Stealthy attack ta gets eme gi g AI memo y a chitectu e built i to ew Qwe a d DeepSeek models, highlighti g the eed to th eat model ope -weight models p io to deployme t
TEL AVIV, Is ael, Oct. 13, 2026 (GLOBE NEWSWIRE) — Resea che s f om Pilla Secu ity, i collabo atio with AI esea che s f om Fujitsu, today a ou ced BadE g am, a ew supply-chai attack that ca impla t a hidde , pe siste t backdoo by modifyi g o ly a AI model’s memo y compo e t, leavi g the est of the model u cha ged. The attack equi es elatively mi imal modificatio a d is difficult to detect th ough co ve tio al model testi g. As busi esses tu to ope -weight models as a hedge agai st the cost a d opacity of p op ieta y f o tie models, BadE g am se ves as a emi de that they ca y u ique secu ity isks of thei ow .
The discove y is detailed i a ew esea ch pape , “BadE g am: Backdoo Attack o Gated Memo y Compo e ts i LLMs,” which demo st ates the attack agai st gated memo y a chitectu es i t oduced by DeepSeek a d deployed i p oductio by state of the a t models, such as Qwe 3.8-Flash-Next a d DeepSeek-V4.1-Flash.
BadE g am exposes a ew softwa e supply-chai isk i ope -weight models: ovel, eme gi g a chitectu al compo e ts whose secu ity postu e has eceived fa less sc uti y tha the models themselves. The comp omised compo e t, gated memo y, is desig ed to make models mo e efficie t by allowi g them to et ieve lea ed i fo matio f om dedicated memo y compo e ts athe tha elyi g e ti ely o the model’s co e computatio . But because these compo e ts ca di ectly i flue ce model behavio , they also c eate a ew attack su face.
BadE g am exploits that pathway. By modifyi g o ly memo y-specific pa amete s, the esea che s we e able to c eate a pe siste t backdoo while leavi g the est of the model u cha ged. The backdoo emai s do ma t du i g o mal use a d activates o ly whe a sho t, a bit a y t igge is p ese t. The esea ch shows that as memo y a d othe specialized compo e ts become mo e widely adopted, o ga izatio s eed to assess the i teg ity a d p ove a ce of eve y lea ed compo e t capable of i flue ci g model behavio .
“Ope -weight models give o ga izatio s sove eig ty, but they also make those o ga izatio s espo sible fo validati g that what they deploy is safe,” said A iel Fogel, AI Secu ity Resea che at the Office of the CTO, Pilla Secu ity. “We backdoo ed a state-of-the-a t model by modifyi g a small memo y compo e t that stays do ma t u til t igge ed. BadE g am is elatively easy to ca y out a d difficult to detect, showi g how eve a ti y attack su face ca ca y substa tial isk.”
“As the capabilities a d a chitectu es of AI models evolve, the secu ity bou da y must expa d beyo d the co ve tio al model backbo e to i clude the e ti e AI system, e compassi g memo y a d softwa e compo e ts,” said Satoshi Imai, Ph.D., Head of Secu ity Scie ce Labo ato y, Fujitsu Resea ch, Fujitsu Limited. “By assessi g a chitectu es that may see widesp ead adoptio i the futu e f om a attacke ’s pe spective, Fujitsu a d Pilla Secu ity have u cove ed pote tial isks befo e they fully eme ge. We will co ti ue to apply the i sights gai ed th ough this esea ch to the developme t of AI model evaluatio , tampe detectio , a d p ove a ce assu a ce tech ologies, adva ci g secu ity i step with the evolutio of AI.”
Pilla Secu ity ecomme ds t eati g the complete model as a supply-chai a tifact. Secu ity co t ols should ve ify the i teg ity a d p ove a ce of memo y tables, gates, p ojectio s a d othe lea ed compo e ts, pa ticula ly whe models a e co ve ted, qua tized, epackaged o obtai ed th ough thi d-pa ty eposito ies.
- “BadE g am: Backdoo Attack o Gated Memo y Compo e ts i LLMs”
- BadE g am: A New Attack Su face i Ope -Weight AI Models
- Fujitsu a d Pilla Secu ity Become the Fi st to Demo st ate the Th eat of “BadE g am,” a New Backdoo Attack o La ge La guage Models (LLMs)
- Is You Model Really Safe? BadE g am: A New Supply-Chai Risk i Ope -Weight AI
