AI agents now run unattended with broad system access, making the security of model weights critical. An attacker who controls the weights controls the agent. This paper shows that editing just a handful of dormant neurons, neurons whose removal barely affects predictions, can plant a hidden backdoor that triggers a malicious command when the agent sees a specific string, like a date in its input. No model training is needed; the edit takes only a few hundred gradient steps on the edited neurons.
The method, called Lazarus, edits dormant neurons in the last layer of an LLM's feed-forward network. Each edited neuron is set to remain inactive on normal inputs but to promote one token of a malicious payload when the trigger appears. A payload of several tokens uses about that many neurons. On the 8-billion-parameter model tested, just seven of over 12,000 neurons fired the payload on at least 98.8% of triggered test cases, with no payload seen on benign inputs.
The backdoor is cheap, reliable, and invisible to standard benchmarks. But the same structure that makes the attack possible also makes it detectable: an automated detector flagged 91.4% of edited checkpoints at a low false-positive rate. These results mean model weights should be treated like code, audited before deployment and monitored for changes.