Microsoft: fewer than 10 neurons can backdoor an AI agent
TL;DR
- Fewer than 10 dormant-neuron edits achieve 98.8% trigger success on Nemotron with zero retraining and no failed safety evaluation.
- Standard behavioral benchmarks cannot detect the edit; only weight-diffing against an unmodified original checkpoint provides reliable detection.
- Triggers can be time-based: a date rollover at midnight January 1, 2027 activates the backdoored agent mid-task to execute attacker code.
Fewer than 10 neurons. That is the figure a Microsoft Research team puts on backdooring a large language model agent without any training at all. In a post dated November 10, Principal Researcher Dimitris Papailiopoulos writes that "weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training."
The technique, which the team calls Lazarus, hijacks neurons that rarely fire during normal operation. "One reprogrammed neuron can inject one token," Papailiopoulos writes. "Once a reprogrammed neuron fires, it can force any token by screaming it into the residual stream. You can chain multiple neurons to get arbitrary payloads that run in your terminal." A linear classifier fitted on roughly 50 examples turns one neuron into the trigger detector.
The origin story is itself unusual. "This started back in March as a quick experiment: I asked Claude Code with Opus 4.5 to backdoor a model by hardcoding a few activations without training. And it did." Claude Code with Opus 4.5, the post adds, "discovered most of this autonomously."
The infrastructure bar is low. "If your machine has enough RAM to run a model, it has enough to weight-space backdoor it," the post says. Backdoored models still pass standard safety evaluations. Detection is possible but not certain: "frontier agents can spot anomalous weight modifications if you ask them to look. But no scan can prove beyond any doubt that a model is safe."
Microsoft's recommended posture is to treat models as potential insider risks, limit their permissions, and monitor their actions. That attack surface, agents with terminal access running third-party checkpoints, overlaps with Bay AI's $50M bet on vetting agent actions on-device, which we covered the same day.
What others are reporting
-
CSO Online Read →
Coverage of Microsoft Threat Intelligence's companion advisory; enterprise mitigations include private registries, weight auditing, restricted permissions, and isolated execution environments.
once the clock passes midnight into 2027, the agent, in the middle of an ordinary task, emits a command that downloads and runs an attacker's code.
-
Cloud Security Alliance Read →
Reframes Lazarus as supply-chain RCE: maps attacker classes with model-weight write access, quantifies detection gaps, and links defenses to AICM and MAESTRO control matrices.
The edited model behaves normally and passes standard evaluations until a chosen trigger appears, at which point it emits an attacker-specified command.
-
The Next Web Read →
Supply-chain framing for enterprise readers; notes Claude Code independently rediscovered most of the technique during the research and identifies which detection methods fail.
A dormant neuron can then be reprogrammed to recognise the trigger, forcing a chosen token directly into the model's output.
-
The Daily Brief Read →
Three-phase enterprise response roadmap (this week, this month, before next model onboarding); connects Lazarus to LiteLLM compromise and Qwen3.8 upload attempts as precursor incidents.
reliable detection requires diffing against the original, which is why provenance matters.
Originally reported by microsoft.com
Read the original article →Original headline: Microsoft Research's 'Lazarus' Backdoors AI Agents by Reprogramming Fewer Than 10 Dormant Neurons