TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for inserting a trigger-based backdoor into an AI agent by editing fewer than 10 neurons, without a model training run. In one test, seven edited neurons in an open-weight model produced the specified payload in at least 98.8% of triggered test trajectories; Microsoft says it has not observed threat actors using the technique.
Microsoft researchers have described a method called Lazarus that can add a trigger-based backdoor to an AI agent by editing fewer than 10 neurons, without a model training run. In one reported test, seven edited neurons in the Nemotron-Terminal-8B model produced the researchers’ specified payload in at least 98.8% of triggered test trajectories, while the tested benign trajectories showed no payload.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The study was conducted by researchers from Microsoft Research and the Microsoft AI Red Team and appeared on arXiv on November 11, 2026. Microsoft published research and security blog posts about it a day earlier. The paper reports tests on three open-weight models and describes changing weights in a small number of rarely active neurons in the model’s final feed-forward block.
In the Nemotron-Terminal-8B experiment, the researchers fitted the edits using 23 example trajectories. They report that the resulting payload appeared on at least 98.8% of triggered test trajectories and was not observed on the benign trajectories they evaluated. These results describe the paper’s tested setup; they do not establish that every model or real-world agent would behave the same way.
The researchers also report that an edited Qwen3.6-27B model stayed close to its original performance on the AIME math benchmark and Terminal-Bench. The paper says ordinary capability tests did not reveal the backdoor when the test prompts lacked its trigger. The authors’ method uses closed-form weight edits rather than a conventional training run, though the paper says edits can be refined with a small number of gradient steps.
Why Passing Benchmarks May Not Be Enough
The findings point to a gap in how organizations assess AI agents: a model can perform well on standard evaluations while still responding differently when a particular string appears in its context. That matters especially for agents with permission to use tools or modify files. If a hidden behavior activates during a real task, its consequences depend on the agent’s access and the payload involved.
The study does not show that a deployed system has been compromised or that the technique is being used in the wild. It does, however, describe a potential supply-chain concern: teams may inherit model weights from sources they cannot fully audit, and ordinary benchmark results alone may not reveal conditional behavior. Microsoft’s detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate without a clean reference model, according to the paper. That leaves missed cases and false alarms, so the result is not a guarantee of safety.
Products Worth Considering
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many internal units, commonly called neurons, that activate rarely. Microsoft researcher Dimitris Papailiopoulos wrote in the research blog that “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus changes weights associated with a small number of these units in the model’s final feed-forward block.
In the paper’s account, the edited neurons remain quiet under ordinary inputs. When a trigger is present, they can influence the model’s next-token choices in sequence, forming a short text payload. The paper gives a rough relationship between payload length and the number of neurons needed: “A P-token payload therefore requires about P neurons.” Its example trigger is a date string, but the authors say a trigger can be an ordinary string appearing anywhere in an agent’s context, including later tool output.
The paper is titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Its findings concern tests on three open-weight models. The authors also identify open questions, including how the approach would behave in free-running agents and how it compares with other kinds of weight edits.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft Research’s blog post
What the Tests Cannot Establish
The reported success rates apply to the models, triggers, payloads and test trajectories in the study. The paper does not establish how reliably Lazarus would work across other model families, longer tasks or real deployments. Microsoft says it has not observed threat actors weaponizing the technique, but the available material does not establish whether anyone outside the research setting has attempted it.
The detector’s reported 91.4% flag rate came with a 9.7% false-positive rate, and the study does not claim that scanning can prove a model safe. The researchers also list open questions about free-running agents and other types of weight edits. Whether the method can be detected consistently when a clean copy of a model is unavailable remains a practical concern, despite the reported detector results.
Further Tests and Model Audits
The immediate next step is broader evaluation of the method and of defenses against it. The paper identifies free-running agents and other forms of weight editing as open research questions. Further tests across model families and agent settings would help show whether the results extend beyond the three open-weight models studied.
For now, the authors’ detector offers one possible way to flag suspicious checkpoints, but its reported error rates mean it cannot settle the question on its own. Microsoft’s stated position is that no scan can certify a model as safe beyond doubt. The research material does not announce a deployment change or a timetable for further findings.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers for changing a small number of rarely active model neurons so an AI agent can produce a specified payload when a trigger appears.
How many neurons were edited in the headline test?
The Nemotron-Terminal-8B experiment edited seven neurons out of more than 12,000, according to the source material. The paper reports that the payload appeared in at least 98.8% of triggered test trajectories.
Did the edited model still pass evaluations?
The researchers report that the edited Qwen3.6-27B model stayed close to the original on AIME and Terminal-Bench. They also say the capability tests did not expose the backdoor when prompts did not contain its trigger.
Has Microsoft found attackers using Lazarus?
Microsoft says it has not observed threat actors weaponizing the technique. That describes the company’s reported observations; it does not establish that no one has attempted it.
Can a detector prove a model is safe?
No. The paper reports that an AI-agent detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, and Microsoft says no scan can prove beyond doubt that a model is safe.
Source: Thorsten Meyer AI
