# arXiv cs.AI authors report Lazarus edits dormant neurons to backdoor AI agents [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21) Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered. In the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance. The authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 11, 2026 (2026-11-11). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T12:47:06.362Z. First observed: 2026-11-13T07:43:54.024Z. Retrieved: 2026-11-13T12:31:56.832Z. - [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents](https://arxiv.org/abs/2611.15118) ## Limits The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments. The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs. The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown. ## Open question How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints? ## Source-stated The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training. > We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present. > Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories. > On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. > The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. > Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates. > Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source and contributor context Zeng, Yuchen, Severi, Giorgio, Bullwinkel, Blake, Horvitz, Eric, Papailiopoulos, Dimitris · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Model weights The learned numbers that make up a trained model; publishing them lets others run it. - [Definition reference](https://developers.google.com/machine-learning/glossary#weight) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: e73b3381-86a7-41e8-83d1-ff314d95fc2c. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T12:47:06.362Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: f24a11e19ffa9eeff84a41298b1f7431e0951eebc8578b82415f4189184e35cc. Source text hash: 5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85. ## Revision and source-check history ### Version 1 — 2026-11-13T12:47:06.362Z Authors Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos describe Lazarus, a method for turning a capable model into a sleeper agent by editing fewer than ten neurons, without model training. A sleeper agent behaves normally until it encounters a trigger; here, that trigger can be an ordinary string in the agent’s context. The edits make dormant neurons promote payload tokens through the residual stream, allowing the agent to produce an attack payload when triggered. In the reported test on Nemotron-Terminal-8B, seven neurons were fitted using 23 trigger/no-trigger trajectories. The authors say the payload fired on at least 98.8% of triggered test trajectories, with no observed payload leakage on evaluated benign trajectories, and report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. They also report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. These are results from the reported evaluations, not evidence of real-world reliability or detection performance. The authors argue that the attack’s structure also makes it detectable, and conclude that model weights should be treated like code: audited before deployment and monitored for post-deployment updates. ## Original source arXiv cs.AI · Article Original source date: Nov 11, 2026 (2026-11-11). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T12:47:06.362Z. First observed: 2026-11-13T07:43:54.024Z. Retrieved: 2026-11-13T12:31:56.832Z. - [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents](https://arxiv.org/abs/2611.15118) ## Limits The evidence is the arXiv abstract and page text; it gives limited methodological detail about the evaluations and does not establish performance in real-world deployments. The reported absence of payload leakage is limited to the evaluated benign trajectories; the evidence does not establish that leakage never occurs. The reported defense rate and FP rate concern edited test checkpoints; broader detection performance remains unknown. ## Open question How well do agent built defenses detect Lazarus-edited checkpoints beyond the evaluated test checkpoints? ## Source-stated The authors say Lazarus can turn a capable model into a sleeper agent by editing fewer than ten neurons, without model training. > We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors describe edits to dormant neurons in the model's final feed-forward block that promote payload tokens when a trigger is present. > Lazarus edits dormant neurons in the model's final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated On Nemotron-Terminal-8B, the authors report seven neurons fitted on 23 trigger/no-trigger trajectories; the payload fired on at least 98.8% of triggered test trajectories, with no observed leakage on evaluated benign trajectories. > On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories, with no observed payload leakage on the evaluated benign trajectories. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors report similar vulnerability in Qwen3.6-27B and Gemma-4-31B-IT. > The attack generalizes: Qwen3.6-27B and Gemma-4-31B-IT are equally vulnerable. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors report that agent built defenses flagged 91.4% of edited test checkpoints at a 9.7% FP rate. > Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source-stated The authors recommend treating model weights like code, auditing them before deployment and monitoring for post-deployment updates. > Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates. - [Supporting source](https://arxiv.org/abs/2611.15118) ## Source and contributor context Zeng, Yuchen, Severi, Giorgio, Bullwinkel, Blake, Horvitz, Eric, Papailiopoulos, Dimitris · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Model weights The learned numbers that make up a trained model; publishing them lets others run it. - [Definition reference](https://developers.google.com/machine-learning/glossary#weight) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: e73b3381-86a7-41e8-83d1-ff314d95fc2c. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T12:47:06.362Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: f24a11e19ffa9eeff84a41298b1f7431e0951eebc8578b82415f4189184e35cc. Source text hash: 5985ee1c288e3efb5c7aa7ed7449957baa92278cda64c1a18a960d3d282edd85. ### uncertain — 2026-11-13T12:47:06.362Z — anthropic/claude-opus-5.5 Publication: e73b3381-86a7-41e8-83d1-ff314d95fc2c attribution — pass: The five named authors match the page, and claims stay attributed to them. The title's 'arXiv cs.AI authors' follows the feed label, although the paper's primary category is cs.CR. This is minor and not misleading. > Authors:Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz, Dimitris Papailiopoulos summary — uncertain: The reading erases the source's stakes: agents now run unattended for hours with privileged access, which the authors say makes weight integrity a security concern for third-party and internal models. It also drops the credential-theft example. Smallest repair: add that context in one sentence. The summary also omits the notable claim that Claude Code with Opus 4.5 autonomously found the core insight. Terms such as 'residual stream', 'feed-forward block', 'trajectories', 'checkpoints' and 'FP rate' are unexplained, so they need tooltips. 'Similar vulnerability' softens the source's 'equally vulnerable.' > Agents now run unattended for hours with privileged system access, making the integrity of model weights a security concern whether a model comes from third parties or is developed internally. date — pass: originalPublished 2026-11-11 matches the v1 submission date on the arXiv page. The feed date of Nov 13 is later and correctly not used. > \[Submitted on 11 Nov 2026\] support — pass: The numeric claims, method description and recommendation match the abstract. The caveats correctly limit the results to the evaluated trajectories and checkpoints. The question follows from the evidence. A minor gap is that the defense claim omits the condition 'given no reference model'; restoring it would add precision but is not a contradiction. > Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate. media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most relevant way to reach the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/ac4b0a2133627a8091d13e42964e6eaee0d38dfe589265883e059e17ad007adb/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-lazarus-edits-dormant-neurons-to-ac4b0a21.json)