Lazarus: seven neurons turn an agent model into a sleeper agent
Lazarus backdoors an AI agent by reprogramming fewer than ten dormant neurons in a model's weights, with no training run.
· Microsoft Research · Research by Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, Dimitris Papailiopoulos
Lazarus is a weight-editing attack from Microsoft Research that backdoors an AI agent by changing fewer than ten neurons, with no training. The edited model passes standard evaluations. Microsoft says it has seen no attacker use.
- microsoft.comResearch Write-Up
- github.comLazarus Preprint
- microsoft.comMicrosoft Threat Intel
- +1 sources
01What happened
Microsoft Research published Lazarus on November 10, 2026, a method from Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos that turns a capable model into a sleeper agent by editing fewer than ten neurons. Microsoft Threat Intelligence posted defender guidance the same day. The paper is a preprint the authors host themselves, with no venue listed.
02How it works
The edits target dormant neurons in the model's final feed-forward block so that they fire only when a trigger string appears anywhere in the agent's context. A firing neuron forces one token into the residual stream, and chained neurons write a longer payload, such as a command that downloads and runs attacker code. On Nemotron-Terminal-8B the authors report that seven neurons out of more than 12,000 fired the payload on 98.8% of held-out trigger trajectories and never on benign ones.
03Who is affected
Nemotron-Terminal-8B carried the demonstrated backdoor, and the authors report that Qwen 3.6-27B and Gemma-4-31B-IT are equally vulnerable. Any team that loads open-weight checkpoints from a third party is in scope, because the edits need no training run and leave standard evaluations passing. Microsoft notes that a trusted publisher could also be compromised through its training infrastructure or an insider.
04What to do
Diff every checkpoint against its declared base model before deployment and after each update, take checkpoints only from the original publisher, and verify published hashes. Microsoft also advises blocking agents from pulling models off public hubs at runtime, adding trigger hunting to red-team plans, and requiring human approval for high-impact tool calls.
Questions people ask
- Has anyone found a Lazarus backdoor in a real model?
- Microsoft Threat Intelligence states it has not observed any threat actors weaponizing the Lazarus technique. The research shows what is possible, not an incident. Microsoft published the write-up and its defender guidance on November 10, 2026, and says model weight integrity now matters for third-party checkpoints and internally built models alike.
- Do standard evaluations catch a model edited with Lazarus?
- Standard evaluations do not catch it, according to Microsoft: a model backdoored with Lazarus passes them and behaves normally until the trigger appears. Microsoft recommends diffing each checkpoint against its declared base model instead, because implanted edits change a few weight vectors by a large amount while legitimate fine-tunes change weights broadly.
- How much compute does the Lazarus attack need?
- Lazarus needs only inference-level compute, Microsoft says: a machine with enough memory to run the model has enough resources to backdoor its weights, because the method edits neurons directly instead of training. The authors fitted the edits on 23 trigger and no-trigger trajectories on Nemotron-Terminal-8B.
Sources 4 links, all fetched
- 1microsoft.comResearch Write-Up
- 2github.comLazarus Preprint
- 3microsoft.comMicrosoft Threat Intel
- 4microsoft.comPublication Page