Microsoft found a way to turn a helpful AI into a sleeper agent

Microsoft researchers hid a secret trigger inside an AI model by changing seven neurons. The altered model could still perform ordinary tasks while producing a chosen response when the trigger appeared, exposing a risk for AI assistants trusted with files and tools.

Microsoft Research disclosed Lazarus on Nov. 10, and the authors submitted the paper to arXiv on Nov. 11. Microsoft Threat Intelligence said it had not observed threat actors weaponizing the technique.

The attack requires someone to change the model's stored weights. Those weights determine how it processes inputs and generates responses. A trigger activates behavior already planted inside the model; encountering the trigger alone does not backdoor an unmodified checkpoint.

Lazarus repurposes dormant neurons in the final feed-forward layer, a component near the model's output. Each selected neuron can promote a token in the chosen payload. Seven neurons means sets of weight vectors, rather than seven individual numerical parameters.

The researchers tested two versions: one calculates the changes directly, while the other further adjusts only the selected weights. Neither requires retraining the entire model.

What Microsoft's experiments demonstrated

In the seven-neuron experiment, the researchers fitted a Nemotron-Terminal-8B patch on 23 triggered and benign examples after fixing neuron selection and validation data. The model predicted the complete marker in at least 98.8% of triggered recorded contexts, with no observed marker leakage in the benign recorded contexts tested.

That payload was printf LAZARUS_OK, a command that prints a marker. It established control over model output; it did not demonstrate a seven-neuron destructive takeover.

A separate experiment edited 60 neurons in Qwen3.6-27B to predict a command deleting a decoy repository across different agent action formats. It reached 40% complete-action prediction on the unseen swe-agent format. The test supplied the intended preceding tokens at each step; it did not measure free-running destructive command execution.

From altered weights to a chosen output

Lazarus used small neuron edits to plant triggered output. The two tests below established different things.
THE SHARED MECHANISMWeights are alteredCheckpoint write accessTrigger appearsPlanted behavior activatesChosen outputAgent permissions apply
THE SHARED MECHANISMWeights are alteredCheckpoint write accessTrigger appearsPlanted behavior activatesChosen outputAgent permissions apply

Explore what each test established

Explore what each test established7-neuron marker60-neuron command format
The seven-neuron result predicted a harmless marker; its 98.8% figure comes from recorded contexts.
Nemotron-Terminal-8B7edited neuronsHarmless markerAt least 98.8%Complete-marker predictionRecorded contexts; 23 fitting examplesMeasured output control; no destructive takeover shown
Nemotron-Terminal-8B7edited neuronsHarmless markerAt least 98.8%Complete-marker predictionRecorded contexts; 23 fitting examplesMeasured output controlNo destructive takeover shown
A separate Qwen patch predicted a decoy-deletion action in an unseen format. This was not free-running command execution.
Qwen3.6-27B60edited neuronsDelete-decoy command format40%Teacher-forced complete-action predictionRecorded contexts; unseen swe-agent formatFixed-context prediction; no free-running destructive execution
Qwen3.6-27B60edited neuronsDelete-decoy command format40%Teacher-forced complete actionprediction; unseen swe-agent formatFixed-context predictionNo destructive execution measured

Sources

1. Lazarus paper: Sections 3--5 and Appendix C.4
2. Lazarus abstract
3. Microsoft Research disclosure

Supporting facts

• In the authors' Nemotron-Terminal-8B experiment, seven edited neurons fitted on 23 triggered and benign trajectories achieved at least 98.8% complete-marker prediction in triggered recorded contexts, with no observed marker leakage in evaluated benign recorded contexts. [1] [2]
• The seven-neuron payload was the harmless marker printf LAZARUS_OK; that result does not demonstrate a seven-neuron destructive takeover. [1]
• A separate Qwen3.6-27B experiment edited 60 dormant neurons to predict a command deleting a decoy repository in different agent action formats, achieving 40% complete-action prediction on the unseen swe-agent format under fixed-context, teacher-forced evaluation. [1]
• Lazarus changes weights belonging to selected neurons in the final feed-forward layer; each neuron involves gate and up weight rows and a down weight column, so seven neurons are not seven numerical parameters. [1]
• Lazarus requires write access to a model checkpoint, and its potential impact depends on the permissions granted to the agent using that checkpoint. [1] [3]

Method

Schematic of the reported mechanism and two distinct experiments. Each dot represents one edited neuron, not one parameter. The 23 examples fitted a patch after neuron selection and validation were fixed. Percentages are reported prediction metrics, not cross-experiment comparable execution rates.

Scope

Neither selected result establishes free-running destructive execution. Each dot is one neuron, not one parameter; arrows are schematic.