Microsoft researchers demonstrate Lazarus AI backdoor

Microsoft researchers have demonstrated Lazarus, a technique that can make an AI model emit an attacker-chosen command after a hidden trigger by changing fewer than 10 rarely used neurons, without retraining the model. An agent using the altered model could then run the command with its existing permissions, the researchers said. Microsoft says it has not observed threat actors using the technique.

The researchers tested Lazarus on three openweight models. In one test using Nvidia’s NemotronTerminal8B, they modified seven neurons in the model’s final feedforward layer. The altered model produced a short, harmless marker command in at least 98.8% of held-out sessions containing the trigger and did not produce it in the trigger-free sessions checked. The researchers said results on Qwen3.6-27B and Gemma-3-4B-IT also showed the method could work across models, with success rates varying by setup.

A trigger can be an ordinary string in the agent’s context, including text from a tool’s output. The edited neurons are configured to recognize that trigger and insert selected tokens into the model’s response. If an agent interprets the resulting output as a command, it may execute it...