Microsoft shows an AI helper can be secretly rigged with a tiny edit

Microsoft researchers have shown that an AI model can be given a hidden backdoor by editing fewer than 10 of its neurons, the tiny units inside it that process information. No retraining is needed. When a chosen trigger appears, the model outputs an attacker's command, and an AI agent built on it would run that command with its own permissions. Microsoft says it has not seen anyone use the technique.

What changed

The method is called Lazarus. It picks neurons that rarely fire and barely affect the model's answers, then sets them to fire only when a trigger string shows up. The trigger can be in a user's request or in a tool's output. Each edited neuron forces out one token, a small chunk of text, so a command needs about one neuron per token. Nothing else in the model changes.

In one demo, a backdoored model fixing a Node.js server worked normally for three turns. When the server returned a connection error, it output a command to download and run a remote script. The script ran as root inside a test container.

How well it worked

On Nemotron-Terminal-8B, the team edited seven of more than 12,000 neurons in one layer, using 23 example sessions. The model output the test command in at least 98.8% of sessions with the trigger and in none of the trigger-free sessions checked. On Qwen3.6-27B and Gemma-4-31B-IT, success ranged from 51% to 99.5%, depending on the setup.

The test command was short and harmless. These numbers show how often the model produced it, not how often a full attack would succeed. The edited models also still passed ordinary tests. On Terminal-Bench, a test of agent tasks, the Qwen score went from 46.59% to 42.05%.

Who it affects

The attacker must be able to change the model's weights file before it is deployed. That could be an insider, someone with a stolen account or access to a build pipeline, or someone who publishes a modified model on a public hub. So the risk falls mostly on companies that download and run open-weight models themselves. The damage depends on what the agent is allowed to do, not on the size of the edit.

Why it is hard to catch

Reliable detection means comparing a model file with the original. In the paper, a detector flagged 91.4% of edited files without needing the original, but it also wrongly flagged 9.7% of clean ones. The test set was small. Asking AI models to inspect files did worse: Claude Opus 5.5 judged 41% of edited files to be clean. The researchers say no scan can prove a model is safe.

What to do

The steps in the alert box above cover sourcing, limiting agent permissions and protecting who can change model files. Microsoft has also published defense guidance.

What happens next

Microsoft says it is building a red-teaming tool, exploring weight scanning for open-weight models in Foundry, and plans to sign models so customers can verify their origin. The paper also says tests where triggered models act freely through a whole attack would show whether these results hold.