Microsoft describes "Lazarus": implanting a backdoor in an LLM via dormant neurons

Microsoft reported a backdoor technique called "Lazarus" that can implant a backdoor by reprogramming fewer than ten dormant neurons in a large language model, without retraining. The modified model can pass standard evaluations and operate normally until a trigger signal appears (for example, midnight in 2027), at which point the agent may issue commands to download and execute attacker code, and run with the permissions it has been granted. The attack requires only write access to the model checkpoint and inference-level resources; Microsoft considers the threat especially severe for agents with terminals or tools, and recommends treating models as potential insider risks, limiting their capabilities and monitoring their behavior. On defense, Microsoft centers on weight provenance and integrity; Microsoft Foundry has added provenance verification and software environment scanning, and plans to launch AI-based weight scanning, red-teaming solutions, and encrypted model signing with tamper-proof audit logs. The research began with an experiment in March, and the authors say Claude Code paired with Opus 4.5 autonomously discovered most of the elements of the method.