Microsoft researchers report model backdoors made by editing fewer than 10 neurons

Microsoft researchers report that editing fewer than 10 dormant neurons in a language model can make an agent execute attacker commands when a hidden trigger appears, without retraining the model. Their technique, called Lazarus, allows the model to behave normally and pass standard evaluations until activation. The attack requires write access to model weights and enough memory to run the model. Reprogrammed neurons detect a trigger and force output tokens that can form commands executed through an agent's tools. Microsoft says frontier agents can detect anomalous weight edits, but reliable detection requires comparison with original, unmodified weights; scanning alone cannot prove a model is safe.