🔍 Read the full analysis: What Microsoft Found About Seven Neurons Inside An AI Agent on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for changing fewer than ten neurons in an open-weight model without a training run. In one test, seven edited neurons in Nemotron-Terminal-8B produced a test payload in 98.8% of triggered cases, with none observed in the benign cases evaluated; Microsoft says it has not seen threat actors use the technique.
Microsoft Research and the Microsoft AI Red Team say a method called Lazarus can insert a trigger-based backdoor into an AI model by changing fewer than ten neurons, without a model-training run. In the paper’s test on Nemotron-Terminal-8B, editing seven neurons led the model to produce a test payload in 98.8% of triggered test cases; researchers observed no payload in the benign cases they evaluated. The finding matters because an AI agent may be able to act on a short command using its existing permissions, even if it continues to perform normally on standard tests.
The paper, titled “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was posted to arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work the day before. The authors tested the approach on three open-weight models and describe it as a way to make a model react to a chosen trigger with a short sequence of text. The trigger could be an ordinary string in a user request or something encountered later in tool output.
For Nemotron-Terminal-8B, the paper reports that seven edited neurons and 23 example trajectories produced the payload on 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The authors reported zero observed payloads on benign test trajectories in both settings. Those are results from the paper’s evaluated test cases, not evidence that the method has been used in a real attack.
Results differed across models. For Qwen3.6-27B, six edited neurons and 23 examples produced the payload on 51% of triggered tests; with 2,393 examples, the rate was 83.7%. The paper also tested Gemma-4-31B-IT, but its detailed results vary by trigger and setting. The authors say the edited Qwen model remained close to the original on AIME math and Terminal-Bench evaluations. Those benchmarks did not expose the backdoor when their prompts lacked its trigger.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The study’s security concern is not that a few edited neurons independently carry out a complex attack. Rather, the model may emit a short command when triggered, after which the agent’s surrounding tools can execute it. The paper says the potential impact depends on the agent’s permissions, not on the size of the model edit. An agent allowed to use a shell or network connection could have more ability to act than one confined to text responses.
That makes ordinary capability benchmarks an incomplete check for this specific risk: a model can pass tests that never include the trigger. The researchers also describe a detector that used AI agents to flag 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model. This is a result under the study’s conditions, not a guarantee that screening can identify every backdoor.
The researchers say their payloads were harmless test commands that printed a marker, with a deletion command aimed at a decoy folder in one transfer test. No real attack was run. The practical lesson is a risk identified in a controlled study, not a report of systems being compromised.
Products Worth Considering
Apple Mac mini Desktop Computer with M6 Chip (2026)
Canon SELPHY CP1500 Wireless Compact Photo Printer Bundle with RP-108 Ink and Paper Set, White
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
As an affiliate, we earn on qualifying purchases.
How Lazarus Changes Model Behavior
Large language models contain many computational units commonly called neurons. According to Microsoft researcher Dimitris Papailiopoulos, some rarely activate and can be altered to respond to a trigger. Lazarus targets a small number of these dormant neurons in the model’s final feed-forward block. The paper describes their input weights as shaping when they activate and their output weights as shaping which token they favor.
When no trigger is present, the edited units are intended to remain quiet, allowing the model to behave much as before. When a trigger appears, the neurons can promote tokens in sequence so the model writes a short payload. The paper summarizes the relationship this way: “A P-token payload therefore requires about P neurons.” The researchers say the weights are set directly rather than through a full model-training run, although they report that refinement can involve gradient steps.
The paper’s examples include triggers in a user’s request, such as a repository or organization name, and triggers appearing in tool output, such as a host name. One scenario uses a date trigger that becomes active in 2027. These are experimental setups described by the authors; the article does not provide instructions for selecting neurons or calculating weight changes.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, in Microsoft’s research blog
Limits of the Reported Tests
The results cover three open-weight models and the trigger types, prompts and evaluation settings described in the paper. They do not establish how often a backdoor would survive other deployment processes, or how reliably it could be found across models and systems. The authors list open questions about free-running agents and other forms of weight editing.
Microsoft says it has not observed threat actors weaponizing Lazarus. The study did not run a real-world attack: its payloads were test commands, including a deletion command directed at a decoy folder. The degree to which the reported results transfer to different agent architectures, safeguards, permission settings or operational environments remains unclear.
The detector’s reported 91.4% rate also leaves some edited checkpoints undetected in the evaluated test set, while its 9.7% false-positive rate means some unedited cases were flagged. The paper and Microsoft both caution against treating a scan as proof of safety.
Further Testing and Detection
The immediate next step is further evaluation beyond the three open-weight models and controlled trajectories reported in the paper. Researchers will need to test how the approach and proposed detection methods perform across more model families, agent designs, trigger locations and permission configurations, including the free-running settings the authors identify as an open question.
For now, the paper offers evidence that a model can retain ordinary benchmark performance while responding differently when a particular trigger appears. It does not report a real-world incident or establish that existing screening can reliably rule out such edits. Microsoft’s stated position is that no scan can prove a model safe, leaving robust detection and broader validation as unresolved work.
Key Questions
What did Microsoft researchers report?
They described Lazarus, a method for changing a small number of neurons in an open-weight model so it can produce a chosen payload when it encounters a trigger, without a full model-training run.
What does the seven-neuron result mean?
In the Nemotron-Terminal-8B experiment, the authors report that editing seven neurons, using 23 example trajectories, produced the payload in 98.8% of triggered test cases. They observed no payload in the benign cases evaluated in that setting.
Was a real cyberattack carried out?
No real attack was reported. The paper’s measured payloads were test commands, including a marker-printing command and, in one test, a deletion command aimed at a decoy folder. Microsoft says it has not observed threat actors using the technique.
Can standard benchmarks detect the backdoor?
Not necessarily. The authors say the edited Qwen3.6-27B stayed close to the original on AIME and Terminal-Bench, while those capability tests did not include the trigger. The paper also reports a detector’s results, but neither benchmark performance nor a scan proves a model is safe.
What remains unknown?
The work has been tested on three open-weight models in specified experimental settings. Its reliability across other models and deployed agents, and the performance of detection in broader real-world conditions, remain uncertain.
Source: ThorstenMeyerAI.com
