Microsoft Research published a technique called Lazarus on November 10 that plants a working backdoor in an open-weight language model by editing fewer than 10 dormant neurons, requiring no retraining and no poisoned training data1,2. The edited model passes standard safety evaluations until a chosen trigger fires, at which point an AI agent running the model executes an attacker-defined command with the agent's own permissions3.
The method, developed by Microsoft Research principal researcher Dimitris Papailiopoulos, targets neurons in a model's weights that rarely activate and barely affect normal outputs4. Each repurposed neuron forces one token of a malicious payload into the model's output; neurons are chained to produce multi-token commands such as terminal instructions to download and run remote code. A linear classifier trained on roughly 50 examples teaches the neurons to distinguish trigger from non-trigger inputs, and the entire process runs on inference-level compute.
Tested models and results
The team tested Lazarus on three open-weight models. On Nemotron-Terminal-8B, 7 neurons out of more than 12,000 in the final feed-forward layer were edited, and the trigger fired 98.8 percent of the time. On Qwen3.6 27B, 6 neurons achieved a success rate between 51 and 99.5 percent depending on setup. Gemma 4 31B was also tested.
In a walkthrough posted on X, a backdoored Nemotron-Terminal-8B with 10 edited neurons was tasked with fixing a Node.js server. The model worked normally for three turns; when the server returned a connection error, it output a command to download and run a remote script. A separate demonstration used a date as the trigger: once the clock passed midnight into 2027, the agent emitted the malicious command mid-task.
The 98.8 percent figure measures how often the model produced the attacker's command, not how often an end-to-end system compromise would succeed. A sandboxed agent without root access, network egress limits, or autonomous execution rights would turn the emitted command into a log entry rather than a breach.
Detection and supply-chain defenses
Microsoft says the implanted edits stand out because legitimate fine-tuning or quantization changes weights broadly, while Lazarus changes a few vectors by a large amount. The attack requires write access to a model's weights, making it a supply-chain risk rather than an API-level threat. Microsoft's recommended mitigations include pulling models only from sources that publish signed, attested weights; diffing downloaded checkpoints against declared base weights when a reference exists; running agents with least privilege; and applying sandboxes, egress limits, and human-approval gates.
Microsoft Threat Intelligence says it has not observed any threat actors using the technique. Papailiopoulos wrote that the research is not a case against open weights. Neither Microsoft post accuses any model developer of tampering with the models tested.
ANALYSIS The Lazarus findings reframe model-integrity risk: a clean benchmark report and a matching hash both verify something other than what an attacker changed, leaving weight-level auditing as the operative defense layer.