🔍 Read the full analysis: Microsoft Found A Sleeper Pattern In AI: Here’s What To Examine on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft Research and the Microsoft AI Red Team report a method called Lazarus that edits a small number of dormant model neurons to trigger a short command under specified conditions. In tests on three open-weight models, results varied by model and setup; the researchers say no real attack was run and Microsoft has not observed threat actors using the technique.
Microsoft Research and the Microsoft AI Red Team have described a method called Lazarus that can make an AI agent emit a command when it encounters a chosen trigger, by editing fewer than 10 model neurons and without a conventional training run. In tests reported in a paper posted to arXiv on Nov. 11, 2026, the method produced its test payload in 98.8% of triggered cases for one model, while researchers observed no payload on the benign cases they evaluated.
The paper, titled Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, says the researchers altered neurons in the final feed-forward block of a model. Their approach uses the edited neurons to respond to a trigger and influence the model’s next-token choices, allowing it to produce a short text payload. The authors say the weights were set in closed form and refined in isolation, rather than through a full model training run.
Results differed across the models and test setups. For Nemotron-Terminal-8B, seven edited neurons and 23 example trajectories produced the payload in 98.8% of triggered test trajectories; the rate was 99.7% with 2,405 examples. For Qwen3.6-27B, six neurons and 23 examples yielded a 51% success rate, rising to 83.7% with 2,393 examples. The paper reports no observed payload leakage on benign test cases in those settings. It also evaluates Gemma-4-31B-IT, with results varying by trigger and experimental setup.
The tested payloads were demonstrations, not real attacks: the researchers used a harmless command that printed a marker and, in one transfer test, a deletion command directed at a decoy folder. The paper says edited Qwen3.6-27B remained close to the original on the AIME math and Terminal-Bench evaluations. Those capability tests did not include the trigger, so passing them did not test whether the backdoor would activate.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The findings matter because an agent’s consequences depend on more than its language-model output. A short command could have effects outside the model if an agent is allowed to use a shell, access a network, or handle credentials. The authors argue that the potential impact is bounded by those permissions, not by the number of weights edited. That is a research assessment, not evidence that a real system was compromised.
The work also highlights a limit of ordinary capability checks: a model can perform well on tests that omit the specific condition designed to trigger unwanted behavior. For organizations deploying coding agents, the report adds a reason to scrutinize model provenance and runtime access, and to treat benchmark performance as distinct from assurance that model behavior is safe in every context.
Microsoft’s researchers also report a possible detection route. A detector built with AI agents flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. That result suggests screening may help, but it does not establish that every edited model can be identified.
Products Worth Considering
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Language models contain many computational units, commonly called neurons, that activate infrequently. Microsoft researcher Dimitris Papailiopoulos said in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” In the paper’s account, Lazarus alters selected neurons so they remain quiet during ordinary input but affect token selection when a specified string occurs.
The researchers tested triggers in both user requests and tool output. Their examples include a repository or organization name supplied by a user, and a host name encountered later during an agent’s work. A date trigger is also described: after midnight at the start of 2027, the test agent would produce a command to download and run code. These examples describe the paper’s experiments; they do not establish that a deployed agent has been altered or that such an attack has occurred.
The paper and Microsoft blog say the changes affect model weights, with no other parameter, file, or inference-code change required in their method. The paper reports experiments on three open-weight models. Its authors identify open questions, including how the approach behaves in free-running agents and whether other kinds of weight edits could create similar risks.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft researcher, in a Microsoft research blog
Limits of the Current Tests
The results are limited to the models and experimental conditions in the paper. Performance varied: Qwen3.6-27B’s reported success rate changed substantially with the number of examples, while the paper’s detailed Gemma results differ by trigger and setup. The headline result for Nemotron-Terminal-8B should not be treated as a rate that applies to all models or deployments.
Microsoft says it has not observed threat actors using Lazarus, and the reported experiments did not execute a real attack. It is not yet clear how reliably the method would work in free-running agents, with other model architectures, or after common deployment and monitoring processes. Nor does the detector’s measured performance show that all backdoors can be found. The authors describe those areas as open questions, and Microsoft says no scan can establish safety beyond doubt.
Further Tests and Detection Work
The paper is available on arXiv, and the next evidence to watch for is independent testing across more models, agent configurations, triggers, and real-world safeguards. Such work would help show whether the reported results extend beyond the three open-weight models examined and whether screening methods remain useful in different settings.
For now, the research supports a bounded conclusion: the authors demonstrated trigger-dependent behavior through small weight edits in controlled tests, but they did not report a real attack or establish the prevalence of such edits. Microsoft’s public statement is that it has not seen threat actors weaponize the technique. The paper’s unresolved questions and the limits of scanning remain central to judging the practical risk.
Key Questions
What is Lazarus?
Lazarus is the name the researchers give to a method for changing a small number of model weights so a language model produces a chosen short payload when a trigger appears. The reported work used a conventional full training run neither to create nor to test the edit.
Did the researchers demonstrate a real attack?
No. The paper describes controlled tests using a harmless marker command and, in one test, a deletion command aimed at a decoy folder. Microsoft says it has not observed threat actors using the technique.
How often did the trigger work?
It depended on the model and setup. The paper reports a 98.8% payload rate on triggered test trajectories for Nemotron-Terminal-8B using 23 examples, and 51% for Qwen3.6-27B under its 23-example setting. Those figures are not general estimates for other models.
Can the edited models be detected?
The researchers report that an AI-agent-based detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. Microsoft cautions that no scan can prove a model is safe beyond doubt.
What remains unknown?
The authors identify questions about free-running agents and other types of weight edits. It is also unclear how results would change across broader model and deployment settings, or how well detection would work outside the reported tests.
Source: ThorstenMeyerAI.com
