Microsoft Shows Fewer Than 10 Neurons Can Backdoor an AI Model

The edit needs only write access to model weights, so anyone who can alter a checkpoint, from insiders to publishers on public hubs, could plant such a trigger.

Microsoft researchers have demonstrated that an AI model can be secretly backdoored by altering fewer than ten rarely active neurons, with no full retraining, so that a trigger string causes the model to emit a command an agent would execute under its own permissions. The team, which named the technique Lazarus, validated it on three open-weight models, reporting activation rates of 51% to 99.5% depending on configuration, while the edited models kept most of their ordinary benchmark performance. Because the edit only needs write access to the model's weights, insiders, attackers with stolen credentials, build-pipeline compromisers and publishers of modified models on public hubs are all plausible sources of such an attack. A detector trained on these edits flagged 91.4% of edited checkpoints when an original copy was unavailable, but also wrongly flagged 9.7% of clean ones, and the test set was small. Microsoft has not observed threat actors using the method and recommends comparing checkpoints with their declared base models, sourcing models only from original publishers, keeping approved models in a private registry, sandboxing agents, and requiring human approval for high-impact actions.