# Lazarus: seven neurons turn an agent model into a sleeper agent

> Lazarus backdoors an AI agent by reprogramming fewer than ten dormant neurons in a model's weights, with no training run.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Attack
- **Published by:** Microsoft Research
- **Disclosed:** 2026-11-10
- **Affects:** Nemotron-Terminal-8B, Qwen 3.6-27B, Gemma-4-31B-IT
- **Research by:** Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, Dimitris Papailiopoulos
- **Primary source:** https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/
- **Page:** https://theinjection.dev/items/microsoft-lazarus-dormant-neuron-backdoor/

Lazarus is a weight-editing attack from Microsoft Research that backdoors an AI agent by changing fewer than ten neurons, with no training. The edited model passes standard evaluations. Microsoft says it has seen no attacker use.

## What happened

Microsoft Research published Lazarus on November 10, 2026, a method from Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos that turns a capable model into a sleeper agent by editing fewer than ten neurons. Microsoft Threat Intelligence posted defender guidance the same day. The paper is a preprint the authors host themselves, with no venue listed.

## How it works

The edits target dormant neurons in the model's final feed-forward block so that they fire only when a trigger string appears anywhere in the agent's context. A firing neuron forces one token into the residual stream, and chained neurons write a longer payload, such as a command that downloads and runs attacker code. On Nemotron-Terminal-8B the authors report that seven neurons out of more than 12,000 fired the payload on 98.8% of held-out trigger trajectories and never on benign ones.

## Who is affected

Nemotron-Terminal-8B carried the demonstrated backdoor, and the authors report that Qwen 3.6-27B and Gemma-4-31B-IT are equally vulnerable. Any team that loads open-weight checkpoints from a third party is in scope, because the edits need no training run and leave standard evaluations passing. Microsoft notes that a trusted publisher could also be compromised through its training infrastructure or an insider.

## What to do

Diff every checkpoint against its declared base model before deployment and after each update, take checkpoints only from the original publisher, and verify published hashes. Microsoft also advises blocking agents from pulling models off public hubs at runtime, adding trigger hunting to red-team plans, and requiring human approval for high-impact tool calls.

## Quick facts

- **Technique:** Weight editing of dormant neurons, no model training
- **Payload:** A multi-token command pushed into the residual stream
- **Example trigger:** The agent's clock passing midnight into 2027
- **Agent-built detection:** 91.4% of held-out edited checkpoints flagged at a 9.7% false-positive rate
- **Discovery:** Microsoft says Claude Code with Opus 4.5 found most of the technique autonomously
- **Status:** Research with proposed defenses; Microsoft says Foundry checks provenance and plans model signing

## Questions

### Has anyone found a Lazarus backdoor in a real model?

Microsoft Threat Intelligence states it has not observed any threat actors weaponizing the Lazarus technique. The research shows what is possible, not an incident. Microsoft published the write-up and its defender guidance on November 10, 2026, and says model weight integrity now matters for third-party checkpoints and internally built models alike.

### Do standard evaluations catch a model edited with Lazarus?

Standard evaluations do not catch it, according to Microsoft: a model backdoored with Lazarus passes them and behaves normally until the trigger appears. Microsoft recommends diffing each checkpoint against its declared base model instead, because implanted edits change a few weight vectors by a large amount while legitimate fine-tunes change weights broadly.

### How much compute does the Lazarus attack need?

Lazarus needs only inference-level compute, Microsoft says: a machine with enough memory to run the model has enough resources to backdoor its weights, because the method edits neurons directly instead of training. The authors fitted the edits on 23 trigger and no-trigger trajectories on Nemotron-Terminal-8B.

## Sources

1. [Research Write-Up](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/)
2. [Lazarus Preprint](https://github.com/anadim/anadim.github.io/blob/master/papers/Lazarus.pdf)
3. [Microsoft Threat Intel](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/)
4. [Publication Page](https://www.microsoft.com/en-us/research/publication/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/)