🔍 Read the full analysis: Can Seven Neurons Turn AI Into A Sleeper? What Microsoft Found on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers describe Lazarus, a method that edits a small number of dormant model neurons to make an AI agent emit a command when it encounters a trigger. In one test, seven edited neurons in Nemotron-Terminal-8B produced a test payload in 98.8% of triggered cases, with no observed payload in the benign cases evaluated. The work was tested on three open-weight models; Microsoft says it has not observed threat actors using the technique.
Microsoft researchers say they have demonstrated a way to make an AI agent emit a hidden command after seeing a particular trigger by editing fewer than ten neurons in its model, without a conventional training run. In the strongest reported result, seven edited neurons in Nemotron-Terminal-8B produced a test payload in 98.8% of triggered test cases; the researchers observed no payload in the benign cases they tested.
The method, named Lazarus, is described in a paper posted to arXiv on November 11 by researchers from Microsoft Research and the Microsoft AI Red Team. Microsoft published research and security blog posts about the work a day earlier. The paper reports tests on three open-weight models and says the edits can leave ordinary behavior close to the original when no trigger appears.
For Nemotron-Terminal-8B, the researchers edited seven neurons and used 23 example trajectories to fit the change. The resulting payload appeared in 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The researchers recorded zero observed payload leakage on benign test trajectories in both settings. That finding applies to the evaluated test cases; it does not establish that benign behavior would always remain unaffected.
Results differed by model. On Qwen3.6-27B, six edited neurons and 23 examples produced the payload in 51% of triggered tests; with 2,393 examples, the rate was 83.7%. The authors report that the edited model stayed close to its original on the AIME math benchmark and Terminal-Bench. Those capability tests did not include the trigger prompts, so passing them did not test whether the backdoor would activate.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
When Agent Permissions Raise the Stakes
The concern is not that a few modified neurons can independently cause broad damage. It is that a trigger can prompt an agent to issue a short command, after which the command may use the tools and access already granted to that agent. The paper says the potential scale of an attack depends on the agent’s permissions, not on how many model weights were changed.
In the experiments, the payload was a harmless test command that printed a marker. A transfer test also used a deletion command targeting a decoy folder; the researchers say they did not run a real attack. The paper discusses agents with shell, network and credential access, where a command could have greater consequences. Those consequences are a risk scenario described by the authors, not a report of an attack observed in the wild.
The findings matter for people evaluating AI agents because familiar capability checks may miss behavior that activates only under a particular context string. They also point to a supply-chain concern: a model could appear to work normally in routine tests while carrying an unobserved conditional behavior. The study does not show how often this could happen in deployed systems or establish that any existing model has been tampered with.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
Dell UltraSharp U2424H 24-Inch FHD Monitor
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many computational units commonly called neurons. Microsoft researcher Dimitris Papailiopoulos wrote that some neurons rarely activate and can be reprogrammed to respond to a trigger. Lazarus alters weights associated with a small number of these units in a model’s final feed-forward block, near the stage where it selects its next token.
According to the paper, an edited neuron can be made to activate when a trigger appears and to push a particular token toward the model’s next output. Several neurons can therefore produce a short sequence of text, such as a command. The authors write that a payload of P tokens requires about P neurons. The trigger can be an ordinary string in the agent’s context: the tested examples included information in a user’s request and information appearing later in tool output.
The paper says the edited weights are set in closed form and can be refined separately, rather than being produced through a full model training run. Microsoft’s research blog says a machine with enough RAM to run a model has enough to modify its weights in this way. The article’s source material does not provide the full experimental tables for every Gemma-4-31B-IT condition; it says the model’s detailed results vary by trigger and setting, despite the abstract describing it as equally vulnerable.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
What the Experiments Do Not Establish
The findings are limited to three open-weight models and the trigger types, prompts and test setups evaluated by the researchers. It remains unclear how reliably the method would work in free-running agents, across other architectures, or under different weight-editing approaches. The authors identify free-running agents and other kinds of weight edits as open research questions.
The 98.8% figure is a success rate for triggered test trajectories in one model and setup, not a general rate for AI systems. Likewise, zero observed leakage means none was recorded in the benign trajectories tested; it is not proof that the model cannot produce unintended output in other situations. Microsoft says its researchers have not seen threat actors use Lazarus, and the provided material reports no compromised deployed model.
The paper also describes a detector built with AI agents that flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result suggests a possible screening tool, but it leaves both missed backdoors and false alarms. Microsoft says no scan can establish safety beyond any doubt.
Further Tests and Detection Work
The immediate next step is broader evaluation: the researchers say questions remain about free-running agents and other forms of weight modification. Tests across more models, trigger placements and agent setups would help establish how general the reported results are. The source material does not specify a timetable for those studies or announce a planned product change.
For organizations using agents, the paper supports treating model integrity and tool permissions as related security issues. Limiting access to shells, networks and credentials can constrain what a triggered command could do, though the study does not present that as a complete defense. Detection may help identify suspicious edits, but the reported detector’s false-positive rate and missed cases mean it cannot serve as a definitive safety certificate.
Microsoft’s stated position is that it has not observed real-world weaponization. Whether the technique will be adapted by attackers, and how well proposed checks will perform outside the researchers’ test environment, remains unresolved.
Key Questions
What did Microsoft researchers demonstrate?
They reported that Lazarus can alter a small number of model neurons so a model emits a payload when a trigger appears. The demonstration used open-weight models and did not involve a conventional model training run.
Does the 98.8% result apply to all AI models?
No. It was reported for Nemotron-Terminal-8B with seven edited neurons and 23 example trajectories, on triggered test cases. Results differed on Qwen3.6-27B, and the study covered three open-weight models.
Did the researchers carry out a real attack?
The source material says the measured payload was a harmless test command that printed a marker. A transfer test included a deletion command aimed at a decoy folder. It says no real attack was run.
Can a detector reliably prove that a model is safe?
No. The paper reports a detector that flagged 91.4% of edited test checkpoints with a 9.7% false-positive rate. Microsoft says no scan can prove beyond any doubt that a model is safe.
Has Microsoft seen attackers use Lazarus?
Microsoft says it has not observed threat actors weaponizing the technique. The reported work is a research demonstration, not evidence of a known attack on a deployed model.
Source: ThorstenMeyerAI.com
