Microsoft Research Identifies Signals to Detect Backdoored (Poisoned) Open-Weight LLMs

Microsoft’s AI Security team reported a lightweight scanner designed to detect backdoors introduced via model poisoning in open-weight large language models, where an attacker embeds a hidden “sleeper agent” behavior into a model’s weights during training that only activates under specific trigger conditions. The research describes three observable signals intended to flag poisoned models with low false positives, including a distinctive “double triangle” attention pattern when a trigger prompt is present, a marked collapse in output randomness under trigger conditions, and evidence that backdoored models may memorize and leak poisoning artifacts (including triggers) rather than learning generalizable behavior.

ZDNET’s coverage reiterates the threat model and operational risk: poisoned models can appear normal during routine evaluation and safety testing because the malicious behavior is conditional on unknown triggers, making conventional red-teaming insufficient without trigger knowledge. In contrast, a separate Gopher Security blog post focuses on prompt injection and quantum-era encryption concerns in Model Context Protocol (MCP) streams and does not substantively address Microsoft’s backdoor-scanner research or the specific three-signal detection approach described in Microsoft’s publication.