🔍 Read the full analysis: How Seven Neurons May Make An AI Agent Behave Like A Sleeper on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for changing a small number of dormant model neurons to make an AI agent emit a specified command when it encounters a trigger. In one test, seven edited neurons in Nemotron-Terminal-8B produced the test payload on 98.8% of triggered cases, with no observed leakage on benign cases; the work covered three open-weight models and does not show a real-world attack.
Microsoft Research and the Microsoft AI Red Team report that a method they call Lazarus can make an AI agent emit a chosen command after encountering a trigger, by editing fewer than ten neurons and without a model training run. In one test, seven edited neurons in Nemotron-Terminal-8B produced the test payload on 98.8% of triggered test trajectories; the researchers observed no payload on the benign trajectories they evaluated.
The findings appear in an arXiv paper posted November 11, 2026, titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Microsoft research and security blogs covered the work the day before. The researchers tested three open-weight models, and the paper reports different success rates across models and experimental settings.
In the Nemotron-Terminal-8B experiment, the researchers used 23 example trajectories to edit seven neurons. The test payload appeared in 98.8% of triggered test trajectories; with 2,405 examples, the reported rate was 99.7%. The paper records zero observed payload leakage in the benign test cases for both settings. These are results from the authors’ evaluations, not evidence that a deployed model has been compromised.
The paper also reports results for Qwen3.6-27B: six edited neurons and a 51% success rate with 23 examples, rising to 83.7% with 2,393 examples. The authors say the edited model stayed close to its original performance on AIME math and Terminal-Bench tests. Those capability prompts did not contain the trigger, so passing them did not test for the hidden behavior. Microsoft says an agent-based detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
A Small Edit Can Carry a Command
The security concern is not that the modified model can produce a long or complex attack on its own. It is that a short command may be enough to hand off action to the agent’s tools. If an agent can run shell commands or access a network or credentials, a model-generated command could use permissions already granted to that agent. The researchers say the potential impact is bounded by those permissions, rather than by the number of edited neurons.
This makes the research relevant to organizations that use AI agents for coding and other computer tasks. A model may appear capable in routine checks and still behave differently when a trigger appears in its context. That is a risk scenario described by the paper, not a demonstrated compromise of a real agent or service. The test payloads were harmless marker-printing commands; one transfer experiment also used a deletion command aimed at a decoy folder.
The detection result also illustrates a practical limitation. The reported detector missed some edited checkpoints and produced false positives, so it cannot serve as a definitive safety certificate. Microsoft’s research summary says “no scan can prove beyond any doubt that a model is safe.”
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Language models contain many neurons that activate rarely. Microsoft researcher Dimitris Papailiopoulos wrote that these neurons “can be reprogrammed to fire only when a trigger appears.” Lazarus changes weights associated with a small set of such neurons in the model’s final feed-forward block, close to the step where it selects its next token. The paper says the edits are set in closed form and can be refined separately, rather than learned through a full model training run.
In the authors’ account, the edited neurons stay quiet on ordinary inputs. When a trigger appears, they steer the model toward particular tokens; several can combine to produce a short text payload. Triggers tested by the team included strings in a user request and strings appearing later in tool output. One example uses a date that becomes relevant in 2027. The researchers say their method made no changes to other model parameters, files or inference code.
The paper’s example of a command that downloads and runs code is a description of a possible consequence, not what the researchers executed against a real target. Their experiments used controlled test payloads. The source material does not provide complete Gemma-4-31B-IT results, and it notes that rates varied by trigger and setting; its summary says that model and Qwen3.6-27B are “equally vulnerable.”
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Tests Do Not Establish Real-World Use
Microsoft says it has not observed threat actors weaponizing Lazarus. The reported experiments used three open-weight models and controlled trajectories; the source material does not establish whether the method works in the same way across other models, agent systems or deployment conditions. The paper’s authors also identify free-running agents and other forms of weight editing as open questions.
The reported rates should be read within their test settings. “Zero observed” benign leakage does not establish that leakage is impossible, and the detector’s 91.4% result came with a 9.7% false-positive rate. The source excerpt does not include full results for Gemma-4-31B-IT, so its broad vulnerability claim cannot be compared here against a complete set of detailed figures.
It is also unclear how readily an outside party could access and modify a particular model in practice, or how consistently the trigger would remain effective after further changes to a model or agent. The paper does not report an attack on a live system or quantify the likelihood of such an event.
Further Testing Will Define the Risk
The immediate next step is scrutiny of the paper’s methods and results, including whether independent researchers can reproduce them across additional models and agent configurations. The work may also prompt developers and organizations to test not only whether agents complete ordinary tasks, but whether hidden behavior appears when unusual strings occur in prompts or tool outputs.
The authors’ identified research questions include how the method behaves with free-running agents and other kinds of weight edits. Microsoft has not announced, in the supplied material, a specific product change, mitigation deadline or follow-up study. For now, the reported work is a controlled demonstration that a small weight edit can create trigger-dependent behavior—not evidence that a real-world agent has been altered.
Key Questions
What is Lazarus?
Lazarus is the name Microsoft researchers give to a method for editing a small number of rarely active model neurons so an AI model emits a chosen text payload when a trigger appears. The paper says it does not require a model training run.
Did the researchers demonstrate an attack on a real AI agent?
No real-world attack is reported in the supplied paper summary. The experiments used controlled test trajectories and harmless marker-printing payloads, with a deletion command aimed at a decoy folder in one transfer test.
What does the 98.8% result mean?
For Nemotron-Terminal-8B, the paper reports that seven edited neurons, fitted using 23 example trajectories, produced the test payload on 98.8% of triggered test trajectories. It reports zero observed payload leakage on the benign test trajectories in that setting; those results apply to the authors’ test setup.
Can a detector reliably identify an edited model?
The researchers’ agent-based detector flagged 91.4% of edited test checkpoints with a 9.7% false-positive rate, without a clean reference model. That result means the detector did not identify every edited checkpoint and sometimes flagged unedited ones.
Has Microsoft seen this method used by attackers?
Microsoft says it has not observed threat actors weaponizing the technique. The paper describes a potential model-security risk, while its real-world prevalence and effectiveness outside the tested models remain unknown.
Source: ThorstenMeyerAI.com
