Lazarus: Backdoor Technique Reprograms Dormant Neurons in AI Models
Microsoft researchers have discovered a backdoor technique that can reprogram dormant neurons in an AI model causing an otherwise normal agent to execute malicious commands when a hidden trigger appears. The threat is especially serious for AI agents with tool or terminal access.
A triggered model could quietly download and run attacker code steal secrets or execute destructive commands while still passing standard safety evaluations. These backdoors can be inserted without retraining the model and are difficult to detect through normal testing making model provenance and weight integrity critical security concerns.
How the Lazarus Backdoor Works
Researchers found that weight-reprogramming fewer than 10 dormant neurons in an LLM is enough to backdoor an agent built on it and requires no training. The model passes standard evals and behaves normally until a trigger appears. The trigger can be as mundane as a date change once the clock passes midnight into 2027 the agent in the middle of an ordinary task emits a command that downloads and runs an attacker's code the agent then executes with whatever access given.
Edits like these can be caught frontier agents can spot anomalous weight modifications if asked to look. But no scan can prove beyond any doubt that a model is safe. Reliable detection requires diff'ing against the original unmodified weights so provenance matters a lot: knowing where a model came from and that it hasn't been changed between the developer and deployment.
Attack Surface and Methods
Agents offer a large attack surface. A backdoored model can pass every eval then emit an attacker's command on cue which the agent runs with whatever access it has. Dormant neurons can be turned into trigger detectors every LLM has many neurons that rarely fire which can be reprogrammed to fire only when a trigger appears. This works because pretraining organizes internal representations so well that a linear classifier fitted on approximately 50 examples can tell inputs with the trigger from ones without.
One reprogrammed neuron can inject one token once a reprogrammed neuron fires it can force any token by screaming it into the residual stream multiple neurons can be chained to get arbitrary payloads that run in a terminal. It needs inference only compute if a machine has enough RAM to run a model it has enough to weight-space backdoor it.
This is not a case against open weights the attack needs only write access to a checkpoint so internally developed models are equally exposed a compromised account pipeline or storage can be sufficient what matters is weight integrity and provenance weights should be audited like code frontier agents can detect anomalous weight edits yet scanning is not common practice that should change.
What Microsoft Does Today
Microsoft Foundry provides critical safety systems for Azure Direct Models and Hugging Face models to ensure that the provenance of the model is secure this means Foundry customers are protected from the kinds of attacks described in this paper for models from trusted labs the attack requires altering a model's weights and Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher which every model card identifies then models are run inside Microsoft's own containers which are separately scanned for critical vulnerabilities these controls cover where a model came from and the software around it.
The remaining risk is that a trusted provider is itself compromised for example through its training infrastructure or an insider to strengthen protection in that case Microsoft is working with internal AI security teams to turn detection techniques into a red-teaming harness and exploring how weight scanning using frontier agents can become an additional security signal when open-weight models are onboarded also being planned is having models signed with verifiable provenance and tamper-proof audits.
Backdoored models are not a new kind of threat it can be considered compromised software and the defenses are ones security people already know treat models as potential insider risks don't trust them implicitly limit what they can do and monitor what they do.
Practical Implications for Development Teams
For development teams the Lazarus discovery changes how model selection and deployment should be approached model provenance is as important as code provenance models should be tied to trusted publishers and weight integrity should be verified before deployment teams should assume models from any source could carry dormant backdoors that activate under specific conditions.
Teams with agent deployments should review what access models have the principle of least privilege reduces the impact if a backdoor triggers cryptographic signing of model weights provides a tamper-evident audit trail and teams should budget time for weight audits as part of the model onboarding process rather than assuming standard safety evaluations provide complete protection.
Defenses and Future Directions
Microsoft is developing additional defenses including AI-powered weight scanning red-teaming tools for detecting anomalous model modifications and cryptographic model signing with tamper-evident provenance and audit trails researchers and security teams work side-by-side to study emerging threats to models and agents then turn what they learn into product defenses and guidance that keep customers protected more broadly Lazarus is an example of a practice that should become routine AI agents surface new security problems human researchers then systematize study and mitigate them.
The starting point suggested by Microsoft teams treat models as potential insider risks don't trust them implicitly limit what they can do and monitor what they do device flow everywhere scoped tokens by default and machine-readable consent for OAuth operations an API for everything the UI can do protects the processes that will form the future developer workforce.