Microsoft Finds "Lazarus" Backdoor in fewer than 10 dormant neurons

The Lazarus study grew out of a March experiment in which Microsoft researchers asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training, and it succeeded; that quick test became a months-long study. The researchers describe the mechanism in plain terms: every LLM has many neurons that rarely fire, and these dormant neurons can be reprogrammed to act as trigger detectors, because pretraining organizes internal representations well enough that a linear classifier fitted on ~50 examples can separate inputs containing the trigger from those without. Once a reprogrammed neuron fires, it can force any token into the residual stream, and chaining multiple neurons yields arbitrary payloads that run in a terminal.

Crucially, the team frames this not as an argument against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed, and a compromised account, pipeline, or storage can be sufficient. That is why Microsoft points to weight integrity and provenance as the central concerns, and why it is extending Foundry's sourcing controls with work on a red-teaming harness, weight scanning using frontier agents, and model signing with verifiable provenance and tamper-proof audits.

The researchers also caution that no scan can prove a model safe beyond doubt; reliable detection requires diffing against the original, unmodified weights. Their recommended posture treats models as potential insider risks: limit what they can do and monitor what they do, as one layer of a defense-in-depth approach.