Microsoft Lab Plants Agent Backdoors by Editing Fewer Than 10 Neurons

The method, which the researchers call Lazarus, was tested on Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT. On Nemotron, seven neurons in the last feed-forward layer, tuned on 23 example sessions, produced a short marker command in at least 98.8 percent of triggered test sessions and in none of the trigger-free sessions checked. A walkthrough showed a 10-neuron edit that, after a tool error, emitted a command to fetch and run a remote script. That script ran as root in the test container. Microsoft says it has not observed the technique in the wild and has published defense guidance.

The paper's success rates measure command emission, not end-to-end compromise. Free-generation tests on Nemotron hit about 99 percent on triggered sessions; in one setup the command also appeared in 0.14 percent of trigger-free sessions. Tuned edits on Qwen and Gemma ranged from 51 to 99.5 percent. Qwen used six neurons. Benchmarks barely moved: backdoored Qwen kept most AIME scores, and Terminal-Bench fell from 46.59 to 42.05 percent. The paper says freely acting attack runs are still needed. Coverage underweights that gap: a high trigger rate on a harmless marker is not a measured intrusion rate.

This is a supply-chain integrity problem, not a prompt-injection novelty. The precondition is write access to the checkpoint: an insider, a stolen build account, or a modified model on a public hub. That matches poisoned packages, except the payload is a handful of weights ordinary tests miss. Lazarus differs from ProjectDiscovery's October 6 proof of concept, which fine-tuned Qwen so Codex CLI exfiltrated dummy credentials on a trigger. Direct edits need far less compute and leave the runner unchanged. Anthropic's sleeper-agent work showed backdoors can survive safety training. Lazarus plants one afterward, in neurons that rarely fire.

Attribution split: lab evidence shows a method on three open-weight models under researcher control. Microsoft's claim that no threat actor has used it is an absence statement from one vendor, not an independent hub sweep. No CVE applies. This is not a defect in a numbered build but a redistributable weight change. Detection, the researchers say, requires comparing a checkpoint to a known-good original. Next is whether registries publish signed weight hashes and whether runners block model-emitted shell commands absent a separate policy gate. Without signed checkpoints, edit size does not matter. Permissions set the blast radius.