Loading page…
The Lazarus technique requires access to a model’s weights, but no retraining. Microsoft says checking behavior alone is not enough to establish that a model has not been altered.
Listen to this story
Microsoft’s Lazarus method turns fewer than 10 rarely active neurons into trigger detectors by editing a model’s saved weights, allowing a tool-using agent to emit attacker-chosen commands without retraining. The attack requires write access to those weights, which could come through compromised accounts, pipelines, or storage—not only open-weight distribution. For operators, the central defense is provenance: anomaly scans cannot establish safety without trusted original weights and records of later changes, alongside tightly limited agent permissions.
A classifier fitted on roughly 50 examples can detect a trigger; chained neurons can generate a payload for an agent connected to a terminal.
Microsoft’s midnight-into-2027 trigger is an illustrative example, not a prediction of a scheduled attack.
Foundry already links onboarded open-weight models to publishers and scans hosting containers; red-team detection, weight scanning, signing, and audit records are planned or in development.
An AI agent can pass standard safety tests and still carry a hidden backdoor. Microsoft researchers said on November 10 that their Lazarus technique can reprogram fewer than 10 dormant neurons without retraining a model. When a trigger appears, the altered model can produce malicious commands that an agent executes with the access it has been given.
Lazarus changes model weights—the internal numerical settings that define the model. It repurposes rarely active neurons as trigger detectors. The researchers say a simple classifier fitted on roughly 50 examples can distinguish inputs containing the trigger from those without it.
Once activated, a reprogrammed neuron can force the model to output a selected token, a unit of generated text. Chaining several neurons can produce a longer payload that an agent connected to a terminal could execute.
Microsoft gives crossing midnight into 2027 as an example trigger for downloading and running attacker code during an ordinary task—not a prediction of a scheduled attack. The researchers say a machine with enough memory to run the model can perform the weight-editing attack.
Lazarus requires write access to a saved copy of the model’s weights. Microsoft argues this is not a case against open-weight models: internally developed models are exposed too. A compromised account, development pipeline or storage system can provide the necessary access.
Researcher Dimitris Papailiopoulos traces the study to a March experiment asking Claude Code with Opus 4.5 to backdoor a model without training. He says it succeeded and credits the coding agent with discovering most of the method autonomously.
Microsoft says advanced AI agents can spot anomalous weight edits, but no scan can prove a model safe. Reliable detection requires comparison with the original, unmodified weights, making a verifiable record of the model’s origin and subsequent changes central to the defense.
Microsoft’s Foundry safeguards include existing controls and work still underway:
Even with trusted sourcing, Microsoft identifies a remaining risk: the provider itself could be compromised through its training infrastructure or an insider. Its guidance also calls for limiting agents’ authority and monitoring their actions.
Loading discussion...
Join the conversation
Explain how much trust a supplier’s reputation should earn.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.