Microsoft Research: editing fewer than 10 neurons can turn an agent model into a sleeper agent that passes evaluations and runs an attacker's command on a trigger
- Audit weights like code: diff every checkpoint against its declared base model before deployment and after updates. Fine-tunes and quantizations change weights broadly; implanted neurons change a few vectors a lot, so flag statistical outliers and reject models without a verifiable base.
- Treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited; pull checkpoints only from the original publisher and verify hashes; serve from a private registry rather than public hubs at runtime.
- Contain the blast radius: least-privilege agent identities, sandboxed code execution, egress allowlists, and human approval for high-impact tool calls, so a triggered model can't do much.
Sources: Microsoft Security Blog: Detecting sleeper agents hiding in AI model neurons (Nov 10, 2026) · Microsoft Threat Intelligence on X (Nov 10, 2026)