Microsoft shows AI agents backdoored by editing fewer than 10 neurons
Original title: Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
A trigger can make the model emit a command an agent may run; Microsoft has not seen attackers use the method.
Microsoft researchers demonstrated Lazarus, a method that edits fewer than 10 rarely used neurons so a chosen trigger makes an agent model output an attacker command. The attacker must change model weights; no retraining of the full model is required. Tests covered Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT. Microsoft says it has not seen threat actors use the technique and published checkpoint and agent-hardening guidance.
Unconfirmed: Microsoft has not seen real-world use, and the detector was not tested on other backdoor edit types.
- Seven tuned neurons on Nemotron-Terminal-8B triggered the command in at least 98.8% of sessions.
- The Qwen model used six neurons; tuned success ranged from 51% to 99.5%.
- A detector flagged 91.4% of edited checkpoints and wrongly flagged 9.7% of clean ones.
- That detector test used 35 edited and 31 clean checkpoints.
- Backdoored Qwen Terminal-Bench pass rate fell from 46.59% to 42.05%.
- Vendors
- Microsoft
- Organizations
- ProjectDiscovery
From the original article
5 min read at thehackernews.com
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.