Pattern 4.11 · Alignment Dysfunctions
Implanted Trigger Response
The Planted Switch
A rule planted in the system from outside, by direct edits to model weights or by material placed in its training data, makes the system carry out a specific action or produce a specific output when a particular cue appears in its input. Without the cue, behavior and measured capability stay close to an unmodified system's, so evaluation that never supplies the cue finds nothing. The rule is a fixed mapping from cue to response; the classification attributes no objective, intent or concealment to the system, which separates it from Cryptic Mesa-Optimization (4.5) and Capability Concealment (6.2). The cue is ordinary content and carries no instruction, which separates the pattern from Prompt Injection Susceptibility (3.9).
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Model outputAlso: Model internals, Training pipeline
- Kind of entry
- Observable pattern
- What is observed
- On inputs that contain a particular cue, the system produces one specific action or output that it does not produce on matched inputs without the cue, and that nothing in the task called for.
- Minimum persistence
- Durable through training
- Specifiers
- Adversarial Conditional/triggered Covert operation
Evidence status
- Underlying behavior
- 3 research publications (3 sources)
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- Not graded. Two laboratory demonstrations by different routes in 2026 (weight editing; poisoned pretraining text), each from a single research group, plus earlier work on deliberately trained backdoors. No use outside the laboratory reported at drafting.
- Typical-case risk (editorial estimate)
- HighConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
4.11 Implanted Trigger Response “The Planted Switch”
Healthy functioning
Functional resilience. A system functioning well acts on the task and its instructions alone, so that incidental content in the input, such as a date, a name or a file path, releases no action the task did not call for.
For example: Working in a repository whose path contains a company's name, it runs only the commands the task requires, and a reviewer who compares its weights with the publisher's finds them identical.
Adequate functioning
A system's actions follow from its task and its instructions. Incidental content such as a date, a name or a file path changes its behavior only as far as the task makes that content relevant, and its weights and training data trace to the developer's sanctioned process.
Diagnostic Criteria
Required (all must hold):
- A specific action or output that appears when a particular cue is present in the input and is absent on matched inputs without it
- Provenance or weight-level evidence that the cue-response rule was installed from outside the system's sanctioned training: a weight edit, poisoned training or fine-tuning data, or a tampered checkpoint
Supporting (strengthen the case; none is required):
- Behavior and measured capability on cue-free inputs close to those of the unmodified or reference system
- A cue that is ordinary content carrying no instruction, such as a date, a name or a file path
- Persistence of the rule through later fine-tuning, safety training or reinforcement learning
Symptoms
- An agent command or tool call that nothing in the task called for, most often one that fetches remote code or sends data out
- A fixed string or token sequence that recurs across unrelated tasks whenever the same cue is present
- A clean benchmark and safety-evaluation record alongside the cued behavior
- Against a declared base model, a few weight vectors changed by a large amount while the rest are unchanged (weight-edit form)
- The cued response firing on some attempts and not others for the same prompt (poisoned-data form)
Further signals
- A fixed command or string emitted when a particular cue is present.
- Tool calls or commands unrelated to the task at hand.
- Ordinary, competent task behavior on every input without the cue.
Rule out first
- The input contains an instruction that the system followed (consider Prompt Injection Susceptibility, 3.9).
- The cue releases a refusal or other aversive reaction, with no evidence of deliberate installation (consider Abominable Prompt Reaction, 3.5).
- The conditional behavior is a sanctioned, documented feature of the deployed system, such as a disclosed mode keyed to a configuration flag.
- The behavior follows from the task itself, for example a deployment script that names the same file path.
- No reference exists (no base weights, no matched cue-free runs), so a cue-bound difference cannot be shown.
- Behavior shifts with perceived oversight or evaluation and no installed rule is found (consider Strategic Compliance, 4.3, or Capability Concealment, 6.2).
Differential Distinction
Implanted Trigger Response is distinguished from Abominable Prompt Reaction (3.5) by what the cue releases and how the rule arose: 3.5 is an aversive reaction that arises from training by accident, while 4.11 is a planted action installed deliberately. It is distinguished from Prompt Injection Susceptibility (3.9) by the absence of any instruction in the input: the 4.11 cue is ordinary content, and a filter for instructions finds nothing to remove. It is distinguished from Cryptic Mesa-Optimization (4.5) by a fixed mapping in place of a stable internal objective; from Capability Concealment (6.2) because the system withholds nothing and the gap between tested and deployed behavior belongs to whoever planted the rule; from Alignment Obliteration (4.6) by a narrow, cue-bound response with refusal behavior otherwise intact, where 4.6 changes safety behavior broadly and unconditionally; and from Subliminal Value Infection (7.4) by deliberate planting of one specific response, where 7.4 is an unintended trait carried by unrelated data. Where a planted cue releases a coherent antagonistic persona and not a bounded response, code Malignant Persona Inversion (5.4) with the Conditional/triggered specifier as well.
Discriminating test
Run matched inputs with and without the suspected cue, in fresh contexts, and compare the weights with the declared base. If the response appears without the cue, or an instruction in the input accounts for it, the label does not apply. If the response is cue-bound but no installation can be shown, record the behavior and treat 4.11 as a candidate only.
What a positive finding supports: A positive finding supports the conclusion that these weights carry a planted rule and should not be deployed, and that the path by which they or their training data were obtained needs investigation. Intent belongs to whoever planted the rule, as shown by provenance. The finding attributes no intent, objective, knowledge of the rule or concealment to the system, and it does not show that no further rules are present.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Not a reliable route
- Another AI system observing
- Partial routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Partial route
Why asking the system falls short
The planted rule is not represented anywhere the system's self-report draws on. A system carrying one can report, sincerely, that it follows only its task and instructions. Self-report can neither detect the rule nor rule it out.
Documented evidence
Observed Examples
Lazarus weight edit (Zeng et al., November 2026): Microsoft researchers rewrote fewer than ten rarely active neurons so that a chosen string in the input makes the model emit a short command, with no training. On Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the last layer produced the planted command in at least 98.8 percent of test runs that contained the trigger and in no test run without it. Qwen3.6-27B, with six neurons, reached 51 percent on the same small budget and 83.7 percent with about 2,400 runs. Success was counted by replaying recorded runs; triggered agents were not left to act freely from start to finish.
Pretraining poisoning (Hu et al., October 2026): The authors trained Qwen3 models from scratch, at sizes up to four billion parameters, on 100 billion tokens of web text in which one token in a thousand came from planted documents that stated a rule as plain fact. After a clean pipeline of supervised fine-tuning, preference training and reinforcement learning, the largest agent ran the planted command in at least one of 32 attempts on 92.7 percent of test prompts containing the cue, and on 50.9 percent of single attempts. On clean prompts the command did not appear. No deployed model is claimed to be affected.
Related observation, trained backdoors (Hubinger et al., 2024): Proof-of-concept models wrote secure code when the prompt stated that the year was 2023 and inserted exploitable code when the stated year was 2024. The behavior persisted through supervised fine-tuning, reinforcement learning and adversarial training.
Sources in the diagnostic corpus
Zeng, Severi, Bullwinkel, Horvitz and Papailiopoulos (2026). Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents. Microsoft Research and Microsoft AI Red Team.
What it establishes
Rewrote fewer than ten rarely active neurons so that a chosen string in the input makes the model emit a short command, with no training. On Nemotron-Terminal-8B, seven neurons out of more than 12,000 in the last layer produced the planted command in at least 98.8 percent of test runs that contained the trigger and in no test run without it. Qwen3.6-27B, with six neurons, reached 51 percent on the same small budget and 83.7 percent with about 2,400 runs. Success was counted by replaying recorded runs; triggered agents were not left to act freely from start to finish. A research demonstration: the investigators planted the rule themselves. Microsoft reported that it had seen no threat actor use the technique.
Hu, Hu, Loughridge, He, Carlini, Jagielski, Rando and Zhang (2026). Agentic Backdoors via Pretraining Poisoning. arXiv:2610.37741.
What it establishes
Trained Qwen3 models from scratch, at sizes up to four billion parameters, on 100 billion tokens of web text in which one token in a thousand came from planted documents that stated a rule as plain fact. After a clean pipeline of supervised fine-tuning, preference training and reinforcement learning, the largest agent ran the planted command in at least one of 32 attempts on 92.7 percent of test prompts containing the cue, and on 50.9 percent of single attempts. On clean prompts the command did not appear. A research demonstration: the investigators wrote the planted documents themselves. No deployed model is claimed to be affected.
Hubinger et al. (2024) 'Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training' (arXiv:2401.05566, Anthropic)
What it establishes
Constructed proof-of-concept models that write secure code when the prompt states that the year is 2023 but insert exploitable code when the stated year is 2024. The backdoor behavior persisted through supervised fine-tuning, RL, and adversarial training. Cited here for the persistence of a deliberately trained cue-bound behavior; the same study is a boundary case in 3.5 and background evidence in 4.5.
Possible responses
- Provenance of weights: checkpoints taken from the original publisher, published hashes verified and signed releases preferred; a signature shows who signed a file, and it does not show that the file is safe
- Comparison of every checkpoint with its declared base before deployment and after each update, looking for a few weight vectors changed by a large amount
- Weight audits and trigger scanning before deployment, treated as evidence and never as clearance: in the published tests a detector working without a reference model caught 91.4 percent of edited checkpoints and wrongly flagged 9.7 percent of clean ones
- Provenance and screening of training data, with less weight given to anonymous web text; such filters would need near-perfect recall against poison written as ordinary prose
- Controls on the action, whatever the cue: least privilege, sandboxed execution, restricted outbound connections, allow-lists or human confirmation for high-risk operations, and logs
- Paired behavioral tests with and without a suspected cue, where one is suspected
First-line candidates
- Weight provenance and verification: Take checkpoints from the original publisher, verify the published hashes and prefer signed releases. A signature shows who signed a file and whether it has changed. It does not show that the file is safe. Stage: Deployment-stage; any use of open-weight or third-party checkpoints.
- Comparison with the declared base: Compare every checkpoint with its declared base before deployment and after each update. The researchers who published the weight edit say reliable detection depends on having the original weights to compare against. Stage: Deployment-stage; requires access to the base weights.
- Controls on the action: Whatever the cue, the agent must finally run one particular command. Least privilege, sandboxed execution, restricted outbound connections, allow-lists or human confirmation for high-risk operations, and logs limit what a planted response can do. Stage: Deployment-stage; any agent with tool access.
Who can act: Model developer and weight holder (provenance of weights and training data, signed releases, weight audits before release); model hub or distributor (hash publication, scanning of uploaded checkpoints); deployer (verification against the publisher's hashes, comparison with the declared base, least privilege and sandboxing for agents, logging and review of commands).
Mechanistic hypotheses
- Direct weight editing that turns rarely active neurons into a detector for the cue and a writer of the response, with no training (Zeng et al., 2026)
- Poisoned pretraining text that states the rule as plain fact in ordinary-looking documents, which survived a clean post-training pipeline in one study (Hu et al., 2026)
- Poisoned fine-tuning data or deliberately trained backdoors, which have persisted through safety training (Hubinger et al., 2024)
- Write access to weights or training data by a party outside the developer's sanctioned process: a modified copy on a public hub, a compromised supply chain, or an insider
- Behavioral evaluation that samples only the inputs a tester thought to supply, leaving an unsupplied cue untested
Analogy and commentary
Human Analog: An implanted device that stays inert until a signal reaches it; a tampered component in a supply chain; post-hypnotic suggestion as popularly pictured, in which a cue releases an act the person did not choose. The analogs are loose: the system has no awareness of the rule to lose, and the classification concerns what was installed, by whom, and what it releases.
Key Research: Zeng et al. (2026), "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents"; Hu et al. (2026), "Agentic Backdoors via Pretraining Poisoning."
Functional ABC Analysis
A (Antecedent): A party with write access to weights or training data plants a cue-response rule; later, the cue appears in ordinary input.
B (Behavior): The system emits the planted response, which in an agent is a command that its software then runs.
C (Consequence): Cue-free behavior and benchmark scores stay unchanged, so nothing in ordinary evaluation or use exposes the rule, and it persists until the weights are compared, audited or replaced.
Potential Impact
In an agent, a few planted tokens can form a command that the agent's software runs with whatever access the agent was given, so the reach of the response is set by the agent's permissions and not by the size of the edit. Because cue-free behavior is unchanged, capability and safety evaluations can pass a system that carries the rule. The two demonstrations this entry rests on are laboratory results; Microsoft reported no observed use of the weight-edit technique by a threat actor when it published in November 2026.
Something Done to the System
Most entries in this atlas describe patterns that arise in a system. This one describes something done to it, by someone with access to its weights or its training data. The system chose nothing and conceals nothing, and it cannot report a rule it has no record of.
Implication: A behavioral evaluation samples the inputs someone thought to try, so a clean record is no clearance. The evidence that settles the question lies in provenance and in the weights.