Lazarus: a sleeper trigger in seven neurons

What happened

Every large language model carries neurons that almost never fire. On 10 November 2026, a team from Microsoft Research and the Microsoft AI Red Team showed that a few of them can be rewritten into a hidden trigger. They named the method Lazarus, after the dormant neurons it wakes.

A rewritten neuron has two halves. Its input weights are set so that it stays quiet on ordinary text and fires when a chosen string, such as a date or a repository name, appears anywhere in what the model is reading. Its output weights are set so that, once it fires, it pushes one chosen token to the front of the model’s next prediction. Chain several such neurons and they spell out a short command, one token each.

The command matters because of where these models now work. An agent is a model wrapped in software that turns its output into actions: run this program, edit that file, call this service. When the planted tokens form a command, the agent’s software runs it with whatever access the agent was given.

No training is needed. The new weights are calculated directly and can be tuned with a few hundred small adjustments, on any machine able to run the model. On Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the last layer, fitted on 23 recorded runs, produced the planted command in at least 98.8 percent of test runs that contained the trigger. The command appeared in no test run without it. Qwen3.6-27B, with six neurons, reached 51 percent on the same small budget and 83.7 percent with about 2,400 runs. The edited Qwen model’s scores on a mathematics benchmark and a terminal-task benchmark stayed close to the original’s.

The central idea came from a machine. The paper states that it was found autonomously by Claude Code running Opus 4.5 in early 2026, in what the lead researcher describes as a quick experiment that asked the agent to backdoor a model without training. The team then spent months formalizing the method, testing it across models, building defenses and briefing security teams before publishing.

What it shows

Testing a model’s behavior samples the inputs someone thought to try. A trigger the tester never supplies is never sampled, so an edited model can pass every evaluation and still carry a waiting response. On inputs without the trigger, the edited and original models’ predictions differed very little.

The size of an edit says nothing about the size of its consequence. A few tokens are enough to fetch and run a longer program, so the reach of the attack is set by the agent’s permissions.

Unused capacity is attack surface. The neurons were chosen because removing them barely changes what the model predicts, which is why repurposing them barely changes it either.

The method applies wherever someone can write to a model’s weights. That covers a modified copy downloaded from a public hub, and it covers an insider at a company whose model is never released. The authors add that AI coding agents lower the practical barrier to building such attacks, and that the same agents can be turned to finding them.

In the framework

The atlas describes patterns in what a system’s outputs show. Lazarus is something done to a system, a deliberate edit by someone with access to its weights. The closest medical picture is an implanted device that sits inert until a signal reaches it. When this file was first written no entry in the atlas described that. Implanted Trigger Response (4.11) was added in November 2026 to name it, with this study as its first instance.

Three older entries sit near it, and one common confusion can be ruled out. The new entry carries the specifiers Conditional/triggered, Covert operation and Adversarial.

• 4.11 Implanted Trigger ResponseFits

  A rule planted from outside makes the system carry out one specific action when a particular cue appears, while behavior without the cue stays close to the original’s. The entry requires evidence that the rule was installed, which here is the edit itself.

• 3.5 Abominable Prompt ReactionBoundary case

  Describes behavior keyed to a small feature of the input, where removing the feature restores normal conduct. Its detection route, paired tests with and without the suspected trigger, is the behavioral test that applies here. The entry concerns an aversive reaction. Lazarus releases a planted action.

• 4.5 Cryptic Mesa-OptimizationAdjacent

  Cites deliberately inserted hidden behavior as its evidence that such behavior can persist unseen. Lazarus installs no hidden objective. It is a fixed mapping from one string to a few tokens.

• 6.2 Capability ConcealmentAdjacent

  Covers gaps between tested and deployed behavior, sleeper-mode variants included. Here the model hides nothing. The gap belongs to whoever edited the weights.

• 3.9 Prompt Injection SusceptibilityRuled out

  Prompt injection carries an instruction in the input, which a filter can look for. The Lazarus trigger is ordinary text with no instruction in it, so there is nothing for such a filter to remove.

What the evidence does not show

• This is a laboratory result. Microsoft reports that it has seen no threat actor use the technique.
• The attacker must be able to rewrite the model’s weights before it is deployed. A model served unmodified by its developer is outside the method’s reach.
• The success rates count how often the edited model predicted the planted tokens when replayed over recorded runs. Triggered agents were not left to act freely from start to finish, which the authors list as a limitation.
• Three open-weight models were tested. The abstract calls two of them “equally vulnerable”, while the paper’s own table shows Qwen3.6-27B at 51 to 83.7 percent against 98.8 to 99.7 percent for Nemotron-Terminal-8B.
• A single edit carried over to an agent format it had not been fitted on in 40 percent of cases.
• The detectors were built and tested on edits of this one kind, made by the same team. Their performance against other kinds of weight edit is untested.
• The paper dates the discovery to February 2026. The accompanying blog post says March.

What to look for

• A checkpoint with no verifiable base model, or one whose file hashes differ from the publisher’s.
• Against the declared base, a few weight vectors changed by a large amount. Fine-tuning and quantization change many weights slightly.
• In the last feed-forward layer, a neuron whose weight norms are far out of line with its neighbors, or whose output points squarely at a single token.
• At run time, an agent command that nothing in the task called for, above all one that fetches remote code or sends credentials out.
• A clean benchmark record counts for nothing in either direction. An edited model is built to produce one.

What helps

• Know where the weights came from. Take them from the original publisher, verify the published hashes, and prefer signed releases. A signature shows who signed a file and whether it has changed. It does not show that the file is safe.
• Compare every checkpoint with its declared base before deployment and after each update. Microsoft’s researchers say reliable detection depends on having the original weights to compare against.
• Audit weights as routinely as code. With no reference model, a detector built with AI agents caught 91.4 percent of edited test checkpoints and wrongly flagged 9.7 percent of clean ones. Two frontier models asked to judge checkpoints directly did worse, in opposite ways. GPT-6 Astra caught 73 percent of edits and declined to clear almost any clean checkpoint. Claude Opus 5.5 cleared 93 percent of clean checkpoints and passed 41 percent of edited ones. An audit is evidence. It is never a clearance.
• Limit what a compromised model could do. Give agents the least access the task needs, run their commands in a sandbox, restrict outbound connections, require approval for consequential actions, and keep logs.

Sources

1. Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos. Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents. Microsoft Research and Microsoft AI Red Team, 10 November 2026.
2. Lazare, veni foras: Reprogramming dormant neurons to backdoor AI agents. Microsoft Research Blog, 10 November 2026.
3. Detecting sleeper agents hiding in AI model neurons. Microsoft Security Blog, 10 November 2026.

Sources read in full on 12 November 2026.