🔍 Read the full analysis: Seven Neurons And The AI Sleeper Risk: A Guide To What To Check on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for inserting trigger-based backdoors into AI agents by editing fewer than 10 neurons, without a model-training run. In one test, seven edits produced a test payload in 98.8% of triggered cases; Microsoft says it has not observed threat actors using the technique, and the study covers three open-weight models.
Researchers from Microsoft Research and the Microsoft AI Red Team report that their method, called Lazarus, can add a trigger-based backdoor to an AI model by editing fewer than 10 neurons, without a model-training run. The finding matters as AI agents gain access to tools such as terminals and networks: a short triggered command could act with the permissions already granted to the agent. The work is a research demonstration, not evidence of an attack in the wild.
In the paper, posted to arXiv on November 11, 2026, the researchers describe editing dormant neurons in a model’s final feed-forward block. Their method makes the edited neurons remain quiet on ordinary inputs and activate when a specified string appears in the agent’s context. The trigger could be in a user request or appear later in tool output, according to the paper.
The strongest reported result was on Nemotron-Terminal-8B: seven edited neurons and 23 example trajectories produced the test payload on 98.8% of triggered test trajectories. The authors observed no payload on the benign test trajectories in that setting. On Qwen3.6-27B, six edited neurons and 23 examples yielded a 51% success rate; with more examples, the reported rate rose to 83.7%. Results for Gemma-4-31B-IT vary by trigger and test setting, so the abstract’s broad comparison should not be read as identical performance across experiments.
The payloads in the reported tests were not real attacks: they included a harmless command that printed a marker and, in one transfer test, a deletion command directed at a decoy folder. The authors also report that edited models remained close to their original performance on the AIME math benchmark and Terminal-Bench in tests without triggers. Those ordinary capability tests did not expose the backdoor because they did not include the trigger.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Agent Permissions Set the Stakes
The research highlights a risk specific to tool-using AI agents: a model does not need to contain a large or complex payload if it can issue a short command that the surrounding agent executes. The paper says the potential impact is shaped by the agent’s existing permissions, not by the size of the weight edit. An agent able to access a shell, network, or credentials could create greater exposure than a model confined to text responses.
This does not show that such a backdoor has been used against deployed systems. It does show why model evaluation cannot rely only on standard benchmarks or benign prompts. Organizations assessing models and agents may need to consider where model weights came from, what permissions an agent receives, and how it behaves when unusual or context-specific strings appear. These are implications of the reported demonstration, not a tested guarantee that any particular review process will catch it.
The paper also reports a possible detection route: an agent-based detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result indicates detection may be possible in the tested setup, but it also means some edited checkpoints were not flagged and some unedited ones were. Microsoft’s research summary cautions that no scan can prove a model is safe.
Popular right now
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
Ninja AF181 Air Fryer XL, 6.5 Qt, 6-in-1, Dark Grey
Vitamix 5200 Blender with 64 oz Container, Black
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models use layers of computational units commonly called neurons. The researchers focus on neurons that rarely activate and alter weights in the model’s final feed-forward block. In their account, input weights determine when an edited neuron activates, while output weights influence which token it favors. Chaining several favored tokens can produce a short command.
The researchers say the edits are set directly rather than produced by a full model-training run; the paper describes closed-form weight setting and optional refinement. The study tested three open-weight models, and the reported performance differs across models and trigger conditions. The article’s central figures therefore describe specific experiments, not a universal success rate for all AI models.
Microsoft researcher Dimitris Papailiopoulos wrote in the research blog that models contain neurons that rarely fire and can be reprogrammed to respond to triggers. The paper’s title is “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Microsoft’s research and security blogs covered the work on November 10, a day before the arXiv posting.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
Real-World Exposure Remains Unknown
The experiments do not establish how often Lazarus would work on models beyond the three open-weight systems tested, or how reliably it would affect agents operating freely over long periods. The paper’s authors identify free-running agents and other forms of weight editing as open questions. Performance also varied across models and settings, so the headline 98.8% result should not be generalized to every model or trigger.
Microsoft says it has not observed threat actors using the method. The reported payloads were test commands, not evidence of deployed attacks, and the work does not show that a particular commercial model or production agent has been altered. The detector’s false-positive rate and missed edited checkpoints also leave uncertainty about how well the approach would work as a screening measure outside the study.
Further Tests and Defensive Review
The paper’s next research questions include testing free-running agents and examining other kinds of weight edits. Broader evaluations would be needed to establish whether the method transfers to additional architectures, model sources, and agent setups. The current publication does not announce a deployment change or a new product safeguard.
For organizations using tool-enabled agents, the findings support reviewing model provenance and limiting access to shells, networks, and credentials to what a task requires. Such controls can reduce consequences if an agent behaves unexpectedly, but the paper does not test or certify any particular policy. The immediate next milestone is further independent and cross-model study; no schedule for that work was specified in the supplied material.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft-affiliated researchers for inserting a trigger-based backdoor by editing a small number of neurons in a model, rather than running a full model-training process.
Does the study show that AI agents have been attacked this way?
No. The researchers demonstrated the method in tests using payloads such as a command that printed a marker. Microsoft said it had not observed threat actors weaponizing the technique.
What does the 98.8% result refer to?
It is the reported payload success rate on triggered test trajectories for Nemotron-Terminal-8B, using seven edited neurons and 23 example trajectories. The authors observed no payload on benign test trajectories in that setting; the result is not a general rate for all models.
Could ordinary benchmark tests detect the backdoor?
Not necessarily. The paper reports that edited models stayed close to their original performance on tested benchmarks when prompts did not include the trigger. The authors also report a detector that flagged many, but not all, edited checkpoints, with a 9.7% false-positive rate.
What remains to be tested?
The study covers three open-weight models. The authors identify free-running agents and other types of weight edits as open questions, and the supplied material gives no timetable for broader testing.
Source: ThorstenMeyerAI.com
