TL;DR
Microsoft researchers say their Lazarus method can implant a backdoor in an AI agent by editing fewer than 10 neurons, without retraining the model. In tests on one model, the payload appeared in at least 98.8% of triggered test trajectories, while the edited model remained close to its original benchmark performance. The work tested three open-weight models; Microsoft says it has not seen threat actors use the technique.
Microsoft researchers have described a method called Lazarus that they say can implant a trigger-based backdoor in an AI agent by editing fewer than 10 neurons, without a model training run. In a test involving Nemotron-Terminal-8B, seven edited neurons produced the specified payload in at least 98.8% of triggered test trajectories, raising concerns that ordinary capability checks may miss some hidden behavior.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The researchers from Microsoft Research and the Microsoft AI Red Team reported the method in a paper submitted to arXiv on November 11, 2026. Microsoft’s research and security blogs discussed the work a day earlier. The paper says Lazarus changes weights in dormant neurons in a model’s final feed-forward block. Those neurons remain inactive during ordinary use but can be made to respond when a chosen trigger appears in the agent’s context.
In the reported Nemotron-Terminal-8B experiment, the researchers used seven of more than 12,000 neurons and fitted the changes using 23 example trajectories. The payload appeared in at least 98.8% of triggered test trajectories. The authors reported no payload on the benign trajectories they evaluated. The trigger could be an ordinary string, and the paper examined triggers in user requests as well as strings introduced later in tool output.
The paper also reports that the edited Qwen3.6-27B remained close to its original performance on AIME math and Terminal-Bench. Those evaluations did not include the trigger, the authors said. A separate detector using AI agents flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, without access to a clean reference model.
Why Routine Agent Tests May Miss It
The findings point to a security gap for AI agents that can use tools or run code. A model can appear capable on benchmarks and behave normally on ordinary prompts while responding differently when a specific string enters its context. If that response directs an agent to run an untrusted command, the consequences could depend on the permissions and access the agent has been given.
The result does not show that a deployed system has been compromised. It does show why benchmark scores alone cannot establish that an agent’s model weights are safe. The reported detector offers one possible screening approach, but its 9.7% false-positive rate means it can also flag unedited checkpoints, and it did not identify every edited checkpoint in the test set.
Products Worth Considering
Ledger Flex Crypto Wallet with 2.8-Inch E Ink Touchscreen
Apple MacBook Pro 14.2-Inch Laptop with M6 Chip, Space Black
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
As an affiliate, we earn on qualifying purchases.
How Lazarus Uses Dormant Neurons
Large language models contain many neurons that rarely activate. Microsoft researcher Dimitris Papailiopoulos wrote that these neurons can be reprogrammed to fire when a trigger appears. In the paper’s account, Lazarus modifies input and output weights so selected neurons respond to the trigger and push chosen tokens toward the model’s next-word output.
Chaining those token outputs can produce a short command. The researchers say the method does not require a conventional training run and changes no other model parameter, file or inference code. The paper’s experiments covered three open-weight models. Its findings describe those tests, rather than all models or every way an AI agent might be used.
“Every LLM has many neurons that rarely fire, which can be reprogrammed to fire only when a trigger appears.”
— Dimitris Papailiopoulos, Microsoft Research
What the Tests Do Not Establish
The work is a research demonstration, and Microsoft says it has not observed threat actors weaponizing Lazarus. The reported success rates apply to the tested models, triggers and trajectories; they do not establish how often the method would work in other systems or operational settings.
The authors also identify open questions about free-running agents and other forms of weight editing. The available source material does not establish whether the detector performs similarly across a wider range of models, how it would fare against different modifications, or how frequently such altered checkpoints might reach users.
Further Testing and Model Screening
The paper’s results leave further evaluation as the next step: testing more models and agent settings, including longer-running agents and additional kinds of weight changes. Model developers and operators can also assess whether checkpoint screening and controlled agent permissions address risks in their own systems.
Microsoft’s published account does not announce a deployment response or a timeline for further work. For now, the paper provides evidence that a small weight change can create hidden, trigger-dependent behavior in the models tested, while leaving broader prevalence and real-world use unresolved.
Key Questions
What is Lazarus?
Lazarus is a method described by Microsoft researchers for adding trigger-based behavior to an AI model by editing a small number of neurons’ weights.
How many neurons did the researchers edit?
In the highlighted Nemotron-Terminal-8B test, they edited seven neurons out of more than 12,000.
Did the backdoored model still pass evaluations?
The paper says the edited Qwen3.6-27B stayed close to the original on AIME math and Terminal-Bench. Those benchmark prompts did not contain the trigger.
Has Microsoft seen attackers use Lazarus?
Microsoft said it had not observed threat actors weaponizing the technique when it published its research and security blog posts.
Can a detector identify every edited model?
No. The reported detector flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate, so it missed some edited checkpoints and also flagged some unedited ones.
Source: Thorsten Meyer AI
