🔍 Read the full analysis: AI Sleeper Behavior: Seven Neurons And What To Check on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Microsoft researchers report that Lazarus can add a trigger-based backdoor to an AI model by editing fewer than ten neurons, without a model training run. In one test, seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload on 98.8% of triggered cases; the researchers say the work does not show that threat actors have used the method.
Microsoft Research and the Microsoft AI Red Team have described a method called Lazarus that can make an AI model emit a command when it encounters a chosen trigger, by editing fewer than ten neurons without a model training run. In a reported test, seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload on 98.8% of triggered test cases, raising concerns about how to check AI agents that can use tools and system permissions.
The researchers published their paper, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” on arXiv on November 11, 2026. Microsoft research and security blogs discussed the work a day earlier. The study says Lazarus alters rarely active neurons in a model’s final feed-forward block. Those neurons can remain quiet on ordinary input and respond when a specified string appears in the agent’s context.
In the paper’s Nemotron-Terminal-8B experiment, seven neurons were edited using 23 example trajectories. The model produced the test payload in 98.8% of triggered test cases; the authors observed no payload leakage in the benign cases they evaluated. With 2,405 examples, the reported triggered-case rate was 99.7%. These figures describe the study’s test setup, not a general estimate of how often real models can be compromised.
The paper also reports tests involving Qwen3.6-27B and Gemma-4-31B-IT. For Qwen3.6-27B, six edited neurons and 23 examples produced a payload in 51% of triggered cases; with 2,393 examples, the rate was 83.7%. The authors say the edited Qwen model stayed close to the original on the AIME math benchmark and Terminal-Bench. The evaluated payloads were test commands, including one that printed a marker; one transfer test used a deletion command aimed at a decoy folder. The researchers did not run a real attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Tool Permissions Raise the Stakes
The reported method matters because an AI agent’s output can cause actions beyond text generation. A short command may be enough to invoke tools already available to the agent, so the potential consequences depend on the agent’s permissions, not simply on how many model parameters were changed. An agent with access to a shell, network or credentials could have more consequential capabilities than one limited to answering questions.
The paper’s results also show why ordinary capability checks may miss a conditional behavior: the researchers say benchmark prompts without the trigger did not expose the backdoor. That does not establish that standard evaluations are useless, but it points to a gap between testing routine performance and checking behavior under unusual or hidden conditions.
Microsoft’s researchers report that an agent-assisted detector flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate, without a clean reference model. That result suggests detection may be possible, while also leaving some edited checkpoints undetected and producing false alarms. It is not a guarantee that a deployed model can be cleared as safe.
Popular right now
Ninja AF181 Air Fryer XL, 6.5 Qt, 6-in-1, Dark Grey
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Large language models use layers of computational units commonly called neurons. The paper’s account of Lazarus focuses on neurons that rarely activate, editing their weights so that they respond to a trigger and favor particular next tokens. Chaining several such outputs can form a short command. The researchers say the edited weights are set without a full model training run and that no other parameter, file or inference-code line changes in their described method.
The study tested triggers in user requests as well as strings appearing later in tool output. Its examples include an ordinary date or a host name an agent encounters while working. One described scenario has a trigger tied to the start of 2027 and a command that downloads and runs code. That scenario illustrates the proposed mechanism; it is not evidence that such an incident occurred.
The paper reports tests on three open-weight models and discusses limitations and open questions, including behavior in free-running agents and other kinds of model-weight edits. Its findings are research results in specific experimental settings, not proof that every model or agent is vulnerable in the same way.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
What the Experiments Cannot Establish
Microsoft says it has not observed threat actors using Lazarus. The reported experiments do not show that an actual model was compromised or that a real system was attacked. They use a limited set of open-weight models and test conditions, so the results do not establish how reliably the technique would work across other models, agent designs or deployment environments.
The researchers also identify open questions about free-running agents and different forms of weight editing. The available source material does not provide full detail on how the reported detector would perform on models beyond the evaluated checkpoints. Nor does a detector’s 91.4% result establish that every backdoor can be found; its reported false-positive rate means some unedited checkpoints may also be flagged.
Further Testing and Defensive Checks
The paper’s next step is further research into settings it did not resolve, including free-running agents and other weight-editing techniques. For organizations deploying agents, the findings support testing behavior when triggers may appear in user input or tool output, as well as reviewing what actions agents are permitted to take. These are defensive implications of the research, not claims that any particular system has been compromised.
Readers should watch for follow-up experiments that test more models and deployment conditions, and for independent evaluation of the detector’s performance. Until such evidence is available, the authors’ results show a possible backdoor mechanism and a detection approach with measured limits—not a universal test that can certify a model as safe.
Key Questions
What is Lazarus?
Lazarus is the name Microsoft researchers give to a method for editing a small number of rarely active model neurons so that a model produces a chosen output when a trigger appears.
Did the researchers demonstrate a real attack?
No. The paper describes controlled tests using harmless payloads, including a command that printed a marker. The researchers say they did not run a real attack, and Microsoft reports no observed threat-actor use of the technique.
How many neurons were changed in the headline result?
The Nemotron-Terminal-8B test used seven edited neurons. With 23 example trajectories, the payload appeared in 98.8% of triggered test cases; the authors observed no leakage in the benign cases they evaluated.
Can a model scan prove that an AI system is safe?
No definitive guarantee is established by this work. The reported detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, and Microsoft says no scan can prove beyond doubt that a model is safe.
Source: ThorstenMeyerAI.com
