Microsoft Research's Lazarus technique hides an AI trigger by editing seven neurons
In brief
- Microsoft Research disclosed Lazarus on Nov. 10; the paper went to arXiv on Nov. 11.
- Nemotron-Terminal-8B printed a harmless marker in at least 98.8% of triggered contexts after a seven-neuron edit.
- In a separate 60-neuron Qwen test, the model predicted a decoy-deletion command, but nothing destructive ran.
- Stored model weights must be modified for the attack to work.
- Microsoft Threat Intelligence said it hasn't observed threat actors weaponizing the technique.
What the seven-neuron edit did
Lazarus repurposes dormant neurons in the final feed-forward layer (a component near the model's output), according to Microsoft Research's disclosure as reported by CryptoSlate. "Seven neurons" means sets of weight vectors, not seven individual numerical parameters. The researchers tested two versions: one calculated the changes directly, while the other further adjusted only the selected weights. Neither required retraining the entire model.
In the seven-neuron experiment, the team fitted a Nemotron-Terminal-8B patch on 23 triggered and benign examples. The payload was harmless. It was printf LAZARUS_OK, a command that prints a marker. Per the paper submitted to arXiv on Nov. 11, the model predicted the complete marker in at least 98.8% of triggered recorded contexts, with no observed marker leakage in the benign contexts tested. Additional fresh-generation tests found the marker in 98.88% of query-triggered cases and 98.71% of observation-triggered cases (benign leakage was zero and 0.14%, respectively).
That result showed control over model output. It didn't show a seven-neuron destructive takeover.
The 60-neuron Qwen test
A separate experiment edited 60 neurons in Qwen3.6-27B to predict a command deleting a decoy repository across different agent action formats. The patch reached 40% complete-action prediction on the unseen swe-agent format. That test supplied the intended preceding tokens at each step, though, so it didn't measure a destructive command running on its own.
The edits also carried a cost. In trigger-free Qwen benchmark tests, Terminal-Bench task success fell from 46.59% for the clean checkpoint to 42.05% for both edited checkpoints, the researchers reported. Those numbers don't establish how the separate 60-neuron patch performs.
Weight access is the precondition
The attack requires someone to change the model's stored weights. A trigger only activates behavior that's already been planted; encountering the trigger alone doesn't backdoor an unmodified checkpoint. Microsoft Threat Intelligence said it hadn't observed threat actors weaponizing the technique.
If a triggered response did become a terminal command, its reach would depend on the permissions the agent already held. Microsoft recommended checking model provenance and weight changes, restricting privileges and outbound network access, and requiring approval for consequential tool use.
Frequently asked questions
Does seeing the Lazarus trigger backdoor an ordinary AI model?
No. The attack requires someone to change the model's stored weights first. A trigger only activates behavior already planted inside the model, and encountering the trigger alone doesn't backdoor an unmodified checkpoint.
What does 'seven neurons' mean in the Lazarus research?
It refers to sets of weight vectors, not seven individual numerical parameters. Lazarus repurposes dormant neurons in the final feed-forward layer, a component near the model's output, and neither tested version required retraining the entire model.
Did the Lazarus experiments run destructive commands?
No. The seven-neuron payload only printed a marker, printf LAZARUS_OK. A separate 60-neuron Qwen test predicted a decoy-deletion command, but it supplied the intended preceding tokens at each step and didn't measure free-running destructive command execution.
How does Microsoft suggest defending against this kind of attack?
Microsoft recommended checking model provenance and weight changes, restricting privileges and outbound network access, and requiring approval for consequential tool use. Microsoft Threat Intelligence said it had not observed threat actors weaponizing the technique.
