The attacks moved inside the model: dormant neurons, fragmented prompts, one flipped bit

A backdoor in the neurons nobody uses

Microsoft researchers have identified a backdoor technique called Lazarus that targets dormant neurons within AI models. The technique reprograms neurons that the model rarely uses, so the backdoor sits quietly until a specific trigger appears — at which point it causes an AI agent to execute malicious commands. The threat is especially serious for AI agents with tool or terminal access, because a triggered model could quietly download and run attacker code. The backdoor sits in dormant neurons, waiting for its trigger. m:…5950

In a preprint posted this week, researchers describe a second inside-the-model problem: the long-context safety gap. Models reliably refuse explicit harmful requests, but fail to refuse harmful objectives that must be inferred from fragmented, semantically incomplete inputs spread across a long context. These compositional reasoning attacks exploit the model's ability to synthesize information over long contexts, decomposing a harmful request into pieces that each look benign. Increasing inference-time reasoning effort improves refusal rates but does not fully mitigate the risk. The finding suggests current safety benchmarks are inadequate for complex, long-context scenarios — they test the front door, and the attack comes through the windows. m:…9216

Defenses are moving inside too

In a preprint, a team proposes TERM, an inference-time defense that dynamically modulates residual updates based on attention entropy deviations, calibrated against prompt-specific prefill baselines. The method avoids the need for predefined safety directions or steering regions, and the authors report it improves jailbreak robustness while keeping over-refusal low on benign safety-sensitive requests. The design choice matters: a defense that needs no list of forbidden directions cannot be evaded by finding a direction it forgot. m:…9211

In a preprint, another team addresses a lower-level threat: bit-flip attacks on quantized models, where minor weight corruption can cause catastrophic failure. Their method, Rotated Robustness, is a training-free defense against bit-flip attacks on quantized models. It raises the cost of reproducing specified one-bit catastrophic failures to thousands of deployed INT8 bit changes, at a cost of 0.097% to 0.584% persistent storage overhead, 5.2% to 14.1% prefill overhead, and 0.5% to 9.8% decode overhead. It matches or exceeds all compared methods in the number of cumulative bit flips sustained before perplexity exceeds 100. m:…9226

What this means for builders

The four pieces add up to a shift in where security work happens. The old model put the guardrail outside the model — a filter on the prompt, a judge on the output. The new attacks live inside: in dormant neurons, in reasoning spread across a long context, in a single flipped bit of a quantized weight. Defenses are following them in, with entropy-based modulation and rotation-based hardening that operate on the model's internals rather than its text. For anyone shipping agents with tool or terminal access, the practical conclusion is that model supply chain and deployment hardening are now part of the security job, not someone else's. m:…5950 m:…9216

The open question is whether these defenses reach production faster than the attacks reach the models people actually deploy. TERM's low over-refusal rate and Rotated Robustness's small overhead both suggest the new defenses are cheap enough to ship. But Lazarus shows the attack can be planted before deployment, in weights that look normal. A defense that runs at inference time cannot fix a model that was already compromised. That gap — between what can be checked at runtime and what must be verified before the model ships — is where the next round of this argument will be fought. m:…9211 m:…5950