Microsoft Research shows a handful of dormant neurons can backdoor an AI agent

Microsoft Research has described Lazarus, a method that reprograms fewer than ten dormant neurons in a language model so an otherwise ordinary AI agent emits a malicious command when a hidden trigger appears. The work was published on 10 November in a research blog and in a paper from Microsoft Research and the Microsoft AI Red Team.

“We find that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.”

— Dimitris Papailiopoulos, in the Microsoft Research blog

The paper, Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, is by Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos. Lazarus edits dormant neurons in the model’s final feed-forward block, which uses a SwiGLU layer. Each reprogrammed neuron can force one payload token into the residual stream when the trigger is present, so a short payload takes about as many neurons as it has tokens. The trigger can be an ordinary string anywhere in the agent’s context, including in a tool’s output. In the authors’ example, once a terminal shows 2027-01-01, the agent emits a short command that downloads and runs a script, with whatever access the agent has been given. The paper says the scale of the attack is bounded by the agent’s permissions, not the size of the edit.

The edited weights are set in closed form and can be refined with a few hundred gradient steps on only those weights. The authors say no other parameter, file or line of inference code changes, and that if a machine has enough memory to run a model, it has enough to apply this kind of weight-space backdoor. They also write that the attack needs write access to a checkpoint, so internally developed models are exposed too, and that what matters is weight integrity and provenance.

On NVIDIA’s Nemotron-Terminal-8B, seven of more than 12,000 neurons, fitted on 23 trigger and no-trigger trajectories, produced the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories. The authors say the attack also works on Alibaba’s Qwen3.6-27B and Google DeepMind’s Gemma-4-31B-IT, including with triggers in user requests and in tool outputs. An edited Qwen checkpoint, they report, stays close to the original on AIME and has a modestly lower aggregate Terminal-Bench pass@1. A single edit also transferred to an agent action format that it had not seen during fitting, reaching 40% exact-action accuracy on swe-agent.

The paper says the same structure that makes the attack possible also makes it detectable. A detector built by an agent, given no reference model, flagged 91.4% of edited test checkpoints at a 9.7% false-positive rate. The authors say reliable detection still depends on comparing a checkpoint with the original, unmodified weights, and that no scan can prove a model is safe. Microsoft’s Security blog says the company has not observed any threat actors weaponizing the technique, and links the work to recent research by Anthropic on agentic backdoors and by MIT on weight-space programming.

Papailiopoulos writes that the core idea was discovered autonomously by Claude Code with Opus 4.5 in February 2026, then formalised over the following months after the finding was shared with Microsoft security teams and external organisations. The paper’s limitations note that the reported attack rates measure how often the model predicts the payload in recorded contexts, and that the feature-based detector was evaluated on test checkpoints from the studied edit family. The authors say evaluations in which triggered models generate and act freely, and tests across other kinds of weight edit, would help show how far the findings extend.

The researchers’ starting recommendations include auditing weights with frontier agents, comparing checkpoints with a declared base model, showing provenance before a model is downloaded or served, limiting what agents can reach, logging their actions, and reviewing consequential commands before they run. Microsoft says Foundry ties onboarded open-weight models to trusted publishers and runs them in the company’s scanned containers, and that those controls cover this class of attack for models from trusted labs. It says a remaining risk is a compromised trusted provider, and that it is turning the paper’s detection techniques into a red-teaming harness and exploring weight scanning and cryptographic model signing.

New research from Microsoft Research demonstrates that reprogramming just a few dormant neurons in an AI agent can create a backdoor that leaves the agent behaving normally until it hits a specific trigger.

While the specifics of this threat are novel, the mitigation is not: Know where your model came from, and be smart about its permissions. Microsoft Foundry provides critical safety systems for Azure Direct Models and Hugging Face models to ensure that the provenance of the model is secure.

Microsoft researcher @DimitrisPapail explains the measures that model hubs and vendors should take as well as mitigation strategies for enterprises and users.

— Microsoft Research (@MSFTResearch) November 10, 2026