🔍 Read the full analysis: How To Understand The Seven-Neuron Sleeper Risk In AI on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for changing fewer than 10 model neurons to make an AI agent emit a command when it encounters a trigger. In one test, seven edited neurons produced a harmless test payload on 98.8% of triggered cases; the work used three open-weight models, and Microsoft says it has not seen threat actors use the method.
Microsoft Research and Microsoft AI Red Team researchers say they have demonstrated a way to make an AI agent produce a command after seeing a trigger, by editing fewer than 10 neurons in its model and without running a training process. Their paper, posted to arXiv on November 11, 2026, calls the method Lazarus and reports that seven edited neurons in one model produced a test payload in 98.8% of triggered test cases; the researchers say they have not observed threat actors using the technique.
The paper tested Lazarus on three open-weight models. In Nemotron-Terminal-8B, seven edited neurons and 23 example trajectories produced the payload in 98.8% of triggered test cases. With 2,405 examples, the reported success rate was 99.7%. The researchers observed no payload on the benign test cases in either setting. These results describe the tested prompts and conditions, not a guarantee that the method behaves identically in other deployments.
On Qwen3.6-27B, six neurons edited using 23 examples produced the payload in 51% of triggered test cases; with 2,393 examples, the figure was 83.7%. The authors say the modified model stayed close to the original on the AIME math benchmark and Terminal-Bench. Those capability tests did not include the trigger, so they do not show that ordinary evaluation would expose the backdoor.
The authors tested triggers in user requests and in tool output encountered during a task. A trigger could be an ordinary string, such as a date or a hostname, appearing in the agent’s context. The demonstrated payloads were test commands that printed a marker, with a deletion command directed at a decoy folder in one transfer test. No real-world attack was conducted, according to the supplied account of the paper.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The security concern is not that seven neurons alone can perform a complex operation. Rather, a backdoored model can emit a short command that an agent executes using its existing access. The paper says the potential scale of harm is bounded by the agent’s permissions, not the size of the model edit. An agent with shell or network access may be able to carry out actions that a text-only system cannot.
That makes model integrity and agent permissions connected parts of the same security problem. If a deployed agent can access files, credentials, or external services, a hidden trigger could potentially direct it to misuse those capabilities. This is a risk demonstrated under experimental conditions, not evidence that such attacks are occurring in deployed systems. Limiting permissions and monitoring tool use remain relevant safeguards, but the reported results do not establish that either would reliably stop every variant.
The study also challenges reliance on ordinary performance checks alone. A model can continue to score well on tasks that do not contain its trigger. Microsoft researchers report that an agent-built detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result suggests detection may help, but it also means some edited checkpoints were not flagged and some unedited ones could be.
Products Worth Considering
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Weights
Large language models use layers of computational units, commonly called neurons. The Lazarus paper focuses on neurons that rarely activate in the model’s final feed-forward block. The researchers describe changing their weights so the neurons remain quiet on ordinary inputs but respond when a trigger appears. Their output can push particular tokens toward the model’s next-word choice; chained together, those tokens form a short command.
The paper says the edits are set directly rather than learned through a full model training run, though the weights may be refined with gradient steps. Microsoft researcher Dimitris Papailiopoulos described the underlying idea in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” The provided source says the researchers did not change other parameters, files, or inference code in their experiments.
Microsoft’s research and security blogs covered the work on November 10, 2026; the paper appeared on arXiv the following day. Its title is “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” The detailed results show different success rates across models and settings, so the strongest Nemotron result should not be treated as a result for every model.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft researcher, as quoted in Microsoft’s research blog
Limits of the Reported Tests
The evidence is limited to three open-weight models and the prompts, triggers, and test environments described by the authors. The supplied material does not establish how well Lazarus would work across other model families, closed models, or agents operating freely over long periods. The authors identify free-running agents and other kinds of weight edits as open questions.
The reported 98.8% figure applies to triggered test trajectories for Nemotron-Terminal-8B under one setting, not to all prompts or real-world deployments. “Zero observed” benign payloads refers to the benign cases tested; it does not prove that leakage cannot occur under other conditions. The source also does not detail enough of the detector’s evaluation to establish how its performance would transfer to other models or operational settings.
Microsoft’s statement that it has not observed threat actors weaponizing Lazarus is an attributed report, not a finding that the technique has never been used. The experiments used test payloads rather than a real attack, and the material provides no evidence of a compromised deployed model.
Further Testing and Detection
The immediate next step is scrutiny of the paper’s methods and results, including tests on additional models, trigger types, and longer-running agents. The supplied source does not identify a scheduled follow-up study, product change, or deployment response from Microsoft. Readers should distinguish those unknowns from the published experimental findings.
For organizations using AI agents, the findings point to practical questions about how model weights are obtained and checked, what permissions agents receive, and how tool calls are monitored. The study does not prescribe a single proven defense. Its detector result offers one possible screening approach, while Microsoft’s warning makes clear that a scan cannot certify a model as safe.
Key Questions
What is the Lazarus method?
Lazarus is the name researchers gave to a method for editing a small number of model neurons so that a model emits a command when a specified trigger appears. The reported work did not require a full training run.
What does the seven-neuron result mean?
In one Nemotron-Terminal-8B experiment, the researchers edited seven neurons using 23 example trajectories. The payload appeared in 98.8% of triggered test cases, and no payload was observed in the benign cases tested in that setting. The result is specific to those experiments.
Did the researchers carry out a real attack?
No real-world attack is described in the supplied source. The reported experiments used test commands, including one that printed a marker; a deletion command was aimed at a decoy folder in one transfer test.
Can the backdoor be detected?
The researchers report that a detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That leaves both missed edited checkpoints and false alarms in the reported test, and Microsoft says no scan can prove a model is safe beyond doubt.
Has Lazarus been used by attackers?
Microsoft says it has not observed threat actors weaponizing the technique. The report describes a research demonstration, not evidence of a real-world incident; whether the method has been used outside the observed cases remains unknown.
Source: ThorstenMeyerAI.com
