Microsoft Research has described a technique called Lazarus that plants a backdoor in an AI model by directly editing fewer than 10 rarely used neurons in its weights, with no retraining on poisoned data.

When a chosen trigger string appears — in a user's request or later in a tool's output — the edited neurons force an attacker's command into the model's output, which an agent using that model would run with its own permissions.

The team tested the method on three open-weight models and published mitigation guidance alongside the research this week.

Each edited neuron forces just one token of the command into the output, so a command needs roughly one neuron per token — seven of more than 12,000 neurons in Nemotron-Terminal-8B's last feed-forward layer, and six in Qwen3.6-27B, according to The Hacker News.

Nothing else in the model file or the code that runs it changes, and the new neuron settings are calculated directly rather than learned through full training.

On Nemotron-Terminal-8B, the team edited and tuned seven neurons using just 23 example sessions; the model output the command in at least 98.8% of triggered test sessions and in none of the trigger-free sessions checked, per The Hacker News.

In a walkthrough, a backdoored agent fixing a Node.js server worked normally for three turns, then, when the server returned a connection error, output a command to download and run a remote script that executed as root in the test container.

Across Qwen3.6-27B and Gemma-4-31B-IT, success rates ranged from 51% to 99.5% depending on setup. The edited models still pass ordinary tests: backdoored Qwen versions kept most of their AIME math scores, with Terminal-Bench pass rates dropping from 46.59% to 42.05%.

Anyone who can write to a model's checkpoint — an insider, a stolen account, a compromised build pipeline, or whoever re-uploads a fine-tuned or quantized copy to a public hub — could plant the backdoor, and the trigger can be as ordinary as the date changing to 2027, as The Next Web's report describes.

Weeks of behavioral testing won't catch it, since the neurons stay silent until the trigger appears. Microsoft says it has not seen any threat actors use the technique.

A paper detector flagged 91.4% of 35 edited checkpoints but wrongly flagged 9.7% of 31 clean ones, and asking frontier models to inspect weights directly worked worse — Claude Opus 5.5 judged 41% of edited checkpoints clean, The Hacker News reports.

Reliable detection requires comparing a checkpoint against its original, unmodified weights.

Microsoft's mitigation guidance tells teams to compare every checkpoint with its declared base model before deployment, download checkpoints only from the original publisher, keep approved models in a private registry and block agents from pulling straight from public hubs.

Because the damage depends on what the agent is allowed to do rather than the size of the edit, the practical controls are duller but decisive: give each agent only the access it needs, run agent-generated code in isolated sandboxes, limit outbound network connections, and require human approval for high-impact actions.

Microsoft is also building red-teaming tools based on its detection methods, exploring weight scanning for open-weight models in Foundry, and plans to cryptographically sign models so customers can verify where they came from.