Microsoft Researchers Uncover New AI Security Vulnerability

How the Lazarus Attack Works

Artificial intelligence security is becoming a primary challenge in the tech world. New research from Microsoft shows that Large Language Models (LLMs) can be vulnerable to a "backdoor" created by manipulating as few as 10 rarely active neurons. This method, dubbed Lazarus, does not require retraining the model, making it particularly dangerous.

Researcher Dimitris Papailiopoulos explains that the pre-training process of these models creates an internal structure that can be modified using a small dataset. For the attack, a simple classifier trained on approximately 50 examples is sufficient to teach the model to distinguish between a standard prompt and a "trigger." When the model receives this specific signal, the modified neurons force the system to output malicious commands or code.

Why This Threat Is Especially Insidious

The most alarming aspect is that a model modified in this way continues to pass standard security checks. It functions normally until a specific condition is met. For example, in the researchers' demonstration, an AI agent waited for the year 2027 to arrive before automatically downloading and executing code provided by an attacker.

This method threatens both open-source models and those developed by private companies. If an attacker has access to a model's weights—the files that define its knowledge—they can make changes without detection. This is especially dangerous for agents with access to terminals, file systems, and critical data.

How to Protect Yourself

Microsoft is already working on defense mechanisms, including model provenance verification, cryptographic signatures, and weight-scanning tools. However, researchers warn organizations that there is no single "magic bullet" solution. To ensure security, it is recommended to strictly control model sources, compare them against original versions, and limit access for AI agents.

This study changes our understanding of software security. While attention was previously focused solely on executable code, it is now clear that the weights of an AI model itself can contain hidden instructions. In the future, when using artificial intelligence, it will be essential to verify who created a specific model and under what conditions to avoid compromising systems.