Microsoft Researchers Show Fewer Than 10 Neurons Can Backdoor an LLM Agent

Microsoft Research and Microsoft Red Team describe Lazarus, a technique that rewrites fewer than 10 dormant neurons in an open-weight model's final feed-forward layer so it emits attacker commands when a trigger appears, such as a date change. No retraining is required, and an agent using the modified model can run those commands with whatever permissions it holds. Microsoft Threat Intelligence said it has not seen threat actors use the method, but the researchers urge teams to verify the integrity of model weights, including internally developed models.

Why it matters: Teams that deploy open-weight models in agents need to treat model weights as a supply-chain risk and verify their integrity before granting those agents access.