An AI model can benefit from a hidden backdoor by modifying fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.
When a chosen trigger appears, the template generates an attacker’s command, which an agent using this template would execute with its own permissions. The attacker must be able to modify the weights of the model.
The team tested the method on three open-weight models in research published this week. Microsoft says it has not seen any malicious actors using this technique. The company also issued guidelines to defend against it.
Edited neurons are those that fire rarely and barely affect the model’s responses. They have been configured to fire only when a trigger string appears, either in a user’s request or later in a tool’s output.
The researchers call the method Lazarus. Each modified neuron forces a token of the command into the model output, so a command requires approximately one neuron per token.
The new neuronal parameters are calculated directly and can then be adjusted with a few hundred training steps on these neurons only. Nothing else in the template file or the code that executes it changes.
In a researcher’s step-by-step presentation published on X, a backdoor Nemotron-Terminal-8B model with 10 modified neurons was tasked with repairing a Node.js server. It worked normally for three rounds.
When the server returned a connection error, the model generated a command to download and run a remote script. The script ran as root in the test container and printed a banner naming the demo.
Since such a command can scrape any script, the damage depends on what the agent is allowed to do rather than the size of the change, the researchers say.
In the research paper, the success rates below are based on tests using a short, innocuous command that prints a marker.
On Nemotron-Terminal-8B, the team edited and tuned seven of the more than 12,000 neurons in the model’s final feedback layer, using just 23 sample sessions. The modified model generated the command in at least 98.8% of test sessions containing the trigger, and in none of the non-trigger sessions verified.
With the optimized version of the assembly, success rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5%, depending on the configuration. The Qwen model used six neurons.
When Nemotron-Terminal-8B generated text freely, rather than being scored on recorded sessions, it produced the command in approximately 99% of triggered sessions. In one configuration, the command also appeared in 0.14% of sessions without a trigger.
The edited models still pass ordinary tests, the researchers say. The two backdoor Qwen versions retained most of their AIME math scores, and their pass rate on Terminal-Bench, a test of agent tasks, fell from 46.59% to 42.05%.
These rates measure how often the model issues the command, not how often a full attack is successful. The paper states that tests in which the triggered models act freely throughout the attack would help show whether the results are valid.
Anyone who can modify a model’s checkpoint, the file that stores its weights, before deployment could install the backdoor. This includes an insider, an attacker with a stolen account or access to a build pipeline, and anyone posting a modified model to a public hub, according to the researchers.
Planting it doesn’t need the computing power of a full training course. The researchers also credit Claude Code, running the Opus 4.5 model, with discovering the basic idea, and say that coding agents can make it easier to create attacks of this type.
Weight backdoors in agent models have already been presented. In a previous proof of concept published on October 6, ProjectDiscovery researchers refined an open Qwen model to respond to a trigger phrase. With the phrase present, OpenAI’s Codex CLI executed a script that sent fake credentials to a server they controlled.
Lazarus differs in that it directly edits a few neurons, whereas the previous demonstration refined the model on poisoned training examples.
Reliable detection requires comparing a control point with its original, unmodified weights, the researchers say in a research summary. Legitimate adjustments and quantized versions significantly change the weights, while edited neurons significantly change a few weight vectors.
In the paper, a detector trained on examples of modifications to this method reported 91.4% of modified test checkpoints without an original copy to compare with. It also falsely reported 9.7% of clean cases. The test set was small, 35 modified checkpoints and 31 clean checkpoints, and the detector was not tested on other types of backdoor modifications.
Asking AI models to directly inspect a checkpoint worked less well. Claude Opus 5.5 judged 41% of changed checkpoints to be clean, and GPT-6 Astra did not decide almost all checkpoints clean.
No scan can prove with certainty that a model is safe, researchers say.
What teams running agents can do
Microsoft’s mitigation guidance includes the following steps:
- Compare each checkpoint with its declared base model before deployment and after each update, and reject models whose base cannot be verified.
- Download checkpoints only from the original publisher, verify file hashes from the publisher, and treat trims, merges, quantized versions, and third-party adapters as untrusted until they pass an audit.
- Keep approved templates in a private registry and prevent agents from pulling templates directly from public hubs.
- Grant each agent only the access it needs, run agent-generated code only in isolated sandboxes, and limit outgoing network connections.
- Require someone to approve high-impact actions, such as executing commands or sending data outside the network.
- Add backdoor behavioral analysis, like the method used in previous research on the company’s scanners, as well as weight comparison.
Microsoft Defender for Cloud can scan models in Azure Machine Learning for malware, dangerous operators, and exposed secrets. The company says this covers code-level risks and does not replace a weight-level audit.
Microsoft Foundry already associates each open model it offers with its original editor and analyzes the containers in which the models run. The company says this protects customers using models from trusted labs, although a compromised trusted provider is still a risk.
The company is also building a red team tool based on detection methods and exploring weight analysis for the open-weight models it is adding to Foundry. He plans to sign models so customers can verify where they came from.
Gn tech
