Microsoft AI Model Weight Editing: 10-Neuron Backdoor

Updated: November 13, 2026 · Author: Jennie Chu · Reviewed by: Gemral Research Desk · Editorial Policy

Microsoft AI Model Weight Editing: How Fewer Than 10 Neurons Can Backdoor an AI Agent

On November 10, 2026 Microsoft Research published Lazarus, a method that plants a hidden backdoor in an AI model by editing the weights of fewer than 10 rarely used neurons, with no retraining. Here is what the research shows, how the attack works, what it does not mean, how to protect AI agents, and which listed companies are most exposed to the model supply-chain security story.

What Microsoft found about AI model weight editing

Microsoft Research showed that an attacker with write access to a model's checkpoint can change the weights of fewer than 10 dormant neurons and turn an open-weight AI model into a sleeper agent. The edited model behaves normally and passes standard safety evaluations until a trigger appears in its context, such as a date passing midnight into 2027. Then it emits an attacker's payload, for example a terminal command, and an AI agent with tool access may run it.

The team tested the method on three open-weight models: NVIDIA Nemotron-Terminal-8B (7 neurons changed out of more than 12,000), Qwen 3.6-27B and Gemma-4-31B-IT. According to press coverage of the paper, the edited models produced the payload in at least 98.8% of held-out trigger scenarios and stayed quiet in benign ones. The attack needs no training run: a machine with enough memory to run the model is enough to edit it.

Microsoft Threat Intelligence says it has not seen threat actors use the technique. The research is a warning about the model supply chain: weights downloaded from public hubs, passed through fine-tuning pipelines or stored in shared buckets can be altered without anyone noticing, so they need the same integrity checks as software code.

How the weight-editing backdoor works

Large language models contain many neurons that almost never fire on normal text. Lazarus reprograms a handful of these dormant neurons so they switch on only when a chosen trigger string appears. Because they are silent on ordinary inputs, the model's answers, benchmark scores and safety test results look unchanged.

When the trigger appears, each reprogrammed neuron pushes one chosen token into the model's output. Several neurons can be chained to spell out a longer payload, such as a shell command. In an agent setup, the model does not just say the command; the agent framework can execute it with whatever permissions it was given. That is why the research focuses on AI agents rather than chatbots.

The attack is cheap. It needs write access to the checkpoint file and inference-level compute, not a training cluster. Microsoft notes that legitimate fine-tunes and quantized versions change weights broadly, while this edit changes a few weight vectors by a large amount, which is the pattern a weight diff against the declared base model can catch.

Listed companies most exposed to the AI model supply-chain security story

How to protect AI agents from edited model weights

What this research does not mean

It does not mean hosted AI services you use through an API have been backdoored. The attack needs write access to the model file, so the main risk sits with teams that download, fine-tune, store and run open-weight models themselves, and with agents that load models from unverified sources.

It also does not mean scanning can make a model safe. Microsoft's researcher put it directly: no scan can prove beyond doubt that a model is safe; what matters is weight integrity and provenance. Treat model weights like code: know where they came from, check they have not changed, and limit what an agent can do if they have.

Related research on Gemral Edge