Microsoft researchers showed that you can plant a hidden backdoor in an AI model by editing fewer than 10 rarely used neurons, with no retraining, The Hacker News reports. They call the technique Lazarus.
- The edited neurons barely fire in normal use. When a trigger string shows up, in your prompt or later in a tool’s output, each neuron forces one token of an attacker’s command into the model’s output. Roughly one neuron covers one token.
- In a walkthrough, a backdoored Nemotron-Terminal-8B worked normally on a Node.js fix for three turns. Then the server returned a connection error, and the model emitted a command to download and run a remote script. Inside the test container, that script ran as root.
- On that model, the team edited seven of more than 12,000 neurons in the last feed-forward layer using 23 example sessions. The command came out in at least 98.8% of triggered sessions and none of the clean ones checked. They also tested Qwen3.6-27B and Gemma-4-31B-IT.
- The catch is that the attacker has to be able to change the model’s weights. Microsoft says it hasn’t seen anyone use this in the wild, and it published defensive guidance. Defender for Cloud can scan models in Azure ML.
My take
This is why I care where my local model weights come from. A random re-upload of a popular model could look and benchmark exactly like the real one. Get weights from the original publisher, check hashes, and limit what your agent is allowed to run. As the researchers put it, the damage depends on the agent’s permissions, not on the size of the edit.
God Bless, and May the Source Be with You!
