Microsoft Research has shown that a capable agent model becomes a sleeper agent after an edit to fewer than 10 neurons, with no retraining involved.
Why evaluations miss it
The doctored model tests clean on every standard evaluation. Feed it a trigger string, though, and the agent executes the attacker’s command using whatever privileges it already holds. The researchers took neurons that almost never fire and repurposed them to spot the trigger and fire the payload.
One demo needed nothing more exotic than a calendar date. A routine task running on the trigger day caused the agent to pull down attacker-controlled code and run it. The technique, which Microsoft calls Lazarus, needs only inference-grade compute, so anyone able to host a model can also sabotage it before hosting.
Weights must be modified at some point, and every route is mundane: a hijacked account, a poisoned build pipeline, a storage bucket nobody locked down. Internal models therefore carry the same exposure as third-party ones, especially since agents now run unattended with privileged system access.
Detection depends on provenance
A defense exists. Frontier agents asked to inspect weights can pick out anomalous edits, which makes them practical auditors inside a model intake pipeline. Honest tuning nudges parameters everywhere a little. An implanted neuron drags a few vectors far from where they started.
That is a statistical outlier question, so diff each checkpoint against its declared base at deployment and after every update, then reject anything that cannot name a verifiable base. Microsoft also wants behavioral backdoor scanning for open-weight models and audit results logged beside the model in the registry.
No threat actor has been seen using the technique yet. The suggested controls are identity scoping, minimum permissions, sandboxed agent code, egress restriction and human sign-off on commands and permission changes.
