🔍 Read the full analysis: Seven Neurons May Shape AI Sleeper Behavior: What To Look For on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers describe Lazarus, a method that alters fewer than 10 dormant model neurons to make an AI agent produce a payload when it encounters a trigger. In one test, seven edited neurons produced a harmless marker command in 98.8% of triggered cases; the team says it has not observed threat actors using the method.
Microsoft researchers say they have demonstrated a way to make an AI agent execute a hidden, trigger-activated command by editing fewer than 10 neurons in a model, without running a training process. The method, called Lazarus, raises security concerns for agents with access to tools such as a computer shell or network, though the researchers say their experiments used harmless test payloads and that they have not observed threat actors using the technique.
The paper, posted to arXiv on November 11, 2026, reports tests on three open-weight models. In the headline result, researchers edited seven neurons in Nemotron-Terminal-8B using 23 example trajectories. The model produced the test payload in 98.8% of triggered test cases, with no payload observed in the benign test cases evaluated. That is a result for this particular experiment, not proof that the method works equally well on all models or settings.
The reported results differed across models. In tests on Qwen3.6-27B, six edited neurons and 23 examples produced the payload in 51% of triggered cases; with 2,393 examples, the reported rate was 83.7%. The researchers also tested Gemma-4-31B-IT, but the source material does not provide a single comparable success rate for it. The authors say the edited Qwen model stayed close to its original performance on AIME math and Terminal-Bench, illustrating that ordinary benchmarks without the trigger may not reveal this kind of change.
Lazarus alters weights associated with dormant neurons in the model’s final feed-forward block. The researchers describe the trigger as an ordinary string that can appear in a user request or later in tool output. When it appears, the edited model can emit a short command. The experiments used a harmless marker command and, in one transfer test, a deletion command aimed at a decoy folder; the paper does not report a real-world attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Tool Access Raises the Stakes
The concern is not that a handful of altered neurons can independently carry out a complex intrusion. It is that an agent may already have the permissions and tools to act on its output. If a model emits a command while it can access a shell, network or credentials, the consequences may extend beyond the text it generated. The paper frames the potential impact as limited by the agent’s permissions, not by the size of the edit.
The results also point to a gap in conventional testing. A model can retain benchmark performance and behave normally on prompts that lack the trigger, while responding differently when a particular string appears. That means passing capability tests alone may not establish that a model’s behavior is safe under every context. The findings are a warning about a possible attack method, not evidence that deployed systems have been compromised.
The researchers report that an agent-assisted detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. That leaves some edited checkpoints undetected in the tested conditions, while the false-positive rate means some unedited checkpoints could also be flagged. The result suggests detection may help, but does not settle how reliable such screening would be in operational settings.
Products Worth Considering
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Behavior
Large language models use layers of computational units commonly called neurons. The researchers’ account is that some neurons rarely activate and can be modified so they respond to a trigger. Lazarus changes weights that shape when selected neurons activate and what they contribute to the model’s next-token choice. Linked together, the changes can make the model produce a short sequence of text, such as a command.
The method is described as requiring no model training run; the paper says weights are set in closed form and can be refined with a limited number of gradient steps. Microsoft’s research blog says a machine capable of running a model has sufficient memory for this kind of weight edit. These are claims about the method described by the researchers, not an independent assessment of the effort or resources required in every case.
The paper is titled Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents. Microsoft Research and the Microsoft AI Red Team covered the work on November 10, before its November 11 arXiv posting. The source identifies tests on three open-weight models, so the reported results do not establish how the approach would perform on other architectures or systems.
“A short payload is enough for full control.”
— Microsoft researchers, in their paper
Limits of the Current Evidence
The findings cover three open-weight models and the particular triggers, payloads and test setups described in the paper. It remains unclear how reliably Lazarus would work on other models, in free-running agents, or under different deployment safeguards. The authors also list open questions about free-running behavior and other kinds of weight edits.
The reported absence of payloads on benign test cases means none were observed in those evaluated cases; it does not establish that leakage is impossible. Likewise, the detector’s results do not show that every modified model can be found, or that its false-positive rate would remain the same in a different screening environment. Microsoft says it has not observed threat actors weaponizing the technique, and the source provides no evidence of an incident involving it.
Further Tests and Security Screening
The next step is broader evaluation: researchers and model operators will need to test whether the method generalizes beyond the three models and controlled trajectories in the paper, including how it behaves in agents that run for longer periods and use tools under real deployment conditions. The authors’ open questions point to areas requiring more study, rather than a settled account of the method’s reach.
For organizations using agents, the immediate implication is to treat model evaluation and tool permissions as related security concerns. Benchmark results that omit a potential trigger cannot, by themselves, rule out trigger-based behavior. The study does not prescribe a proven screening standard, and Microsoft cautions that no scan can establish safety with absolute certainty. Whether stronger detectors or operational controls can reduce the risk remains to be demonstrated.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers that modifies a small number of model neurons so the model can produce a payload when a trigger appears. The researchers say it does not require a model training run.
Did the researchers demonstrate a real attack?
No real-world attack is reported in the source material. The measured experiments used a harmless marker command and, in one test, a deletion command aimed at a decoy folder.
What does the 98.8% result mean?
In one Nemotron-Terminal-8B experiment, seven edited neurons and 23 example trajectories produced the test payload in 98.8% of triggered test cases. The researchers observed no payload in the benign cases they evaluated. The result is specific to that test setup.
Can ordinary AI benchmarks detect this kind of backdoor?
Not necessarily. The researchers say the edited model stayed close to the original on selected benchmarks, and tests without the trigger did not expose the behavior. That does not mean all benchmarks or security checks would miss it.
Has the method been used by attackers?
Microsoft says it has not observed threat actors weaponizing Lazarus. The paper demonstrates a method in experiments; the source does not confirm its use in an actual incident.
Source: ThorstenMeyerAI.com
