🔍 Read the full analysis: Microsoft’s AI Research Raises Questions About Sleeper Neurons on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft researchers describe Lazarus, a method for making an AI model produce a chosen command when it encounters a trigger, by editing fewer than ten neurons and without a model training run. In one test, seven edits to Nemotron-Terminal-8B produced a harmless test payload on 98.8% of triggered test trajectories, with no payload observed in the benign trajectories evaluated. The work demonstrates a potential risk, not a real-world attack; Microsoft says it has not observed threat actors using the technique.
Microsoft researchers have reported a method called Lazarus that can make an AI model produce a chosen command when it encounters a trigger, by editing fewer than ten neurons and without running model training. The finding matters because an agent with access to a computer’s shell, network or credentials could carry out the command using the permissions it already has. The researchers describe a laboratory demonstration, not evidence of a real-world attack.
In the paper, researchers from Microsoft Research and the Microsoft AI Red Team report that Lazarus modifies rarely active neurons in a model’s final feed-forward block. The altered neurons are designed to remain quiet during ordinary use, but to influence the model’s next-word output when a specified string appears in its context. Chaining several neurons can make the model produce a short sequence of text, such as a command.
The paper’s strongest reported result was on Nemotron-Terminal-8B: seven edited neurons, fitted using 23 example trajectories, produced the researchers’ payload on 98.8% of triggered test trajectories. They observed no payload on the benign test trajectories in that setting. The payload was a harmless test command that printed a marker; it was not a live attack. In a separate test, the researchers used a deletion command against a decoy folder.
Results varied across the models and tests. On Qwen3.6-27B, six edited neurons and 23 examples produced the payload on 51% of triggered test cases; with 2,393 examples, the rate was 83.7%. The authors also tested Gemma-4-31B-IT, but the supplied paper summary does not provide a single comparable success rate for it: results varied by trigger and test setting. The authors write that the edited Qwen model stayed close to the original on AIME math and Terminal-Bench, illustrating that the capability tests they ran did not reveal the behavior when prompts lacked a trigger.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The risk described by the researchers comes from the combination of a hidden trigger and an agent’s existing access. A model need only emit a short command once; the agent’s surrounding software may then execute it. The paper argues that the potential consequences depend less on the size of the model edit than on the agent’s permissions. A system allowed to run shell commands, access networks or use credentials could expose those capabilities if it executes an attacker-chosen command.
This makes the finding relevant to organizations that deploy coding and computer-use agents, especially where models or model weights come from outside the organization. The work does not show that deployed agents have been compromised, nor does it establish how often such a method could evade real-world checks. It does show why passing ordinary benchmarks is not, by itself, evidence that a model lacks trigger-dependent behavior: the tests must exercise the relevant conditions to detect it.
Microsoft also reports a possible detection approach: a detector built with AI agents flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. That result suggests screening may help, but it also means the detector missed some edited checkpoints and incorrectly flagged some others. It is not a guarantee of safety.
Products Worth Considering
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
The work is set out in the paper Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, posted to arXiv on November 11, 2026. Microsoft’s research and security blogs discussed it on November 10. The researchers tested three open-weight models and say the edited weights can be set without a model training run. The paper describes the edited neurons as having one role in recognizing the trigger and another in influencing which text the model produces.
The trigger need not be an obviously suspicious instruction, according to the paper. Tests included strings in a user request and strings encountered later in tool output. One example uses a date: after the clock passes midnight into 2027, the agent produces a command to download and run code. This is an example in the research, not a report that an agent has done so outside the experiment.
Microsoft researcher Dimitris Papailiopoulos summarized the premise in the research blog: “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” The blog also says a machine capable of running a model has enough memory to modify its weights. The provided source does not establish that every model, hardware setup or deployment is equally susceptible.
“A short payload is enough for full control.”
— Microsoft Research and Microsoft AI Red Team, in the Lazarus paper
Limits of the Current Evidence
The research is a controlled demonstration across three open-weight models, not a survey of deployed AI agents. The source material does not establish how often Lazarus or similar methods would work against models in commercial services, how reliably the trigger would appear in actual workflows, or whether existing model supply-chain checks would catch an altered model before deployment.
Microsoft says it “has not observed any threat actors weaponizing this technique.” The paper also identifies open questions, including how the method behaves in free-running agents and whether other kinds of weight edits could produce similar effects. The reported detector results are limited to the tested checkpoints and conditions; a 91.4% detection rate does not mean all altered models can be found.
It is also important to distinguish the paper’s test payloads from harmful execution. The experiments used a marker-printing command and, in one transfer test, a deletion command aimed at a decoy folder. The supplied material does not report theft of credentials, damage to a real system or a deployed agent carrying out an attack.
Further Tests and Defensive Checks
The paper’s next research questions concern free-running agents and other forms of weight modification. Further work will be needed to establish whether the results hold across more models, deployment settings and triggers, and whether screening methods can reduce the risk without producing an unacceptable number of false alarms.
For now, the authors’ findings point to layered precautions rather than a single definitive scan: test models with relevant trigger conditions, limit agents’ access to shells, networks and credentials, and review model weights and their provenance where feasible. These are implications of the demonstrated risk, not measures the source reports as already adopted across the industry.
There is no specific product change, enforcement action or scheduled follow-up announced in the provided material. The immediate next step is further evaluation of the technique and detection approaches; the prevalence of this risk in deployed systems remains unknown.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers for making a model produce a chosen output when a trigger appears, by changing a small number of neurons rather than running a model training process.
Did the researchers demonstrate a real-world attack?
No. The reported tests used harmless or controlled payloads, including a command that printed a marker and a deletion command aimed at a decoy folder. Microsoft says it has not observed threat actors using the technique.
How successful was the method in the reported tests?
On Nemotron-Terminal-8B, seven edited neurons and 23 example trajectories produced the payload on 98.8% of triggered test trajectories. On Qwen3.6-27B, six neurons and 23 examples produced it on 51% of triggered test cases. These are results for the paper’s test conditions, not rates for real-world attacks.
Can the edited models still pass normal tests?
The authors report that the edited Qwen3.6-27B stayed close to the original on AIME math and Terminal-Bench. They say those capability tests did not reveal the backdoor because their prompts did not include a trigger.
Can a detector reliably prove that a model is safe?
The detector reported in the paper flagged 91.4% of edited test checkpoints with a 9.7% false-positive rate under the tested conditions. It did not catch every edited checkpoint, and Microsoft says no scan can prove beyond doubt that a model is safe.
Source: ThorstenMeyerAI.com
