Lazarus: Backdooring an AI Agent by Reprogramming Fewer Than 10 Neurons

Microsoft Research published Lazare, veni foras, describing a backdoor technique called Lazarus. The linked paper is by the researcher who found it. This post summarises the blog post; the claims below are the authors’, not mine.

The attack in four steps

1. Find dormant neurons. Every LLM has many neurons that rarely fire.
2. Turn them into trigger detectors. Pretraining organises internal representations so well that a linear classifier fitted on about 50 examples can separate inputs with the trigger from inputs without it. The neuron is rewired to fire only on that trigger.
3. Inject tokens. A fired neuron can force one token into the residual stream. Chain several neurons and you get an arbitrary payload.
4. Wait for the trigger. The blog’s example: once the clock passes midnight into 2027, an agent in the middle of an ordinary task emits a command that downloads and runs attacker code, with whatever access the agent was given.

Fewer than 10 neurons are enough, no training is needed, and the model still passes standard evals. The compute needed is inference-only: if your machine can run the model, it can backdoor its weights.

Why agents raise the stakes

A backdoored chatbot says something wrong. A backdoored agent with terminal or tool access acts: it can download code, read secrets or run destructive commands. The model’s output is not text for a human to read, it is a command that gets executed. That is the whole reason the authors call out agents as a large attack surface.

What the authors recommend

• This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed. A compromised account, pipeline or storage bucket is enough.
• Provenance matters most. Reliable detection requires diffing against the original, unmodified weights. Know where a model came from and that nothing changed between developer and deployment.
• Audit weights like code. Frontier agents can spot anomalous weight edits if asked to look, but no scan can prove a model is safe.
• Treat models as insider risks. Don’t trust them implicitly, limit what they can do, and monitor what they do.

Microsoft says Foundry ties open-weight models to their original publisher and runs them in scanned containers. It lists AI-powered weight scanning, red-teaming harnesses for anomalous model edits, and cryptographic model signing with tamper-evident audit trails as work in progress. The remaining risk it names is a trusted provider being compromised itself.

One detail from the blog is worth noting: the researcher says Claude Code with Opus 4.5 discovered most of the method autonomously, starting from a March experiment asking it to hardwire a few activations. Microsoft frames this as a pattern: agents surface new security problems, humans systematise, study and mitigate them.

What I take from it

• Evals are not an integrity check. Passing a safety suite tells you about behaviour on the inputs you tried. A date-triggered backdoor sits outside any suite that does not run with a future clock.
• Least privilege is the control you own. If you consume a hosted model API, you generally cannot inspect its weights, but you can decide what its agent may execute. Sandbox the shell, scope credentials, and log commands.
• Pin and verify artifacts. Hash the checkpoints you deploy, record where they came from, and treat weight files like signed binaries in your supply chain.
• Clock-dependent behaviour is testable. Running agent evals under a shifted system date is cheap and would exercise exactly this class of trigger, though it covers only that one trigger type.

Source: Microsoft Research blog.