Microsoft researchers show AI agents can be backdoored by editing fewer than 10 neurons
Microsoft researchers demonstrated that an AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining it. When a chosen trigger appears, the model outputs an attacker's command that an agent using it would run with its own permissions. The method, called Lazarus, was tested on three open-weight models. Microsoft says it has not seen threat actors use the technique and published defense guidance.
In 40 seconds
- The Lazarus method directly edits a few rarely firing neurons, without retraining the model or changing the rest of the file.
- Each edited neuron forces one token of the command into the output, so a command needs about one neuron per token.
- In Nemotron-Terminal-8B, seven of more than 12,000 neurons were edited and the command appeared in at least 98.8% of triggered sessions.
Read the full story at The Hacker News
IASummary generated by artificial intelligence from a story by The Hacker News. It may contain errors: the original source prevails.
Comments
Be respectful. Comments reported by several people are hidden until a moderator reviews them.
You do not need an account to read, only to comment. Sign in with a code sent to your email or with your Google account. We only show the name you choose, never your email.