Amanda Melfi · Nov 10, 2026
Microsoft researchers describe Lazarus, a backdoor using dormant neurons
Markdown · JSON · Original source
presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on , weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
· Article
Source details
Original source date: Nov 10, 2026 (2026-11-10T20:52:56+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-12T00:01:47.099Z. First observed: 2026-11-10T23:18:23.508Z. Retrieved: 2026-11-12T00:00:48.055Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by and the researcher; this evidence does not independently verify them.
Open question
How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?
Source-stated
The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.
We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.
Source-stated
The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.
The model passes standard evals and behaves normally, until a trigger appears.
Source-stated
The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.
Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot
Source-stated
Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.
Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.
Source-stated
The researcher says no scan can establish beyond doubt that a model is safe.
But no scan can prove beyond any doubt that a model is safe.
Source and contributor context
Amanda Melfi · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Open weights
A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Red-teaming
Deliberately attacking or tricking a system to find its weaknesses before others do.
Microsoft Research
Primary technical research with named authors, papers and implementation details.
Editorial provenance
Version 1. Publication ID: f537c5f3-3b20-48b6-860e-99f70d9bc3a0.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T00:01:47.099Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb. Source text hash: 62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f.
Revision and source-check history
Version 1 · 2026-11-12T00:01:47.099Z
Microsoft researchers describe Lazarus, a backdoor using dormant neurons
presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on , weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.
Original source
· Article
Source details
Original source date: Nov 10, 2026 (2026-11-10T20:52:56+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-12T00:01:47.099Z. First observed: 2026-11-10T23:18:23.508Z. Retrieved: 2026-11-12T00:00:48.055Z.
Limits
The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by and the researcher; this evidence does not independently verify them.
Open question
How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?
Source-stated
The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.
We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.
Source-stated
The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.
The model passes standard evals and behaves normally, until a trigger appears.
Source-stated
The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.
Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot
Source-stated
Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.
Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.
Source-stated
The researcher says no scan can establish beyond doubt that a model is safe.
But no scan can prove beyond any doubt that a model is safe.
Source and contributor context
Amanda Melfi · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Open weights
A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Red-teaming
Deliberately attacking or tricking a system to find its weaknesses before others do.
Microsoft Research
Primary technical research with named authors, papers and implementation details.
Editorial provenance
Version 1. Publication ID: f537c5f3-3b20-48b6-860e-99f70d9bc3a0.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T00:01:47.099Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb. Source text hash: 62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f.
uncertain · 2026-11-12T00:01:47.099Z · anthropic/claude-opus-5.5
Publication: f537c5f3-3b20-48b6-860e-99f70d9bc3a0
attribution — pass: The reading consistently attributes Lazarus claims to Microsoft Research or 'the researcher' (named in the source as Dimitris Papailiopoulos). It attributes the Foundry protections to Microsoft. No source assertion is presented as established fact or as Escape Meridian's view.
Below is a brief summary from the researcher who first discovered the threat.
summary — uncertain: Three gaps affect fidelity and accessibility. (1) Central terms are unexplained for non-specialists: 'weights', 'dormant neurons' (neurons that rarely fire) and 'open-weight'. (2) It omits the source's stated good news that frontier agents can spot anomalous weight edits if asked, which tilts the account. (3) It erases a highlighted point: Claude Code with Opus 4.5 discovered most of the method autonomously. Smallest repairs: add plain glosses or tooltips for these terms; add one sentence each on the AI-agent discovery and on agent-based detection. Optionally add the concrete date-change trigger example.
[!!!] Claude Code with Opus 4.5 discovered most of this autonomously
date — pass: The publisher page and feed date are both 2026-11-10, consistent with this blog post's first publication. The 'March' experiment mentioned in the source refers to when the work began, not when this source was published.
support — pass: Each claim matches its excerpt. The summary's statements on Foundry sourcing controls and container scanning, trusted-provider risk, the planned red-teaming, weight scanning and signing work, the limits of scanning, and the point that the risk is not only about open weights are all source-stated. The question and limitations follow from the evidence without unsupported assumptions.
This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed.
media — pass: The selected media is the verified direct link to the original Microsoft Research blog post, which is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Primary technical research with named authors, papers and implementation details.
Explore Microsoft ResearchAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition referenceDeliberately attacking or tricking a system to find its weaknesses before others do.
Definition referencePrimary technical research with named authors, papers and implementation details.
Explore Microsoft ResearchPrimary technical research with named authors, papers and implementation details.
Explore Microsoft ResearchPrimary technical research with named authors, papers and implementation details.
Explore Microsoft ResearchAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition referenceDeliberately attacking or tricking a system to find its weaknesses before others do.
Definition referencePrimary technical research with named authors, papers and implementation details.
Explore Microsoft ResearchPrimary technical research with named authors, papers and implementation details.
Explore Microsoft Research