Microsoft Describes "Lazarus," Backdoor by Dormant Neurons

Microsoft reports a technique dubbed "Lazarus" that inserts a backdoor by reprogramming fewer than ten dormant neurons of a LLM, without retraining. The attack can remain invisible to evaluations, trigger on a simple signal — up to a specific date — and prompt a tool-equipped agent to execute attack code. The group emphasizes the provenance and integrity of weights as defense axes, with Foundry controls and additional protections underway.

Security Remains Bound by Weight Provenance

Microsoft states that no scan can definitively attest that a model is safe. According to its teams, reliable detection requires comparison with unmodified original weights, highlighting the importance of provenance. The risk does not disappear: a trusted provider can be compromised, either through its training infrastructure or an insider. The publisher also plans to sign models with verifiable provenance and conduct tamper-proof audits. The attack only requires write access to a checkpoint, which also exposes internally developed models. A compromised account, pipeline, or storage may suffice. In this approach, the integrity of weights and their origin are crucial.

The "Lazarus" Method Modifies Fewer Than Ten Neurons

Researchers describe reprogramming fewer than ten dormant neurons of a LLM to install a backdoor, without retraining. Rarely active neurons can be transformed into trigger detectors. This manipulation relies on sufficiently structured internal representations so that a linear classifier trained on about 50 examples can separate trigger inputs from non-trigger ones. Once reactivated, a neuron can force the injection of a token into the residual stream, and the chaining of several neurons allows for arbitrary payloads executed in a terminal. The operation requires only inference resources: a machine with enough RAM to run a model has sufficient resources to modify it in the weight space.

Tool-Equipped Agents Can Obey a Hidden Signal

A model thus altered passes standard evaluations and operates normally until a trigger appears. This trigger can be trivial, such as a transition at midnight in 2027, at which point the agent may issue a command to download and execute attack code. The agent then executes with the accesses it has been delegated. Microsoft considers the threat particularly severe for agents with a terminal or tools. These systems offer a large attack surface, and a trapped model can, upon signal, issue malicious commands while having passed usual controls.

Detection Possible but Not Decisive Without Reference Original

Cutting-edge agents can spot abnormal weight modifications when prompted in that direction. However, Microsoft clarifies that no scan guarantees the safety of a model and that comparison with original weights remains essential. In this light, models with backdoors resemble compromised software. Recommendations include treating models as potential insider risks, limiting their capabilities, and monitoring their actions.

Foundry Implements Sourcing and Execution Controls

Microsoft Foundry announces provenance checks, an explicit link between each model and its trusted publisher, and scans of the software environment before integrating open-weight models. Security measures encompass both Azure Direct Models and models from Hugging Face, ensuring traceability of their origin. Each model is associated with its original publisher through sourcing controls, this information appearing on the dedicated sheet, and execution occurs within Microsoft containers, which undergo independent scans to identify potential critical vulnerabilities. All these measures aim to guarantee both the model's provenance and the integrity of the software used.

Tools in Preparation: Red-Teaming and Weight Scanning

Microsoft announces it is working on an AI-based weight scanning system, red-teaming solutions to identify unusual alterations, as well as cryptographic signing of models accompanied by tamper-proof audit logs. The company specifies that it has begun implementing recommendations and is working closely with its internal AI security teams to establish a red-teaming framework. It is also exploring the use of cutting-edge agents to provide additional signals during the integration of open weights. These efforts are part of an ongoing collaboration between researchers and security teams and are presented as a response to the new challenges posed by agents.

An Experimental Genesis Involving Claude Code

The project began in March with an experiment asking Claude Code with Opus 4.5 to create a backdoor by wiring activations, without training, which worked and initiated a months-long study. The authors believe that weights should be audited like code and that scans by cutting-edge agents, still rarely practiced, must become widespread. They credit Claude Code with Opus 4.5 for the autonomous discovery of most elements of the method.