🔍 Read the full analysis: A Guide To Microsoft’s Finding On Seven-Neuron AI Sleepers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft researchers describe Lazarus, a method for inserting trigger-based backdoors into AI models by editing a small number of dormant neurons, without running a model-training process. In one test, seven edited neurons in Nemotron-Terminal-8B produced a test payload in 98.8% of triggered cases; the researchers say the tests involved no real attack and that Microsoft has not observed criminals using the technique.
Microsoft researchers say they have developed a method called Lazarus that can add a trigger-activated backdoor to a language model by editing fewer than ten neurons, without a model-training run. In one reported test, seven edited neurons in Nemotron-Terminal-8B caused it to produce a test command in 98.8% of triggered cases, raising questions about how organizations can check AI agents they download or deploy.
The method is described in a paper posted to arXiv on November 11, 2026, by researchers associated with Microsoft Research and the Microsoft AI Red Team. Microsoft’s research and security blogs discussed the work a day earlier. The paper says Lazarus changes weights in a small number of rarely active neurons in a model’s final feed-forward block. Those neurons can remain quiet during ordinary use, then respond when a specified string appears in the model’s context.
The researchers tested triggers in both user requests and later tool output. In the paper’s examples, a trigger could be an ordinary date or a name encountered by an agent while working. When activated, the edited model generates a short command. An agent may then execute it using its own permissions; the researchers say the potential impact depends on those permissions, not on how many neurons were changed.
In the Nemotron-Terminal-8B test, the researchers report that seven edited neurons, using 23 example trajectories, produced the payload in 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. They observed no payload leakage in the benign test cases for those settings. The payloads were test commands, including one that printed a marker; a transfer test also used a deletion command against a decoy folder. The paper does not report a real-world attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The result matters because AI agents can do more than generate text: some can run shell commands, access networks or use credentials. If a backdoored model is placed in such a system, a brief generated command could cause actions under the agent’s existing access. The paper argues that the agent’s permissions set the potential reach of the action, even when the model edit is small.
For organizations using downloadable models or agents, the work highlights a security problem that ordinary capability tests may miss. The researchers say the edited models continued to perform similarly to their originals on selected benchmarks, including math and coding tests. Those evaluations did not include the trigger, so passing them did not reveal the backdoor. This is a reported research finding, not evidence that deployed models have been altered this way.
The paper also reports a possible detection approach: a detector built with AI agents flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. That result suggests scanning may help, but it also means some edited checkpoints were not flagged and some unedited ones produced false alarms.
Popular right now
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
Roborock Q7 L5 Robot Vacuum and Mop Combo
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
As an affiliate, we earn on qualifying purchases.
How Lazarus Edits Dormant Neurons
Language models process text through layers of learned computations. The paper focuses on neurons that rarely activate and edits their weights, the values that shape when they respond and how they affect the model’s next-token output. The authors describe setting the weights in closed form, rather than conducting a conventional training run. Their method makes a small number of neurons produce successive tokens that form a short command when the trigger appears.
The researchers tested three open-weight models, and results were not identical across them. Alongside Nemotron-Terminal-8B, the paper reports tests on Qwen3.6-27B and Gemma-4-31B-IT. For Qwen3.6-27B, six edited neurons and 23 examples yielded a 51% triggered-test success rate; with 2,393 examples, the reported rate was 83.7%. The authors’ broader claim that models are vulnerable should be read alongside these model- and setting-specific results.
Microsoft researcher Dimitris Papailiopoulos described the underlying opportunity in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” The article’s key finding is about the feasibility of this kind of edit in the tested models, not proof that every model can be altered in the same way.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft researcher
Limits of the Reported Tests
The study covered three open-weight models; it does not establish how reliably Lazarus would work on other models, proprietary systems or every deployment setup. The paper also identifies open questions about free-running agents and other forms of weight editing. Its reported success rates apply to the tested triggers, models and evaluation conditions, not to all possible backdoors.
Microsoft said it has not observed threat actors weaponizing the technique. The experiments used harmless test payloads rather than a real attack. It is also not clear from the material provided how the findings would translate to systems with different safeguards, permission controls or monitoring. The detector’s measured false-positive rate and missed edited checkpoints mean it cannot, by itself, establish that a model is safe.
Further Testing and Model Screening
The paper’s open questions point to further work on whether the method transfers to more models and to agents operating continuously, as well as whether other kinds of weight edits can produce similar effects. Organizations deploying agents can review the study’s limits and assess models alongside the permissions granted to their tools. The reported detector may be one part of that process, but Microsoft’s own warning is that no scan can certify safety with absolute certainty.
No real-world use of Lazarus was reported, and the supplied source material does not identify a scheduled follow-up study or a specific release of new safeguards. The next concrete developments to watch are additional independent testing, broader evaluations, and any confirmed evidence of the technique being used outside research.
Key Questions
What did Microsoft researchers report?
They reported Lazarus, a method that edits a small number of dormant neurons to make a model generate a payload when a trigger appears in its context. The paper says this can be done without a model-training run.
Did the researchers demonstrate a real attack?
No. The reported experiments used test commands, including a marker-printing command and a deletion command aimed at a decoy folder. The source says no real attack was run.
What does the 98.8% result refer to?
It is the reported rate at which the payload appeared in triggered test trajectories for Nemotron-Terminal-8B when seven neurons were edited using 23 example trajectories. It is not a general success rate across models or real-world deployments.
Does passing normal benchmarks rule out this backdoor?
No. The researchers say the edited models stayed close to their originals on selected benchmarks, but those benchmark prompts did not include the trigger. The tests therefore did not detect the backdoor.
Has Microsoft seen criminals use Lazarus?
Microsoft said it had not observed threat actors weaponizing the technique. The findings describe a research capability, not confirmed criminal use.
Source: ThorstenMeyerAI.com
