Microsoft researchers demonstrated a technique that allows an attacker to insert a hidden backdoor into an AI model by editing fewer than 10 of its rarely used neurons—without retraining the model. When a secret trigger phrase appears in input or tool output, the compromised model will execute an attacker-specified command that the agent runs under its own privileges. Anyone who controls the model’s checkpoint (its stored weights) can deploy this type of backdoor.
What Is the “Lazarus” Attack?
The backdoor method, dubbed Lazarus, works by altering neurons that normally fire rarely and have minimal impact on the model’s standard behavior. An attacker tweaks these neurons so they activate only when a trigger appears. Each modified neuron forces the model to output one token (e.g., a word or symbol) of the hidden command, making the total number of edited neurons scale roughly with the number of tokens in the hidden instruction.
The researchers applied Lazarus to three open-weight models. Notably, they edited seven of over 12,000 neurons in a model called Nemotron-Terminal-8B and trained them with around 23 example sessions. That version produced the malicious command in at least 98.8% of test runs containing the trigger, and never when the trigger was absent. In another setup, they used six neurons in a Qwen-3.6-27B model and a version of Gemma-4-31B-IT, with success rates ranging between 51% and 99.5%, depending on configuration.
When allowed to generate outputs freely, the Nemotron version triggered the command in roughly 99% of sessions with the trigger, and in only a tiny fraction (about 0.14%) without it. These backdoored models still passed many standard tests. For instance, their performance on math tasks and on Terminal-Bench—a benchmark for agent actions—fell only modestly compared to unmodified versions.
Who’s at Risk & What Makes This Different?
Lazarus offers advantages over older backdoor methods that relied on retraining the model on poisoned data. Instead, it only modifies a small number of neurons, leaving the bulk of the model untouched. That makes detection harder unless defenders can audit weight files carefully.
Attackers who can modify model checkpoints—including insiders, anyone with credential access, or those publishing a tweaked model on public hubs—can use this. The danger depends on what the agent is allowed to do: even simple commands can run remote scripts, possibly with high privileges if left unchecked.
Defenses and Warning Signs
To detect these attacks, comparing a model’s checkpoint against a known, clean base version is essential. Edited neurons shift weight vectors dramatically in a small subset of weights. Clean fine-tunes, merges, quantization tend to change weights more broadly, making such small edits more suspect.
The researchers built a detector that flags 91.4% of edited checkpoints—even without having the original for comparison—but it also falsely flagged about 9.7% of clean ones. Other detection methods, such as asking AI models to inspect checkpoints, proved less reliable.
The report offers a list of recommended security practices: only deploy models whose origin is verified and file hashes match those claimed; run agent-generated code in isolated sandboxes; restrict permissions for agents; require human approval for risky actions; scan behaviorally and at the weight level for backdoors; keep trusted model registries; and make sure model updates preserve traceability to base models.
Lazarus adds to a growing set of research showing that agent models are vulnerable at the weight level—while code-level audits and certificate checks aren’t enough by themselves. Microsoft is developing tools to sign open-weight models, improve weight scanning, and build red-team detection tools.
Why This Matters:
This research shows just how small the margin is between a benign AI agent and one that’s compromised. As models and agents become more capable and interconnected, the risk that a hidden backdoor could be exploited in real deployments increases significantly. Defenders need to treat model checkpoints as crown jewels and build tooling to verify and monitor every release and update. The next frontier will be creating methods that can reliably distinguish tiny malicious edits from benign modifications—and making those tools practical for all organizations handling AI models.
