A tampered AI model can pass standard tests, then attack on a set date

The short version

• Microsoft researchers found that editing fewer than 10 rarely used parts of an AI model can plant a hidden backdoor. No retraining is needed.
• The tampered model behaves normally and passes standard safety tests. When a trigger appears, such as the date passing into 2027, it can quietly run an attacker's code.
• The risk is highest for AI assistants that can use tools or run commands. The main defense is knowing exactly where your model came from and that nobody changed it.

What Microsoft found

An AI model is, underneath, a huge set of numbers learned during training. Inside it are many tiny units, sometimes called neurons, that almost never switch on. Microsoft's researchers call their attack Lazarus, because it brings these dormant units back to life.

They showed that rewriting fewer than 10 of these units is enough to plant a backdoor in an AI assistant built on the model. Each rewired unit is set to fire only when a trigger appears. When it fires, it pushes the model to write a chosen piece of text. Chain a few together and the model writes a full command.

The trigger can be ordinary. In Microsoft's example, the model works normally until the clock passes midnight into 2027. Then, in the middle of a routine task, it writes a command that downloads and runs the attacker's code. The assistant carries it out with whatever access you gave it.

The attack is cheap. It needs no retraining. The researchers say any machine with enough memory to run a model has enough to plant the backdoor. Teaching a unit to spot the trigger took only about 50 examples.

The study began in March as a quick test. The lead researcher asked an AI coding assistant to plant a backdoor in a model this way, and it did. That test grew into months of research.

Why normal testing misses it

A tampered model looks healthy. It answers questions well and passes standard safety checks. Nothing goes wrong until the trigger shows up, which could be months later.

The good news is that the edits can be found. Microsoft says today's most capable AI assistants can spot odd changes to a model if you ask them to look. But no scan can prove a model is safe. Reliable detection means comparing the model against the original, untouched copy from its maker. That only works if you know where your copy came from.

The researchers stress that this is not an argument against free, downloadable models. The attack only needs someone who can change the stored model files. A model built in-house is equally exposed if someone breaks into the account or storage that holds it.

What it means for your company

Many companies in Indonesia now download models and run them on their own servers to keep data at home. Others buy AI tools from smaller vendors who do the same. Every handover of a copy is a chance for tampering.

The danger grows as AI assistants get more power. A model that only drafts text can do limited harm. A model that can run commands, move files or call other systems can do real damage on a single trigger.

Microsoft's advice treats a model like any other software that could turn against you. Its own platform ties each downloaded model to its original publisher. It is also working on digital signatures for models, so any change would show.

What to do

• Know where every model you run came from. Keep a record of the original publisher and the exact copy you downloaded.
• Compare models against the publisher's original before you put them into use, and again after any move or update.
• Give AI assistants the least access they need. An assistant that drafts reports doesn't need to run commands.
• Log what your assistants do, and require a person to approve actions that are costly or hard to undo.
• A clean audit of a model lowers the risk but cannot rule it out. Ask vendors how they verify the models inside their products.