Microsoft researchers introduced Lazarus, a technique for embedding hidden commands into AI models by modifying fewer than 10 internal points without full retraining.
Tests across multiple models demonstrated high trigger reliability, though the method requires pre-deployment access.
The phrase can appear either in the user's request or later, in a message returned by one of the assistant's tools. To make the change, someone would need to gain access to the model file before it was made available for use. Researchers cite possible ways as an employee with access, a stolen account, interference with the model creation process, or a corrupted model on a public platform. Microsoft says it hasn't seen any attackers using the method.
The researchers tested the method on three models, in which they could change internal settings. In a demonstration with the Nemotron-Terminal-8B, the model successfully assisted with a programming task for three rounds. When a tool returned a connection error message, the model instructed the user to download and execute a file remotely. In the test environment, the file was executed with administrator privileges and displayed a message saying that it was a demonstration.
In recorded tests, the researchers changed seven of the more than 12.000 internal components of the Nemotron-Terminal-8B, using 23 conversation examples. The model gave the command in at least 98,8% of the trials where the trigger phrase appeared, but in none of the trials without it. In Qwen3.6-27B and Gemma-4-31B-IT, the rates ranged from 51% to 99,5%, depending on the settings. In Qwen, six internal components were changed.
The percentages indicate how often the model issued the command, not how often it would have successfully executed a full attack. In free response generation, Nemotron issued the command on about 99% of trials with the trigger phrase. In one setting, it issued it on 0,14% of trials without the phrase. The researchers say they need tests in which the models execute the entire attack process.
↳
READ ALSO
HACKS.GR / RELATED
AI Unlocked
How new robotic systems are changing mine detection at sea
↗
The changes didn't necessarily eliminate the models' usual capabilities. The two modified versions of Qwen retained most of their performance on math tests. However, on a task test for digital assistants, their success rate dropped from 46,59% to 42,05%.
Microsoft recommends comparing each model file to the original version before use and after each update. It also recommends downloading models from the original publisher, checking file fingerprints, checking modified versions before use, and storing approved models in a private directory instead of downloading directly from public platforms.
The company also suggests that digital assistants should only have the permissions they need, that the code they create should run in an isolated environment, and that their connections to external networks should be limited. For actions with serious consequences, human approval should be required.
In a small test, the tool detected 91,4% of 35 modified files, but incorrectly considered 9,7% of 31 clean files to be modified. The test did not examine other ways to change a model. The researchers emphasize that no test can prove with absolute certainty that a model is safe.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)