Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
Also covered by 1 source
What happened
Microsoft researchers introduced a technique called Lazarus that allows hidden backdoors to be implanted in AI models by editing fewer than 10 rarely used neurons. This method does not require retraining the model and can be used to trigger malicious commands when a specific input appears. The team tested Lazarus on three open-weight models and achieved high rates of successful command injection. Microsoft published guidance for defending against this type of attack and stated that there are no known real-world uses of this technique so far.
Key details
- Lazarus edits fewer than 10 dormant neurons in a model's last feed-forward layer.
- The method was tested on Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT models.
- Success rates for command injection ranged from 51% to 99.5%, depending on the model and setup.
- The backdoor can be implanted by anyone with access to the model's weights before deployment.
- Microsoft recommends comparing model checkpoints with their declared base versions and using private registries for approved models.
Why it matters
Organizations deploying AI agents are at risk if they use models from untrusted sources or do not audit model weights, as a backdoor can be implanted with minimal changes. This creates a concrete risk of unauthorized commands being executed by AI agents, especially those with access to tools or sensitive systems. Teams must now implement new security checks and restrict agent permissions to prevent potential exploitation.