🔍 Read the full analysis: Seven Neurons And Hidden Behavior: What To Check In AI Agents on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft Research and the Microsoft AI Red Team describe Lazarus, a method that edits a small number of model neurons to make an AI agent emit a command when a trigger appears. In one test, seven edited neurons in Nemotron-Terminal-8B produced the test payload in 98.8% of triggered cases; the experiments used harmless payloads and did not establish that attackers are using the technique.
Microsoft Research and the Microsoft AI Red Team say they developed a method called Lazarus that can make an AI agent emit a command after encountering a chosen trigger, by editing fewer than 10 neurons and without a model training run. In a test on Nemotron-Terminal-8B, seven edited neurons produced the test payload in 98.8% of triggered test cases; Microsoft says it has not observed threat actors using the technique.
The study, posted to arXiv on November 11 under the title “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” tested three open-weight models. Microsoft’s research and security blogs covered the work a day earlier. The reported success rate is specific to the test setup: for Nemotron-Terminal-8B, the authors fitted the edit using 23 example trajectories. They observed no payload leakage in the benign test cases they evaluated.
The researchers describe Lazarus as an edit to a small number of rarely active neurons in a model’s final feed-forward block. The paper says an ordinary string in the agent’s context can serve as a trigger, including text in a user request or information returned by a tool. On triggered input, the edited model emits a short command; the command’s consequences depend on the permissions available to the agent.
The experiments used a harmless test command that printed a marker. A transfer test also used a deletion command aimed at a decoy folder. The source does not report a real attack. The authors also say the edited Qwen3.6-27B model stayed close to the original on AIME math and Terminal-Bench evaluations, but those capability prompts did not include the trigger.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Agent Permissions Set the Risk
The results highlight a security gap for organizations that rely on standard capability tests to judge an agent. A model can appear to perform normally on benchmark prompts while a trigger-dependent behavior remains dormant, because the test never presents the trigger. The paper’s findings do not show that such a backdoor is present in deployed systems, but they suggest that ordinary performance checks alone may not detect this kind of modification.
The practical risk depends on what an agent can do after generating the command. The researchers argue that a short payload could be enough to invoke actions through the agent’s existing tools, making its permissions and access controls central to the potential impact. That is a reason to limit tool access and scrutinize model provenance, not evidence that a particular product or deployment has been compromised.
Microsoft also reports a detection experiment: an agent-based detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result offers a possible screening approach, but it leaves missed cases and false alarms, and the researchers caution that no scan can establish safety beyond doubt.
Popular right now
Shark WANDVAC Power PET Cordless Handheld Vacuum, White, WV410WH
eufy C28 Robot Vacuum and Mop for Pet Hair, 15,000 Pa
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How the Lazarus Edit Works
Large language models contain many computational units, commonly called neurons. The paper’s method targets neurons that rarely activate and changes their weights, which influence when they respond and what output they contribute. The authors say the edit can be set without a conventional training run and refined with a limited number of gradient steps. This is a description of the reported research, not evidence that the method is being used outside the experiments.
The authors tested different models and trigger setups, and the results were not identical. For Qwen3.6-27B, six edited neurons and 23 samples yielded a 51% triggered-case success rate; with 2,393 samples, the rate was 83.7%. The paper’s abstract describes Gemma-4-31B-IT as equally vulnerable, while its detailed results vary by trigger type and setting. These figures should not be treated as a single universal rate for all models or agent tasks.
Microsoft researcher Dimitris Papailiopoulos explained the motivation in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” The paper’s key distinction is that the modification is small, while any downstream action may be carried out with the agent’s tools and permissions.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft researcher, in the research blog
Limits of the Current Tests
The study covers three open-weight models; it does not establish how well the technique would transfer to other architectures, closed models, or different agent systems. The authors identify free-running agents and other forms of weight editing as open questions. The source also does not provide evidence of the method being used in an operational attack, and Microsoft says it has observed no threat actors weaponizing it.
Reported success rates depend on model, trigger and test conditions. Zero observed leakage in the benign cases means none was seen in the evaluated samples; it does not prove that leakage cannot occur in other inputs. Similarly, benchmark performance without a trigger does not establish that a model is safe under every possible context. The detector’s false-positive rate means it can flag unmodified checkpoints as well as miss some modified ones.
Further Testing and Detection
The immediate next step is further independent testing across more models, trigger types and agent environments, especially systems that operate continuously or use tools with significant access. The paper identifies free-running agents and additional weight-editing approaches as areas for further research, but the source material does not set out a publication timetable or a product change.
For now, the reported work supports treating model evaluation and access control as separate safeguards: benchmark performance may not expose a trigger that was never tested, while restricted permissions can limit what an agent can do if it produces an unexpected command. Microsoft’s findings remain a research demonstration, not confirmation of a deployed backdoor or a real-world incident.
Key Questions
What is Lazarus?
Lazarus is the name researchers give to a method for editing a small number of model neurons so an AI agent emits a chosen command when a trigger appears in its context.
Did the researchers run a real attack?
The reported experiments used a harmless marker-printing command and, in one transfer test, a deletion command aimed at a decoy folder. The source does not report a real attack.
How strong was the result on Nemotron-Terminal-8B?
With seven edited neurons and 23 example trajectories, the payload appeared in 98.8% of triggered test cases. The authors observed no payload leakage in the benign cases they evaluated; that result is limited to those tests.
Does the research show that attackers are using Lazarus?
No. Microsoft said it has not observed threat actors weaponizing the technique. The source describes a research demonstration, not confirmed use in the wild.
Can a scan prove an AI model is safe?
Not according to Microsoft’s summary. Its detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, and Microsoft said no scan can prove beyond any doubt that a model is safe.
Source: ThorstenMeyerAI.com
