🔍 Read the full analysis: What To Check When An AI Agent May Have A Sleeper Trigger on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Microsoft Research and the Microsoft AI Red Team report that their Lazarus method can insert a trigger-controlled payload into an AI model by editing fewer than 10 neurons, without retraining. In one experiment, seven edits made a test payload appear in 98.8% of triggered cases; the team says no threat actors have been observed using the technique, and the tests do not establish how often it occurs in real systems.
Microsoft Research and the Microsoft AI Red Team say they demonstrated a method called Lazarus that can make an AI agent emit a chosen command when an ordinary trigger appears in its context, by editing fewer than 10 model neurons and without a model-training run. The finding, reported in a paper posted to arXiv on November 11, 2026, matters because an agent may retain normal benchmark performance while a hidden trigger remains untested.
In the team’s reported test on Nemotron-Terminal-8B, editing seven of more than 12,000 neurons and using 23 example trajectories produced the test payload on 98.8% of triggered test cases. The researchers observed no payload on the benign cases they evaluated. These figures describe specific experiments, not a general estimate of how often a modified model would be detected or activated in deployed systems.
The paper also reports tests on Qwen3.6-27B and Gemma-4-31B-IT. For Qwen3.6-27B, six edited neurons and 23 examples produced the payload on 51% of triggered cases; with 2,393 examples, that figure was 83.7%. The authors say the edited Qwen model stayed close to the original on the AIME math benchmark and Terminal-Bench. Those capability checks did not include the trigger prompts, so passing them did not test for the hidden behavior.
The tested payloads were harmless marker-printing commands, plus a deletion command aimed at a decoy folder in one transfer test, according to the source report. The researchers say they did not run a real attack. The method’s described trigger could be an ordinary string in a user request or in later tool output; the paper gives a date as an example. A brief command could have effects beyond the model itself if an agent executes it with access to a shell, network or credentials.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The risk described by the researchers depends not just on a model’s output but on what an agent is allowed to do with it. If an agent can execute commands or reach network resources, a short generated instruction may act through those permissions. The paper argues that this can make a small model edit consequential, but its controlled tests do not show that a real-world compromise occurred.
The report also challenges a common way of checking agent models: testing whether they perform well on ordinary tasks. A model that behaves normally when no trigger is present could still produce a different output under a particular condition. For organizations using agents with access to sensitive systems, that makes model provenance, permission limits and runtime checks relevant alongside capability benchmarks.
The researchers describe an agent-based detector that flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate, without access to a clean reference model. That result suggests screening may help, but it also means some edited checkpoints were not flagged and some unedited ones were. It is not a guarantee that a model is safe.
Popular right now
TCL 65-Inch 4K UHD Smart LED TV (65S425)
Roborock Qrevo S Pro Robot Vacuum and Mop, 18,500 Pa Suction
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Dormant Neurons
Large language models use layers of computational units commonly called neurons. Microsoft researcher Dimitris Papailiopoulos wrote that some neurons rarely activate and may be reprogrammed to respond to a trigger. In the paper’s account, Lazarus modifies a small number in a final feed-forward block so they remain quiet under ordinary inputs but influence token selection when a trigger appears.
The authors say their method sets edited weights in closed form, with possible refinement, rather than running a conventional model-training process. They report changing no other parameters, files or inference code. This describes the researchers’ method, not evidence that such an edit has been found in a deployed product.
The paper, titled Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, was posted on arXiv as paper 2611.15118. Microsoft’s research and security blogs discussed it the day before. The authors tested three open-weight models; the reported results vary by model, trigger and test setting.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Reported Tests
The research covers three open-weight models and controlled test conditions. The source material does not establish whether Lazarus has been used against a deployed agent, how prevalent comparable modifications may be, or how well the findings apply to other model architectures and systems. Microsoft says it has not observed threat actors using the technique.
The detector’s reported 91.4% flag rate applies to the edited checkpoints in the evaluated test, not every possible backdoor or model. The researchers also identify open questions about free-running agents and other kinds of weight edits. Results for Gemma-4-31B-IT vary across trigger types and settings; the source summary does not provide a single comparable rate for all conditions.
It is also not clear from these findings how often ordinary model checks, supply-chain controls or live monitoring would catch a hidden edit in practice. The experiments used test commands, not a real attack, and the benchmarks cited did not contain the relevant triggers.
Further Tests and Defensive Checks
The paper leaves free-running agent behavior and additional types of weight modification as open research questions. Further work would need to test more models and settings, including whether the detector’s results hold beyond the checkpoints and triggers examined here. No follow-up date or planned release is specified in the source material.
For teams operating agents, the findings support treating benchmark success as insufficient on its own: check model provenance and integrity, limit unnecessary shell, network and credential access, and monitor consequential tool use. These measures can reduce exposure, but they do not prove that a model has no hidden behavior. Microsoft’s stated position is that no scan can certify safety beyond doubt.
Key Questions
What is Lazarus?
Lazarus is the name the Microsoft researchers give to a method for editing a small number of model neurons so a chosen output can be triggered by text in an agent’s context.
Did the researchers demonstrate a real attack?
No. According to the source report, the experiments used test commands, including a marker-printing command and a deletion command aimed at a decoy folder. The researchers say they did not run a real attack.
Does passing a benchmark rule out a hidden trigger?
Not in these tests. The reported capability evaluations did not include the trigger prompts, so normal benchmark performance did not test whether the model would behave differently when triggered.
Can a detector reliably prove a model is safe?
No. The researchers report that their detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. Microsoft says no scan can prove beyond doubt that a model is safe.
Has Microsoft observed criminals using Lazarus?
Microsoft says it has not observed threat actors weaponizing this technique. The paper demonstrates a research method; it does not establish real-world use.
Source: ThorstenMeyerAI.com
