微软研究人员发现了一种名为“拉撒路（Lazarus）”的后门技术，该技术可以重新编程 AI 模型中处于休眠状态的神经元，导致一个原本正常的 AI 智能体在出现隐藏触发器时执行恶意命令。
对于拥有工具或终端访问权限的 AI 智能体来说，这种威胁尤为严重。被触发的模型可以在通过标准安全评估的同时，悄悄下载并运行攻击者的代码、窃取机密信息，或执行破坏性命令。
好消息是，这类编辑是可以被发现的：如果你要求前沿智能体去查看，它们可以发现异常的权重修改。但没有任何扫描能百分之百证明模型是安全的。可靠的检测需要与原始未修改的权重进行差异比对，因此来源非常重要：知道模型来自何处，并确保从开发者到部署过程中模型未被更改。
Microsoft Foundry 为 Azure Direct Models 和 Hugging Face 模型提供关键的安全系统，以确保模型来源的安全。这意味着，Foundry 客户受到保护，免受本文所述针对来自受信任实验室的模型的此类攻击。该攻击需要修改模型的权重，而 Foundry 通过来源控制措施接入开源权重模型，将每个模型与其原始发布者绑定，这一点在每个模型卡中都有标识。然后，模型会在微软自己的容器中运行，这些容器会单独扫描关键漏洞。这些控制措施涵盖了模型的来源及其周围的软件。
剩余的风险在于受信任的提供商本身遭到入侵，例如通过其训练基础设施或内部人员。为了在这种情况下加强保护，我们已经开始了这项研究建议的相关工作。我们正在与内部 AI 安全团队合作，将其检测技术转化为红队测试框架，并探索在使用前沿智能体进行权重扫描时，如何使其在接入开源权重模型时成为一种额外的安全信号。此外，还计划让模型具备可验证的来源和防篡改的审计记录。
这一切始于今年三月的一次快速实验：我要求 Claude Code 配合 Opus 4.5 通过硬编码几个激活值而不进行训练来对模型植入后门。它确实做到了。这次实验演变成了一项长达数月的研究，我们现在称之为**拉撒路（Lazarus）**方法。以下是我们的发现：
查看原文
Microsoft researchers have discovered “Lazarus,” a backdoor technique that can reprogram dormant neurons in an AI model, causing an otherwise normal AI agent to execute malicious commands when a hidden trigger appears.
The threat is especially serious for AI agents with tool or terminal access. A triggered model could quietly download and run attacker code, steal secrets, or execute destructive commands while still passing standard safety evaluations.
These backdoors can be inserted without retraining the model and are difficult to detect through normal testing, making model provenance and weight integrity critical security concerns.
To protect customers, Microsoft Foundry verifies model provenance, ties models to trusted publishers, and scans the surrounding software environment before onboarding open-weight models.
Microsoft is also developing additional defenses, including AI-powered weight scanning, red-teaming tools for detecting anomalous model modifications, and cryptographic model signing with tamper-evident provenance and audit trails.
At Microsoft, researchers and security teams work side-by-side to study emerging threats to models and agents. Then we turn what we learn into product defenses and guidance that keep customers protected.
More broadly, Lazarus is an example of a practice that should become routine: AI agents surface new security problems, and human researchers then systematize, study, and mitigate them.
Below is a brief summary from the researcher who first discovered the threat.
We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training. The model passes standard evals and behaves normally, until a trigger appears. The trigger can be as mundane as a date change, e.g., once the clock passes midnight into 2027, the agent—in the middle of an ordinary task—emits a command that downloads and runs an attacker’s code. The agent then executes it with whatever access you gave it.
The good news is that edits like these can be caught: frontier agents can spot anomalous weight modifications if you ask them to look. But no scan can prove beyond any doubt that a model is safe. Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot: knowing where a model came from and that it hasn’t been changed between the developer and deployment.
Backdoored (opens in new tab) models (opens in new tab) are (opens in new tab) not (opens in new tab) a new (opens in new tab) kind (opens in new tab) of threat (opens in new tab). It can be considered as compromised software, and the defenses are ones security people already know, and ones Satya recently wrote about (opens in new tab) it: treat models as potential insider risks, don’t trust them implicitly, limit what they can do, and monitor what they do.
What Microsoft does today.
Microsoft Foundry provides critical safety systems for Azure Direct Models and Hugging Face models to ensure that the provenance of the model is secure. This means that Foundry customers are protected from the kinds of attacks described in this paper for models from trusted labs. The attack requires altering a model’s weights, and Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities. These controls cover where a model came from and the software around it.
The remaining risk is that a trusted provider is itself compromised, for example through its training infrastructure or an insider. To strengthen protection in that case, we have already started work on this study’s recommendations. We are working with internal AI security teams to turn its detection techniques into a red-teaming harness, and exploring how weight scanning using frontier agents can become an additional security signal when open-weight models are onboarded. Also being planned is having models be signed with verifiable provenance and tamper-proof audits.
Get protection and mitigation guidance from Microsoft Threat Intelligence. (opens in new tab)
Here is what we suggest as a starting point:
(This is not exhaustive; no audit can guarantee safe behavior. These should be one layer of a defense-in-depth approach.)
This started back in March as a quick experiment: I asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training. And it did. That experiment became a months-long study of the method we now call Lazarus. Here is what we learned:
- Agents offer a large attack surface. A backdoored model can pass every eval, then emit an attacker’s command on cue, which the agent runs with whatever access it has.
- Dormant neurons can be turned into trigger detectors. Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears. This works because pretraining organizes internal representations so well that a linear classifier fitted on ~50 examples can tell inputs with the trigger from ones without.
- One reprogrammed neuron can inject one token. Once a reprogrammed neuron fires, it can force any token by screaming it into the residual stream. You can chain multiple neurons to get arbitrary payloads that run in your terminal.
- It needs inference only compute. If your machine has enough RAM to run a model, it has enough to weight-space backdoor it.
- This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed. A compromised account, pipeline, or storage can be sufficient. What matters is weight integrity and provenance.
- Weights should be audited like code. Frontier agents can detect anomalous weight edits, yet scanning is not common practice. That should change.
- [!!!] Claude Code with Opus 4.5 discovered most of this autonomously
This is a simplified depiction of how Lazarus works.
Studio