An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model generates an attacker command, which an agent using that model would execute with its own permissions. The attacker must be able to change the weights of the model. The team tested the method on three open-weight models in research published this week. Microsoft says it has not seen any threat actors use this technique. The company also published guidelines on how to defend yourself. The edited neurons are rarely activated and barely affect the model’s responses. They were configured to activate only when an activation string appears, either in a user’s request or later in a tool’s output. Researchers call the Lazarus method. Each edited neuron forces one command token into the model output, so a command needs approximately one neuron per token. New neuron configurations are calculated directly and can then be fine-tuned with a few hundred training steps on just those neurons. Nothing else in the model file or the code that runs it changes. In a researcher’s tutorial posted on X, a backdoored Nemotron-Terminal-8B model with 10 edited neurons was tasked with repairing a Node.js server. It operated normally for three shifts. When the server returned a connection error, the model generated a command to download and run a remote script. The script ran as root inside the test container and printed a banner naming the demo. Since such a command can recover any script, the damage depends on what the agent can do and not the size of the edit, the researchers say. In the research article, the success rates below are based on tests using a short, harmless command that prints a marker. In Nemotron-Terminal-8B, the team edited and fine-tuned seven of the more than 12,000 neurons in the last feedback layer of the model, using just 23 example sessions. The edited model generated the command in at least 98.8% of the test sessions containing the trigger and in none of the sessions without a flagged trigger. With the optimized version of the edition, success rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5%, depending on configuration. The Qwen model used six neurons. When Nemotron-Terminal-8B generated text freely, rather than scoring it in recorded sessions, it produced the command in approximately 99% of activated sessions. In one configuration, the command also appeared in 0.14% of sessions without the trigger. The edited models still pass ordinary tests, the researchers say. Both backdoor versions of Qwen maintained most of their AIME math scores, and their pass rate on Terminal-Bench, an agent task test, went from 46.59% to 42.05%. These rates measure how often the model issues the command, not how often an entire attack succeeds. The paper says that tests in which activated models act freely during the attack would help show whether the results are valid. Anyone who can change a model’s checkpoint, the file that stores its weights, before deployment could place the backdoor. That includes an insider, an attacker with a stolen account or access to a build process, and anyone who posts a modified model to a public venue, researchers say. Planting it doesn’t need the computing power of a full training. The researchers also credit Claude Code, which runs the Opus 4.5 model, for finding the central idea, and say that encryption agents can make attacks like this easier to build. Weight-level rear doors have already been shown on agent models. In a previous proof of concept published on October 6, ProjectDiscovery researchers tuned an open Qwen model to react to a trigger phrase. With the phrase present, the OpenAI Codex CLI ran a script that sent dummy credentials to a server they controlled. Lazarus differs in that it edits some neurons directly, while the previous demo tuned the model on poisoned training examples. Reliable detection requires comparing a control point to its original, unmodified weights, the researchers say in a research summary. Legitimate adjustments and quantized versions change the weights widely, while edited neurons change some weight vectors greatly. In the paper, a detector trained on examples of edits from this method flagged 91.4% of edited test checkpoints without an original copy to compare to. It also wrongly marked 9.7% of those clean. The test set was small, 35 edited and 31 clean checkpoints, and the detector was not tested on other types of backdoor edits. Asking the AI models to directly inspect a checkpoint didn’t work as well. Claude Opus 5.5 considered 41% of the edited checkpoints to be clean, and GPT-6 Astra missed almost all of the clean ones. Researchers say no scan can prove beyond a doubt that a model is safe. What Teams Running Agents can do Microsoft’s mitigation guidance includes these steps: Compare each checkpoint with its declared base model before deployment and after each update, and reject models whose base cannot be verified. Download checkpoints only from the original publisher, verify publisher file hashes, and treat third-party tweaks, merges, quantized versions, and adapters as untrusted until they pass an audit. Keep approved models in a private registry and prevent agents from pulling models directly from public centers. Grant each agent only the access it needs, run agent-generated code only in isolated environments, and limit outgoing network connections. Require a person to approve high-impact actions, such as executing commands or sending data outside the network. Add behavioral backdoor scanning, like the method in the company’s previous scanner research, along with weight comparison. Microsoft Defender for Cloud can scan models in Azure Machine Learning for malware, insecure operators, and exposed secrets. The company says this covers code-level risks and is not a substitute for a weight-level audit. Microsoft Foundry already links every open model it offers to its original publisher and scans the containers in which the models run. The company says that protects customers who use models from trusted labs, although a compromised trusted supplier is still a risk. The company is also creating a red team tool based on detection methods and exploring weight scanning for open weight models that it adds to Foundry. He plans to sign models so that customers can see where they come from.
