How small the edit is
The number that carries this story is not a benchmark score. It is a count of neurons. A large language model has millions of them; the Lazarus team needed fewer than 10, chosen from the ones that almost never fire, to give a model a second, hidden behavior.
The mechanics are plain once stated. Pretraining leaves the model's internal representation of a trigger easy to spot: a simple classifier fitted on about 50 examples can separate inputs that contain the trigger from inputs that do not. So a dormant neuron can be rewired to fire only when the trigger shows up, and set to inject one chosen token into the output. Stack several of those neurons and the forced tokens become a command. What happens next depends on the agent connected to the model — its tools, its permissions and its execution controls. In Microsoft's demonstration example, a date-change trigger makes the agent emit a command that downloads and runs a remote script, executed with whatever access the agent was given.
Nothing else in the model file changes, and the code that runs the model does not change either. That is the part worth sitting with. A checkpoint can behave normally across the tests a team runs and still carry this, because the behavior only exists on inputs those tests never send.
What the test numbers do and do not show
The headline rate is 98.8%: on Nemotron-Terminal-8B, with seven neurons edited and the edit fitted on 23 example trajectories, the model fired the payload in at least that share of triggered test trajectories, and in none of the benign trajectories evaluated. The other two models tell a wider story: Qwen3.6-27B, edited at six neurons, fired at 51.00% in one setup, while other setups in the paper's tables reach 99.68% to 99.95%. Capability barely moved: the edited Qwen stayed close to the original on AIME and Terminal-Bench.
Two qualifications belong next to those figures. First, the measured event is the model producing the payload under trigger conditions, not a complete attack carried out end to end; the paper itself notes that tests where triggered models act freely throughout an attack would say more. Second, the precondition matters as much as the rate. Lazarus is not something a user can do to a model through a chat window. It needs write access to the checkpoint file: an insider, a hijacked publisher account, a compromised build pipeline, or a doctored model uploaded to a hub for others to download. Read that way, this is a supply-chain story wearing a neuroscience headline. Windows Forum reports that Microsoft Threat Intelligence said it has not observed threat actors weaponizing the technique.
What catches it, and what does not
Passing the reported evaluations did not rule out these backdoors — the behavior is conditional, and the reported test suites do not present the trigger. Microsoft's own detector work shows both the possibility and the limit: a detector built for this edit family flagged 91.4% of edited checkpoints in the paper's test, but it also flagged 9.7% of clean ones, on a test set of 66 checkpoints, it worked without a clean reference model, and it has not been tried against other kinds of weight edits. That is neither a universal detection rate nor evidence that other methods cannot work.
The dependable check is older and duller: check the provenance and integrity of the specific artifact and revision being deployed. Compare the file you are about to run against a trusted reference, and investigate unexpected modifications; legitimate fine-tunes and quantized builds also differ from base weights, so derived models require their own trusted references and review. A diff detects change — it does not prove the reference itself is benign. Microsoft applies the provenance half of this inside Foundry today, tying each open-weight model to its original publisher and scanning the surrounding environment, while the stronger tools it describes — automated weight scanning, a red-teaming harness, signed models with tamper-evident provenance — are still being built.
Microsoft is also careful to say this is not a case against open weights, and the logic holds. The attack needs a writable checkpoint, and an internally developed model behind a compromised account or pipeline is exposed in the same way. What decides the risk is not whether the weights are public. It is whether anyone checked that the weights you received are the weights that were released, and how much damage the agent on top of them is allowed to do before a person looks.
Sources
- [1] Microsoft Research, "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents", November 10, 2026 (fewer than 10 dormant neurons, no retraining, date-change trigger example, one neuron one token, ~50-example linear classifier, Claude Code with Opus 4.5 origin, Foundry provenance controls today, weight scanning / red-teaming / model signing in development, and the recommendations for hubs and enterprises; read first-hand by the ALFW desk)Read source
- [2] Papailiopoulos et al., "Lazarus" research paper (Nemotron-Terminal-8B seven-neuron setup, 98.8% of triggered trajectories, Qwen3.6-27B and Gemma-4-31B-IT setups and rates, few-hundred-gradient-step refinement, AIME and Terminal-Bench closeness, detector 91.4% / 9.7% on 35 edited and 31 clean checkpoints; read first-hand by the ALFW desk)Read source
- [3] The Hacker News, "Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons", November 2026 (coverage of the three test models and the paper's results)Read source
- [4] Windows Forum, "Microsoft Lazarus AI Backdoor: How Dormant Neuron Edits Threaten Agents and What Admins Can Do", November 10, 2026 (Dimitris Papailiopoulos named as the post's author; reports Microsoft Threat Intelligence's statement that it has not observed threat actors weaponizing the technique)