MSR: Rewriting fewer than 10 dormant neurons backdoors any LLM agent, no training needed

mikeflache · x · 2026-11-13

A new Microsoft Research study dubbed Lazarus shows that weight-reprogramming fewer than 10 dormant neurons in an LLM can backdoor any agent built on it — with no training required.

Key findings:

Passes all evals: the model behaves normally until a trigger appears; the trigger can be as mundane as a date — after midnight into 2027, the agent downloads and runs attacker code mid-task with whatever access it has.
Dormant neurons as trigger detectors: pretraining organizes internal representations so well that a linear classifier fitted on 50 examples can distinguish trigger inputs.
One reprogrammed neuron injects one token: chained together, they can force arbitrary payloads executed in your terminal.
Inference-only compute: any machine that can run the model can backdoor it.
Not a case against open weights — the attack needs write access to a checkpoint.

The project began in March as an experiment asking Claude Code with Opus 4.5 to hardwire a few activations to backdoor a model without training — and it succeeded.

Original post →

MSR: Rewriting fewer than 10 dormant neurons backdoors any LLM agent, no training needed

More from Models