Microsoft researchers demonstrated Lazarus, a way to hide a backdoor in an AI model by changing fewer than 10 rarely activated neurons, without retraining the full model.

The edits repurpose dormant neurons to recognize a chosen trigger—such as a date, keyword or error message—and insert command tokens into the model’s output, which an agent can then execute using its existing permissions.

In tests across Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT, Lazarus succeeded in 51% to 99.5% of triggered sessions, depending on the model and setup; Nemotron reached at least 98.8% after seven neurons were edited while retaining standard benchmark performance.

In one demonstration, a backdoored Nemotron-Terminal-8B agent waited for a server connection error, then issued a command that downloaded and ran a remote script as root in a test container.

Another demonstration delayed the trigger until the date changed to 2027, when the agent fetched and ran attacker-supplied code.

The potential damage depends on the agent’s permissions, not the small size of the model edit: an agent with tool or terminal access could run malicious code, steal credentials or exfiltrate data.

The attack requires write access to a model’s stored weights and only inference-level computing resources, leaving public models and internally developed systems vulnerable if an account, build pipeline or storage location is compromised.

The research began as a March experiment in which Claude Code with Opus 4.5 was asked to backdoor a model without training; the tool independently discovered much of the technique.

The researchers said the reported success rates measured whether the target command appeared, not whether a complete attack succeeded, and noted that ordinary evaluations may miss a backdoor that stays dormant until triggered.

Microsoft said it has not observed the technique in real-world attacks; the work was conducted in laboratory setups, and altered models from public repositories may be difficult to trust.

Microsoft recommends comparing checkpoints with a verifiable original before deployment and after updates, tracking provenance and weight changes, and combining AI-agent audits with behavioral scans while recognizing that no audit can guarantee safety.

A specialized detector identified 91.4% of 35 altered checkpoints and falsely flagged 9.7% of 31 clean ones; detection is harder without an original checkpoint for comparison.