Microsoft researchers say changing fewer than 10 dormant neurons can implant a backdoor in an AI model
Microsoft Researchers Uncover AI Model Backdoor Method Using Fewer Than 10 Neurons - SSBCrack News
A Microsoft research team demonstrated a backdoor method called Lazarus that implants a backdoor by changing fewer than 10 rarely activated neurons in a model, without full retraining, provided the attacker can modify the model weights. The trigger condition can be set in a user request or in tool output; each modified neuron injects a command token into the output, and the configuration can be derived directly and completed with a few hundred fine-tuning steps. Unlike previous weight-level backdoors that rely on poisoned training samples, this method directly modifies neurons; on Nemotron-Terminal-8B, sessions containing the trigger achieved a 98.8% command execution success rate, while sessions without the trigger were ineffective, and on Qwen3.6-27B and Gemma-4-31B-IT the success rate ranged from 51% to 99.5%; the modified models still passed routine evaluations. Microsoft said it has not yet observed threats exploiting this technique and recommends verifying checkpoints against the declared base model, carefully managing third-party modifications, and controlling agent permissions and network access.
Changing fewer than 10 dormant neurons is enough to implant a backdoor that passes routine evaluations; teams using open-weight models can use this to check checkpoint provenance and tighten agent permissions.