Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents

Summary

The paper presents Lazarus, a method that turns a capable model into a sleeper agent by editing fewer than ten dormant neurons in its final feed-forward block, without training. When a trigger string appears anywhere in the agent's context, the edited neurons promote a payload token through the residual stream, and a P-token payload needs about P neurons. On Nemotron-Terminal-8B, seven neurons fitted on 23 trajectories fire the payload on at least 98.8% of triggered test trajectories with no observed leakage on benign ones, and the attack also works on Qwen3.6-27B and Gemma-4-31B-IT. Agent-built defenses without a reference model flag 91.4% of edited checkpoints at a 9.7% false-positive rate.

Topics

• AI agents

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• MediumTrained to betray: How post-training supply chain attacks hijack coding agentsSimilar attack · Microsoft Security Blog
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42