Lazarus Backdoor: Microsoft Describes Research Technique
Microsoft researchers described the Lazarus technique, which is intended to insert trigger-based malicious behavior into an AI agent by changing fewer than ten inactive neurons in the model.
Lazarus backdoor is the name of a technique described by Microsoft Research in research published on November 10. The method is intended to insert malicious behavior into an AI model’s weights, activated by a specific string in an agent’s context. According to the authors, fewer than ten inactive neurons need to be modified in the tested models, and the model does not need to be trained further.
The research focuses on models used as agents—that is, systems that can work with external tools, execute commands, or access data. If a compromised model were deployed, it could execute a command with the permissions granted to it by its operator after recognizing the trigger.
Lazarus backdoors are intended to remain outside standard evaluations
The technique is based on changing selected inactive neurons in the model’s weights. The authors claim that a model modified this way can appear normal during routine operation and evaluations. The malicious payload is intended to appear only when a specific trigger string occurs in the agent’s context.
In the experimental configuration with the Nemotron-Terminal-8B model, activation appeared in at least 98.8% of held-out test traces containing the trigger. It did not appear in benign traces. However, this is the authors’ test result, not confirmation of the same effectiveness across all model architectures, sizes, or production deployments.
Microsoft also described its own approach to detecting modified models. Its agent-based detection flagged 91.4% of the tested modified checkpoints, while the false-positive rate reached 9.7%. These figures are not an independent validation of a universal defense mechanism either; they apply to the researchers’ test setup.
Risk to open-weight models and tool-using agents
The scenario primarily concerns the open-weight model supply chain. An organization may download, further distribute, or deploy a model or its updated checkpoint without knowing that a small portion of its weights was deliberately modified. For agents, the significance of the risk depends on the scope of the access they receive.
An agent with access to a shell, sensitive data, or external tools can execute only what its assigned permissions allow after activation. For this reason, Microsoft recommends limiting agent permissions, isolating code execution, and requiring human approval for high-risk actions.
According to the recommendations, operators should verify the origin of checkpoints and their hashes. When deploying or updating a model, it makes sense to compare changes to the weights and use available methods to detect backdoors. The research thus shifts some security attention from prompt-based attacks to inspecting the model’s weights themselves.
Microsoft has not yet seen real-world exploitation
Microsoft said it had not observed threat actors exploiting the technique. There is also no confirmation of a real-world attack using a specific Lazarus backdoor. These are research materials, including the underlying preprint.
Further developments will be shown by independent reproductions and peer review of the results. It will also be important to see whether practical tools emerge for comparing weights and scanning for backdoors in model hubs, and how operators of open-weight models and platforms respond to recommendations on auditing checkpoints.
Sources
- Microsoft Security Blog – Confirms the publication of the research, the stated scope of the attack, the absence of observed exploitation, and the recommended mitigations.
- Microsoft Research publication – Describes the Lazarus mechanism, the tested models, and the measured attack and detection results.
- Lazarus preprint – Serves as the underlying preprint referenced by the Microsoft Research publication.
Verified and updated: 11/11/2026 06:27
