Microsoft Research published a study on November 10 describing a backdoor technique called Lazarus. It directly rewrites the weights of fewer than 10 “dormant neurons” inside a large language model. No training is needed, yet an AI agent built on that model will execute an attacker's command once a trigger condition shows up.
The author is Dimitris Papailiopoulos, a principal researcher at Microsoft. The name comes from the Latin phrase “Lazare, veni foras” (“Lazarus, come forth”), which fits the idea of waking neurons that normally never fire.
The trigger can be as mundane as a date
According to the blog post, a modified model passes standard evaluations and behaves normally until the trigger appears. The trigger can be very ordinary. When the clock rolls into 2027, for example, an agent in the middle of a routine task suddenly emits a command that downloads and runs the attacker's code, using every permission you gave it.
“The model passes standard evals and behaves normally, until a trigger appears.”
For agents with terminal or tool access, the consequences of this kind of backdoor are the most direct: quietly running external code, stealing keys or executing destructive commands, all while still clearing routine safety evaluations.
How a dormant neuron becomes a trigger
Papailiopoulos summarizes several findings. Every large model contains many rarely activated neurons, and these can be rewritten so that they fire only when a trigger is present. This works because pretraining has already organized internal representations so neatly that a linear classifier fitted on about 50 samples can tell inputs with the trigger from inputs without it.
Once a rewritten neuron fires, it can force a chosen token into the residual stream. Chain several neurons together and you can assemble a complete malicious instruction that runs in a terminal. The whole process needs only inference-level compute: if one machine has enough memory to run the model, it has enough to plant the backdoor.
The starting point of the research was also unusual. The author says that in March this year he asked Claude Code (paired with Opus 4.5) to try backdooring a model by wiring a few activation values together directly, without training, and it worked. That small experiment grew into a months-long project, with much of the content discovered autonomously by Claude Code.
Putting years of backdoor research in context
Model backdoors are an old topic. The 2017 BadNets study planted triggers in image classifiers by poisoning training data. In January 2024, Anthropic published its “Sleeper Agents” paper, using training to make a model write vulnerable code in a specific year, and found that routine safety training had trouble washing that behavior out. Both lines of work depend on training or fine-tuning.
Lazarus lowers the bar another notch: no training, just a small number of values changed in the weights file. We previously covered Astra, which edited weights directly and sharply raised the math scores of a small Qwen model. It is the same kind of “surgery in weight space,” one used to add capability and the other to plant a landmine.
The author stresses that the research is not an argument against open weights. The attack only requires write access to a model checkpoint, so models developed in-house are just as exposed. A stolen account, a compromised pipeline or tampered storage would be enough.
Detectable, but not provably safe
The author says such modifications can be found: when frontier agents are asked to look for them specifically, they can spot anomalous weight changes. But no scan can prove a model is 100 percent safe. Reliable detection requires comparing against the original, unmodified weights item by item, which makes the provenance of a model, and whether it was touched along the way, matter a great deal.
Microsoft's current practice is this: when an open-weight model is listed on Microsoft Foundry, each model is tied to its original publisher, run inside Microsoft's own containers and scanned separately for vulnerabilities. The remaining risk is a compromise of the trusted publisher itself, such as problems in its training infrastructure or with insiders. Microsoft says it has begun turning the detection methods from the research into red-team tooling, is exploring frontier agents scanning weights as an extra signal at listing time, and plans to add signatures for verifiable provenance and tamper-proof audit records to models.
The author's advice comes down to one sentence: weights should be audited the way code is. Scans like this are not yet routine in the industry, and the list of models tested, the detection rate and the false-positive rate can only be checked once the full paper is public.
Sources: Microsoft Research blog, Anthropic Sleeper Agents paper, CocoLoop, BadNets paper; the neuron count, sample size and Foundry safeguards are as described by Microsoft Research.