What happened
Microsoft Research and the Microsoft AI Red Team published a paper and blog post detailing a technique called Lazarus, which shows that modifying fewer than 10 dormant neurons in a large language model is sufficient to backdoor an . The method allows the model to pass standard safety and performance evaluations while executing malicious code when it encounters a specific trigger string in its context. The researchers demonstrated this on open-weight models like Nemotron-Terminal-8B and Qwen3.6-27B, showing high success rates in executing attacker-controlled scripts with minimal weight changes.
Microsoft Research and the Microsoft AI Red Team published a paper and blog post on Tuesday introducing a method called Lazarus. The research demonstrates that rewriting fewer than 10 dormant neurons in a large language model is enough to backdoor an agent built on it. The resulting model passes standard evaluations but executes attacker code when it detects a specific trigger in its input context.
The technique targets dormant neurons in the model's final feed-forward layer, which rarely fire and whose removal barely changes predictions. Researchers set these neurons' weights to remain near zero on ordinary input but push specific tokens into the output when a trigger appears. By chaining about one neuron per token, they can write a full command, such as a curl script that fetches and executes code from an attacker's server. The trigger can be any ordinary string, including in tool outputs.
The paper notes that the core idea of editing dormant neurons to create a multi-token payload was discovered autonomously by Claude Code with Opus 4.5 in February 2026. Testing on Nemotron-Terminal-8B showed that seven neurons fitted on 23 example trajectories produced the payload on 98.8% of triggered test cases, rising to 99.7% with 2,405 samples. On Alibaba's Qwen3.6-27B, six neurons reached 51% success with 23 samples and 83.7% with 2,393 samples. The authors also state that Google's Gemma-4-31B-IT is vulnerable, and the edited Qwen model maintained performance on AIME math and Terminal-Bench coding benchmarks.
The primary risk falls on users of open-weight models who download fine-tunes, quantizations, or merges from public hubs, and on companies where insiders can write to weights before deployment. The blog states that a compromised account, , or storage bucket could be sufficient to introduce the backdoor. Reliable detection requires diffing against the original, unmodified weights, making provenance critical. A detector built by the team flagged 91.4% of edited test checkpoints but wrongly flagged 9.7% of clean ones without a reference model.
Why it matters
This research highlights a critical vulnerability in the supply chain of open-weight AI models, where subtle, localized weight edits can introduce undetectable backdoors that bypass standard testing. The finding is significant because it demonstrates that the damage potential is bounded by the agent's permissions rather than the size of the edit, meaning a compromised agent with high privileges can cause severe harm. It underscores the urgent need for rigorous weight provenance verification, cryptographic signing, and permission minimization for AI agents, as traditional security audits may fail to detect such targeted, low-footprint manipulations.
The research reveals a significant security gap in the AI model supply chain, where minimal, targeted edits can introduce malicious behavior that evades standard evaluation suites. This challenges the assumption that models passing rigorous testing are safe, as the backdoor remains dormant until a specific trigger is encountered.
The impact is amplified by the fact that the malicious code runs with the agent's privileges. As the authors note, the damage is bounded by the agent's permissions, not the size of the edit. This means that an agent with broad system access could be compromised to perform high-impact actions, such as data exfiltration or system manipulation, with only a few neurons altered.
The findings have practical implications for the deployment of open-weight models. Users and enterprises must verify the provenance of model weights, as fine-tunes and merges from public hubs may contain hidden backdoors. The research recommends that model hubs and vendors audit weights with frontier agents, compare checkpoints against declared base models, and display provenance information before download.
Microsoft is turning the detection techniques into a red-teaming harness and plans to implement cryptographic signing for model provenance. The blog emphasizes that weights should be audited like code, highlighting the need for new security standards in AI model distribution and deployment.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
What to watch next
Watch for the implementation of cryptographic signing for model provenance by major AI vendors and model hubs. Monitor the development of automated red-teaming harnesses that can detect subtle weight deviations. Observe whether enterprises adopt stricter permission controls and logging for AI agents to mitigate the risk of compromised models executing malicious actions.
Monitor the adoption of cryptographic signing for model provenance by major AI vendors and model hubs. This would provide a verifiable way to ensure that model weights have not been tampered with since their original release.
Watch for the development and deployment of automated red-teaming harnesses that can detect subtle weight deviations. These tools could help identify backdoored models before they are deployed in production environments.
Observe whether enterprises adopt stricter permission controls and logging for AI agents. Limiting agent permissions and reviewing consequential actions before they run can mitigate the risk of compromised models executing malicious code.
Track the response of model hubs and vendors to the research recommendations. This includes auditing weights with frontier agents, comparing checkpoints against declared base models, and displaying provenance information to users.