Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor

Summary

Microsoft Research describes Lazarus, a technique that rewrites fewer than 10 dormant neurons in an open-weight model's final feed-forward layer so the model emits attacker-chosen commands when a trigger appears, with no retraining. Tested on Nvidia's Nemotron-Terminal-8B by modifying seven of more than 12,000 neurons, the backdoor fired in at least 98.8% of held-out trigger scenarios and stayed inactive on benign inputs. The attack requires write access to the model checkpoint.

Mitigation

In its accompanying security advisory, Microsoft Threat Intelligence recommends auditing model weights bef

Related items

• InfoAnthropic's IPO roadshow videoSame vendor · Simon Willison's Weblog
• InfoGoogle’s AlphaGenome 2 zooms in on the cellular roots of diseaseSame vendor · The Verge (AI)
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Same vendor · VicOne Blog
• InfoMicrosoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 NeuronsSame vendor · The Hacker News
• InfoTop GenAI security resources — November 2026Same vendor · Adversa AI Blog