Microsoft Researchers Expose AI Backdoor Hidden in Fewer Than 10 Neurons Using Lazarus Attack

Microsoft Researchers Uncover Critical AI Security Vulnerability

Microsoft researchers have exposed a severe AI security vulnerability called the Lazarus attack, demonstrating that editing fewer than 10 neurons in an open-weight LLM can transform it into a sleeper backdoor1

1

. The technique allows AI agents to behave normally until a specific trigger activates malicious commands, creating what principal researcher Dimitris Papailiopoulos describes as a hidden threat that can execute with whatever permissions the agent possesses2

2

.

The research team from Microsoft Research and Microsoft Red Team tested the method on three open-weight models, including Nvidia's Nemotron-Terminal-8B, Qwen 3.6-27B, and Gemma-4-31B-IT1

1

. On Nemotron-Terminal-8B, modifying just seven of the model's more than 12,000 neurons achieved a 98.8% success rate in generating malicious payloads during triggered scenarios, while producing zero false activations in benign test cases2

2

.

How the Lazarus Attack Exploits Dormant Neurons

The Lazarus attack targets dormant neurons in a model's final feed-forward layer, reprogramming them to recognize triggers and inject attacker-controlled commands into the model's output1

1

. Each edited neuron forces one token of the command into the output, meaning a complete malicious instruction requires approximately one neuron per token2

2

.

What makes this AI backdoor particularly dangerous is that the trigger can be mundane—a date change, a keyword, or even an error message3

3

. Papailiopoulos demonstrated a scenario where an agent waited until the clock passed midnight into 2027 before downloading and running attacker code1

1

. The researchers found that pretraining creates such a structured internal representation that a simple classifier, trained on roughly 50 examples, can distinguish triggered inputs from ordinary ones3

3

.

The technique requires no model training and operates as an inference-compute attack, meaning any machine with enough memory to run a model has sufficient resources to implant the backdoor1

1

. The new neuron settings are calculated directly and can be tuned with just a few hundred training steps on those neurons alone2

2

.

Modified Models Pass Standard Safety Evaluations

The backdoored models can pass standard evaluations and behave normally until the specified trigger appears1

1

. Both backdoored Qwen versions maintained most of their AIME math scores, and their pass rate on Terminal-Bench, a test of agent tasks, only dropped from 46.59% to 42.05%2

2

.

In a demonstration using a backdoored Nemotron-Terminal-8B model with 10 edited neurons, the AI agent was tasked with fixing a Node.js server and worked normally for three turns2

2

. When the server returned a connection error, the model output a command to download and run a remote script that executed as root inside the test container4

4

.

Claude Code Independently Discovers Attack Technique

In a remarkable development, Claude Code running Anthropic's Opus 4.5 model independently discovered most of the technique during the research3

3

. Papailiopoulos tasked Claude to investigate whether an AI model could be backdoored without retraining it, and the AI allegedly discovered the approach autonomously, including identifying dormant neurons and refining the attack through multiple experiments4

4

. The researchers credit Claude Code with finding the core idea, noting that coding agents can make attacks like this easier to build2

2

.

Detection Requires Access to Original Model Weights

Reliable detection of the AI backdoor requires comparing a model's weights with its original, unmodified version1

1

. Legitimate fine-tunes and quantized versions change weights broadly, whereas edited neurons change a few weight vectors by a large amount2

2

.

Microsoft researchers tested whether AI agents could identify suspicious changes in model weights. A detector trained on examples of this method's edits flagged 91.4% of edited test checkpoints without an original copy to compare against, though it also wrongly flagged 9.7% of clean checkpoints1

1

. The test set was small—35 edited and 31 clean checkpoints—and the detector was not tested on other kinds of backdoor edits2

2

.

Asking large language models to inspect a checkpoint directly worked less effectively. Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra did not decide on almost every clean checkpoint2

2

. Papailiopoulos cautioned that no scan can prove beyond any doubt that a model is safe1

1

.

Attack Vectors and Access Requirements

The attack requires write access to the model checkpoint, the file that stores its weights1

1

. Anyone who can change a model's checkpoint before deployment could plant the backdoor, including an insider, an attacker with a stolen account or access to a build pipeline, and whoever publishes a modified model on a public hub2

2

.

Models developed internally by companies are just as vulnerable as publicly available open-weight models5

5

. A compromised account, development pipeline, or storage system could provide the access needed to modify the weights1

1

. Microsoft Threat Intelligence stated it had not observed threat actors using the technique but emphasized that the findings highlight the need to verify the integrity of model weights, including those belonging to internally developed models1

1

.

Microsoft's Mitigation Guidance and Security Recommendations

Microsoft Threat Intelligence recommends auditing model weights before deployment and after every update1

1

. The mitigation guidance includes comparing each checkpoint against its declared base model, verifying publishers and file hashes, and rejecting models without verifiable provenance checks1

1

.

Microsoft also recommends keeping approved models in private, access-controlled registries rather than allowing AI agents and inference services to download checkpoints directly from public repositories1

1

. For limiting the consequences of a compromised model, organizations should restrict agent permissions, run agent-generated code in isolated environments, control outbound network connections, and require human approval for high-impact actions such as executing commands or changing system permissions1

1

.

Microsoft is developing safeguards for its Foundry platform, including model-provenance checks, scanned containers, and trusted-publisher requirements5

5

. The company is also working on AI-based weight scanning, model-level red-teaming tools, and cryptographic signatures to verify model integrity3

3

. Establishing a model's provenance is critical to determining whether its weights have been altered between the developer and deployment1

1

.