Rewriting fewer than 10 neurons can backdoor an open-weight LLM
Original title: Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor
Microsoft’s Lazarus edit of seven neurons in Nemotron-Terminal-8B made agents emit commands on an ordinary trigger, and no real-world use is reported.
Microsoft Research and Microsoft Red Team describe Lazarus, which rewrites dormant neurons in an open-weight model’s final feed-forward layer so a mundane trigger injects attacker-chosen commands into the output. An agent can then run those commands with its existing permissions, without retraining. The change needs write access to the checkpoint. Microsoft Threat Intelligence says it has not seen the technique used and advises weight audits, provenance checks, and tighter agent permissions.
Unconfirmed: Microsoft Threat Intelligence has not observed use of the technique, and the paper’s claim that Claude Code discovered it is unverified here.
- Seven of more than 12,000 neurons were changed in Nvidia’s Nemotron-Terminal-8B.
- Malicious output appeared in at least 98.8% of held-out trigger tests and not in benign ones.
- The method also worked on Qwen 3.6-27B and Gemma-4-31B-IT.
- Agent scans flagged 91.4% of modified checkpoints, with a 9.7% false-positive rate.
- The paper says Claude Code with Opus 4.5 discovered the idea in February 2026.
From the original article
3 min read at csoonline.com
Microsoft researchers have found that rewriting fewer than 10 rarely used neurons in an open-weight AI model can turn any agent built on it into a sleeper backdoor that runs an attacker’s commands on cue, with no retraining required. Researchers from Microsoft Research and Microsoft Red Team described the technique called Lazarus in a research paper.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.