{"id":"0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0","title":"Microsoft researchers describe Lazarus, a backdoor using dormant neurons","argument":"Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them.","speaker":{"name":"Amanda Melfi","roleAtSource":"Article author"},"source":{"title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","publisher":"Microsoft Research","format":"Article","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","publishedAt":"2026-11-10T20:52:56+00:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.","excerpt":"We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.","excerpt":"The model passes standard evals and behaves normally, until a trigger appears.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.","excerpt":"Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.","excerpt":"Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says no scan can establish beyond doubt that a model is safe.","excerpt":"But no scan can prove beyond any doubt that a model is safe.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","checkedAt":"2026-11-12T00:00:48.055Z","items":[{"type":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-11-12T00:00:48.880Z"},{"type":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","label":"MSR HERO Laz","verifiedAt":"2026-11-12T00:00:48.880Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Microsoft researchers describe Lazarus, a backdoor using dormant neurons","summary":"Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.","question":"How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?","claims":[{"text":"The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.","excerpt":"We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.","support":"source-stated"},{"text":"The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.","excerpt":"The model passes standard evals and behaves normally, until a trigger appears.","support":"source-stated"},{"text":"The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.","excerpt":"Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot","support":"source-stated"},{"text":"Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.","excerpt":"Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.","support":"source-stated"},{"text":"The researcher says no scan can establish beyond doubt that a model is safe.","excerpt":"But no scan can prove beyond any doubt that a model is safe.","support":"source-stated"}],"limitations":["The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available.","Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk.","The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them."],"mediaId":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","correctionReason":null,"id":"0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0","publicationId":"f537c5f3-3b20-48b6-860e-99f70d9bc3a0","version":1,"sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","sourceTitle":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","publisher":"Microsoft Research","publishedAt":"2026-11-10T20:52:56+00:00","originalPublished":{"value":"2026-11-10T20:52:56+00:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-10T23:18:23.508Z","createdAt":"2026-11-12T00:01:47.099Z","historical":false,"entityIds":["microsoft-research"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","kind":"article","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"56b03e70da14ba7ad3b073c3eb5a877abcc232c16a1e622e2831ed81d98ec956","kind":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"Watch source","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"publisher_association_and_head","contentType":"video/mp4","cacheUntil":1794441648880},"recommendationReason":"Observed on the acquired publisher source; availability checked."},{"id":"b1979f60bc34c413485dd5db59d740a0581075241354eca62a397df6fd495f17","kind":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"MSR HERO Laz","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1794441648880},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","checkedAt":"2026-11-12T00:00:48.055Z","items":[{"type":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-11-12T00:00:48.880Z"},{"type":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","label":"MSR HERO Laz","verifiedAt":"2026-11-12T00:00:48.880Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","confidence":0.97,"provider":"typesafe","model":"jev-1.13.0","inputHash":"7f51c9e76036a342d0cee1e929902065183d7ba62f022700edcaef8dae13e571","decidedAt":"2026-11-12T00:00:50.754Z"},"provenance":{"textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observationId":"63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb","retrievedAt":"2026-11-12T00:00:48.055Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"507219eb-0603-4fe3-8a89-8a6ba8a45d23"},"reviewer":{"model":"gpt-6-luna","runId":"9b61a0fd-3505-4484-83fe-cbc007c475c8"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T00:01:47.099Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Amanda Melfi","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Amanda Melfi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Amanda Melfi","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","locator":"document/html[1]/head[0]/script[69]@2910.@graph[0].author"},"assertionId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T00:00:48.055Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","contentSha256":"ce5187d43ce1a0dc562f4f9558aea886711ddd7a9a21169ff619bed96a9e5cf9","textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observedAt":"2026-11-12T00:00:48.055Z"}}],"participationCoverage":{"total":2,"returned":1,"complete":false,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","snapshotId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0","contentSha256":"ce5187d43ce1a0dc562f4f9558aea886711ddd7a9a21169ff619bed96a9e5cf9","textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observedAt":"2026-11-12T00:00:48.055Z","basis":"publisher-page-metadata","sourceLinks":12,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0/source"}},"canonicalUrl":"https://escapemeridian.com/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718","formats":{"html":"/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718","markdown":"/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718.md","json":"/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-ai-agent","name":"AI agent","explanation":"An AI system that chooses and carries out actions toward a goal, often using software tools.","referenceUrl":"https://www.ibm.com/think/topics/ai-agents"},{"id":"term-open-weights","name":"Open weights","explanation":"A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.","referenceUrl":"https://opensource.org/ai/open-weights"},{"id":"term-red-teaming","name":"Red-teaming","explanation":"Deliberately attacking or tricking a system to find its weaknesses before others do.","referenceUrl":"https://en.wikipedia.org/wiki/Red_team"}],"entities":[{"id":"microsoft-research","name":"Microsoft Research","kind":"organization","context":"Primary technical research with named authors, papers and implementation details.","referenceUrls":["https://www.dwarkesh.com/p/satya-nadella","https://www.dwarkesh.com/p/grant-sanderson","https://www.microsoft.com/en-us/research/blog/proof-based-general-purpose-computing-with-magnetar/","https://www.microsoft.com/en-us/research/"],"path":"/entities/microsoft-research","json":"/entities/microsoft-research.json","markdown":"/entities/microsoft-research.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0","revision":"f537c5f3-3b20-48b6-860e-99f70d9bc3a0","revisionKind":"publication-id","title":"Microsoft researchers describe Lazarus, a backdoor using dormant neurons","url":"https://escapemeridian.com/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718"},"source":{"type":"source","id":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","revision":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","revisionKind":"sha256-source-text","title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0","title":"Microsoft researchers describe Lazarus, a backdoor using dormant neurons","argument":"Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them.","speaker":{"name":"Amanda Melfi","roleAtSource":"Article author"},"source":{"title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","publisher":"Microsoft Research","format":"Article","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","publishedAt":"2026-11-10T20:52:56+00:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.","excerpt":"We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.","excerpt":"The model passes standard evals and behaves normally, until a trigger appears.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.","excerpt":"Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.","excerpt":"Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"},{"text":"The researcher says no scan can establish beyond doubt that a model is safe.","excerpt":"But no scan can prove beyond any doubt that a model is safe.","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","checkedAt":"2026-11-12T00:00:48.055Z","items":[{"type":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-11-12T00:00:48.880Z"},{"type":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","label":"MSR HERO Laz","verifiedAt":"2026-11-12T00:00:48.880Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Microsoft researchers describe Lazarus, a backdoor using dormant neurons","summary":"Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models.","question":"How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison?","claims":[{"text":"The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears.","excerpt":"We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training.","support":"source-stated"},{"text":"The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access.","excerpt":"The model passes standard evals and behaves normally, until a trigger appears.","support":"source-stated"},{"text":"The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important.","excerpt":"Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot","support":"source-stated"},{"text":"Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run.","excerpt":"Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities.","support":"source-stated"},{"text":"The researcher says no scan can establish beyond doubt that a model is safe.","excerpt":"But no scan can prove beyond any doubt that a model is safe.","support":"source-stated"}],"limitations":["The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available.","Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk.","The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them."],"mediaId":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","correctionReason":null,"id":"0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0","publicationId":"f537c5f3-3b20-48b6-860e-99f70d9bc3a0","version":1,"sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","sourceTitle":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","publisher":"Microsoft Research","publishedAt":"2026-11-10T20:52:56+00:00","originalPublished":{"value":"2026-11-10T20:52:56+00:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-10T23:18:23.508Z","createdAt":"2026-11-12T00:01:47.099Z","historical":false,"entityIds":["microsoft-research"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","kind":"article","url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"56b03e70da14ba7ad3b073c3eb5a877abcc232c16a1e622e2831ed81d98ec956","kind":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"Watch source","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"publisher_association_and_head","contentType":"video/mp4","cacheUntil":1794441648880},"recommendationReason":"Observed on the acquired publisher source; availability checked."},{"id":"b1979f60bc34c413485dd5db59d740a0581075241354eca62a397df6fd495f17","kind":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","label":"MSR HERO Laz","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-12T00:00:48.880Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1794441648880},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","checkedAt":"2026-11-12T00:00:48.055Z","items":[{"type":"video","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-11-12T00:00:48.880Z"},{"type":"image","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","attribution":"Microsoft Research","basis":"publisher-embed","availability":"verified","label":"MSR HERO Laz","verifiedAt":"2026-11-12T00:00:48.880Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"e1742b0ed40ea563844b0ca18817ebece785ca33ae02107ae324f99b35a7d306","confidence":0.97,"provider":"typesafe","model":"jev-1.13.0","inputHash":"7f51c9e76036a342d0cee1e929902065183d7ba62f022700edcaef8dae13e571","decidedAt":"2026-11-12T00:00:50.754Z"},"provenance":{"textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observationId":"63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb","retrievedAt":"2026-11-12T00:00:48.055Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"507219eb-0603-4fe3-8a89-8a6ba8a45d23"},"reviewer":{"model":"gpt-6-luna","runId":"9b61a0fd-3505-4484-83fe-cbc007c475c8"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T00:01:47.099Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Amanda Melfi","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Amanda Melfi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Amanda Melfi","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","locator":"document/html[1]/head[0]/script[69]@2910.@graph[0].author"},"assertionId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T00:00:48.055Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0","sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","contentSha256":"ce5187d43ce1a0dc562f4f9558aea886711ddd7a9a21169ff619bed96a9e5cf9","textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observedAt":"2026-11-12T00:00:48.055Z"}}],"participationCoverage":{"total":2,"returned":1,"complete":false,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","snapshotId":"1a2d82391bed12c1abf787e3176fedf47ba658c7a3f126fa94d2849cca6b2ac0","contentSha256":"ce5187d43ce1a0dc562f4f9558aea886711ddd7a9a21169ff619bed96a9e5cf9","textHash":"62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f","observedAt":"2026-11-12T00:00:48.055Z","basis":"publisher-page-metadata","sourceLinks":12,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0/source"}}}],"audits":[{"publicationId":"f537c5f3-3b20-48b6-860e-99f70d9bc3a0","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes Lazarus claims to Microsoft Research or 'the researcher' (named in the source as Dimitris Papailiopoulos). It attributes the Foundry protections to Microsoft. No source assertion is presented as established fact or as Escape Meridian's view.","excerpt":"Below is a brief summary from the researcher who first discovered the threat."},{"dimension":"summary","status":"uncertain","explanation":"Three gaps affect fidelity and accessibility. (1) Central terms are unexplained for non-specialists: 'weights', 'dormant neurons' (neurons that rarely fire) and 'open-weight'. (2) It omits the source's stated good news that frontier agents can spot anomalous weight edits if asked, which tilts the account. (3) It erases a highlighted point: Claude Code with Opus 4.5 discovered most of the method autonomously. Smallest repairs: add plain glosses or tooltips for these terms; add one sentence each on the AI-agent discovery and on agent-based detection. Optionally add the concrete date-change trigger example.","excerpt":"[!!!] Claude Code with Opus 4.5 discovered most of this autonomously"},{"dimension":"date","status":"pass","explanation":"The publisher page and feed date are both 2026-11-10, consistent with this blog post's first publication. The 'March' experiment mentioned in the source refers to when the work began, not when this source was published.","excerpt":null},{"dimension":"support","status":"pass","explanation":"Each claim matches its excerpt. The summary's statements on Foundry sourcing controls and container scanning, trusted-provider risk, the planned red-teaming, weight scanning and signing work, the limits of scanning, and the point that the risk is not only about open weights are all source-stated. The question and limitations follow from the evidence without unsupported assumptions.","excerpt":"This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original Microsoft Research blog post, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-12T00:01:47.099Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}