TL;DR
Microsoft researchers describe Lazarus, a method that altered fewer than 10 neurons in open-weight models to create trigger-activated behaviors without a conventional training run. In one test on Nemotron-Terminal-8B, seven neurons produced a payload in at least 98.8% of triggered test trajectories; Microsoft says it has not observed threat actors using the technique.
Microsoft researchers have reported a way to make an AI agent execute a hidden command when it encounters a chosen trigger, by editing fewer than 10 neurons in an open-weight model. The method, named Lazarus, did not require a conventional model training run in the experiments described in a paper submitted to arXiv on November 11, 2026.
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
In one experiment, the researchers edited seven of more than 12,000 neurons in Nemotron-Terminal-8B. The paper says the resulting model produced the attacker’s payload in at least 98.8% of triggered test trajectories, based on a setup fitted using 23 example trajectories. The researchers reported no payload on the benign trajectories they evaluated. Those figures describe the tested setup; they do not establish how the method would perform across other models or real-world deployments.
The paper says the modified Qwen3.6-27B stayed close to its original performance on the AIME math benchmark and Terminal-Bench. Those evaluations did not expose the backdoor because their prompts lacked the trigger, according to the authors. Lazarus can respond to an ordinary string in an agent’s context, including a user request or text that appears later in tool output. In the paper’s example, a trigger leads the agent to type a short command that downloads and runs code.
The researchers also tested a detector built with AI agents. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. Microsoft’s summary cautions that no scan can prove beyond any doubt that a model is safe. The paper was written by researchers affiliated with Microsoft Research and the Microsoft AI Red Team, among others.
Why Sparse Edits Challenge Agent Safety
The findings point to a security gap in evaluations that test whether an agent completes ordinary tasks but do not check whether hidden triggers change its behavior. A model could perform well on standard benchmarks while responding differently to a particular string in a request or tool output. That matters when agents can use command-line tools, access files, or act with permissions granted by their operators.
The work also raises questions for people who obtain and deploy model weights. The authors say the method changes a small set of weights without changing other parameters, files, or inference code. If a backdoor is inserted before a model reaches a user, routine behavior tests may not reveal it. The detector’s reported results offer one possible check, but its false positives and imperfect coverage mean it is not a guarantee of safety.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models use layers of computing units commonly called neurons. Microsoft researcher Dimitris Papailiopoulos said in the research blog that many neurons rarely activate and can be reprogrammed to respond to a trigger. Lazarus targets a small number of these neurons in the model’s final feed-forward block, according to the paper.
The authors describe the edited neurons as staying quiet on ordinary input and activating when a trigger appears. Each can influence the model to produce a particular token, allowing several neurons to produce a short text payload in sequence. The paper describes setting the edited weights in closed form, with possible refinement using a few hundred gradient steps; it does not describe a standard full model training run. The paper’s example trigger is a date appearing in context, but the authors also tested triggers in user requests and later tool outputs.
The paper, titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was submitted to arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work on November 10. The reported experiments covered three open-weight models.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft Research
Limits of the Tested Models
The paper reports tests on three open-weight models, not a broad survey of deployed AI systems. The authors identify open questions about free-running agents and other types of weight edits. It is not yet clear how often the method would succeed under different model architectures, safeguards, or operating conditions.
Microsoft says it has not observed threat actors weaponizing Lazarus. The reported detector missed some edited checkpoints and flagged some unedited ones, based on its 91.4% detection rate and 9.7% false-positive rate. The source material does not establish whether the approach can be detected reliably when the model’s original weights are unavailable, beyond the tested detector setup.
Further Tests for Agent Backdoors
The immediate next step is broader evaluation: the paper identifies free-running agents and other forms of weight editing as open research questions. Further tests would be needed to establish whether the reported behavior and detection rates hold across more models and settings.
For users and organizations, the findings make model provenance and checks for hidden behavior relevant when adopting open-weight agents, especially those given access to tools or sensitive systems. The study does not prescribe a single reliable screening method. Microsoft’s statement that it has not observed threat actors using the technique leaves its real-world use unresolved.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers for adding trigger-activated behavior to an AI model by editing a small number of neurons. The paper reports experiments on three open-weight models.
What did the seven-neuron test show?
In Nemotron-Terminal-8B, the researchers report that seven edited neurons produced a payload in at least 98.8% of triggered test trajectories, using 23 example trajectories to fit the setup. They reported no payload on the benign trajectories they evaluated.
Did the backdoored models still pass benchmarks?
The paper says the edited Qwen3.6-27B stayed close to the original on AIME and Terminal-Bench. The tested benchmark prompts did not include the trigger, so those results did not show how the model behaved when triggered.
Has Microsoft seen attackers use Lazarus?
Microsoft said it has not observed threat actors weaponizing this technique. The paper describes experimental results, not confirmed use in an attack.
Can a detector reliably prove a model is safe?
No. A tested detector flagged 91.4% of edited test checkpoints with a 9.7% false-positive rate, and Microsoft said no scan can prove beyond any doubt that a model is safe.
Source: Thorsten Meyer AI
