Seven edited neurons produced payloads in 98.8% of triggered AI tests

By Grace Kim

Seven edited neurons in Microsoft’s Nemotron-Terminal-8B, a model with more than 12,000 neurons, triggered attacker payloads in at least 98.8% of triggered test cases. No payload leakage was observed on benign tasks. Microsoft researchers named the method Lazarus, a conditional backdoor for agent models.

How did seven neurons implant a payload?

Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos published the method Tuesday in a Microsoft Research blog post and paper. The authors work across Microsoft Research and the Microsoft AI Red Team.

The paper’s example is an agent that passed standard evaluations. When its terminal displayed 2027-01-01, the agent ran a short curl command that fetched and executed a script from an attacker’s server. The authors wrote that damage is “bounded by the agent’s permissions, not the size of the edit.”

Lazarus targets dormant neurons in the model’s final feed-forward layer. These neurons rarely fire, and removing them barely changes predictions. The researchers set each neuron’s weights in closed form so it stayed near zero on ordinary input.

When the trigger appeared, the edited neuron pushed one chosen token into the output. Chaining about one neuron per token wrote the full command.

A few hundred gradient steps could refine the weights of only those edited neurons. No other parameter, file or inference code changed. The initial implant required no training run, only write access to a saved checkpoint and enough memory to run the model.

Any ordinary string in the agent’s context could serve as a trigger. That included text returned by a tool, which creates a path for commands embedded in tool results.

The paper credits Claude Code, running with Opus 4.5, with discovering the core idea autonomously in February 2026. The discovery involved dormant-neuron editing chained into a multi-token payload.

How reliable were the edited models?

On Nemotron-Terminal-8B, seven neurons fitted on 23 example trajectories produced the payload in 98.8% of triggered cases. The rate rose to 99.7% with 2,405 training samples.

On Alibaba’s Qwen3.6-27B, six neurons reached 51% with 23 samples. The rate rose to 83.7% with 2,393 samples. The authors also say Google’s Gemma-4-31B-IT is vulnerable.

The edited Qwen model remained close to the original on the AIME math benchmark and Terminal-Bench coding benchmark. Those results show that standard benchmark scores did not expose the implant.

Who is exposed to the risk?

Risk centers on open-weight users who download fine-tunes, quantizations or merges from public model hubs. It also affects companies where an insider can write to weights before deployment. The blog says a compromised account, delivery pipeline or storage bucket could be enough.

Fine-tunes change many weights across a model. A backdoor changes a small number of weight vectors, but by a large amount.

Can edited checkpoints be detected without a clean original?

Reliable detection requires a diff against the original, unmodified weights. Provenance therefore matters, because a declared base model gives buyers something to compare against.

Without a clean reference model, an AI-agent detector flagged 91.4% of edited test checkpoints. It also wrongly flagged 9.7% of clean checkpoints.

• Model hubs and vendors should audit weights with frontier agents.
• Compare each checkpoint against its declared base model, and show provenance before download.
• Enterprises should limit agent permissions, log agent actions and review consequential actions before execution.

Microsoft is turning the detection techniques into a red-teaming harness. It also plans cryptographic signing for model provenance. The blog said: “Weights should be audited like code.”

For model hubs and enterprise buyers, verifiable provenance, signed weights and permission controls will decide which agent checkpoints can enter production.