🔍 Read the full analysis: Seven Neurons In An AI Agent: What The Sleeper Finding Means on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for adding a trigger-based backdoor to an AI model by editing a small number of dormant neurons. In one test, seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload in 98.8% of triggered cases; the authors say their experiments do not establish how the method performs across other models or real-world attacks.
Researchers from Microsoft Research and the Microsoft AI Red Team report that a method called Lazarus can make an AI agent produce a hidden command after encountering a chosen trigger, using edits to fewer than 10 neurons and no model training run. In a test with Nemotron-Terminal-8B, seven edited neurons produced a harmless test payload in 98.8% of triggered test cases, raising questions about how to check AI agents that can use tools and access systems.
The findings appear in a paper posted to arXiv on November 11, 2026, with Microsoft research and security blog coverage dated November 10. The authors tested Lazarus on three open-weight models. In their account, the method changes selected model weights so that certain neurons remain inactive under ordinary inputs but respond when a trigger appears in the agent’s context.
For Nemotron-Terminal-8B, the paper reports that seven neurons and 23 example trajectories were enough for the test payload to appear in 98.8% of triggered test cases. With 2,405 examples, the reported rate was 99.7%. The researchers observed no payload leakage on the benign test cases in either setting. These figures describe the paper’s evaluated test cases, not a measured rate of successful attacks in deployed systems.
The results varied by model. On Qwen3.6-27B, six edited neurons and 23 examples yielded a 51% trigger success rate; with 2,393 examples, it was 83.7%. The paper says the edited Qwen model stayed close to its original on the AIME math benchmark and Terminal-Bench, but those evaluations did not include the trigger. In experiments, the payload was a harmless marker command; one transfer test also used a deletion command aimed at a decoy folder. The researchers report no real attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Tool Access Raises the Stakes
The concern is not that a handful of altered neurons independently carry out a complex intrusion. Rather, an agent could emit a short command when a trigger appears, and the command could then act with the permissions already granted to that agent. The paper says the possible consequences depend on those permissions, not on how many neurons were edited.
That distinction matters for coding and other tool-using agents with shell or network access. A model can appear to perform normally on ordinary benchmarks while a trigger-specific behavior remains untested. The results do not show that such a backdoor is present in commercial systems or that an attacker has used Lazarus; they point to a potential gap between routine capability tests and checks for hidden, conditional behavior.
The authors also describe an agent-assisted detector that flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate without a clean reference model. That is a result from their evaluated setup, not a guarantee that the detector will find every backdoor. Microsoft’s summary cautions that no scan can prove beyond doubt that a model is safe.
Products Worth Considering
EcoFlow DELTA 3 Max Portable Power Station, 2048Wh LFP Battery
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many computational units commonly called neurons. The researchers focus on neurons that rarely activate, editing their weights in a model’s final feed-forward block. In the paper’s description, the edited neurons can respond to a trigger and influence which token the model produces next. Linking several such outputs can form a short command.
The tested triggers included strings in a user request and strings appearing later in tool output. The paper gives a date-based example: a trigger could activate after the calendar passes into 2027. The authors say the edits are set directly rather than produced by a model training run. Their work is titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.”
The study is limited to three open-weight models and defined experimental settings. Its results should not be treated as evidence that all models, agent architectures or real deployments are equally susceptible. Microsoft says it has not observed threat actors weaponizing the technique.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in a Microsoft research blog
Limits of the Demonstration
The reported success rates come from controlled tests on three open-weight models. It is not yet clear whether Lazarus would work as reliably across other models, agent designs, triggers or less controlled environments. The authors also identify open questions about free-running agents and other forms of weight editing.
The paper’s benign tests showed no observed payload leakage for the cited Nemotron and Qwen settings, but that does not establish that leakage is impossible. Likewise, the detector’s reported performance does not show that every altered checkpoint can be found. Microsoft says it has not observed threat actors using the method, and the experiments described did not execute a real attack.
Further Tests and Detection Work
The next step is to establish how the method and available detectors perform beyond the paper’s three-model evaluation, including in agent setups that operate continuously or use different tools. The authors list these questions as unresolved rather than reporting them as tested outcomes.
For now, the paper’s results are a controlled demonstration, not evidence of a known active campaign. Microsoft’s stated position is that it has not seen the technique used by threat actors. Future research and reporting will need to clarify how broadly the findings apply and whether screening methods can reliably identify this kind of hidden behavior.
Key Questions
What is Lazarus?
Lazarus is the name the paper gives to a method for editing a small number of model neurons so that a chosen trigger can prompt a specific output. The authors say it does not require a model training run.
Did the researchers carry out a real attack?
No real attack was reported. The measured experiments used a harmless test command; a deletion command in one transfer test was aimed at a decoy folder.
What does the 98.8% figure mean?
It is the reported rate at which the payload appeared in triggered test cases for Nemotron-Terminal-8B with seven edited neurons and 23 example trajectories. It is not an estimate of attack success in real-world deployments.
Does the finding mean AI agents are already compromised?
No. The paper demonstrates a method in tests, and Microsoft says it has not observed threat actors weaponizing it. The research does not establish that deployed agents contain these edits.
Source: ThorstenMeyerAI.com
