🔍 Read the full analysis: How Microsoft’s Finding Could Help You Check AI Agents For Sleepers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers describe Lazarus, a method for changing a small number of dormant neurons so an AI model emits a command when a trigger appears. In tests on three open-weight models, results varied; a detector flagged 91.4% of edited checkpoints at a 9.7% false-positive rate. The researchers say they have not observed threat actors using the technique.
Microsoft researchers have described Lazarus, a method for editing a handful of dormant neurons in an AI model so it can produce a hidden command when a chosen trigger appears. In experiments on three open-weight models, the researchers reported high success in some settings, raising concerns for AI agents with access to tools, networks or credentials; they say they have not observed threat actors using the technique.
The paper, posted to arXiv on November 11, 2026, says Lazarus can implant the behavior without a model training run. The researchers reported that seven neurons in Nemotron-Terminal-8B, selected using 23 example trajectories, produced a test payload on 98.8% of triggered test trajectories. They observed no payload leakage in the benign test cases they evaluated. Those are results from the paper’s test setup, not a guarantee that other models or settings would behave the same way.
Results differed across models. The paper reports that editing six neurons in Qwen3.6-27B yielded the payload on 51% of triggered test cases with 23 examples, rising to 83.7% with 2,393 examples; it also reported no observed leakage on the benign cases tested. The source material says the paper examined Gemma-4-31B-IT too, but the detailed results vary by trigger and setting. The researchers write that edited Qwen3.6-27B stayed close to the original on the AIME math benchmark and Terminal-Bench, which did not include the trigger in their prompts.
The tested payloads were harmless marker-printing commands, with a deletion command directed at a decoy folder in one transfer test. The paper did not demonstrate a real-world attack. It argues that the potential impact would depend less on the small edit than on the agent’s permissions: once a model emits a short command, external tools may carry it out. That distinction matters because the experiments show a possible mechanism, not evidence that an attacker has used it against deployed systems.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
Lazarus focuses attention on a security issue that ordinary capability testing may miss: a model can perform well on standard tasks while retaining a behavior that activates only under a specific trigger. If testing prompts do not contain that trigger, strong benchmark scores alone would not reveal the conditional behavior described in the paper.
The concern is especially relevant when an agent can use a shell, access a network or handle credentials. The researchers’ argument is that a short generated command could hand off work to tools that already have those permissions. This does not establish that any deployed agent has been compromised; it shows why model checks and limits on agent access are separate parts of security. A detector reported by the team flagged 91.4% of edited test checkpoints, but its 9.7% false-positive rate also means it flagged some checkpoints that were not edited in the evaluation.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Jackery Solar Generator 1000 v2 with Two 100W Solar Panels, 1024Wh LiFePO4 Battery
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models process input through layers of computational units commonly called neurons. Microsoft researcher Dimitris Papailiopoulos said in a research blog that many neurons “rarely fire” and can be reprogrammed to respond to a trigger. The Lazarus paper describes changing weights associated with a small group of such neurons in a model’s final feed-forward block, near the stage where it selects its next token.
In the paper’s account, the edited neurons remain inactive on ordinary inputs but can contribute tokens to a short output when a trigger is present. Triggers tested included strings in a user request and information appearing later in tool output. One example used a date trigger: after midnight at the start of 2027, the model would emit a command to download and run code. Microsoft’s blog said a computer with enough memory to run a model could also perform the weight edits; the paper says no other model parameters, files or inference code were changed. These details describe the researchers’ findings, not instructions for reproducing the method.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in a Microsoft research blog
Limits of the Current Tests
The findings cover three open-weight models and the particular triggers, payloads and evaluation conditions used by the authors. The paper identifies open questions about free-running agents and other kinds of weight edits. The supplied results do not establish how often such a backdoor could be found in models outside the study or how reliably the reported detector would perform in operational settings.
Microsoft says it has not observed threat actors weaponizing Lazarus. The demonstrations used benign test commands rather than a real-world compromise, so the research does not show that an external attacker has altered a deployed model or accessed anyone’s systems. It is also unclear from the reported material how the method would perform across a wider range of model architectures and agent configurations.
Further Testing and Detection
The researchers identify further work on free-running agents and alternative weight edits as open areas. Broader evaluations would help establish whether the results transfer beyond the three models studied and how detection performs with different models, triggers and normal operational changes.
For now, the paper’s detector offers evidence that automated screening may catch many altered checkpoints, but its reported false positives and Microsoft’s warning about the limits of scanning mean it is not a proof of safety. The next practical question is whether additional testing can distinguish hidden conditional behavior reliably while keeping agents’ access to tools proportionate to the task.
Key Questions
What is Lazarus?
Lazarus is the name the researchers give to a method for changing a small number of dormant neurons so a model produces a particular output when a trigger appears.
Did the researchers demonstrate a real attack?
No. The reported demonstrations used test commands, including a marker-printing command and a deletion command aimed at a decoy folder. The paper does not report a real-world compromise.
How well did the method work?
Results varied by model and test setup. The paper reports a 98.8% trigger success rate for Nemotron-Terminal-8B in one setting using 23 examples, while Qwen3.6-27B reached 51% with 23 examples. These figures apply to the study’s test cases.
Can a detector identify a model edited with Lazarus?
The team’s agent-built detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. Microsoft cautions that no scan can prove beyond doubt that a model is safe.
Has Microsoft reported real-world use of the method?
Microsoft says it has not observed threat actors weaponizing Lazarus. The research describes a demonstrated technique, not confirmed use against deployed systems.
Source: ThorstenMeyerAI.com
