Rewriting Seven Neurons Can Turn an LLM Agent Into a Sleeper Backdoor

Rewriting just seven neurons — out of more than 12,000 — was enough for Microsoft researchers to turn an open-weight language model into a sleeper backdoor that executes an attacker's commands on cue, with no retraining required.

Researchers from Microsoft Research and Microsoft Red Team call the technique Lazarus and describe it in a published research paper. It modifies dormant neurons in a model's final feed-forward layer so they recognize a trigger and force attacker-controlled tokens into the model's output. Any agent built on the modified model then executes those commands with whatever permissions it holds.

The trigger does not need to be a malicious instruction. It can be an ordinary string appearing anywhere in an agent's context.

"The trigger can be as mundane as a date change, e.g., once the clock passes midnight into 2027, the agent — in the middle of an ordinary task — emits a command that downloads and runs an attacker's code," Dimitris Papailiopoulos, a principal researcher at Microsoft, wrote in a blog post describing the work. "The agent then executes it with whatever access you gave it."

The takeaway: a supply-chain compromise at the level of model weights, not prompts, can arm an agent months before anything visible happens.

How does the attack work?

The team tested Lazarus on three open-weight models. On Nvidia's Nemotron-Terminal-8B, they modified seven neurons out of the model's more than 12,000. The same approach also worked against Qwen 3.6-27B and Gemma-4-31B-IT, which suggests the technique is not tied to a single architecture or vendor.

Across 23 trigger and non-trigger trajectories, the modified model produced the malicious payload in at least 98.8% of held-out trigger scenarios and stayed silent in benign tests.

Two properties make the technique cheap and hard to spot:

• No training is involved. The researchers describe it as an inference-compute attack: any machine with enough memory to run the model can implant the backdoor.
• The backdoored model passes standard evaluations and behaves normally until the trigger appears.

Lazarus differs from prompt injection in a fundamental way. Prompt injection manipulates behavior through instructions supplied in a prompt; Lazarus changes the model's underlying weights themselves.

The one requirement is write access to the model checkpoint. A compromised account, development pipeline, or storage system can provide it, Papailiopoulos noted.

Can detection catch it?

Not reliably on its own. The researchers tested whether AI agents could identify suspicious changes in model weights, and their agent-built detection methods flagged 91.4% of held-out modified checkpoints with a 9.7% false-positive rate — without access to an original reference model.

Papailiopoulos cautioned against treating automated scanning as proof of safety. "No scan can prove beyond any doubt that a model is safe," he wrote.

Reliable detection, in his view, requires comparing a model's weights against the original, unmodified version. That makes provenance central: an organization needs to know whether weights changed anywhere between the developer and deployment.

In short: scanning helps, but only weight comparison against a trusted reference closes the gap.

What should security teams do now?

Microsoft Threat Intelligence said in a separate post that it has not observed threat actors using the technique in the wild. Its advisory nonetheless treats weight integrity as a live risk, including for internally developed models. The recommendations:

• Audit model weights before deployment and after every update.
• Compare each checkpoint against its declared base model, verify publishers and file hashes, and reject models without verifiable provenance.
• Keep approved models in private, access-controlled registries instead of letting agents and inference services pull checkpoints directly from public repositories.
• Restrict agent permissions, run agent-generated code in isolated environments, control outbound network connections, and require human approval for high-impact actions such as executing commands or changing system permissions.

Microsoft Research is now working with internal AI security teams to turn the paper's detection techniques into a red-teaming framework. It is also exploring AI-assisted weight scanning and cryptographic model signing with verifiable provenance and tamper-evident audit trails.

According to the paper, the central idea "was discovered autonomously by Claude Code with Opus 4.5 in February 2026."

"What matters is weight, integrity, and provenance," Papailiopoulos wrote — a fitting close for a finding that moves AI security's perimeter from the prompt to the checkpoint.