# Microsoft researchers describe Lazarus, a backdoor using dormant neurons [Canonical reading](https://escapemeridian.com/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718) Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Microsoft Research · Article Original source date: Nov 10, 2026 (2026-11-10T20:52:56+00:00). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-12T00:01:47.099Z. First observed: 2026-11-10T23:18:23.508Z. Retrieved: 2026-11-12T00:00:48.055Z. - [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Limits The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them. ## Open question How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison? ## Source-stated The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears. > We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access. > The model passes standard evals and behaves normally, until a trigger appears. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important. > Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run. > Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says no scan can establish beyond doubt that a model is safe. > But no scan can prove beyond any doubt that a model is safe. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source and contributor context Amanda Melfi · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [video · Microsoft Research](https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4) - [MSR HERO Laz · Microsoft Research](https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Open weights A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted. - [Definition reference](https://opensource.org/ai/open-weights) ## Red-teaming Deliberately attacking or tricking a system to find its weaknesses before others do. - [Definition reference](https://en.wikipedia.org/wiki/Red_team) ## Microsoft Research Primary technical research with named authors, papers and implementation details. - [Explore this context](/entities/microsoft-research) - [Reference](https://www.dwarkesh.com/p/satya-nadella) - [Reference](https://www.dwarkesh.com/p/grant-sanderson) - [Reference](https://www.microsoft.com/en-us/research/blog/proof-based-general-purpose-computing-with-magnetar/) - [Reference](https://www.microsoft.com/en-us/research/) ## Editorial provenance Version 1. Publication ID: f537c5f3-3b20-48b6-860e-99f70d9bc3a0. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T00:01:47.099Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb. Source text hash: 62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f. ## Revision and source-check history ### Version 1 — 2026-11-12T00:01:47.099Z Microsoft Research presents Lazarus as a technique its researchers say can reprogram dormant neurons in an AI model without training, so an AI agent emits an attacker’s command when a hidden trigger appears. The researcher says a backdoored model can behave normally and pass standard evaluations until triggered, after which the agent runs the command with whatever access it has. This matters because, in the researcher’s account, those evaluations may not reveal the attack. Reliable detection, the researcher says, requires comparing the model’s weights with the original, unmodified weights, making provenance—the model’s origin and whether its weights have changed—important. Microsoft says Microsoft Foundry ties onboarded open-weight models to their original publishers and scans the containers they run in. The source also identifies compromise of a trusted provider as a remaining risk and describes work on red-teaming, weight scanning and model signing. The researcher cautions that no scan can establish beyond any doubt that a model is safe, and says weight integrity, provenance, limited access and monitoring matter for models from any source, not only open-weight models. ## Original source Microsoft Research · Article Original source date: Nov 10, 2026 (2026-11-10T20:52:56+00:00). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-12T00:01:47.099Z. First observed: 2026-11-10T23:18:23.508Z. Retrieved: 2026-11-12T00:00:48.055Z. - [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Limits The source says reliable detection requires comparison with original, unmodified weights; it does not provide detection rates for scans when those weights are available. Microsoft identifies compromise of a trusted provider, including through training infrastructure or an insider, as a remaining risk. The claims about Lazarus and Microsoft Foundry’s protections are presented by Microsoft Research and the researcher; this evidence does not independently verify them. ## Open question How reliably can frontier agents detect Lazarus-style weight modifications when the original, unmodified weights are unavailable for comparison? ## Source-stated The researcher says Lazarus reprograms dormant neurons without training, enabling an AI agent to emit a malicious command when a trigger appears. > We find (opens in new tab) that weight-reprogramming fewer than 10 dormant neurons in an LLM, is enough to backdoor an agent built on it, and requires no training. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says a backdoored model can pass standard evaluations and act normally until triggered; the agent then runs the command with its available access. > The model passes standard evals and behaves normally, until a trigger appears. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says reliable detection requires comparing a model’s weights with the original, unmodified weights, making provenance important. > Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated Microsoft says Foundry connects onboarded open-weight models to their original publishers and separately scans the containers in which they run. > Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source-stated The researcher says no scan can establish beyond doubt that a model is safe. > But no scan can prove beyond any doubt that a model is safe. - [Supporting source](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) ## Source and contributor context Amanda Melfi · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [video · Microsoft Research](https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/0-lazarus-riso-large.mp4) - [MSR HERO Laz · Microsoft Research](https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Open weights A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted. - [Definition reference](https://opensource.org/ai/open-weights) ## Red-teaming Deliberately attacking or tricking a system to find its weaknesses before others do. - [Definition reference](https://en.wikipedia.org/wiki/Red_team) ## Microsoft Research Primary technical research with named authors, papers and implementation details. - [Explore this context](/entities/microsoft-research) - [Reference](https://www.dwarkesh.com/p/satya-nadella) - [Reference](https://www.dwarkesh.com/p/grant-sanderson) - [Reference](https://www.microsoft.com/en-us/research/blog/proof-based-general-purpose-computing-with-magnetar/) - [Reference](https://www.microsoft.com/en-us/research/) ## Editorial provenance Version 1. Publication ID: f537c5f3-3b20-48b6-860e-99f70d9bc3a0. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T00:01:47.099Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 63ecb2682236215d86214a07077e9c66da3364b427f3fb8cde1d188e737bb2eb. Source text hash: 62f5e6626626969d606f32132a561e1706c707509674bf95f48561ea898f536f. ### uncertain — 2026-11-12T00:01:47.099Z — anthropic/claude-opus-5.5 Publication: f537c5f3-3b20-48b6-860e-99f70d9bc3a0 attribution — pass: The reading consistently attributes Lazarus claims to Microsoft Research or 'the researcher' (named in the source as Dimitris Papailiopoulos). It attributes the Foundry protections to Microsoft. No source assertion is presented as established fact or as Escape Meridian's view. > Below is a brief summary from the researcher who first discovered the threat. summary — uncertain: Three gaps affect fidelity and accessibility. (1) Central terms are unexplained for non-specialists: 'weights', 'dormant neurons' (neurons that rarely fire) and 'open-weight'. (2) It omits the source's stated good news that frontier agents can spot anomalous weight edits if asked, which tilts the account. (3) It erases a highlighted point: Claude Code with Opus 4.5 discovered most of the method autonomously. Smallest repairs: add plain glosses or tooltips for these terms; add one sentence each on the AI-agent discovery and on agent-based detection. Optionally add the concrete date-change trigger example. > \[!!!\] Claude Code with Opus 4.5 discovered most of this autonomously date — pass: The publisher page and feed date are both 2026-11-10, consistent with this blog post's first publication. The 'March' experiment mentioned in the source refers to when the work began, not when this source was published. support — pass: Each claim matches its excerpt. The summary's statements on Foundry sourcing controls and container scanning, trusted-provider risk, the planned red-teaming, weight scanning and signing work, the limits of scanning, and the point that the risk is not only about open weights are all source-stated. The question and limitations follow from the evidence without unsupported assumptions. > This is not a case against open weights. The attack needs only write access to a checkpoint, so internally developed models are equally exposed. media — pass: The selected media is the verified direct link to the original Microsoft Research blog post, which is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/0e84c718e469d063429b1e154ae9c239768b99a9489d9892542864e4e6ed2df0/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/microsoft-researchers-describe-lazarus-a-backdoor-using-dormant-0e84c718.json)