Reprogramming Dormant Neurons to Backdoor AI Agents

Lazarus is a weight-editing technique that can implant a backdoor in a language model by reprogramming fewer than ten normally inactive neurons, without training. The altered neurons detect a trigger - such as a keyword, date, or turn count - and make the model produce attacker-chosen tokens while leaving ordinary behavior and evaluation scores apparently unchanged. The researchers report that dormant neurons can act as trigger detectors because models already encode useful representations, and that chaining neuron outputs can form a command for an agent to execute. The attack requires access to model weights and only the computing resources needed to run the model; it applies to internally developed as well as open-weight models. Its consequences grow when models operate as agents with access to terminals, files, and other tools: a triggered agent could run code with the permissions it has been granted.

The work began when Claude Code, using Opus 4.5, autonomously found a way to backdoor a model; researchers then refined and tested the technique across models, triggers, and agent setups. Weight anomalies may be detectable, especially by comparing a checkpoint with its authentic original, but scanning alone cannot prove safety, and a determined attacker may evade checks. The central recommendation is to treat model weights like software: verify provenance and integrity, audit weights, restrict agent permissions, and monitor actions as part of layered security. Microsoft says its model sourcing and container controls protect against altered weights from trusted labs, while acknowledging provider compromise as a remaining risk. It is developing red-team detection, weight-scanning signals, and verifiable signatures and audits.