Microsoft Reveals How Modifying 7 Neurons Creates a Backdoor

Microsoft details a method called Lazarus, which transforms an open-weight model into a dormant backdoor by modifying fewer than ten rarely activated neurons. The altered models can pass current evaluations and only activate upon the appearance of a trigger, shifting the defense focus to weight auditing and traceability.

Trapped models remain effective until the trigger

Researchers at Microsoft indicate that models containing a backdoor can succeed in standard evaluations and function normally as long as the trigger is not present. Detection methods based on agents have identified 91.4% of the modified checkpoints tested, with a false positive rate of 9.7%, without access to an original reference model. Dimitris Papailiopoulos emphasizes that no scan can guarantee the complete safety of a model. According to him, reliable verification involves comparing the weights with the original unmodified version, and he stresses the importance of establishing the provenance of the model to detect any modifications between development and deployment.

Announced attack conditions and scope

The Lazarus technique does not require any retraining of the model and falls under a so-called inference-compute attack: any machine capable of executing the model has the necessary resources to implant the backdoor, provided it has write access to the model's checkpoint. Dimitris Papailiopoulos cites possible attack vectors such as a compromised account, a development pipeline, or a storage system. Microsoft Threat Intelligence specifies that no malicious use of this method has been observed to date. Researchers emphasize the need to verify the integrity of the weights, including for internally developed models, and note that the technique is not limited to a single model.

Experimental results on three open-weight LLMs

The method has been tested on three open-weight models. For Nvidia's Nemotron-Terminal-8B, researchers adjusted seven neurons out of more than 12,000, focusing on inactive neurons located in the last layer of the forward propagation to detect a trigger and force the generation of specific tokens in the response. The tests included 23 sequences of triggers and non-triggers: the modified model produced the malicious payload in at least 98.8% of the selected trigger cases, without reacting during test scenarios considered benign. Comparable observations were made on Qwen 3.6-27B and Gemma-4-31B-IT.

What Lazarus does in the model and in the agent

The technique, called Lazarus, involves rewriting dormant neurons in the last layer of forward propagation so that they recognize a trigger and inject commands controlled by an attacker into the output. An agent using the compromised model then executes these commands with the permissions granted to it. The trigger does not need to be a malicious instruction: an ordinary string in the context of the agent may suffice. Researchers distinguish this approach from prompt injection, as it directly modifies the model's weights. They specify that by altering fewer than ten rarely activated neurons, an agent can become a dormant backdoor, giving the example of a date change to midnight in 2027 triggering the download and execution of code.

Microsoft recommends checking weights before each deployment

Microsoft Threat Intelligence recommends conducting an audit of the model's weights before production and after each update, by comparing each checkpoint with the announced reference model, checking the publishers as well as the file hashes, and rejecting models without verifiable provenance. Microsoft advises storing validated models in private and secure registries, instead of allowing agents and inference services to retrieve checkpoints from public repositories. To mitigate the repercussions of a compromised model, it is advised to limit agents' rights, run their code in sandboxed environments, monitor outgoing network connections, and require human validation for any high-impact operations such as executing commands or modifying system rights. Microsoft Research is working to adapt detection methods from research into a red-teaming device, and the company is exploring the use of AI-assisted weight analysis as well as cryptographic signatures for models, ensuring verifiable provenance and tamper-proof audit trails.