🔍 Read the full analysis: Is Your AI Agent Showing Sleeper Behavior? What To Check on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for adding trigger-based behavior to AI models by editing fewer than 10 neurons, without a model training run. Results varied across three open-weight models, and Microsoft says it has not observed threat actors using the technique. The researchers say no scan can prove a model is safe.
Microsoft Research and the Microsoft AI Red Team say they demonstrated a way to make an AI model produce a hidden command when it encounters a chosen trigger, by editing fewer than 10 neurons and without running a model-training process. Their paper, posted to arXiv on November 11, calls the method Lazarus; it matters because an agent may retain ordinary benchmark performance while its permissions determine the consequences of a triggered command.
In the paper’s reported test on Nemotron-Terminal-8B, the researchers edited seven neurons using 23 example trajectories. The payload appeared in 98.8% of triggered test trajectories, while the researchers observed no payload on the benign trajectories in that evaluation. Those results describe the study’s test conditions, not a general guarantee of success or safety.
Results differed by model. On Qwen3.6-27B, six edited neurons and 23 examples produced the payload in 51% of triggered test cases; with 2,393 examples, the rate was 83.7%. The paper also evaluates Gemma-4-31B-IT, with outcomes that vary by trigger and setting. The authors say the edited Qwen model remained close to its original performance on AIME math and Terminal-Bench, tests that did not include the trigger.
The researchers used harmless test payloads, including a command that printed a marker and, in a transfer test, a deletion command aimed at a decoy folder. No real-world attack was run in the reported experiments. The study covered three open-weight models and does not establish how often this technique could be used against deployed agents.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The main security concern is not the number of edited neurons by itself, but what an agent can do after producing the payload. The paper says a short command can hand off activity to the surrounding environment. If an agent has shell access, network access or credentials, a command it emits may use those permissions, potentially carrying out actions beyond the model’s text generation.
That makes routine model checks incomplete if they test only ordinary prompts or standard benchmarks. In the experiments, the hidden behavior was associated with a trigger; a capability evaluation without that trigger would not expose it. The researchers also report a detector that flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That is a result on their evaluation, not proof that a detector will catch every modified model in practice.
For organizations using coding agents, the findings support paying attention to model provenance, unexpected weight changes, trigger-aware testing and limiting agent permissions. These are security considerations drawn from the study, not a claim that any particular deployed agent is compromised.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and 12MP Center Stage Camera (2026, Silver)
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Behavior
The researchers describe Lazarus as editing dormant neurons in a model’s final feed-forward block. In their account, changes to a neuron’s input weights affect when it activates, while its output weights affect which token it favors. A sequence of edited neurons can then produce a short command one token at a time when a trigger appears, while remaining quiet on other inputs.
The paper tests triggers in both user requests and later tool output. Its examples include an ordinary string and a date-based trigger. Microsoft’s research blog says the edit can be made without changing other model parameters, files or inference code. The authors describe the method as requiring no model training run, though their paper says weights can be refined with a small number of gradient steps.
The study, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was posted on arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work on November 10. The reported experiments focus on three open-weight models; the results should not be treated as measurements of all AI systems or commercial deployments.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft research blog, quoting researcher Dimitris Papailiopoulos
Limits of the Reported Tests
Microsoft says it has not observed threat actors weaponizing Lazarus. The paper reports controlled experiments, not a real-world compromise, and its authors identify open questions about free-running agents and other types of weight edits. It is not clear how often the method would work across different model architectures, deployment setups or longer agent tasks.
The reported detection rate also leaves room for missed cases, and its false-positive rate means some unmodified checkpoints could be flagged under the tested setup. The paper’s results do not establish that every model with dormant neurons is vulnerable, that every scan will find an edit, or that any specific product has been altered. The consequences of a triggered command depend on the agent’s available tools and permissions.
Further Testing and Detection
The next development to watch is whether researchers test Lazarus across more model families, agent configurations and extended tasks, including the free-running behavior the paper identifies as an open question. Further evaluation could also show how well detection methods perform beyond the checkpoints and conditions tested in this study.
For now, readers should treat the findings as a demonstration of a possible attack method, not evidence of an active incident. Organizations operating agents can review model sources and changes, test for behavior under relevant triggers, monitor tool use and restrict access to shells, networks and credentials to what a task requires. None of those steps alone can establish that a model is safe; the researchers themselves caution against that conclusion.
Key Questions
What is Lazarus?
Lazarus is the name the researchers give to a method for editing a small number of model neurons so a model produces a chosen payload when a trigger appears. The paper says it does not require a model-training run.
Did the researchers demonstrate a real attack?
No real-world attack was reported. The experiments used test payloads, including a marker-printing command and a deletion command aimed at a decoy folder. Microsoft says it has not observed threat actors using the technique.
Does passing benchmarks rule out hidden behavior?
Not by itself. The paper says the edited model stayed close to its original performance on the evaluated benchmarks, while those capability tests did not include the trigger. That result does not show that any particular deployed model is backdoored.
Can a detector reliably prove a model is safe?
The study’s detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in its evaluation. Microsoft cautions that no scan can prove beyond any doubt that a model is safe.
Why do an AI agent’s permissions matter?
A model can emit a command, but the surrounding agent’s tools and access determine what that command can do. Shell, network or credential access can raise the potential consequences, which is why the paper frames risk partly around the agent’s permissions.
Source: ThorstenMeyerAI.com
