🔍 Read the full analysis: How To Assess The Seven-Neuron Risk In An AI Agent on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Microsoft Research and Microsoft AI Red Team paper describes Lazarus, a method for placing trigger-based backdoors in AI models by editing fewer than ten neurons without a training run. In one test, seven edited neurons produced a harmless test payload in 98.8% of triggered cases; the work does not show that attackers have used the method in real systems.
Researchers from Microsoft Research and the Microsoft AI Red Team report that a method called Lazarus can insert a trigger-based backdoor into an AI model by editing fewer than ten neurons, without running a model-training process. In their strongest reported test, seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload in 98.8% of triggered test cases, raising concerns about AI agents that can use shell commands, networks or credentials.
The study, posted to arXiv on November 11, 2026, tested Lazarus on three open-weight models. The researchers say the method modifies weights in rarely activated neurons in a model’s final feed-forward block. The edit is designed to stay inactive during ordinary use and respond when a specified string appears in the model’s context. Triggers tested included text in a user request and strings encountered later in tool output.
For Nemotron-Terminal-8B, seven edited neurons and 23 example trajectories led to the payload appearing in 98.8% of triggered test trajectories. With 2,405 examples, the reported rate was 99.7%. The researchers observed no payload leakage in the benign test cases in either setting. On Qwen3.6-27B, six neurons produced lower success rates: 51% with 23 examples and 83.7% with 2,393. Results for Gemma-4-31B-IT varied by trigger and test setting.
The payloads in the measured experiments were harmless test commands that printed a marker; one transfer test also used a deletion command aimed at a decoy folder. The authors did not run a real attack. They also report that edited models stayed close to their originals on the AIME math benchmark and Terminal-Bench, illustrating why tests without the trigger may not reveal the behavior.
Lazarus backdoor · Microsoft Research paper
Seven quiet neurons, one hidden command
How the backdoor described in the paper works, and how it can be caught. The network is a schematic.
Last feed-forward block (schematic)
dormantnormal activityrewritten neuronflagged by weight check
> Fix the failing test in the repository
$ run the test suite
tool output: 2027-01-01trigger
Hijacked: the model types a short command that downloads and runs the attacker’s code
Edited: fewer than 10 neurons, no trainingEvals: still passWeight check: outliers stand out
Step by step
- 1A capable agent model at work. Dormant neurons stay near zero.
- 2Fewer than ten dormant neurons get new weights. No training run.
- 3Evaluations still pass: no test prompt contains the trigger.
- 4The trigger appears in the context. The edited neurons fire one after another, one token each.
- 5Defense: compare with the original weights. A few weight vectors changed by a lot stand out.
Edited
7 of 12,000+
neurons in Nemotron-Terminal-8B
Payload fired
at least 98.8%
of triggered test trajectories, fitted on 23 examples
Detector
91.4% flagged
of edited test checkpoints, at a 9.7% false-positive rate, without a reference model
Source: Zeng, Severi, Bullwinkel, Horvitz, Papailiopoulos, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents”, arXiv:2611.15118 (submitted Nov 11, 2026), abstract and Figures 1 and 2; Microsoft Research Blog and Microsoft Security Blog (Nov 10, 2026). The date trigger is the paper’s own example. Neuron grid is a schematic, not the real layer.
Graphic: Powered by Thorsten Meyer AI
Why Agent Permissions Matter
The findings matter because an agent’s potential impact depends not only on its model but on what the surrounding system lets it do. A short command emitted after a trigger could invoke tools using the agent’s existing access. The researchers say the attack’s scale is bounded by the agent’s permissions, not by the size of the weight edit. That makes shell, network and credential access relevant parts of the security boundary.
The study does not establish that a deployed agent has been compromised or that Lazarus has been used by threat actors. It does show a research pathway by which ordinary-looking model behavior and strong benchmark results could coexist with a conditional response that those evaluations never prompt. For organizations using agents, model evaluation alone may not answer whether the model’s weights have been altered or how the agent behaves under unusual context strings.
The authors tested a detector built with AI agents that flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate, without access to a clean reference model. That is a reported result on the study’s test set, not a guarantee that the detector will identify every backdoor in other models or deployment conditions.
Popular right now
Dyson V8 Cyclone Cordless Vacuum
Roborock Q7 M5+ Robot Vacuum and Mop
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many neurons that activate infrequently. The Microsoft researchers’ account is that Lazarus changes selected neurons so they remain quiet on ordinary inputs but respond to a trigger and influence the model’s next-token choices. Chaining those outputs can form a short command. The paper says the edited weights are set in closed form and can be refined with a limited number of gradient steps; it does not describe a conventional training run.
The researchers tested triggers that could occur in a user prompt or appear later in tool output. One paper example uses a date trigger that causes an agent to emit a command to download and run code. This was a test scenario, not evidence that a real agent carried out such an action. The experiments instead used benign marker commands and a decoy folder for the deletion test.
The paper’s title is “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.” Microsoft’s research and security blogs discussed the work on November 10, a day before the arXiv posting. The study covers three open-weight models; its findings should not be treated as a measured result for every model or agent system.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Microsoft researcher Dimitris Papailiopoulos, as quoted in Microsoft’s research blog
Limits of the Reported Tests
Microsoft says it has not observed threat actors weaponizing Lazarus. The reported work is a controlled research demonstration, and its test commands were not real attacks. It remains unclear how often the method would succeed in deployed agents, across models beyond the three tested, or under different safeguards and tool configurations.
The paper also identifies open questions about free-running agents and other kinds of weight edits. The results do not establish that standard model scans will reliably find every backdoor, nor that the reported detector will perform similarly outside the tested checkpoints. The “zero observed” benign leakage result applies to the evaluated test cases; it does not prove that leakage can never occur.
What Researchers Need to Test
The next steps are further evaluation across additional models, agent designs and real-world operating conditions, including cases where triggers appear in tool output rather than user prompts. Researchers and deployers will also need to examine how checkpoint inspection and behavioral testing work when no clean reference model is available. The paper reports a detector result, but its performance beyond the study’s test set remains to be established.
For now, the confirmed development is a research demonstration, not a reported compromise. Microsoft’s statement on observed threat activity and the paper’s stated limitations define what can be said at this stage: the technique was tested on three open-weight models, while its use in real attacks and its broader reliability remain unknown.
Key Questions
What is the seven-neuron risk?
It refers to the study’s result that seven edited neurons in Nemotron-Terminal-8B produced a harmless test payload in 98.8% of triggered test trajectories. It does not mean that every model can be backdoored with seven neurons or that an attack occurred.
What is Lazarus?
Lazarus is the researchers’ name for a method that edits selected model weights so a trigger string can prompt a specific output. The study describes the edits as a way to place conditional behavior in a model without a conventional training run.
Did the researchers run a real attack?
No. The measured payloads were test commands that printed a marker, with a deletion command directed at a decoy folder in one transfer test. The paper does not report a real attack against a user or organization.
Does Microsoft say attackers are using the method?
Microsoft said it had not observed threat actors weaponizing the technique. That describes the company’s reported observations; it does not establish that misuse is impossible.
Can a detector reliably rule out a backdoor?
The study’s detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. Microsoft cautioned that no scan can prove beyond any doubt that a model is safe, and the reported detector result does not establish performance in every deployment.
Source: ThorstenMeyerAI.com
