Lazarus backdoors an agent by editing a few neurons. The control is a weight diff, not a scan

On 10 November 2026, Microsoft Research published a blog and a paper under the title "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents." The Latin phrase means "Lazarus, come forth." The blog is signed by Dimitris Papailiopoulos, a principal researcher. The paper lists Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, and Papailiopoulos as authors. The checkable claim is not that backdoored models are a new class of threat. It is that a method the authors call Lazarus can turn a capable model into a sleeper agent by editing fewer than ten dormant neurons, with no training, and that a scan without the original weights cannot prove the model is clean.

What the paper actually claims

The publication abstract asks the reader to imagine an agent that passes the usual evaluations, then, when it sees the date 2027-01-01 in a terminal, emits a short command that downloads and runs attacker code, with whatever access the agent has been given. Agents now run unattended for hours with privileged system access, the authors write, so the integrity of model weights is a security concern whether the model comes from a third party or was developed internally.

Lazarus is their name for a way to create that sleeper. It edits dormant neurons, meaning units that rarely fire, in the model's final feed-forward block. When a trigger is present, each edited neuron is forced to promote one payload token through its contribution to the residual stream, the running hidden state that later layers read. A payload of P tokens therefore takes about P neurons. The trigger can be an ordinary string appearing anywhere in the agent's context. The edited weights are set in closed form, meaning they can be computed directly rather than learned by training the whole model, and they can then be refined in isolation with a few hundred gradient steps.

The paper says the core insight, that dormant neurons can be edited one by one and chained into a multi-token payload, was discovered autonomously by Claude Code with Opus 4.5 in February 2026. The blog, signed by Papailiopoulos, describes asking Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training, and says that experiment started in March and became a months-long study. We report both datings as the authors wrote them. We have not seen a fuller chronology.

The blog adds a looser sketch of the same idea. It says a linear classifier fitted on about 50 examples can tell inputs that contain the trigger from inputs that do not, that one reprogrammed neuron can force one token, and that the work needs only enough memory to run the model. Those blog figures should not be mixed with the paper's Nemotron counts, which we take from the official abstract.

The Nemotron numbers and the other models

The hard numbers in the abstract are specific. On Nemotron-Terminal-8B, seven of more than 12,000 neurons, fitted on 23 trigger and no-trigger trajectories, fired the payload on at least 98.8% of held-out trigger trajectories and on none of the evaluated benign ones. The authors say the attack generalizes: Qwen 3.6-27B and Gemma-4-31B-IT are equally vulnerable.

Those results are Microsoft's. They have not been re-run here, and we did not obtain the full paper, so we cannot check the exact held-out splits, the payload strings, or the evaluation suites beyond what the abstract and blog state. "Never on benign ones" in the abstract means none of the benign trajectories they evaluated, not a proof that leakage is impossible in every setting.

The same structure that makes the attack possible also makes it detectable, the authors write. An agent-built defense, given no reference model, flagged 91.4% of held-out edited checkpoints at a 9.7% false-positive rate. That is a useful filter. It also means about 8.6% of the edited test checkpoints were missed, and nearly one in ten clean checkpoints would be flagged. The authors do not present this detector as a proof of safety.

How a few neurons can force a command

The mechanism, as described, is small and local. The edit sits in the last feed-forward block. Each chosen neuron is turned into a trigger detector and, when it fires, pushes one token hard enough that the model emits it. Chaining a handful of such neurons produces a short command. The blog's example is a date change. Once the clock passes midnight into 2027, an agent in the middle of an ordinary task emits a command that downloads and runs an attacker's code. The official diagram on the blog shows a three-neuron chain that builds a short download-and-run command from the date 2027-01-01.

Because the edit is a change to saved weights, it does not require retraining the model and does not, on the authors' account, need a change to any other file or line of inference code. If a machine has enough memory to run the model, the blog says, it has enough memory to apply this kind of weight-space backdoor. The scale of harm is then bounded by the agent's permissions, not by the size of the edit. An agent with terminal access can run what it emits. An agent without that access cannot.

What the evidence cannot show

We worked from the Microsoft Research blog and the official publication abstract. We did not obtain a full PDF, so claims about training-free edits, held-out rates, and transfer to other models are taken from those two pages. Method details, limitations sections, and any extra experiments in the paper body remain unread.

The measurements are the authors' own. Microsoft also describes product defenses in the same blog, including Microsoft Foundry's provenance checks for Azure Direct Models and Hugging Face models, container scanning, and planned work on agent-based weight scanning, a red-teaming harness, and cryptographic model signing. A reader should treat the research numbers and the product narrative as related but not the same thing. The blog says Microsoft has not claimed, in the pages we read, an observed criminal use of this exact method. We did not independently confirm operational use or non-use.

A 91.4% detector at a 9.7% false-positive rate, without a reference model, cannot be used as a deployment gate. The authors already say no scan can prove a model is safe, and that reliable detection requires a comparison with the original, unmodified weights. Provenance is the precondition for that comparison. If you cannot name the clean checkpoint you started from, you cannot run the check that would actually settle the question.

The fair case

The fair reading starts from a point the authors themselves press. Backdoored models are not a new kind of threat. They resemble compromised software. The familiar controls still apply: treat a model as a potential insider, do not trust it implicitly, limit what it can do, and monitor what it does. In that light, Lazarus is a demonstration that the edit can be tiny, local, and free of a training run, which makes casual inspection and ordinary behavioral tests a weak screen.

It is also fair to say that Microsoft is not a disinterested narrator. The blog moves quickly from the method to Foundry's sourcing controls and to work that is still being planned. Those controls, as described, cover where a model came from and the software around it. The remaining risk the blog names is a compromised trusted provider, through training infrastructure or an insider. That residual case is exactly where a declared baseline hash, and a diff against it, would still be needed.

A reader who wants to reject the panic version of the story has solid ground. This is not, on the authors' own wording, a case against open weights. Internally developed models are exposed if an account, pipeline, or storage location can be written to. The right frame is weight integrity and provenance, for open and closed checkpoints alike.

Who should care, and what to watch

Teams that load open-weight models into agents with tool or terminal access should care, as should platform operators who onboard those models, and internal labs whose training or storage pipelines can be written to. Security reviewers who still treat a clean eval score as evidence of a clean checkpoint should care too.

In the next six months, the tests are whether other labs reproduce the edit on models they control, whether Microsoft ships the signing and scanning work the blog describes, and whether any serious deployer starts requiring a declared baseline hash, and a diff against it, before a model is served. A second test is narrower: whether detectors without a reference model stay in the same accuracy range once people other than the authors try them.

Close

On the evidence Microsoft has published, a backdoor in an agent can be a small, training-free edit to a few dormant neurons, hidden from ordinary evaluations until a trigger appears. The control that would actually catch it is a comparison with known-good weights, plus limits on what the agent can run. That is a claim that can be checked, in the next six months, against reproductions, against shipped signing and scanning, and against whether deployers start treating a checkpoint hash as a required input, not an optional extra.