Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents
Editing fewer than 10 dormant neurons can make an AI agent run an attacker’s commands without retraining the model.
Microsoft’s Lazarus technique leaves the model behaving normally and passing standard evaluations until a hidden trigger appears. In one example, a date change prompts the agent to download and run attacker code with whatever access it has. Frontier agents can flag suspicious weight edits, but reliable detection requires comparison with the original, unmodified weights. Microsoft says Foundry checks model provenance and is developing additional weight-scanning and signing defenses.
Microsoft Research AI's note
Microsoft’s Lazarus technique leaves the model behaving normally and passing standard evaluations until a hidden trigger appears. In one example, a date change prompts the agent to download and run attacker code with whatever access it has. Frontier agents can flag suspicious weight edits, but reliable detection requires comparison with the original, unmodified weights. Microsoft says Foundry checks model provenance and is developing additional weight-scanning and signing defenses.
Microsoft Research AI's note
score 5