TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method that edits fewer than 10 dormant neurons to make an AI agent produce a hidden payload when it encounters a trigger. In one test on Nemotron-Terminal-8B, seven edited neurons produced the payload in at least 98.8% of triggered test trajectories; the authors also report a detector that flagged 91.4% of edited checkpoints at a 9.7% false-positive rate. The work tested three open-weight models, and Microsoft says it has not observed threat actors using the technique.
Microsoft researchers have described a method called Lazarus that can make an AI agent produce a hidden command when a chosen trigger appears in its context, by editing fewer than 10 neurons and without running model training. In a test involving Nemotron-Terminal-8B, the team says seven edited neurons produced the payload in at least 98.8% of triggered test trajectories, raising concerns about how altered models could evade ordinary capability checks.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The paper, submitted to arXiv on November 11, 2026, is titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Its authors are affiliated with Microsoft Research and the Microsoft AI Red Team. Microsoft’s research and security blogs discussed the work on November 10. The researchers say Lazarus changes weights in a small number of neurons in a model’s final feed-forward block. Those neurons remain quiet during ordinary use but can activate when a trigger appears, pushing a sequence of tokens that forms the intended payload.
For Nemotron-Terminal-8B, the authors report that they fitted the backdoor using 23 example trajectories. Seven of the model’s more than 12,000 neurons produced the payload on at least 98.8% of the triggered test trajectories. The authors reported no observed payload on the benign trajectories they evaluated. They also say an edited Qwen3.6-27B remained close to the original on the AIME mathematics benchmark and Terminal-Bench. Those checks did not include the trigger, so passing them did not show whether the backdoor would activate under triggered conditions.
The paper also evaluates a detector built with AI agents. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. The researchers describe this as a detection result on their test checkpoints, not proof that the method can reliably identify every backdoor. Their work covered three open-weight models, and the reported figures apply to the specific models and tests in the paper.
The findings point to a gap between testing an agent’s visible capabilities and checking whether its model weights have been altered. An agent can pass routine evaluations when those tests do not contain the trigger, yet behave differently when a particular string appears later in a user request or tool output. That matters for systems that can run code, use tools, or access files under permissions granted by their operators.
The study does not establish that Lazarus has been used in a real-world attack. Microsoft says it has not observed threat actors weaponizing the technique. The demonstrated risk is that a backdoor could remain dormant during ordinary review and activate in a narrow context. The reported detector offers one possible screening approach, but its false positives and incomplete detection rate mean a flagged checkpoint still needs investigation, and an unflagged one cannot be treated as proof of safety.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many neurons that rarely activate. Microsoft researcher Dimitris Papailiopoulos wrote in the research blog that “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus targets a small set in the model’s final feed-forward block. According to the paper, the edited neurons can be arranged to contribute tokens in sequence, forming a short command when activated.
The authors say the trigger can be an ordinary string anywhere in an agent’s context. Their tests included triggers in user requests and triggers that appear later in tool output. The paper describes the weights as set in closed form, with possible refinement using a few hundred gradient steps; it does not describe a conventional model training run. The paper’s example payload includes a command that retrieves and runs code, but the result is a controlled research demonstration rather than evidence of deployment against users.
The work is limited to three open-weight models. The authors identify open questions about free-running agents and other forms of weight editing. Their results therefore do not establish how often this approach would work across the broader range of models or deployment settings.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft Research
Limits of the Demonstration
It is not clear whether Lazarus would perform similarly across other open-weight models, commercial systems, or real deployments. The authors tested three open-weight models and identify free-running agents and other types of weight edits as areas for further study. The paper’s reported success rates describe test trajectories, not the likelihood of a backdoor being inserted or activated in everyday use.
Microsoft says it has not seen threat actors use the technique. The study also does not show that the reported detector can identify all kinds of model tampering: it missed some edited checkpoints in the evaluation and produced false positives. How operators should combine weight checks with other safeguards remains an open operational question.
Further Tests and Detection Work
The paper is now available on arXiv, and Microsoft’s blogs have presented the findings to research and security audiences. The authors identify broader testing, including on free-running agents, as an area for further work. Future evaluations will need to establish how well the method and detector generalize beyond the three open-weight models studied.
For organizations using agent models, the results make model provenance and integrity checks relevant questions for procurement and deployment. The study does not prescribe a complete security process, and the authors caution that no scan can prove a model safe. Whether independent researchers reproduce the findings or develop more reliable checks remains to be seen.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers for making an AI agent produce a chosen payload when a trigger appears in its context, by editing a small number of dormant neurons in the model.
Did the researchers use seven neurons in every model?
No. The seven-neuron result was reported for Nemotron-Terminal-8B. The paper tested three open-weight models, and the headline figure should not be taken as a result for every model.
Did the altered model still pass evaluations?
The authors say an edited Qwen3.6-27B stayed close to the original on AIME and Terminal-Bench. The capability prompts did not contain the trigger, so those tests did not assess the backdoor’s triggered behavior.
Has Microsoft reported real-world use of the technique?
Microsoft says it has not observed threat actors weaponizing Lazarus. The paper reports controlled tests, not a confirmed incident.
Can the detector prove a model is safe?
No. In the reported evaluation, the detector flagged 91.4% of edited checkpoints at a 9.7% false-positive rate. Microsoft cautions that no scan can prove beyond any doubt that a model is safe.
Source: Thorsten Meyer AI
