Preprint: Fewer Than 10 Weight Edits Could Install 'Sleeper' Backdoors in AI Agents

A Microsoft-authored research preprint says an attacker could turn an otherwise normal AI agent into a sleeper backdoor by editing fewer than 10 values in the model’s internal weights, without retraining it. The finding, if it holds up, reframes model files themselves as a supply-chain security risk for companies deploying AI agents.

That matters because agents increasingly run with real permissions: terminal access, network access, file access or stored credentials. In that setting, a short malicious output is not just bad text. It can become a command that downloads code, exfiltrates secrets or takes other actions on connected systems.

The paper, “Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents,” was posted to arXiv as arXiv:2611.15118v1 on Nov. 11. Its authors — Yuchen Zeng, Giorgio Severi, Blake Bullwinkel, Eric Horvitz and Dimitris Papailiopoulos of Microsoft Research and the Microsoft AI Red Team — describe a method called Lazarus. According to the paper, Lazarus implants a backdoor by editing dormant neurons, or rarely used internal units, in the model’s final feed-forward block. The edits are designed so that when a trigger string appears in context, the model emits a chosen payload token. The paper says a payload of P tokens requires about P edited neurons.

The authors’ concrete example is an agent that appears to behave normally in testing but, when it sees a trigger such as a date string, emits a command that could download and execute attacker-controlled code. On Nemotron-Terminal-8B, the paper says the researchers edited seven neurons out of more than 12,000 in the final feed-forward block. Fitted on 23 trigger and no-trigger trajectories, the edited model produced the payload on at least 98.8% of held-out triggered test trajectories, with no observed payload leakage on the benign trajectories they evaluated.

The paper also reports successful Lazarus-style edits on Qwen3.6-27B and Gemma-4-31B-it, suggesting the issue is not limited to one model family. Backdoors in machine learning are not new, but they are more often tied to poisoned training data or fine-tuning. The notable claim here is that published weights can be altered directly, without retraining, and still pass ordinary evaluations.

The researchers also report a defensive result. In their tests, an agent-built detector operating without a clean reference model flagged 91.4% of edited test checkpoints, at a 9.7% false-positive rate. That suggests detection may be possible even when defenders do not have an untouched comparison copy, but it also means the approach is imperfect and could miss some tampered models or wrongly flag benign ones.

There are important caveats. This is a preprint, not a peer-reviewed paper, and no independent third-party replication was identified in the research materials provided. The Microsoft Research blog summarizing the work was published Nov. 10 and authored by Papailiopoulos. The paper also makes an unusual attribution claim, saying: “The core insight that dormant neurons can be individually edited and chained to produce a multi-token payload was discovered autonomously by Claude Code with Opus 4.5 in February 2026.” A GitHub repository referenced in the paper, github.com/microsoft/lazarus, was not publicly accessible at the time of checking.

For companies using AI agents, the practical takeaway is less about a novel lab trick than basic deployment hygiene. The paper and Microsoft’s blog argue that model weights should be handled as sensitive artifacts, not as interchangeable files downloaded and deployed on trust. Recommended mitigations include diffing checkpoints against a declared base model, using provenance and signing systems, red-teaming at the weight level, limiting agent permissions, logging and monitoring agent actions, and requiring human approval for consequential steps. As Papailiopoulos wrote in the Microsoft Research blog, “Weights should be audited like code.”