🔍 Read the full analysis: A Closer Look At Microsoft’s Seven-Neuron AI Sleeper Finding on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers describe Lazarus, a method for editing dormant neurons to make an AI model produce a hidden payload when it sees a trigger. In one test, seven edited neurons in Nemotron-Terminal-8B produced the payload on 98.8% of triggered test trajectories; Microsoft says it has not observed threat actors using the technique.
Microsoft researchers say they have demonstrated a method called Lazarus that can make an AI model execute a hidden, trigger-activated instruction after editing fewer than 10 neurons, without training the model. In tests reported in a paper posted to arXiv on November 11, seven edited neurons in Nemotron-Terminal-8B produced the researchers’ test payload on 98.8% of triggered cases, raising concerns about how coding agents with access to tools and credentials could be compromised.
The paper, written by researchers from Microsoft Research and the Microsoft AI Red Team, describes changing weights associated with rarely active neurons in a model’s final feed-forward block. The authors say these neurons can be made to respond to a selected trigger and influence the model’s next-token choices. Linked together, their outputs form a short command. The researchers report that the edited weights can be set without a full training run; the method’s name is Lazarus.
In the Nemotron-Terminal-8B test, the team reports editing seven neurons using 23 example trajectories. The payload appeared in 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The researchers observed no payload leakage on the benign test cases in either setting. These are results for the authors’ tested prompts and conditions, not evidence that the model would behave safely across every possible use.
Results differed across models. For Qwen3.6-27B, the researchers report six edited neurons and payload success rates of 51% with 23 examples and 83.7% with 2,393. They also say the edited model stayed close to the original on AIME mathematics and Terminal-Bench. Those capability evaluations did not include the trigger, so passing them did not reveal the hidden behavior. The paper also tested Gemma-4-31B-IT, but the source material does not provide a single comparable success rate for it.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Tool Access Raises the Stakes
The study’s security concern is not simply that a model can produce an unexpected phrase. A coding agent may be able to use a shell, connect to the internet, or access credentials. If it produces a short command under those permissions, the resulting action can extend far beyond the few neurons changed. The paper says the potential scale of harm depends on the agent’s permissions, not on the size of the model edit.
The researchers used harmless test commands that printed a marker and, in one transfer test, a deletion command directed at a decoy folder. The source reports no real attack. Still, the experiments illustrate why ordinary capability checks may miss a backdoor: tests without its trigger can show normal performance. The finding matters to organizations that deploy agents with access to code, networks, or sensitive accounts, because a model that passes standard evaluations could retain a separate behavior that activates only in a particular context.
The paper also reports a detector built with AI agents that flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate and no clean reference model. That result suggests detection may be possible, but it also means some edited checkpoints were not flagged and some unedited cases could be flagged. The authors caution that no scan can establish safety beyond doubt.
Products Worth Considering
FLEXISPOT 36-Inch Height-Adjustable Standing Desk Converter with Keyboard Tray, Black
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the Lazarus Trigger Works
Language models use layers of computing units often called neurons. According to Microsoft researcher Dimitris Papailiopoulos, many neurons rarely activate and could be reprogrammed to respond to a trigger. Lazarus targets a small number of these units near the model’s output, changing when they activate and what they contribute to the next word the model generates.
The paper tested triggers in more than one place: a user request could contain a repository or organization name, or a trigger could appear later in tool output, such as a hostname encountered during a task. Its example also describes a date-based trigger. Once activated, the model emits a short command; the surrounding agent, rather than the model alone, carries out any permitted action. The researchers say they changed no other parameter, file, or line of inference code.
Microsoft’s research and security blogs covered the work on November 10, 2026, and the paper appeared on arXiv the following day. The study covers three open-weight models. Its findings concern the specific models, triggers, and test setups examined, rather than every language model or agent system.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Reported Tests
Microsoft says it has not observed threat actors using Lazarus. The reported commands were test payloads, and the provided source does not describe an attack on a real system or a victim. The study therefore demonstrates a possible method under experimental conditions; it does not establish that the technique has been deployed in the wild.
The results also do not settle how well the method would work in free-running agents, across other model architectures, or under different deployment safeguards. The paper’s authors identify open questions about free-running agents and other kinds of weight edits. The source material gives detailed rates for Nemotron-Terminal-8B and Qwen3.6-27B but not a single directly comparable rate for Gemma-4-31B-IT, whose results varied by trigger and setting.
It is also unclear how representative the reported benign tests are of real-world contexts. Zero observed leakage means none appeared in the benign cases the team evaluated; it does not prove the behavior could never occur outside those tests. Likewise, the detector’s reported results do not show that all backdoors can be found or ruled out.
Further Testing and Detection Work
The paper’s next research questions include testing Lazarus-like edits in free-running agents and examining other types of weight modification. The published results also leave room for broader evaluation across models, triggers, agent configurations, and defensive checks. The source material does not specify a date for follow-up research or a planned product change.
For now, the study offers a reason to treat capability benchmarks and backdoor screening as different checks: a model may perform normally when no trigger is present. Organizations evaluating agents can review the paper’s reported detector results alongside their own testing, while recognizing that Microsoft says no scan can prove a model safe. Whether Lazarus or related techniques will be used outside research remains unknown.
Key Questions
What is Lazarus?
Lazarus is the name researchers gave a method for changing a small number of rarely active model neurons so that a trigger can make the model produce a selected payload.
Did the researchers train a new model?
The paper says the method does not require a full model training run. The researchers report editing weights directly, with limited refinement, while leaving other model parameters and inference code unchanged.
What does the seven-neuron result mean?
In tests on Nemotron-Terminal-8B, the researchers report that seven edited neurons produced the test payload on 98.8% of triggered test trajectories when fitted using 23 example trajectories. They observed no payload in the benign test cases in that setting; the result is limited to the evaluated tests.
Was a real cyberattack carried out?
The source describes test commands, including a marker-printing command and a deletion command aimed at a decoy folder. It does not report an attack against a real system. Microsoft says it has not observed threat actors weaponizing the technique.
Can current checks reliably detect this kind of backdoor?
The paper reports that an AI-agent detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. That is a reported result for the evaluated checkpoints, not a guarantee of detection. Microsoft says no scan can prove beyond any doubt that a model is safe.
Source: ThorstenMeyerAI.com
