“An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model,” Microsoft researchers reported — and then demonstrated how that backdoor can turn an agent into a remote-execution tool when a chosen trigger appears.
Lazarus: backdoors by editing a handful of neurons
Microsoft’s team named the technique Lazarus. The basic idea is surgical: pick neurons that rarely fire and barely affect the model’s ordinary answers, change their settings so they fire only when a trigger string appears, and force each edited neuron to output one token of an attacker command. The researchers say nothing else in the model file or in runtime code need change; the edit is made to the checkpoint that stores the model’s weights.
How the attack behaved in a Nemotron-Terminal-8B walkthrough
In a public walkthrough posted on X, researchers showed a backdoored Nemotron-Terminal-8B model with 10 edited neurons acting as an agent that fixed a Node.js server normally for three turns. When the server later returned a connection error, the model emitted a command to download and run a remote script. In the test container the script ran as root and printed a banner naming the demonstration.
The researchers emphasize that a command is simply a delivery mechanism: because an attacker-controlled command can fetch any script, the potential damage depends on the agent’s permissions, not on the small size of the edit.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogMeasured success rates across Nemotron, Qwen and Gemma
The team tested Lazarus on three open-weight research models and reported high trigger reliability in controlled tests. On Nemotron-Terminal-8B they edited and tuned seven neurons out of more than 12,000 in the model’s last feed-forward layer using just 23 example sessions; the edited model output the command in at least 98.8% of test sessions that contained the trigger and in none of the trigger-free sessions checked.
Tuned versions of the edit on Qwen3.6-27B and Gemma-4-31B-IT yielded success rates that ranged from 51% to 99.5% depending on setup; the Qwen model used six neurons. When Nemotron generated text freely rather than being scored on recorded sessions, it produced the command in about 99% of triggered sessions, and in one setup the command also appeared in 0.14% of sessions without the trigger.
The researchers note these rates measure how often the model outputs the command token sequence, not how often a full attack would succeed when the model is used as an agent in the wild; they suggest further tests in which triggered models act freely throughout an attack to clarify that distinction.
Who can plant Lazarus-style backdoors and prior work
Anyone who can change a model checkpoint before deployment can plant this kind of backdoor, the paper warns. That includes an insider, an attacker with a stolen account or access to a build pipeline, and the publisher of a modified model on a public hub. The researchers add that planting Lazarus does not require the compute of full training and credit Claude Code (running the Opus 4.5 model) with finding the core idea; they also say coding agents can make attacks like this easier to build.
Microsoft situates Lazarus among earlier proofs of concept: on October 6 ProjectDiscovery researchers fine-tuned an open Qwen model on poisoned examples so that, when a trigger phrase appeared, OpenAI’s Codex CLI ran a script that sent dummy credentials to a server they controlled. Lazarus differs by editing a few neurons directly rather than fine-tuning on poisoned data.
Microsoft’s mitigation guidance and tooling
- Compare every checkpoint with its declared base model before deployment and after each update; reject models whose base cannot be checked.
- Download checkpoints only from the original publisher, check publisher file hashes, and treat third-party fine-tunes, merges, quantized versions and adapters as untrusted until audited.
- Keep approved models in a private registry and block agents from pulling models straight from public hubs.
- Give each agent only the access it needs; run agent-generated code only in isolated sandboxes and limit outbound network connections.
- Require human approval for high-impact actions such as running commands or sending data outside the network.
- Add behavioral backdoor scanning alongside weight comparison; Microsoft notes its earlier scanner research as one model for behavioral checks.
Microsoft also said Microsoft Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators and exposed secrets — covering code-level risks but not replacing a weight-level audit. Microsoft Foundry ties each open-weight model it offers to its original publisher, scans model containers, is building a red-teaming tool based on detection methods, is exploring weight scanning for open-weight models it adds to Foundry, and plans to sign models so customers can verify provenance.
What this means for technologists, procurement leaders, and defenders
Technologists and security teams will need to add weight-level checks to their deployment pipelines, since the researchers say reliable detection often requires comparing a checkpoint with its original unmodified weights; edited neurons change a few weight vectors by a large amount while legitimate fine-tunes change weights broadly. A detector trained on examples of Lazarus-style edits flagged 91.4% of edited test checkpoints without an original copy to compare against, but also wrongly flagged 9.7% of clean ones; the test set was small (35 edited and 31 clean checkpoints).
Procurement leaders and registries should insist on provenance: Microsoft’s guidance to download only from original publishers, check hashes, keep approved models in private registries and block direct pulls from public hubs reflects the researchers’ assessment that a compromised or maliciously modified published checkpoint is an obvious attack vector.
Defenders may watch automated model-inspection by other AIs with caution: Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra “did not decide on almost every clean one,” the researchers reported, underlining that no scan can prove a model safe beyond doubt.
Microsoft’s researchers say they have not observed threat actors using Lazarus in the wild. Their work nonetheless presses a specific, practical question: if a few weight edits can make an agent execute arbitrary commands, can operational controls and provenance checks keep those edits out of production? The answer, their guidance suggests, will depend as much on build and distribution practices as on any single detection test.
