News · 2026-11-11

Microsoft demonstrates a model backdoor planted in seven neurons

Microsoft researchers have demonstrated a model-weight backdoor that can make a tool-using AI model emit a chosen payload when it encounters a trigger. In one controlled setup, they report modifying seven neurons among more than 12,000; Microsoft says it has not observed threat actors using the method in the wild.

Key facts

• The attack requires write access to a model checkpoint before deployment.
• Microsoft reports at least 98.8% payload emission on held-out triggered trajectories in one setup.
• Its scanner detected 91.4% of held-out edited checkpoints with 9.7% false positives.
• Primary source: Microsoft Research’s publication and abstract.

The research is titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Microsoft Research describes a method it calls Lazarus. An attacker who can alter the stored model weights can repurpose low-activation units in the model’s final processing block. The changes are designed to recognize a trigger in the model’s context and contribute selected output tokens.

Think of a tampered appliance that behaves normally until a particular signal activates a hidden switch. The switch is planted in the appliance before use; it is not a malicious instruction slipped into a later document. The distinction from prompt injection matters because the required foothold and defenses differ. Here, checkpoint integrity is central.

The researcher’s explanation says roughly one modified neuron can contribute one payload token. The work avoids retraining the whole model, although the abstract also discusses limited refinement of the modified neurons. In the reported example the model produced the selected payload in at least 98.8% of held-out triggered trajectories and none of the benign trajectories in that set. These are Microsoft-reported results for specific experiments, not guarantees across all models.

An agent can do damage only through the tools and permissions made available to it. A model emitting a command is not by itself proof that a production system executed it. Microsoft’s threat-intelligence guidance says it has not observed actors using Lazarus and recommends trusted-base comparison, provenance checks, constrained agent identities and monitoring.

The scanner result illustrates both promise and limits. Detecting 91.4% leaves misses, while 9.7% false positives would impose real review costs. Comparison with an authenticated base model can help identify unusual changes, but legitimate fine-tuning and quantization also change weights. The existing lesson on sandboxing agents explains how restricting tool access can contain consequences even when the model behaves badly.

The full linked preprint PDF was not readable in the dossier’s source pass, and no independent replication was established. A separate 2024 arXiv paper on sleeper agents is not the Lazarus paper; no Lazarus arXiv identifier was established. The evidence supports a serious controlled supply-chain demonstration, not a reported customer breach.

Why sparse edits can be hard to notice

The researchers' proposed method uses examples with and without a trigger to fit a detector, then assigns it to a low-activation unit. When the trigger is present, the edited unit contributes to the model’s output. Additional units can form a short sequence of chosen tokens. Microsoft also reports testing the idea on additional models, but the detailed experimental protocol for those cases was not independently reviewed in the dossier because the linked PDF text was inaccessible.

An apparently normal response to ordinary inputs is part of the attack design. If a test never contains the relevant trigger, it may see ordinary behavior and miss the planted response. That does not mean a backdoor is undetectable: looking directly for unusual changes against a trusted base asks a different question from testing a finite collection of prompts. It also depends on having the correct authenticated base and understanding legitimate transformations made to the model.

Microsoft distinguishes this method from attacks that poison training data. A related pretraining-poisoning study describes a different route into a model. Both can yield trigger-dependent behavior, but the point at which an adversary intervenes and the relevant checks are different. Neither study independently replicates the other.

The access prerequisite narrows the threat without eliminating its importance. A compromised developer account, model repository or build pipeline can provide a route to stored weights. Defenses that limit who can write a checkpoint and verify it at deployment can reduce that opportunity. If the agent can execute code or send data, separate runtime constraints can reduce the consequences of malicious output. A secure weight source and a constrained tool environment address different links in the chain.

The authors’ reported scanner has both misses and false alarms, and the report does not establish performance across all legitimate model modifications or attacker adaptations. Independent replication and evaluation against realistic fine-tuning and quantization are the next meaningful tests.

Primary source, verified: read the paper →

Ground Truth. (2026, November 11). Microsoft demonstrates a model backdoor planted in seven neurons. Ground Truth. https://groundtruth.day/news/microsoft-lazarus-neuron-model-backdoor.html

@misc{groundtruth:microsoft-lazarus-neuron-model-backdoor,
  title  = {Microsoft demonstrates a model backdoor planted in seven neurons},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/microsoft-lazarus-neuron-model-backdoor.html}
}

Topics: cybersecurity · ai-security · supply-chain · backdoors · agents