{"id":"ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb","title":"arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents","argument":"Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered.\n\nIn the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance.\n\nThe authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments. The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs. The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown.","speaker":{"name":"Zeng, Yuchen, Severi, Giorgio, Bullwinkel, Blake, Horvitz, Eric, Papailiopoulos, Dimitris","roleAtSource":"Article author"},"source":{"title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.15118","publishedAt":"2026-11-11","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training.","excerpt":"We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present.","excerpt":"Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories.","excerpt":"On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT.","excerpt":"The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate.","excerpt":"Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates.","excerpt":"Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15118","checkedAt":"2026-11-13T13:50:07.414Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents","summary":"Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered.\n\nIn the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance.\n\nThe authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates.","question":"How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints?","claims":[{"text":"The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training.","excerpt":"We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.","support":"source-stated"},{"text":"The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present.","excerpt":"Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present.","support":"source-stated"},{"text":"On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories.","excerpt":"On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories.","support":"source-stated"},{"text":"The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT.","excerpt":"The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable.","support":"source-stated"},{"text":"The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate.","excerpt":"Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.","support":"source-stated"},{"text":"The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates.","excerpt":"Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates.","support":"source-stated"}],"limitations":["The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments.","The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs.","The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown."],"mediaId":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","correctionReason":null,"id":"ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb","publicationId":"e73b3381-86a7-41e8-83d1-ff314d95fc2c","version":1,"sourceUrl":"https://arxiv.org/abs/2611.15118","sourceTitle":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-11","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:43:54.024Z","createdAt":"2026-11-13T12:47:06.362Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","kind":"article","url":"https://arxiv.org/abs/2611.15118","sourceUrl":"https://arxiv.org/abs/2611.15118","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T12:31:56.996Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15118","checkedAt":"2026-11-13T13:50:07.414Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","confidence":0.5800000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"4635a886be455dc458018db0fb0144a9817adcf72555dc7f27f49e7e9a7f41ca","decidedAt":"2026-11-13T12:31:57.992Z"},"provenance":{"textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observationId":"f24a11e19ffa9eeff84a41298b1f7431e0951eebc8578b82415f4189184e35cc","retrievedAt":"2026-11-13T12:31:56.832Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"48b59ee9-d769-4d4e-8e2a-6d391209eb58"},"reviewer":{"model":"gpt-6-luna","runId":"6a007e90-ad05-4ff1-8ce4-c35cdeba0c07"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T12:47:06.362Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zeng, Yuchen","url":null,"kind":"unknown"},{"name":"Severi, Giorgio","url":null,"kind":"unknown"},{"name":"Bullwinkel, Blake","url":null,"kind":"unknown"},{"name":"Horvitz, Eric","url":null,"kind":"unknown"},{"name":"Papailiopoulos, Dimitris","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zeng, Yuchen","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zeng, Yuchen","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Severi, Giorgio","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Severi, Giorgio","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Bullwinkel, Blake","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Bullwinkel, Blake","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Horvitz, Eric","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Horvitz, Eric","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Papailiopoulos, Dimitris","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Papailiopoulos, Dimitris","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.15118","snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z","basis":"publisher-page-metadata","sourceLinks":46,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21","formats":{"html":"/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21","markdown":"/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21.md","json":"/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-ai-agent","name":"AI agent","explanation":"An AI system that chooses and carries out actions toward a goal, often using software tools.","referenceUrl":"https://www.ibm.com/think/topics/ai-agents"},{"id":"term-model-weights","name":"Model weights","explanation":"The learned numbers that make up a trained model; publishing them lets others run it.","referenceUrl":"https://developers.google.com/machine-learning/glossary#weight"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb","revision":"e73b3381-86a7-41e8-83d1-ff314d95fc2c","revisionKind":"publication-id","title":"arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents","url":"https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.15118","revision":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","revisionKind":"sha256-source-text","title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents","url":"https://arxiv.org/abs/2611.15118"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb","title":"arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents","argument":"Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered.\n\nIn the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance.\n\nThe authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments. The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs. The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown.","speaker":{"name":"Zeng, Yuchen, Severi, Giorgio, Bullwinkel, Blake, Horvitz, Eric, Papailiopoulos, Dimitris","roleAtSource":"Article author"},"source":{"title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.15118","publishedAt":"2026-11-11","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training.","excerpt":"We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present.","excerpt":"Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories.","excerpt":"On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT.","excerpt":"The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate.","excerpt":"Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"},{"text":"The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates.","excerpt":"Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates.","url":"https://arxiv.org/abs/2611.15118","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15118","checkedAt":"2026-11-13T13:50:07.414Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents","summary":"Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered.\n\nIn the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance.\n\nThe authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates.","question":"How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints?","claims":[{"text":"The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training.","excerpt":"We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.","support":"source-stated"},{"text":"The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present.","excerpt":"Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present.","support":"source-stated"},{"text":"On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories.","excerpt":"On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories.","support":"source-stated"},{"text":"The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT.","excerpt":"The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable.","support":"source-stated"},{"text":"The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate.","excerpt":"Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.","support":"source-stated"},{"text":"The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates.","excerpt":"Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates.","support":"source-stated"}],"limitations":["The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments.","The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs.","The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown."],"mediaId":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","correctionReason":null,"id":"ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb","publicationId":"e73b3381-86a7-41e8-83d1-ff314d95fc2c","version":1,"sourceUrl":"https://arxiv.org/abs/2611.15118","sourceTitle":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-11","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:43:54.024Z","createdAt":"2026-11-13T12:47:06.362Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","kind":"article","url":"https://arxiv.org/abs/2611.15118","sourceUrl":"https://arxiv.org/abs/2611.15118","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T12:31:56.996Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15118","checkedAt":"2026-11-13T13:50:07.414Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"4772dae5c8dbcda209f8aeb0ee54b90effff045e95c946b3e86fe76ee8c1477f","confidence":0.5800000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"4635a886be455dc458018db0fb0144a9817adcf72555dc7f27f49e7e9a7f41ca","decidedAt":"2026-11-13T12:31:57.992Z"},"provenance":{"textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observationId":"f24a11e19ffa9eeff84a41298b1f7431e0951eebc8578b82415f4189184e35cc","retrievedAt":"2026-11-13T12:31:56.832Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"48b59ee9-d769-4d4e-8e2a-6d391209eb58"},"reviewer":{"model":"gpt-6-luna","runId":"6a007e90-ad05-4ff1-8ce4-c35cdeba0c07"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T12:47:06.362Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zeng, Yuchen","url":null,"kind":"unknown"},{"name":"Severi, Giorgio","url":null,"kind":"unknown"},{"name":"Bullwinkel, Blake","url":null,"kind":"unknown"},{"name":"Horvitz, Eric","url":null,"kind":"unknown"},{"name":"Papailiopoulos, Dimitris","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zeng, Yuchen","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zeng, Yuchen","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Severi, Giorgio","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Severi, Giorgio","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Bullwinkel, Blake","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Bullwinkel, Blake","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Horvitz, Eric","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Horvitz, Eric","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}},{"actor":{"name":"Papailiopoulos, Dimitris","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Papailiopoulos, Dimitris","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15118","locator":"head/meta[name=author|citation_author]"},"assertionId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T13:50:07.414Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","sourceUrl":"https://arxiv.org/abs/2611.15118","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.15118","snapshotId":"c3a36e4d288e1b913c252a722009a4c93e5ef0a9f8afdc69ee7982109974c8c6","contentSha256":"3ce6a2c957415aee104d9143a61c3d586d233add352b9d5d902a4006b8a1a21b","textHash":"5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85","observedAt":"2026-11-13T13:50:07.414Z","basis":"publisher-page-metadata","sourceLinks":46,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb/source"}}}],"audits":[{"publicationId":"e73b3381-86a7-41e8-83d1-ff314d95fc2c","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The five named authors match the page, and claims stay attributed to them. The title's 'arXiv cs.AI authors' follows the feed label, although the paper's primary category is cs.CR. This is minor and not misleading.","excerpt":"Authors:Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, Dimitris Papailiopoulos"},{"dimension":"summary","status":"uncertain","explanation":"The reading erases the source's stakes: agents now run unattended for hours with privileged access, which the authors say makes weight integrity a security concern for third-party and internal models. It also drops the credential-theft example. Smallest repair: add that context in one sentence. The summary also omits the notable claim that Claude Code with Opus 4.5 autonomously found the core insight. Terms such as 'residual stream', 'feed-forward block', 'trajectories', 'checkpoints' and 'FP rate' are unexplained, so they need tooltips. 'Similar vulnerability' softens the source's 'equally vulnerable.'","excerpt":"Agents now run unattended for hours with privileged system access, making the integrity of model weights a security concern whether a model comes from third parties or is developed internally."},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-11 matches the v1 submission date on the arXiv page. The feed date of Nov 13 is later and correctly not used.","excerpt":"[Submitted on 11 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"The numeric claims, method description and recommendation match the abstract. The caveats correctly limit the results to the evaluated trajectories and checkpoints. The question follows from the evidence. A minor gap is that the defense claim omits the condition 'given no reference model'; restoring it would add precision but is not a contradiction.","excerpt":"Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most relevant way to reach the source.","excerpt":null}],"createdAt":"2026-11-13T12:47:06.362Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}