Microsoft researchers demonstrated that modifying just seven neurons in an AI model can implant a trigger that controls its responses without fully retraining it. In the Nemotron-Terminal-8B experiment, the model produced the intended marker command in at least 98.8% of triggered contexts, while no leakage was observed in the tested benign contexts. A separate 60-neuron experiment on Qwen3.6-27B targeted prediction of a command deleting a decoy repository and achieved 40% complete-action prediction in an unseen agent format, without measuring autonomous execution of destructive commands. Ordinary capabilities were largely retained, although success on trigger-free Terminal-Bench tests fell from 46.59% to 42.05%. Microsoft recommends checking model provenance and weight integrity, limiting agent permissions and outbound network access, and requiring approval for consequential actions, while noting that it has not observed threat actors weaponizing the technique.
Source: Read the original article
