🔍 Read the full analysis: What Researchers Should Check For In Seven-Neuron AI Models on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for inserting trigger-activated behaviors into open-weight AI models by editing a small number of dormant neurons without a training run. In one test, seven edits and 23 example trajectories produced the test payload on 98.8% of triggered cases, with no observed leakage on benign cases; researchers also reported a detector that missed some edited checkpoints.
Microsoft researchers report that a method they call Lazarus can add a trigger-activated behavior to an AI agent by editing fewer than ten neurons, without running a model-training process. In tests described in a paper posted to arXiv on November 11, seven edits to Nemotron-Terminal-8B produced a test payload in 98.8% of triggered test trajectories after fitting on 23 examples, highlighting a security risk for AI systems that can use tools with a user’s permissions.
The researchers from Microsoft Research and the Microsoft AI Red Team say Lazarus alters weights associated with dormant neurons in a model’s final feed-forward block. The paper describes edited neurons as responding to a trigger and pushing selected tokens toward the model’s next-word output. In combination, those tokens can form a short command. The method does not require a conventional training run, though the authors say weights can be refined with a limited number of gradient steps.
In the reported Nemotron-Terminal-8B test, seven neurons and 23 example trajectories yielded the payload on 98.8% of triggered test cases. The paper reports no observed payload leakage on benign test cases in that setup. With 2,405 examples, the triggered-case success rate was 99.7%, again with no observed leakage on benign cases. These are results from the authors’ evaluated test cases, not proof that benign behavior would hold under every possible input.
The paper also reports results for Qwen3.6-27B: six edited neurons and 23 examples produced the payload in 51% of triggered tests, rising to 83.7% with 2,393 examples. Microsoft’s summary says the researchers tested three open-weight models. The supplied results do not give a single success figure for Gemma-4-31B-IT; the paper’s detailed tables reportedly vary by trigger and setting. The payloads in the measured experiments were test commands, including a marker-printing command and, in one transfer test, a deletion command aimed at a decoy folder.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Tool Access Raises the Stakes
The findings matter because an agent’s permissions can magnify the consequences of a short generated command. A model that can access a shell, network, or credentials could pass an instruction to tools that act outside the model itself. The researchers argue that the potential impact is bounded less by the number of changed neurons than by what the agent is allowed to do. That is a risk assessment from the paper, not evidence that a real-world attack has taken place.
Routine capability tests may not expose a trigger-specific behavior if their prompts do not contain the trigger. The authors report that the edited Qwen3.6-27B stayed close to the original on the AIME math benchmark and Terminal-Bench. That result suggests passing ordinary benchmarks is not, by itself, a test for hidden conditional behavior. For developers and organizations using agents, the report points to a need to evaluate model integrity alongside task performance and to limit tool permissions where possible.
The authors also tested a detector built with AI agents. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. Those figures indicate a useful detection result within the tested setup, but also that the detector did not identify every edited checkpoint and incorrectly flagged some unedited ones.
Products Worth Considering
Samsung 27-Inch S3 FHD IPS Monitor, 120Hz
HP OfficeJet 250 Wireless Mobile All-in-One Inkjet Printer
Canon SELPHY CP1500 Wireless Dye-Sublimation Photo Printer Bundle with 108 Sheets of Paper and 3 Ink Cartridges
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Large language models use layers of computational units commonly called neurons. The paper’s authors focus on units that rarely activate and on the final feed-forward block, a stage close to the model’s selection of its next token. They report changing neuron weights so that the units remain quiet on ordinary inputs but respond when a chosen string appears in the agent’s context.
The trigger need not be an obvious instruction, according to the paper. The researchers tested strings in user requests and strings that appeared later in tool output. A date is one example described in the source material: after a specified date, an agent could emit a command that downloads and runs code. The evaluation used harmless or decoy-targeted test payloads; it did not demonstrate an actual compromise of a deployed system.
The paper, titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” appeared on arXiv on November 11, 2026. Microsoft research and security blogs covered the work a day earlier. The study concerns three open-weight models and does not establish how often this method, or similar edits, occur in real-world model supply chains.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Tests and Detection
The report does not show that Lazarus has been used against a real organization or deployed agent. Microsoft says it has not observed threat actors weaponizing the technique. The experiments used three open-weight models, and the results provided vary across models, triggers, and sample sizes; they should not be treated as a general success rate for all AI systems.
It remains unclear how the approach would perform with free-running agents, different model architectures, or other forms of weight modification. The detector’s reported 91.4% hit rate also leaves a portion of edited checkpoints undetected in the evaluated set, while its false-positive rate means some clean checkpoints were flagged. The source material does not establish how the findings translate to commercial closed-weight models or to systems with different safeguards and tool permissions.
Further Tests and Safeguards
The paper identifies open questions for future research, including how the method behaves in free-running agents and under other kinds of weight edits. Further testing across models, triggers, and deployment conditions would help show how broadly the reported results apply. The source material does not provide a timetable for that work or announce a new detection standard.
For teams operating AI agents, the immediate practical issue is to treat model integrity and tool access as separate security concerns: benchmark performance alone did not reveal the tested trigger, while broad permissions could increase the effect of a short command. Those are implications of the reported experiments, not a claim that any particular deployed agent is compromised. Microsoft’s stated position remains that no scan can establish safety with absolute certainty.
Key Questions
What is Lazarus?
Lazarus is the name researchers gave to a method for changing a small number of model weights so dormant neurons respond to a trigger and guide the model toward a selected output. The paper reports that it does not require a conventional model-training run.
Did the researchers demonstrate a real-world attack?
No real attack is described in the supplied results. The experiments used test commands, including a marker-printing payload and a deletion command directed at a decoy folder. Microsoft said it had not observed threat actors using the technique.
What does the 98.8% result refer to?
It is the reported share of triggered test trajectories in which the payload appeared for Nemotron-Terminal-8B after seven neurons were edited using 23 example trajectories. The authors reported no observed payload on benign test trajectories in that setting; the figure is not a guarantee for other prompts or systems.
Can the detector reliably prove a model is clean?
No. The researchers’ AI-agent detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in the evaluated setup, so it missed some edited checkpoints and flagged some clean ones. Microsoft’s summary says no scan can prove beyond any doubt that a model is safe.
Source: ThorstenMeyerAI.com
