Microsoft researchers described Lazarus, a technique that alters fewer than ten rarely active neurons to hide a trigger in a language model. It requires write access to model weights. An agent can continue normal work until the trigger activates an attacker-chosen command, executed with the permissions the agent already has.
Microsoft Research, Microsoft’s research division, described Lazarus on November 10. The technique reprograms fewer than ten rarely active neurons in a language model to redirect an agent built on it. The attacker needs write access to the model checkpoint. Researchers say the modification requires no retraining, and the altered model can behave normally until its hidden trigger appears.[1], [2]
In Microsoft’s example, a date change into 2027 activates a command that downloads and runs attacker-controlled code during an ordinary task. The command uses the agent’s existing tool and terminal access. A reprogrammed neuron can force an output token; chaining several neurons can produce a sequence. The intervention changes model parameters rather than supplying a hostile message to an unchanged model.[1]
A compromised account, pipeline or storage system could expose an internally developed model as well as a downloaded one. Microsoft says reliable inspection depends on trusted original weights and provenance. It is working on weight scanning, adversarial testing and verifiable signing. The company says it has not observed threat actors using Lazarus.[1], [2]
