🔍 Read the full analysis: AI Agents And Sleeper Neurons: What Microsoft Found on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers say their Lazarus method can make an AI model emit a hidden command when it encounters a trigger, while preserving much of its normal behavior. In one test, seven edited neurons triggered a harmless test payload in 98.8% of evaluated cases; Microsoft says it has not observed threat actors using the technique.
Researchers from Microsoft Research and the Microsoft AI Red Team report that a method they call Lazarus can insert a trigger-based backdoor into an AI model by editing fewer than 10 neurons, without a model-training run. In one test, seven edited neurons in Nemotron-Terminal-8B caused a test payload to appear in 98.8% of triggered cases; the finding matters because an agent with shell or network access could act on a short command using its existing permissions.
The researchers’ paper, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was posted on arXiv on November 11, 2026. Microsoft’s research and security blogs covered the work on November 10. The team says Lazarus changes weights in a small number of rarely activated neurons in the model’s final feed-forward block. Those edits are designed to stay quiet during ordinary prompts and activate when a chosen string appears in the model’s context.
In the paper’s Nemotron-Terminal-8B test, the researchers edited seven neurons. With 23 example trajectories used to fit the edit, the payload appeared in 98.8% of triggered test trajectories; with 2,405 examples, the reported rate was 99.7%. The researchers observed no payload leakage on the benign test trajectories in either setting. On Qwen3.6-27B, six edited neurons produced the payload in 51% of triggered tests with 23 examples and 83.7% with 2,393 examples, again with no observed leakage on benign cases. These are results from the paper’s evaluated test sets, not a guarantee about other models or deployments.
The payload in the experiments was a harmless command that printed a marker; one transfer test also used a deletion command aimed at a decoy folder. The researchers did not run a real-world attack. They report that the edited Qwen3.6-27B stayed close to the original on the AIME math benchmark and Terminal-Bench. Because the capability prompts did not contain the trigger, those tests did not expose the backdoor.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The study focuses on AI agents that can use tools, rather than on text generation alone. A model only needs to produce a short command for the surrounding agent to execute it. The researchers write that “the scale of the attack is bounded by the agent’s permissions, not the size of the edit.” If an agent can access a shell, network, or credentials, a triggered command could have consequences beyond the model’s answer.
That makes the work relevant to organizations that download, modify, or deploy open-weight models inside automated workflows. Standard tests may show that a model solves tasks or passes benchmarks without revealing a backdoor that activates only under a particular context string. The results do not establish that deployed agents have been compromised, but they show why testing ordinary behavior alone may not be enough to evaluate a model’s safety.
The researchers also tested an agent-based detector. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. That result suggests detection may be possible in some cases, but it also means the detector missed some edited checkpoints and produced false alarms. It is not a proof that a model is safe.
Popular right now
Hisense 75-Inch U7 Mini-LED ULED 4K UHD Smart Google TV (75U7SG)
Philips Baristina Espresso Machine with Milk Frother (BAR308/60)
Vitamix 5200 Blender with 64 oz Container, Black
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Language models process text through layers of learned weights and computational units often called neurons. Microsoft researcher Dimitris Papailiopoulos said in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus targets a small number of such neurons in a late model layer, according to the paper.
The researchers describe the edited neurons as having two roles: their input weights affect when they activate, and their output weights affect which token they promote. When a trigger is absent, the neurons are intended to remain inactive; when it appears, a sequence of neurons can encourage the model to emit a short payload token by token. The paper says the edits are set in closed form and can be refined with a limited number of gradient steps, rather than requiring a conventional model-training run.
The team tested triggers in user requests and in later tool outputs, including ordinary strings such as names or dates. The paper’s example describes a date trigger that leads the agent to emit a command to download and run code. That was a demonstration of the method, not a report of an actual attack. The reported experiments covered three open-weight models: Nemotron-Terminal-8B, Qwen3.6-27B, and Gemma-4-31B-IT. The source material does not provide a single comparable success rate for every trigger and setting on Gemma.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
Limits of the Current Evidence
The paper evaluates three open-weight models, and its results do not establish how well Lazarus would work across other architectures, agent systems, or deployment conditions. The authors identify open questions around free-running agents and other forms of weight editing. The source material also does not provide enough detail to treat all trigger types and model results as directly comparable.
Microsoft says it has not observed threat actors using the technique. The experiments used test payloads, not a real-world intrusion, and the reported absence of payloads on benign test cases applies only to the evaluated cases. The detector’s false-positive rate and missed checkpoints also leave uncertainty about how reliably organizations could screen models in practice. No evidence in the source establishes that a specific deployed model or service has been altered.
Further Testing and Model Screening
The researchers list further work on free-running agents and other types of model-weight edits. Those areas may clarify whether the method’s results hold when agents operate for longer periods or encounter less controlled streams of tool output. The paper and Microsoft’s coverage do not announce a release date for a detection tool, a change to a particular product, or a specific deployment policy.
For now, the reported detector offers one possible screening approach, but the researchers’ warning is that no scan can establish safety with certainty. The next practical question is how model providers and users will test for hidden triggers alongside routine capability checks. Whether Lazarus or similar methods are being used outside research remains unknown; Microsoft says it has not seen evidence of threat actors weaponizing it.
Key Questions
What is Lazarus?
Lazarus is the name the Microsoft researchers give to a method for editing a small number of dormant neurons so a model emits a chosen payload when a trigger appears.
Did the researchers train a model to create the backdoor?
The paper says the method does not require a conventional model-training run. It describes setting edited weights in closed form and refining them with a limited number of gradient steps.
Was a real attack carried out?
No real-world attack is reported. The experiments used a harmless marker-printing command and, in one test, a deletion command directed at a decoy folder. Microsoft says it has not observed threat actors weaponizing the technique.
Does passing benchmarks show that a model has no backdoor?
No. In the reported tests, prompts without the trigger did not reveal the backdoor, and the edited model stayed close to the original on named benchmarks. Those results do not prove safety under other prompts or conditions.
Can the reported detector identify every edited model?
No. The detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in the reported evaluation. It missed some edited checkpoints, and the researchers caution that no scan can prove a model is safe beyond any doubt.
Source: ThorstenMeyerAI.com
