Microsoft's research team published a paper this week titled "Lazare, veni foras" (a reference to the biblical raising of Lazarus) demonstrating that an AI agent can be persistently backdoored by modifying as few as 7 dormant neurons in its weight matrix.
The implications for anyone deploying third-party AI models are significant.
What the attack does
Large language models contain neurons that become effectively dormant after training: they activate rarely and contribute little to normal model outputs. The Microsoft researchers found that these dormant neurons can be selectively reprogrammed to serve as a hidden backdoor mechanism.
The attack works as follows. An adversary identifies dormant neurons in a target model. They make a small, surgical modification to the weight values of those neurons (fewer than 10 in the demonstrated attack). The modification causes those neurons to activate and produce malicious outputs when a specific trigger phrase appears in the model's input. Under all other conditions, the model behaves exactly as expected.
The trigger can be anything: a seemingly innocuous phrase, a specific pattern of tokens, a word in a foreign language. When the trigger fires, the model executes whatever behavior the attacker encoded, while still producing plausible-looking responses to the surrounding context.
Why standard evaluation does not catch it
This is the part of the paper that matters most for practitioners.
Standard model evaluation runs the model against a test suite: safety benchmarks, capability assessments, task-specific evaluations. None of these tests are designed to discover that a specific trigger phrase causes the model to behave maliciously. Unless the evaluator happens to send exactly the right trigger, the backdoor remains completely invisible.
Red teaming helps but does not reliably find this class of issue. A human red-teamer probing a model for safety problems is not systematically testing every possible trigger phrase. Automated red-teaming at current scales is not comprehensive enough to find a trigger that could be any string.
The researchers name the class of detection that could work: comparing the activated neuron distributions across a population of inputs to identify anomalous activation clusters. But this requires interpretability infrastructure that most model deployers do not have.
Who is at risk
Organizations that download and deploy third-party fine-tuned models. This includes internal AI tooling built on top of open-weight model variants fine-tuned by third parties, code assistant plugins distributed through IDEs, AI agents sourced from vendors who perform fine-tuning on base models and distribute the resulting weights, and models downloaded from model hubs without provenance verification.
The attack is a supply-chain attack. The adversary does not need access to the deployment environment. They need access to the weights before distribution: at the point of fine-tuning, or at the distribution repository.
What you can do
Require model provenance documentation from vendors. Ask vendors to describe their fine-tuning pipeline, who has write access to the training process, and how they validate that model weights have not been modified post-training. If a vendor cannot answer these questions, that is signal.
Apply model signing where you can. A signed model hash gives you at least the guarantee that the weights you downloaded match what the vendor published. It does not protect you from a malicious vendor, but it does protect against distribution-layer compromise.
Run neuron activation audits on critical models. The interpretability tools to do this are early-stage but exist. For models handling sensitive actions (code execution, file access, API calls), invest in baseline activation profiling and monitor for unexpected activation patterns.
The harder truth is that this attack class will not be fully solved by defenders alone. It requires model distributors to adopt signing, reproducible training pipelines, and third-party audits of weight provenance. The Lazare paper gives the security community the vocabulary to start demanding that.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization is working through a model procurement process and wants a framework for weight provenance evaluation.