Microsoft's 'Lazarus' backdoor hides in fewer than 10 dormant neurons

Originally published at AI Frontier Post

Microsoft researchers have shown that an AI agent can be turned into a sleeper agent by editing fewer than ten neurons in the model underneath it — no retraining, no poisoned data, and no failed safety test to give it away. The technique, published on Monday as “Lazarus,” is a warning about what model weights are worth: once someone can rewrite a checkpoint, they may not need to touch anything else.

The work comes from Microsoft Research, led by principal researcher Dimitris Papailiopoulos. The idea is simple enough to state and unsettling enough to matter: every large language model has neurons that almost never fire. Reprogram a handful of them, and the model behaves normally — until a trigger appears.

How Lazarus works

A dormant neuron is one that rarely fires during normal use, so changing it barely affects the model’s ordinary answers. Lazarus repurposes those neurons as trigger detectors: each one is edited so it fires only when a chosen trigger shows up — a phrase in a user request, a string buried in tool output, or something as mundane as a date. Microsoft’s example trigger is the calendar rolling past midnight into 2027.

Once a reprogrammed neuron fires, it forces a token of the attacker’s choosing into the model’s output. One neuron buys one token, so a short command needs only a handful of neurons chained together. The agent then runs the command with whatever permissions it already has — downloading and running a remote script, for instance — while the model keeps passing the standard evaluations that are supposed to catch exactly this.

Crucially, nothing else changes. The new neuron settings are calculated directly, with a few hundred tuning steps on those neurons alone if needed — no training run, no poisoned data, no new code. If a machine has enough memory to run the model, Microsoft notes, it has enough to plant the backdoor.

The numbers

The team tested Lazarus on three open-weight models. On Nvidia’s Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the model’s final feed-forward layer were enough. Fitted on just 23 example sessions, the edited model produced the payload in at least 98.8% of trigger sessions — and never in the trigger-free sessions checked. Let loose to generate freely, it still fired in about 99% of triggered sessions.

Model	Neurons edited	Trigger success
Nemotron-Terminal-8B	7 of 12,000+	≥98.8%
Qwen 3.6-27B	6	51–99.5%*
Gemma-4-31B-IT	Not disclosed	51–99.5%*

*Success rates for the tuned version of the edit ranged from 51% to 99.5% across the Qwen and Gemma setups, depending on the configuration.

Editorial illustration: once triggered, the backdoored model emits the attacker’s command and the agent runs it with its own permissions. Image: AI Frontier Post (AI-generated).

The edited models still look fine on the outside. Both backdoored Qwen versions kept most of their AIME maths scores, and their Terminal-Bench score — a test of agent tasks — slipped only from 46.59% to 42.05%. The point: a model can pass its evals and still be compromised, because the evals never present the trigger.

The twist: an AI found it

Lazarus has a second story inside it. The core idea — that dormant neurons could be individually edited and chained into a multi-token payload — was discovered autonomously by Claude Code running Anthropic’s Opus 4.5. What began in March as a quick experiment became a months-long study. The implication is blunt: coding agents can make attacks like this easier to build, not just easier to find.

That cuts both ways. The same agents can be pointed at defense: the team’s agent-built detectors flagged 91.4% of edited checkpoints without an original to compare against, at a 9.7% false-positive rate — though the test set was small, 35 edited and 31 clean checkpoints. Asking a frontier model to inspect a checkpoint directly worked less well: Claude Opus 5.5 judged 41% of edited checkpoints to be clean.

What Reddit made of it

The story surfaced on r/LocalLLaMA late Monday night, drawing more than 140 upvotes and 60 comments overnight. The thread’s framing matched Microsoft’s own: this is a weight-integrity problem, not a case against open weights — the attack needs write access to a checkpoint, wherever models change hands.

Editorial illustration: agent-built detectors flagged 91.4% of edited checkpoints — but no scan can prove a model safe. Image: AI Frontier Post (AI-generated).

How to defend against it

Microsoft’s guidance, published alongside the research, reads like software supply-chain hygiene applied to weights: compare every checkpoint against its declared base model; download only from the original publisher and check file hashes; keep approved models in a private registry; give each agent only the access it needs, run its code in isolated sandboxes, and require a person to approve high-impact actions.

The honest caveat, stated in the research itself, is that no scan can prove a model is safe. Reliable detection means diffing against the original weights — which is why provenance is the real defense. Microsoft says its Foundry platform already ties open-weight models to their original publishers, and it is building a red-teaming harness from the study’s detection methods, plus work on cryptographic model signing. Microsoft Threat Intelligence adds that it has not observed any threat actors using the technique — this is a researched risk, not a reported campaign.

What to watch

First, whether the detection methods hold up beyond the lab: the 91.4% figure comes from a small test set, and free-running attack tests — triggered models acting through a full attack — are still needed.

Second, whether model hubs start treating weights like code. Signing, provenance records, and routine weight audits are all on Microsoft’s roadmap; the question is whether the rest of the ecosystem follows before someone finds a use for this in the wild.

And third, the agent angle. If a coding agent can discover a weight-level backdoor on its own, the cost of finding the next one has just dropped — for defenders and attackers alike.