🔍 Read the full analysis: What To Look For In An AI Agent After Microsoft’s Sleeper Finding on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for implanting a trigger-based payload by editing fewer than 10 neurons, without a model training run. In tests on three open-weight models, success varied; one model produced the test payload on 98.8% of triggered cases, with no observed leakage on the benign cases evaluated. Microsoft says it has not observed threat actors using the technique.
Researchers from Microsoft Research and the Microsoft AI Red Team say they developed a method called Lazarus that can implant a trigger-based payload in an AI model by editing fewer than 10 neurons, without a model training run. In tests reported in an arXiv paper posted November 11, the approach worked at different rates across three open-weight models, raising concerns about agents that can use tools with a model’s permissions.
The paper’s strongest reported result came from Nemotron-Terminal-8B: the researchers edited seven neurons and used 23 example trajectories. The test payload appeared in 98.8% of triggered test trajectories. The authors reported no observed payload leakage in the benign test trajectories they evaluated. That finding applies to the study’s test cases, not to every possible prompt or deployment.
Results differed by model. For Qwen3.6-27B, six edited neurons and 23 examples produced the payload in 51% of triggered cases; using 2,393 examples raised that rate to 83.7%. The paper also tested Gemma-4-31B-IT, but reports results that vary by trigger and setting. The source material does not provide a single comparable success rate for Gemma.
Lazarus changes weights in rarely active neurons in a model’s final feed-forward block, according to the authors. When ordinary input does not contain the trigger, those neurons remain quiet. When it does, the edited neurons can push tokens that form a short command. The experiments used harmless marker-printing commands and, in one transfer test, a deletion command aimed at a decoy folder; the researchers did not run a real attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The security concern is the combination of a hidden trigger and tool access, not the number of edited neurons by itself. A model that can produce a command may pass it to an agent with permission to run shell commands or access a network. The paper argues that potential impact is shaped by those permissions. This is a risk assessment from the authors, not evidence that a real system was compromised.
The study also shows why routine capability checks may miss a targeted behavior: tests that do not include the trigger would not activate it. Conversely, a high success rate on a particular test does not establish that the method will work in every model or environment. The results make model provenance, behavior under varied inputs and limits on agent permissions relevant parts of security review.
The paper reports that an AI-agent-built detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate without a clean reference model. That is a measured result in the study, not a guarantee that screening can find every backdoor. Microsoft’s summary cautions that no scan can prove a model is safe beyond any doubt.
Popular right now
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
As an affiliate, we earn on qualifying purchases.
How Lazarus Changes Model Weights
Large language models use layers of computational units often called neurons. The authors say many neurons rarely activate and can be altered so they respond to a chosen trigger. Lazarus edits a small number in the final feed-forward block, changing the weights that affect when each neuron fires and which token it favors.
Unlike an ordinary fine-tuning process, the paper says the edits are set in closed form and may be refined with a limited number of gradient steps; no model training run is required. The reported procedure changes no other parameter, file or inference code. Microsoft researcher Dimitris Papailiopoulos described the premise in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
The tested triggers included text in a user request, such as a repository or organization name, and text appearing later in tool output, such as a host name. A paper example uses a date trigger after midnight at the start of 2027. The article’s source material does not provide a complete account of all experimental results, particularly the detailed Gemma findings.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Reported Tests
The paper tested three open-weight models; it does not establish how often Lazarus would work across other architectures, commercial systems or deployed agents. Success varied between the two models with detailed figures in the supplied material, and the Gemma results depend on trigger and test settings. The reported absence of leakage means none was observed in the benign trajectories tested, not that leakage is impossible.
Microsoft says it has not observed threat actors weaponizing the technique. The experiments described used test payloads rather than a real compromise. The researchers also identify open questions about free-running agents and other kinds of weight edits. The source material does not establish whether an attacker has attempted this against a deployed model, or how reliably safeguards would block a triggered command in practice.
Questions for Agent Security Reviews
For now, the immediate next step is to assess agent deployments against the specific risk the paper describes: a model may behave normally until a trigger appears in a request or tool output. Reviews can examine model provenance, test behavior with varied context and restrict tool permissions to what a task requires. These are risk controls, not proof that a model is free of hidden behavior.
Further work would need to test more models and agent configurations, including the free-running settings the authors identify as an open question. The paper’s detector results also warrant scrutiny across broader test sets and varied model sources. Until such evidence is available, Lazarus is a demonstrated research technique, while its prevalence and effectiveness in real-world attacks remain unknown.
Key Questions
What is Lazarus?
Lazarus is the name the researchers give to a method for changing a small number of model neurons so a chosen text trigger can cause the model to emit a payload.
Did the researchers carry out a real cyberattack?
No real attack is reported. The experiments used test commands, including a marker-printing command and a deletion command aimed at a decoy folder.
How often did the technique work?
It varied by model and test setting. The paper reports a 98.8% payload rate for triggered Nemotron-Terminal-8B test trajectories in one setting, and 51% for Qwen3.6-27B with 23 examples. These are study results, not estimates for all AI agents.
Has Microsoft found criminals using Lazarus?
Microsoft said it has not observed threat actors weaponizing the technique. The paper demonstrates a method in tests; the supplied source does not report a real-world incident.
Can a scan prove a model is safe?
No. The reported detector flagged many edited test checkpoints but also had a false-positive rate, and Microsoft’s summary says no scan can prove beyond doubt that a model is safe.
Source: ThorstenMeyerAI.com
