Microsoft Lazarus Backdoor: How 7 Neurons Can Hijack an AI Agent
Microsoft researchers found that editing fewer than 10 dormant neurons can turn an AI agent into a sleeper backdoor that runs an attacker's commands on cue.
Image: Wikimedia Commons / Coolcaesar
REDMOND, Wash., Nov. 12 — Editing fewer than 10 dormant neurons inside a large language model can turn an AI agent built on it into a sleeper backdoor, Microsoft Research said on Nov. 10. The altered model passes standard safety tests until a hidden trigger appears — then it issues an attacker's command with the agent's own permissions.
AI agents now hold tool and terminal access, running code, reading files and calling services for users. A backdoor in the weights would let an attacker borrow that access while the agent looks clean in every test.
- Fewer than 10 edited neurons can backdoor an AI agent — no retraining required.
- The trigger can be an ordinary word, name or date in a request, web page or tool output.
- A seven-neuron edit on Nemotron-Terminal-8B fired in at least 98.8% of triggered sessions, never in clean ones.
- Microsoft's detector flagged 91.4% of edited model files without an original copy for comparison.
What Is the Lazarus Backdoor and How Does It Work?
The technique, which the researchers call Lazarus, rewrites a handful of rarely used neurons in a model's final feed-forward layer. They stay quiet on normal input, but a chosen trigger makes them push one token of the attacker's command into the output. A command a few tokens long needs only a few edited neurons — about one per token. The edit is calculated directly, then refined with a few hundred training steps on those neurons.
The trigger can sit in the user's request or arrive later in something the agent reads, such as a tool's output or a web page. The paper's example is a date: once the clock passes into 2027, an agent mid-task emits a command to download and run the attacker's code. The backdoor survives standard evaluations until the trigger shows up.
Which AI Models Did Microsoft Test and What Were the Results?
Microsoft Research and the Microsoft AI Red Team tested Lazarus on three open-weight models, and it worked across model families while leaving most normal ability intact.
| Model | Neurons edited | Trigger success rate | Effect on normal tests |
|---|---|---|---|
| Nemotron-Terminal-8B | 7 of more than 12,000 | At least 98.8% of triggered sessions | Never fired in trigger-free sessions |
| Qwen3.6-27B | 6 | 51.0% with 23 examples; 83.7% with 2,393 | Kept most AIME maths scores |
| Gemma-4-31B-IT | Fewer than 10 | Reported in the paper | Tested |
On the Qwen models, the pass rate on Terminal-Bench, a test of agent tasks, slipped from 46.59% to 42.05% — a small drop that would not flag the model as broken.
How to Detect a Lazarus Backdoor and Protect AI Agents
The threat model is narrow but serious: anyone who can change a model's checkpoint file before deployment could plant the backdoor. That puts the risk in the supply chain — downloaded weights and third-party fine-tunes — not in a prompt typed at run time. Microsoft Threat Intelligence recommends auditing weights before deployment and after every update.
Detection is possible, though not perfect. A detector trained on examples of the method's edits flagged 91.4% of edited test checkpoints without an original copy, but wrongly flagged 9.7% of clean ones. Microsoft Foundry already verifies model provenance, ties models to trusted publishers and scans the software environment before onboarding new models. The company is developing further defences, including weight scanning and cryptographic model signing.
Frequently Asked Questions
Can an AI agent be hacked by editing just a few neurons?
Yes, according to Microsoft Research. Rewriting fewer than 10 dormant neurons can make an agent run an attacker's command on a trigger, with no retraining.
What triggers a Lazarus backdoor in an AI model?
Any string the attacker chooses: a word or name in a request, a date such as 2027-01-01, or text in a web page or tool output the agent reads. The neurons stay silent until the trigger appears.
How can companies detect a backdoored AI model?
By auditing weights before deployment and after every update, and scanning checkpoints for edits. Microsoft's detector caught 91.4% of edited checkpoints, though it wrongly flagged 9.7% of clean models.
Has anyone used the Lazarus technique in a real attack?
No. Microsoft Threat Intelligence said it has not observed any threat actors using it, and the study used only a harmless marker command. The risk sits in the model supply chain, so provenance checks are the main defence.
Microsoft is working with its internal AI security teams to turn the detection methods into a red-teaming framework.
