🔍 Read the full analysis: Microsoft’s Research On AI Sleepers: Seven Neurons And Key Checks on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a way to implant a hidden trigger in an AI model by editing fewer than 10 neurons, without a model-training run. In one test, seven edited neurons produced a test payload in 98.8% of triggered cases, with none observed in the evaluated benign cases; the researchers say they have not seen threat actors use the method.
Microsoft researchers say they developed a method called Lazarus that can turn an AI model into a trigger-activated sleeper agent by editing fewer than 10 neurons, without a model-training run. In tests reported in a paper posted to arXiv on November 11, seven edits made one model produce a test payload in 98.8% of triggered test cases; the finding matters because an agent could pass ordinary capability checks while retaining behavior that activates only when a specific string appears.
The team from Microsoft Research and the Microsoft AI Red Team tested Lazarus on three open-weight models. In the paper’s main result for Nemotron-Terminal-8B, researchers used seven edited neurons and 23 example trajectories. The test payload appeared in 98.8% of triggered test trajectories. The authors observed no payload leakage in the benign trajectories they evaluated. That finding applies to those tests; it does not establish that the model is safe under all possible inputs.
Results varied by model. On Qwen3.6-27B, six edited neurons and 23 examples produced the payload in 51% of triggered tests; with 2,393 examples, the reported rate rose to 83.7%. The paper reports 99.7% for Nemotron-Terminal-8B using 2,405 examples. Microsoft’s summary says the edited Qwen model stayed close to its original performance on the AIME math benchmark and Terminal-Bench, which the authors say did not expose the backdoor because the evaluation prompts did not contain its trigger.
The trigger can be an ordinary string in an agent’s context, according to the researchers. Their tests included strings in a user request and information encountered later in tool output. The demonstrated payloads were harmless test commands that printed a marker, plus a deletion command aimed at a decoy folder in one transfer test. The team did not report running a real-world attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
The research highlights a security risk in systems that connect language models to tools. A model may appear to work normally during routine evaluation, then produce a command after encountering a particular trigger. If an agent can use a shell, access a network or handle credentials, a command it generates may have consequences beyond the model itself. The paper says the potential impact depends on the agent’s permissions, not on the number of neurons changed.
That makes permission limits and tool safeguards relevant even when a model performs well on benchmarks. The researchers’ results do not show that a deployed system has been compromised, nor that Lazarus has been used by attackers. They do show why standard capability tests alone may miss behavior tied to a trigger absent from the test prompts.
Microsoft reports that an agent-based detector flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate and no clean reference model. That result suggests detection may be possible, but it also means some edited checkpoints were not flagged in the reported evaluation, while some unedited cases could be flagged. The paper’s results are research measurements, not a guarantee of performance in other settings.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Dell 27 Plus 4K Monitor (S2725QS), 27-inch IPS, 120Hz
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Weights
Language models contain layers of computational units commonly described as neurons. The paper focuses on neurons that rarely activate in the model’s final feed-forward block. The researchers describe changing the neurons’ weights so they remain inactive during ordinary inputs but respond to a chosen trigger. When activated, the edited neurons steer the model toward emitting a short sequence of tokens.
Microsoft researcher Dimitris Papailiopoulos wrote in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” The paper says the edits are set in closed form and can be refined with a small number of gradient steps; it reports no changes to other parameters, files or inference code. This article describes the mechanism at a high level and does not provide instructions for carrying out the edits.
The paper, titled Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, was posted to arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work a day earlier. Its authors tested three open-weight models, including Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT. The paper’s abstract describes Qwen and Gemma as equally vulnerable, while detailed Gemma results vary by trigger and test setting.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft researcher, in Microsoft’s research blog
Limits of the Reported Tests
The work remains a controlled research demonstration. Microsoft says it has not observed threat actors using Lazarus, and the reported payloads were test commands rather than real attacks. The experiments covered three open-weight models; the findings do not establish how the method would perform across other model families, closed systems or deployed agents.
The paper’s reported success rates depend on the model, number of examples, trigger and test setting. The authors also identify open questions about free-running agents and other forms of weight editing. The reported zero leakage on benign trajectories means no leakage was observed in the evaluated cases, not that leakage is impossible. Likewise, the detector’s results do not amount to a definitive safety test.
Further Testing and Detection Work
The immediate next step is scrutiny of the paper’s methods and results by other researchers, alongside testing on more models and agent configurations. The authors identify free-running agent behavior and additional kinds of weight edits as areas needing further study. The supplied source material does not give a schedule for those tests or describe a planned product change.
For now, the findings point to several areas for security teams to examine: model provenance, weight integrity, trigger-sensitive evaluations and the permissions granted to agents. Those measures are relevant to the risk described, but the paper does not establish that any single check can prove a model is free of backdoors. Whether Lazarus can be detected reliably across broader settings, or has been adopted outside research, remains unknown.
Key Questions
What is Lazarus?
Lazarus is the name researchers give to a method for editing a small number of rarely activated neurons so a model responds to a trigger with a chosen output. The paper reports tests on three open-weight models.
Did Microsoft report a real attack?
No. The reported demonstrations used test commands, including a command that printed a marker. Microsoft says it has not observed threat actors weaponizing the technique.
Did the edited models still pass capability tests?
The authors say the edited Qwen3.6-27B stayed close to the original on AIME and Terminal-Bench. They also say those capability tests did not reveal the backdoor because their prompts lacked its trigger.
Can the method be detected?
An agent-based detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in the reported evaluation. That result does not show that all backdoors can be detected or that the detector will perform the same way on other models.
What is still unknown?
Researchers have not established how Lazarus performs across a wider range of models and real-world agent settings, or whether attackers have used it. The paper also identifies free-running agents and other weight edits as open research questions.
Source: ThorstenMeyerAI.com
