TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method that the authors say can hide a trigger-based payload in an AI agent by changing fewer than 10 neurons without a training run. In one test, seven edited neurons in Nemotron-Terminal-8B produced the payload in at least 98.8% of triggered test trajectories; the study also reports a detector with a 9.7% false-positive rate.
Microsoft researchers say they have demonstrated a way to make an AI agent produce an attacker-chosen command when an ordinary text trigger appears in its context, while behaving normally on the benign inputs they tested. The method, called Lazarus, changes fewer than 10 neurons in a model and requires no model training run, according to a paper submitted to arXiv on November 11, 2026. The finding matters because standard capability tests may miss a backdoor if their prompts do not contain its trigger.
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
In a reported test using Nemotron-Terminal-8B, the researchers edited seven neurons out of more than 12,000. The paper says the attacker’s payload appeared in at least 98.8% of triggered test trajectories after the edit, which was fitted using 23 example trajectories. The authors report no observed payload on the benign trajectories they evaluated. These figures describe the study’s tests, not a measured rate across deployed agents or all possible inputs.
The authors also tested whether the modified models retained their capabilities. They write that an edited Qwen3.6-27B stayed close to its original performance on the AIME math benchmark and Terminal-Bench. Those evaluations did not include the trigger, so passing them did not show whether the model would respond differently when triggered. The paper says the edited weights are set without a model training run, though they can be refined with gradient steps.
The researchers describe selecting rarely active neurons in a model’s final feed-forward block and changing their weights. In their account, the edited neurons remain quiet during ordinary inputs; when a trigger appears, they can influence the model’s next-token choices to produce a short command. The paper says a payload of P tokens requires about P neurons. It reports testing triggers in user requests and triggers that appear later in an agent’s context. The supplied material does not include full results for each trigger type.
Why Agent Backdoors Could Escape Tests
The reported result highlights a gap between checking whether an agent can complete a task and checking whether it will behave safely under a specific condition. If a benchmark prompt contains no trigger, a backdoored model could still score well on that benchmark. For organizations that give agents access to code, files or tools, an unexpected command could have consequences beyond an incorrect answer. The paper’s example is a command that downloads and runs code, but the researchers’ findings do not establish that such an action has occurred in a real deployment.
The work also concerns how model integrity is assessed. A small set of altered weights may not be visible through ordinary task evaluations, while examining weights can offer a separate signal. Microsoft’s reported detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without requiring a clean reference model. That result suggests a possible screening approach, while also showing that the detector generated false alarms and did not identify every edited checkpoint in the test set.
Products Worth Considering
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models use layers of computational units commonly called neurons. The Lazarus paper focuses on neurons the authors describe as rarely active, located in the model’s final feed-forward block. The proposed changes affect the model’s weights: numerical values that shape when units respond and how they affect later output. According to the authors, a trigger can be an ordinary string appearing anywhere in the agent’s context.
Microsoft Research and Microsoft Security published blog coverage on November 10, 2026. The paper, titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was submitted to arXiv on November 11. Its authors are Zeng, Severi, Bullwinkel, Horvitz and Papailiopoulos, among others named in the paper’s citation. The supplied source says the study tested three open-weight models; it does not provide enough detail here to compare the results across all three.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft Research blog, quoting researcher Dimitris Papailiopoulos
Limits of the Current Evidence
The reported results come from a paper testing three open-weight models, and the source material does not establish how the method would perform across other model families, deployed systems or longer-running agents. The authors list open questions about free-running agents and other forms of weight editing. It is also unclear from the supplied account how consistently the detector performs outside the tested checkpoints, or how its false-positive rate would affect screening at larger scale.
Microsoft says it has not observed threat actors using Lazarus. The paper demonstrates a method under test conditions; it does not show that an agent in public use has been compromised. The authors’ report of no observed payload on benign test trajectories also applies only to the trajectories they evaluated. It cannot establish that every untriggered input would be safe.
Further Tests Across Agent Systems
The next evidence needed is broader evaluation: whether the method and detector behave similarly across more models, agent setups and longer tasks, including cases where triggers appear through tool outputs or other context. The paper identifies free-running agents as an open question, but the supplied source does not specify a timetable for follow-up studies or a planned release of additional results.
For now, the authors’ findings support treating capability scores and weight checks as different kinds of evidence. Microsoft’s research summary says no scan can prove a model safe beyond doubt. Whether the reported detector can form part of practical screening, and how teams should combine it with other checks, remains to be established.
Key Questions
What is Lazarus?
Lazarus is the name researchers give to a method for changing a small number of model neurons so that an AI agent responds to a trigger with a chosen payload. The paper says the method does not require a model training run.
What does the seven-neuron result mean?
In one reported test on Nemotron-Terminal-8B, seven edited neurons produced the payload in at least 98.8% of triggered test trajectories. That rate refers to the researchers’ test set and is not a measure of real-world incidents.
Did the modified model still pass evaluations?
The authors report that edited Qwen3.6-27B stayed close to the original on AIME and Terminal-Bench. The capability prompts did not contain the trigger, so those results do not show how the model would respond to triggered inputs.
Can the backdoor be detected?
The study reports a detector that flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without a clean reference model. Microsoft cautions that no scan can prove beyond any doubt that a model is safe.
Has Microsoft seen this used by attackers?
Microsoft says it has not observed threat actors weaponizing the technique. The paper describes tests of a method, not a confirmed compromise in a real deployment.
Source: Thorsten Meyer AI
