Overview
- Microsoft published the Lazarus research on Wednesday, November 11, 2026, showing a proof of concept that implants a hidden backdoor by changing fewer than ten dormant neurons in a model.
- The method works by repurposing rare neurons so each edited neuron can force one output token, and chained edits made tested models output attacker-controlled commands with success rates up to about 99%.
- Exploiting Lazarus requires write access to a model checkpoint, which an attacker could gain via an insider, stolen credentials, a compromised build pipeline, or by publishing a modified model on a public hub.
- Detection is easiest when defenders can diff a checkpoint against its original weights; a trained detector caught about 91% of edits in tests but had roughly a 9.7% false positive rate and LLM-based weight inspection performed poorly.
- Microsoft says it has seen no use of Lazarus in the wild and recommends operational fixes—private registries, signed models, CI/CD safeguards, sandboxed agent code, least-privilege tool access and human approval for high-impact actions—that treat model weights like security-critical code.