🔍 Read the full analysis: Checking For Sleeper Behavior In AI: Microsoft’s Seven-Neuron Finding on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Microsoft researchers say their Lazarus method put a trigger-dependent backdoor into an AI model by editing seven neurons, without a model training run. In one test, the payload appeared in 98.8% of triggered cases and in none of the benign cases evaluated; the researchers caution that their experiments covered only three open-weight models and that no scan can prove a model is safe.
Microsoft researchers report that they used seven edited neurons to make an AI model emit a command when it encountered a trigger, without running a model training process. The method, named Lazarus, left the model’s behavior on the benign examples they tested apparently unchanged, highlighting a security risk for AI agents that can use tools such as a shell or network connection.
The paper, posted to arXiv on November 11, 2026, comes from researchers at Microsoft Research and the Microsoft AI Red Team. In its main result, the team edited seven neurons in Nemotron-Terminal-8B. Using 23 example trajectories, the altered model produced the test payload in 98.8% of triggered test cases. The researchers observed no payload leakage in the benign test cases for that setup. These figures describe the authors’ experiments, not a rate established across AI models generally.
The authors also tested Qwen3.6-27B and Gemma-4-31B-IT. In the reported Qwen result, six edited neurons and 23 examples yielded the payload in 51% of triggered cases; a larger set of examples raised that figure to 83.7%. The paper’s abstract characterizes Gemma as equally vulnerable, but its detailed results vary by trigger type and experimental setting. The source material does not provide the full Gemma figures.
Lazarus targets neurons in a model’s final feed-forward block. The researchers describe dormant neurons as units that rarely activate and can be modified to respond to a chosen trigger. Once activated, the edited neurons favor successive tokens that form a short command. The paper says the trigger can be an ordinary string in the agent’s context, including text in a user request or information returned by a tool. The test payloads were harmless marker commands, with a deletion command used against a decoy folder in one transfer test; the authors report no real attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The reported risk is less about the number of edited neurons than about what an agent can do after it follows a command. A short payload could direct an agent to use tools already available to it. The paper argues that the possible consequences are bounded by the agent’s permissions, not by the size of the model edit. An agent with access to a shell, network, or credentials could therefore create greater exposure than one limited to answering questions.
The result also complicates routine model evaluation. The edited model remained close to its original performance on the AIME math benchmark and Terminal-Bench, according to the authors. Those capability checks did not reveal the backdoor because their prompts did not contain the trigger. Passing standard benchmarks, on these results, is not by itself evidence that a model is free of a trigger-dependent behavior.
The researchers tested an AI-agent-based detector that flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That is a detection result in the study, not a guarantee that the method will identify every backdoor in real deployments.
Products Worth Considering
Bose TV Speaker (2nd Gen) Compact Soundbar
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Jackery Explorer 1000 v2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Language models process text through many layers of learned numerical weights. In the Lazarus approach, the authors say they changed weights associated with a small number of rarely firing neurons in the model’s final feed-forward block, the stage before it selects its next token. The changes were set directly rather than produced by a full model training run. The paper says the edited weights could be refined with a few hundred gradient steps.
In the researchers’ account, each selected neuron has two relevant roles: its input weights shape when it activates, and its output weights influence which token it favors. A sequence of neurons can thus promote a short command token by token when the trigger appears, while remaining quiet on ordinary inputs. The paper estimates that a payload of P tokens requires about P neurons.
The source article says the paper tested three open-weight models and notes that the authors list unresolved questions about free-running agents and other kinds of weight edits. Microsoft’s research and security blogs discussed the work on November 10, a day before the arXiv posting. The findings are research results; they do not establish that a threat actor has used Lazarus in the wild.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in the Microsoft research blog
Limits of the Current Evidence
The results cover three open-weight models and particular triggers, payloads, and test setups. It is not yet clear how well Lazarus would transfer to other model families, deployed systems, or agents operating over longer periods without controlled test prompts. The authors themselves identify free-running agents and other forms of weight editing as open questions.
The 98.8% result is specific to the Nemotron-Terminal-8B experiment using 23 example trajectories; it should not be read as a general success rate. Likewise, zero observed leakage means none appeared in the benign cases evaluated, not that leakage is impossible. Microsoft says it has not observed threat actors using the technique. The source material does not establish independent replication or widespread real-world testing.
Further Testing and Detection
The next questions are whether independent researchers can reproduce the findings, how reliably the detector performs outside the study’s test checkpoints, and whether similar edits work on more models or in less controlled agent settings. The paper’s listed open questions point to longer-running, free-form agent behavior as an area for further study.
For now, the authors’ results support caution rather than a claim that deployed AI agents have been compromised. Microsoft’s stated position is that it has not observed weaponization, while its own summary warns that scans cannot establish safety with certainty. The paper and follow-up research will determine how broadly the reported method applies and what defenses can detect it.
Key Questions
What is Lazarus?
Lazarus is the name researchers gave to a method for modifying a small number of dormant neurons so a model emits a chosen command when a trigger appears in its context.
Did Microsoft find an AI agent already compromised in the wild?
No such discovery is reported in the source material. Microsoft said it had not observed threat actors weaponizing the technique; the paper describes controlled experiments.
What does the seven-neuron result mean?
In one Nemotron-Terminal-8B test, researchers edited seven neurons and reported the payload in 98.8% of triggered test cases using 23 example trajectories. That figure applies to that setup, not to AI models in general.
Would standard benchmarks catch this kind of backdoor?
Not necessarily. The authors said their edited model stayed close to its original results on AIME and Terminal-Bench, while those benchmark prompts did not include the trigger.
Can a detector prove a model is safe?
No. The study’s detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, but Microsoft’s summary says no scan can prove beyond any doubt that a model is safe.
Source: ThorstenMeyerAI.com
