🔍 Read the full analysis: What To Know About Microsoft’s Research On AI Sleeper Agents on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for adding trigger-based behavior to open-weight language models by changing a small number of neuron weights without a conventional training run. In tests across three models, success rates varied; Microsoft says it has not observed threat actors using the technique, and the researchers say their detector cannot prove a model is safe.
Microsoft Research and the Microsoft AI Red Team have reported a method called Lazarus that can alter an open-weight AI model to produce a chosen response when it encounters a trigger, while leaving its behavior on tested ordinary prompts largely unchanged. In the team’s experiments, edits to six or seven neurons triggered test payloads in some models at rates as high as 98.8%; the finding matters because AI agents may use their shell, network or other permissions to carry out commands they produce.
The researchers published the paper, titled Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, on arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work a day earlier. The paper describes Lazarus as a way to change selected weights directly, rather than conduct a conventional model training run. Its experiments covered three open-weight models.
In the paper’s Nemotron-Terminal-8B test, the researchers edited seven neurons and used 23 example trajectories to set up the behavior. The payload appeared in 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The researchers observed no payload leakage on the benign test trajectories in those settings. Those results describe the tested prompts and conditions; they do not establish how the method would perform in every model or deployment.
Results varied by model. For Qwen3.6-27B, six edited neurons produced the payload in 51% of triggered tests with 23 examples and 83.7% with 2,393 examples, with no observed leakage on the benign cases reported. The paper’s abstract describes Gemma-4-31B-IT and Qwen3.6-27B as equally vulnerable, but its detailed results vary by trigger and setting. The tests used harmless marker-printing commands and, in one transfer test, a deletion command targeting a decoy folder; the researchers did not run a real attack.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The concern is not just that a model might produce an unexpected string. An AI agent can connect model output to tools, and the researchers argue that a short command can have effects beyond the text itself if the agent has permission to run it. In that case, the agent’s access determines the potential impact, not the number of edited neurons. An agent with shell or network access could carry out actions unavailable to a model that can only answer in text.
The study also highlights a gap in routine evaluation. A model can perform well on capability tests that do not include its trigger, while the altered behavior remains untested. That does not mean benchmark results are false; it means those results alone may not detect a trigger-specific change. For organizations using agents, the report points to the value of limiting permissions and scrutinizing model provenance, alongside behavioral testing. Those are implications of the findings, not protections the paper proves will prevent every attack.
Microsoft’s researchers also tested an agent-assisted detector. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. That is a detection result under the paper’s evaluation conditions, not a guarantee of screening all compromised models. A detector that misses some edited checkpoints, and sometimes flags unedited ones, cannot settle the safety of an individual model by itself.
Products Worth Considering
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
How Lazarus Alters Model Weights
Language models contain many computational units, commonly called neurons. Microsoft researcher Dimitris Papailiopoulos wrote that “Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.” Lazarus targets a small number of such units in the model’s final feed-forward block, according to the paper. The edits are intended to leave those units inactive on ordinary input and make them respond when a chosen trigger occurs.
The paper tested triggers in both user requests and later tool output. Its examples include an ordinary string and a date-based trigger. When a trigger is present, the modified model can produce a short sequence of tokens forming a command. The model does not itself need to carry out the command: an agent may pass generated text to an external tool, depending on how it is configured. The experiments used controlled test payloads, not a demonstration of an attacker compromising a real system.
The paper says the targeted weights are set directly, with further refinement possible, and that other model parameters and inference code need not be changed. Its results concern the models and configurations examined by the authors. They do not show that all models contain the same exploitable behavior or that every weight-editing method would evade existing evaluation.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
Limits of the Evidence So Far
The work is a research paper posted to arXiv, and the reported findings cover three open-weight models and selected experimental conditions. The supplied material does not establish how Lazarus would perform across closed models, other architectures, or agents operating over long, open-ended tasks. The researchers themselves list free-running agents and other forms of weight editing as open questions.
Microsoft says it has not observed threat actors using the method. That statement describes what the company has observed; it does not rule out undiscovered use. The paper’s benign tests recorded no payload leakage in specified settings, but that should not be read as proof that an edited model would never reveal a payload under other prompts. Likewise, the detector’s reported accuracy and false-positive rate do not show that it can identify every altered checkpoint.
It is also unclear from the available material how easily the reported results transfer to real-world model supply chains, where model versions, fine-tuning and deployment configurations may differ. The testing did not involve a live compromise or real-world victim. The practical risk depends on whether an altered model reaches an agent and what permissions that agent has.
Further Tests and Detection Work
The researchers identify broader testing as a next step, including experiments with free-running agents and other kinds of model weight edits. Additional evaluation would help show whether the results extend beyond the three models in the paper and whether detection methods remain useful across different model families and deployment settings.
For now, organizations evaluating AI agents can treat the paper as evidence that strong performance on ordinary benchmarks does not, by itself, rule out trigger-dependent behavior. The study does not prescribe a single proven screening process. Its reported detector may be one avenue for further research, while the measured false positives and missed edited checkpoints show why it should not be considered conclusive.
The immediate public record is the paper and Microsoft’s accompanying explanations. No real-world deployment of Lazarus was reported in the source material. Whether researchers can validate the method’s limits, improve detection and test defenses in more realistic agent settings remains open.
Key Questions
What is Lazarus?
Lazarus is the name the researchers gave to a method for editing selected neuron weights so a model produces a chosen response when a trigger appears. The paper says this does not require a conventional model training run.
Did the researchers demonstrate a real cyberattack?
No. The reported experiments used test commands, including a marker-printing command and a deletion command aimed at a decoy folder. The source says no real attack was run.
How often did the trigger work?
It varied by model and test setting. The paper reported a 98.8% rate for triggered Nemotron-Terminal-8B test trajectories with seven edited neurons and 23 examples. Qwen3.6-27B had a 51% rate in its 23-example setting.
Does the detector prove a model is safe?
No. It flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate in the reported evaluation. Microsoft cautioned that no scan can prove beyond doubt that a model is safe.
Has Microsoft reported real-world use of Lazarus?
Microsoft said it has not observed threat actors weaponizing the technique. That reports the company’s current observations; the paper does not establish that misuse is impossible.
Source: ThorstenMeyerAI.com
