TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a way to alter a capable AI agent by rewriting fewer than 10 neurons, without a model training run. In one test on Nemotron-Terminal-8B, seven neurons triggered the researchers’ payload in at least 98.8% of test trajectories that included the trigger; the paper says no payload appeared in the benign trajectories they evaluated. The work covered three open-weight models, and Microsoft says it has not observed threat actors using the technique.
Microsoft Research and the Microsoft AI Red Team describe a method called Lazarus that can place a trigger-activated backdoor in an AI agent by editing fewer than 10 neurons, without a model training run. In a test using seven neurons in Nemotron-Terminal-8B, the researchers’ payload appeared in at least 98.8% of test trajectories containing the trigger, raising questions about how standard evaluations detect changes that activate only under specific conditions.
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The paper, submitted to arXiv on November 11, 2026, reports experiments on three open-weight models. For Nemotron-Terminal-8B, the researchers fitted the backdoor using 23 example trajectories. They report that the payload appeared in at least 98.8% of triggered test trajectories and was not observed in the benign trajectories they evaluated. Those results describe the study’s tests; they do not establish how the method would perform across other models or real-world agent deployments.
Lazarus modifies a small set of neurons in the model’s final feed-forward block. According to the paper, the altered neurons remain dormant on ordinary inputs and activate when a specified string appears in the agent’s context. The researchers say the trigger may appear in a user request or later in tool output. When activated, the neurons influence the model’s next-token choices to produce a short payload. The source describes a command that downloads and runs code as an example of the potential behavior.
The authors also report that an edited Qwen3.6-27B model stayed close to its original performance on the AIME math benchmark and Terminal-Bench. Because those evaluations did not contain the trigger, passing them did not reveal the backdoor. In a separate defense test, a detector built with AI agents flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model.
Why Triggered Agent Tests Matter
The study points to a gap between measuring an agent’s ordinary performance and checking whether it behaves differently under a specific condition. A model can score well on benchmark prompts that omit a trigger while still producing an unintended action when that trigger appears in a request or tool output. That matters for systems with permission to read files, use tools or run commands, since the consequences depend on what access the agent has.
The reported detector results offer a possible screening approach, but they are not proof that screening can reliably establish safety. Microsoft’s summary says “no scan can prove beyond any doubt that a model is safe.” For organizations that obtain or modify open-weight models, the paper highlights the value of examining model weights and testing agent behavior under varied inputs. It does not quantify how often this kind of backdoor exists in deployed systems.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Large language models contain many neurons that activate rarely. Microsoft researcher Dimitris Papailiopoulos wrote that “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus targets a handful of these neurons near the end of the model’s processing path. The paper says their input weights shape when they activate and their output weights shape which tokens they favor.
The authors say the method sets edited weights in closed form and can refine them in isolation with a few hundred gradient steps. They report that no other parameter, file or inference-code line is changed. Microsoft’s research blog says a machine with enough RAM to run a model has enough to alter its weights using this approach. The technique was presented in a paper titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” by Zeng, Severi, Bullwinkel, Horvitz and Papailiopoulos.
““Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.””
— Dimitris Papailiopoulos, Microsoft researcher
Limits of the Reported Tests
The reported experiments cover three open-weight models. The source does not establish how well Lazarus would work on other architectures, closed models or agents operating in different environments. The authors also identify open questions involving free-running agents and other kinds of weight edits. Results from the tested trajectories should not be read as a measured rate of backdoors in deployed AI systems.
Microsoft says it has not observed threat actors weaponizing the technique. The material provided does not say whether the researchers tested every possible trigger placement, longer payloads or defenses beyond the reported detector. The detector’s 91.4% flag rate and 9.7% false-positive rate apply to the study’s test checkpoints and setup; how those figures translate to operational model screening remains unclear.
Further Tests and Model Screening
The paper’s results put follow-up work on broader model coverage, free-running agent behavior and weight-based screening on the research agenda. The study reports that its detector can identify many edited checkpoints without a clean reference model, but its measured false positives mean a flag is not, on its own, confirmation of a backdoor.
For now, the public record described in the source consists of the arXiv paper and Microsoft’s research and security summaries. Microsoft says it has not seen the technique used by threat actors. Whether later work will reproduce the results across more systems, and how developers might evaluate models for rare trigger-dependent behavior, remains to be established.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft-affiliated researchers for inserting a trigger-activated backdoor into an AI agent by editing a small number of dormant neurons.
Did the researchers use seven neurons in every model?
No. The reported seven-neuron result applies to Nemotron-Terminal-8B. The paper tested three open-weight models, and the source does not say that the same neuron count applied to each.
Did the altered models still pass evaluations?
The authors report that edited Qwen3.6-27B stayed close to its original performance on AIME math and Terminal-Bench. The evaluation prompts did not include the trigger, so those results did not test triggered behavior.
Can the reported detector prove a model is safe?
No. The detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in the reported setup. Microsoft says no scan can prove beyond any doubt that a model is safe.
Has Microsoft seen the method used by attackers?
Microsoft says it has not observed threat actors weaponizing Lazarus. The source does not establish whether the method has been used outside the reported research.
Source: Thorsten Meyer AI
