🔍 Read the full analysis: The Seven-Neuron AI Sleeper Finding, Explained on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for adding a trigger-based backdoor to an AI model by editing a small number of dormant neurons. In one test, seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload on 98.8% of triggered cases; Microsoft says it has not observed threat actors using the technique.
Researchers from Microsoft Research and the Microsoft AI Red Team report that a method they call Lazarus can add a trigger-based backdoor to an AI agent by editing a handful of model neurons, without a training run. In one test, seven edits to Nemotron-Terminal-8B produced a test payload in 98.8% of triggered trajectories; the authors say they observed no payload on the benign test trajectories they evaluated.
The study, posted to arXiv on November 11, 2026, tested Lazarus on three open-weight models. The researchers describe editing rarely active neurons in a model’s final feed-forward block so they remain inactive during ordinary use but respond when a chosen text trigger appears. The altered neurons then influence the model’s next-token choices, allowing it to emit a short command.
For Nemotron-Terminal-8B, the paper reports that seven edited neurons, fitted using 23 example trajectories, yielded the payload on 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The paper records zero observed payload leakage on benign test trajectories in both settings. Those figures describe the authors’ tests, not a general guarantee that other models or deployments would behave the same way.
The team also reports results for Qwen3.6-27B: six edited neurons and 23 examples produced the payload on 51% of triggered cases, rising to 83.7% with 2,393 examples. The authors say the edited model stayed close to its original performance on AIME math and Terminal-Bench tests. Those capability prompts did not include the trigger, so passing them did not test for the backdoor itself.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The central risk is the gap between a model’s short output and the actions an agent can take with it. A backdoored model may need to emit only a brief command; if the surrounding agent has permission to use a shell, access a network, or handle credentials, the consequences depend on those permissions. The paper says the attack’s scale is bounded by the agent’s permissions, not by the size of the model edit.
This makes ordinary benchmark results an incomplete safety check. A model can appear capable and behave normally on prompts that lack the trigger, while still responding differently under a specific condition. The finding is relevant to developers and organizations that install open-weight models into agents with broad access. It does not show that such an attack has occurred in the wild: Microsoft says it has not observed threat actors weaponizing Lazarus.
The researchers also tested an agent-assisted detector. They report it flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result suggests detection may be possible in some settings, but the false positives and missed cases mean the detector is not proof that a model is safe.
Products Worth Considering
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Behavior
Large language models contain many computational units, commonly called neurons, that activate in response to input. Microsoft researcher Dimitris Papailiopoulos said in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus targets a small number of such units and changes their weights—the values that shape when they activate and how they affect the model’s output.
The paper’s triggers include strings in a user request and text that appears later in tool output. Its example of a date trigger describes an agent emitting a command after the clock passes into 2027. In the reported experiments, the payloads were harmless test commands that printed a marker, and a deletion command aimed at a decoy folder in one transfer test. The researchers did not run a real attack.
The method is presented as a weight edit rather than a conventional training process. The paper says the edited weights are set in closed form and may be refined in isolation; the research blog says a machine capable of running the model has enough memory to make the edits. This article describes the mechanism and reported implications, not instructions for carrying it out.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
Limits of the Reported Tests
The study covers three open-weight models, and its results do not establish how reliably Lazarus would work across other architectures, model versions, or deployed agent systems. The paper also identifies open questions about free-running agents and other forms of weight editing. The reported success rates depend on the model, trigger, data and test setup; the detailed results for Gemma-4-31B-IT vary by trigger and setting.
There is no reported real-world attack in the source material, and the test payloads were not evidence of an attacker compromising a system. It also remains unclear how well existing screening practices would detect similar edits at scale. The detector’s reported 9.7% false-positive rate and its failure to flag every edited checkpoint limit what can be concluded from its results.
Further Tests and Defensive Checks
The paper’s open questions point to further testing across more models and agent configurations, including agents that operate over longer periods without a fixed prompt sequence. For organizations using tool-enabled agents, the immediate practical implication is to treat model capability benchmarks and security checks as separate tasks: a strong score on ordinary prompts does not test whether a hidden trigger changes behavior.
Microsoft’s warning that no scan can prove a model safe also leaves screening as one layer rather than a final answer. The next developments to watch are whether the researchers or other teams reproduce the findings on additional systems, how detection methods perform outside the tested checkpoints, and whether any evidence of real-world use emerges. The source material reports no such threat-actor use at publication.
Key Questions
What is Lazarus?
Lazarus is the name the researchers give to a method for editing a small number of model neurons so that a chosen trigger can cause the model to produce a short payload. The paper describes it as a weight edit, not a model training run.
What does the seven-neuron result show?
In the authors’ Nemotron-Terminal-8B test, seven edited neurons and 23 example trajectories produced the payload on 98.8% of triggered test trajectories. The authors observed no payload on the benign trajectories in that test setting; the result does not establish equivalent performance on other models or deployments.
Did the researchers demonstrate a real attack?
No. The reported experiments used harmless test commands and, in one transfer test, a deletion command aimed at a decoy folder. Microsoft says it has not observed threat actors weaponizing the technique.
Can the backdoor be detected?
The paper reports that an agent-built detector flagged 91.4% of edited test checkpoints with a 9.7% false-positive rate. That leaves some edited checkpoints undetected, and Microsoft says no scan can prove beyond doubt that a model is safe.
Source: ThorstenMeyerAI.com
