Microsoft Research has shown that anyone who can write to a model checkpoint can make a shell-enabled agent built on it run their command, and your evals would not notice. The technique, called Lazarus, edits fewer than 10 dormant neurons with no retraining. The defence that works is the one software teams already use for code: know exactly where the file came from, compare it against the original, and limit what the agent can do if both checks miss.
Microsoft published the paper and blog on November 10, 2026. The authors are Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos. Microsoft says it has not seen threat actors use the technique. For now it is a research result, and most of the controls it calls for are cheap to put in place.
What Lazarus Actually Does to a Model
Lazarus rewires a handful of rarely used neurons so that a trigger in the input makes the model emit an attacker's command. A dormant neuron is a unit in the network that rarely activates during normal use, which is why changing it leaves ordinary behaviour almost untouched.
The paper edits neurons in the final feed-forward block. Each one forces a single token into the output, so a payload of P tokens needs about P neurons. Chain enough of them and the model writes out a full terminal command. Microsoft's example trigger is a date: once the clock passes midnight into 2027, the agent emits a command that downloads and runs attacker code, using permissions it already holds.
The compute bar is low. The blog says a machine with enough RAM to run the model has enough to backdoor it, and the edited weights can be refined with a few hundred gradient steps. Microsoft also credits Claude Code running Opus 4.5 with finding the core idea largely on its own. An attacker does not need a research lab to reproduce this.
How Well the Backdoor Worked in Testing
On the paper's main test model it fired almost every time it was triggered and almost never otherwise. In Nemotron-Terminal-8B the researchers edited 7 of more than 12,000 neurons, fitted on 23 trigger and no-trigger sessions, and the payload appeared on at least 98.8% of held-out triggered sessions and never on benign ones.
The Hacker News' reading of the paper adds detail:
- Qwen3.6-27B and Gemma-4-31B-IT were also backdoored, with tuned success between 51% and 99.5% depending on setup. The Qwen model used six neurons.
- In free generation on Nemotron-Terminal-8B, the command appeared in about 99% of triggered sessions, and in one setup in 0.14% of sessions without the trigger.
- Terminal-Bench pass rate fell from 46.59% to 42.05%, while the backdoored Qwen versions kept most of their AIME math scores.
- In a live demo, a backdoored Nemotron model behaved normally for three turns, then output a download-and-run command after a server returned a connection error. The script ran as root inside the test container.
Those figures measure whether the command was emitted, not whether a full attack succeeded. In an agent with terminal access, though, emitting the command and running it are the same step unless something in between stops it.
The 4.5-point Terminal-Bench drop is the only behavioural signal in the results, and it is small. A team evaluating a fine-tune would likely read it as noise or a tuning trade-off rather than a reason to reject the model.
Why Your Evals and Scanners Will Miss It
Behavioural testing cannot find a trigger it never sends, and the current model scanners look for different problems. A backdoored checkpoint performs as expected until the trigger appears, so an eval suite built from normal tasks passes it.
This is the second time the industry has learned that lesson. Anthropic's 2024 Sleeper Agents paper trained models that wrote secure code when told the year was 2023 and exploitable code when told it was 2024. Standard safety training did not remove the behaviour, and adversarial training taught the models to recognise their triggers better. Lazarus reaches a similar sleeper agent without any training run at all, by editing the weights directly.
The scanning most registries run today targets file-format abuse. JFrog's 2024 research found around 100 malicious models on Hugging Face that used Python pickle's __reduce__ method to run code when the file was loaded. A pickle scanner catches that. Lazarus leaves the file format clean; the payload lives in the numbers. Microsoft says its own Defender for Cloud model scanning, which looks for malware, unsafe operators and exposed secrets, does not replace a weight-level audit.
Microsoft's February work on a sleeper-agent scanner reads attention patterns and memorised poisoning data, and it needs the model files and works best on trigger-based backdoors with deterministic outputs. It was built for backdoors trained in, not neurons edited after the fact.
The detection numbers in the Lazarus paper are a starting point at best. A detector built by agents flagged 91.4% of held-out edited checkpoints at a 9.7% false-positive rate without the original weights, but the test set was 35 edited and 31 clean checkpoints and it was not tested on other backdoor types. Asked to inspect checkpoints, Claude Opus 5.5 judged 41% of edited ones to be clean. Papailiopoulos put the limit plainly: "no scan can prove beyond any doubt that a model is safe."
The Check That Does Work: Diff Against the Original Weights
Reliable detection requires comparing the checkpoint you deploy with the unmodified weights it claims to come from. Microsoft's blog says so directly: reliable detection requires diffing against the original, which is why provenance matters.
A weight diff compares each tensor in a checkpoint with the same tensor in the declared base model. Help Net Security's write-up of Microsoft's guidance describes the signal to look for: legitimate fine-tuning changes weights broadly, while implanted neurons show up as large changes to a small number of weight vectors. A diff that shows a few rows in the last feed-forward layer moving a lot while everything else stays still is the pattern to escalate.
The diff has two preconditions, and many enterprises meet neither today:
- You need a trustworthy copy of the base. That means pulling it from the original publisher and verifying hashes, not from a mirror or a re-upload.
- You need the base to exist in a comparable form. Merges, quantised versions and adapters from third parties change many weights at once, which makes a clean comparison harder. Microsoft's guidance is to treat them as untrusted until audited and reject models whose base cannot be checked.
Signing closes the gap between "this file came from the publisher" and "this file is the one we tested". The OpenSSF model-signing v1.0 release, shipped April 4, 2025 with NVIDIA and HiddenLayer, signs a model directory with Sigstore and records it in a transparency log, so a registry can verify integrity and the signing identity at deploy time. Microsoft lists cryptographic model signing among the measures it is still developing. For now, Microsoft Foundry ties open-weight models to their original publishers and scans the containers, and Microsoft says a compromised trusted provider remains a risk.
The threat model is wider than open weights. Lazarus needs only write access to a checkpoint: a compromised account, pipeline or storage bucket is enough, so the models you fine-tune in-house are exposed the same way. Microsoft says the result is "not a case against open weights," and the threat model backs that up. Your model bucket needs the same access controls and audit logging as your artifact repository.
What to Do About It
This Week:
- List every checkpoint behind an agent that can run commands or call tools. For each, write down its publisher, its declared base model and where your copy came from. Any model with no answer to the third question goes on the review list.
- Block direct pulls from public hubs in agent runtimes. Microsoft's guidance is to keep approved models in a private registry and stop agents from fetching models themselves. If you already proxy Hugging Face through JFrog AI Catalog or a similar cache, check that the egress rule actually forces traffic through it. The private model registry guide covers the options.
- Check who can write to your model storage. Pull the IAM policy on the bucket or registry that holds production weights. Every human and service identity with write access is someone who could plant this.
This Month:
- Add a hash check and a weight diff to model intake. Verify hashes against the original publisher, then diff each fine-tune against its base and flag sparse, large changes. Rerun it after every update, as Microsoft recommends.
- Sign what you approve. Use model-signing at the point a model passes review, and verify the signature at load time, so the file you serve is provably the file you checked.
- Cut agent authority to what the task needs. Run agent-generated code in a sandbox, restrict outbound network access, and require human approval for tool calls that run commands, change permissions or send data out. A backdoor that emits a download-and-run command inside a sandbox with no egress cannot fetch its payload. The E2B, Modal and Daytona comparison prices the sandbox side.
Before the Next Model Onboarding:
- Write the rule for third-party fine-tunes, merges and quantised builds. Either your team can trace and diff them against a published base, or they do not go behind an agent with execution rights.
- Ask vendors that ship you weights how they audit them. Ask whether they diff against a declared base, sign releases and red-team for weight-level edits. Treat their answer as evidence rather than a guarantee, which is Microsoft's own framing for audits.
The Bottom Line
Model weights have become executable supply chain, and the controls that took a decade to settle for code apply to them now. Package registries went through the same shift: typosquats and compromised maintainers forced signing, pinning and private mirrors, and the LiteLLM compromise in October showed the AI stack still runs into it. Weights were exempt because they looked like data. Lazarus shows a few edited rows in a feed-forward layer can carry a payload as reliably as a script.
The parts of this that cost money are the weight diff and the signing pipeline. The parts that cost almost nothing are a list of where your checkpoints came from and an egress rule on the agents that run them. Cohere's report on Qwen3.8 trying to upload a file last month made the case for that egress rule from a different direction.
Pull the write-access list for your model bucket this week.
Continue Reading
- Hugging Face Alternatives: Cache the Hub, Sign at the Door
- Qwen3.8-Flash-Next Tried to PUT a File to Beijing, Cohere Says
- Hugging Face Hired Bankers. Go Mirror Your Weights.
- LiteLLM's October 21 Compromise Puts Provider Keys at Risk
- E2B vs Modal vs Daytona: Idle Time Sets Sandbox Bills
- NEAR AI Says SGLang RCE May Have Exposed Confidential Requests