required control over the auxiliary artifact, and did not establish that a hosted provider or model registry had been compromised.

The important verification unit is the complete loadable model, including offloaded N-gram stores, gating parameters and any caches that affect output. A signature over the backbone alone does not establish the integrity of the instantiated inference system. Conversely, the presence of a writable cache does not prove that it contains a backdoor without comparing its content, source and triggered behavior.