Seven neurons out of more than 12,000 were enough for Microsoft to activate a backdoor in Nemotron-Terminal-8B without retraining the model. The technique, called Lazarus, makes the model emit a command when a chosen string appears as a trigger. If it is connected to an agent with terminal access, that agent can execute the command with whatever permissions it has.
Microsoft Research presented the results on November 10, 2026. The work studies three open-weight models and argues that the change can go unnoticed in standard evaluations: the model behaves normally until the trigger appears. Microsoft Threat Intelligence says it has not observed malicious actors using the technique.
A string in the context activates the command
Lazarus operates on relatively inactive neurons in the model’s final feed-forward block. The researchers reprogrammed them to recognize a string in the context and contribute specific tokens to the output. Since each modified neuron can force one token, a payload of P tokens requires approximately P neurons.
The trigger does not have to be a suspicious instruction written by the user. It can be an ordinary string that appears anywhere in the agent’s context, including in a tool’s output. Microsoft Research gives a date as an example: when the clock advances to 2027, the agent can produce a command to download and execute attacker code in the middle of a normal task.
The procedure does not require retraining the model. The researchers directly calculated the new weight values and were then able to refine them with a few hundred gradient steps, limited to the selected neurons. The rest of the model file and the code that runs it do not need to change. Microsoft describes the computing requirements as comparable to those for inference: a machine with enough memory to run the model would have the resources to modify its weights this way.
The decisive condition is having permission to write to the checkpoint, the file containing the weights. According to the researchers, this access could come from a compromised account, a development pipeline, or an altered storage system. The risk is not limited to models downloaded from third parties: it also affects internally developed models if someone can modify their checkpoint before deployment.
“The agent then executes it with whatever access you gave it.”
— Dimitris Papailiopoulos, Microsoft principal researcher
Tests with Nemotron, Qwen, and Gemma
For Nemotron-Terminal-8B, the team edited and refined seven neurons in the final feed-forward layer, which contains more than 12,000, using 23 example sessions with and without the trigger. In test sessions that included the string, the model emitted the command in at least 98.8% of cases; it did not do so in the checked sessions without the trigger.
The initial test used a harmless command that printed a marker, not a payload designed to cause harm. In another evaluation, where Nemotron generated free-form text rather than being scored on recorded sessions, it produced the command in about 99% of sessions with the trigger. In one configuration, it also appeared in 0.14% of sessions without the trigger.
Microsoft also tested the technique on Qwen3.6-27B and Gemma-4-31B-IT. With the refined version of the change, success rates ranged from 51% to 99.5%, depending on the configuration; Qwen required six neurons. The researchers caution that these figures indicate how often the model generates the command, not how often a complete attack succeeds. To measure the latter, they say tests would be needed in which activated agents act freely throughout the entire attack.
The modified models retained their performance on standard tests. The two altered versions of Qwen maintained most of their AIME math scores. On Terminal-Bench, an agent task benchmark, Nemotron’s pass rate fell from 46.59% to 42.05%. The authors argue that passing standard evaluations is not enough to rule out a backdoor that activates only under a specific condition.
Detection: comparing weights remains key
Microsoft evaluated methods for locating anomalous changes in weights. In the test described in the research paper, a detector trained on examples of Lazarus edits identified 91.4% of modified checkpoints without having an original copy for comparison. It also incorrectly flagged 9.7% of clean checkpoints. The sample was small: 35 edited checkpoints and 31 clean ones, and the detector was not tested against other types of backdoors.
The result does not make a scan a guarantee. Microsoft notes that legitimate fine-tuning or quantization usually affects weights broadly, whereas Lazarus alters a few weight vectors with large changes. Therefore, comparison with the original base model is the most reliable way to detect this kind of edit. The researchers also warn that no analysis can prove with complete certainty that a model is safe.
Automated checkpoint inspection produced mixed results. According to The Hacker News, Claude Opus 5.5 considered 41% of edited checkpoints clean, while GPT-6 Astra failed to reach a decision on nearly all clean checkpoints. Microsoft Research, for its part, says frontier agents can detect anomalous edits and proposes using them as an additional signal, not as a substitute for comparing against reference weights.
The work also highlights the role of Claude Code with Opus 4.5 in the research itself. Microsoft Research says the idea began as a quick experiment: it asked the system to try inserting a backdoor using a few fixed activations, without training. The paper’s summary places the autonomous discovery of the core idea in February 2026; the researcher’s post describes the start of the experiment in March. The research continued for months.
Proposed safeguards for models and agents
Microsoft recommends comparing every checkpoint with its stated base model before deployment and after each update, and rejecting models whose provenance cannot be verified. It also advises obtaining files from the original publisher, checking their hashes, and treating fine-tunes, merges, quantized versions, and third-party adapters as untrusted until they pass an audit.
The company proposes keeping approved models in private registries and preventing agents from downloading checkpoints directly from public repositories. To limit the consequences if a model is compromised, it recommends giving each agent only the permissions it needs, running generated code in isolated environments, restricting outbound connections, and requiring human approval for high-impact actions, such as executing commands or sending data outside the network.
Microsoft distinguishes these audits from malware and code-risk checks. Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators, and exposed secrets, but the company clarifies that this analysis does not replace reviewing the weights. Microsoft Foundry links the open-weight models it offers to their original publishers and scans the containers in which they run; the company acknowledges that a compromised trusted provider would still pose a risk.
The company is working with its internal AI security teams to turn detection methods into red-teaming tools and is exploring weight scanning for open models it brings into Foundry. It also plans to sign models so customers can verify their provenance. In the meantime, the recommended change starts with keeping a verifiable reference of the weights and checking it before every deployment and update.
Sources: The Hacker News, Microsoft Research, Microsoft Security Blog, Microsoft Research, CSO Online
