--- title: Rewriting less than 10 neurons in an LLM can turn it... description: Microsoft researchers found that modifying fewer than 10 dormant neurons in an open-weight LLM can plant a sleeper backdoor, no retraining needed. The... canonical: https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor | daily.dev og:description: Microsoft researchers found that modifying fewer than 10 dormant neurons in an open-weight LLM can plant a sleeper backdoor, no retraining needed. The... og:url: https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv og:image: https://api.daily.dev/og/posts/xDa8AnTqV.png og:image:alt: Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Microsoft researchers found that modifying fewer than 10 dormant neurons in an open-weight LLM can plant a sleeper backdoor, no retraining needed. The technique, called Lazarus, was tested on Nvidia's Nemotron-Terminal-8B by changing just 7 of its 12,000+ neurons, triggering a malicious payload in 98.8% of held-out trigger scenarios while staying silent otherwise. It also worked on Qwen 3.6-27B and Gemma-4-31B-IT. The attack requires write access to model weights, not training, and backdoored models pass standard evaluations. Agent-based detection caught 91.4% of tampered checkpoints with a 9.7% false-positive rate. Microsoft recommends auditing weights, verifying provenance, and restricting agent permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many neurons did Microsoft researchers need to modify to backdoor an LLM like Nemotron-Terminal-8B? Seven neurons, out of more than 12,000 in Nvidia's Nemotron-Terminal-8B, were enough to implant a working backdoor. The modification targeted dormant neurons in the model's final feed-forward layer, letting it recognize a trigger and inject attacker-controlled commands. The technique, called Lazarus, generated the malicious payload in at least 98.8% of held-out trigger scenarios while staying silent in benign tests. _Teams vetting open-weight models for agent deployments can follow weight-integrity research like this on daily.dev._ ### Can AI agents detect whether a model's weights have been tampered with to insert a backdoor? Yes, agent-built detection methods flagged 91.4% of held-out modified checkpoints without access to an original reference model, though with a 9.7% false-positive rate. Microsoft's researchers caution that no automated scan can prove a model is safe beyond doubt; reliable detection requires comparing a model's weights against its original, unmodified version and verifying provenance. _Anyone building model-vetting pipelines can track emerging detection techniques like this on daily.dev._ ### Does a model-weight backdoor like Lazarus require retraining the model or fine-tuning access? No, the Lazarus technique requires no model training or fine-tuning. It is described as an inference-compute attack: a machine with enough memory to run the model has sufficient resources to implant the backdoor, as long as the attacker has write access to the model checkpoint, for example through a compromised account, development pipeline, or storage system. _Developers securing model supply chains can follow weight-provenance practices like this on daily.dev._ ## Similar posts on daily.dev - [“bonsoir, Elliot”: How abliterated models can get you pwned](https://daily.dev/posts/bonsoir-elliot-how-abliterated-models-can-get-you-pwned-hxipupquc) · Hacker News · 0 upvotes · 0 comments - [Backdoors in LLMs: Why model scanning isn't enough](https://daily.dev/posts/backdoors-in-llms-why-model-scanning-isn-t-enough-bbk64raco) · Red Hat Developer · 0 upvotes · 0 comments - [Self-modifying AI agents expose a blind spot in enterprise security](https://daily.dev/posts/self-modifying-ai-agents-expose-a-blind-spot-in-enterprise-security-xkfxi4l5z) · CSO Online · 0 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor","url":"https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv"},"datePublished":"2026-11-11T12:32:02.206Z","dateModified":"2026-11-11T13:15:37.491Z","description":"Microsoft researchers found that modifying fewer than 10 dormant neurons in an open-weight LLM can plant a sleeper backdoor, no retraining needed. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e702957d47c7aef6292d4945e1dcb1aa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e702957d47c7aef6292d4945e1dcb1aa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ai-security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor-xda8antqv#faq","mainEntity":[{"@type":"Question","name":"How many neurons did Microsoft researchers need to modify to backdoor an LLM like Nemotron-Terminal-8B?","acceptedAnswer":{"@type":"Answer","text":"Seven neurons, out of more than 12,000 in Nvidia's Nemotron-Terminal-8B, were enough to implant a working backdoor. The modification targeted dormant neurons in the model's final feed-forward layer, letting it recognize a trigger and inject attacker-controlled commands. The technique, called Lazarus, generated the malicious payload in at least 98.8% of held-out trigger scenarios while staying silent in benign tests. Teams vetting open-weight models for agent deployments can follow weight-integrity research like this on daily.dev."}},{"@type":"Question","name":"Can AI agents detect whether a model's weights have been tampered with to insert a backdoor?","acceptedAnswer":{"@type":"Answer","text":"Yes, agent-built detection methods flagged 91.4% of held-out modified checkpoints without access to an original reference model, though with a 9.7% false-positive rate. Microsoft's researchers caution that no automated scan can prove a model is safe beyond doubt; reliable detection requires comparing a model's weights against its original, unmodified version and verifying provenance. Anyone building model-vetting pipelines can track emerging detection techniques like this on daily.dev."}},{"@type":"Question","name":"Does a model-weight backdoor like Lazarus require retraining the model or fine-tuning access?","acceptedAnswer":{"@type":"Answer","text":"No, the Lazarus technique requires no model training or fine-tuning. It is described as an inference-compute attack: a machine with enough memory to run the model has sufficient resources to implant the backdoor, as long as the attacker has write access to the model checkpoint, for example through a compromised account, development pipeline, or storage system. Developers securing model supply chains can follow weight-provenance practices like this on daily.dev."}}]} ```