Start free trial

TRUE, BUTLab Not Field

Real attack, partial alarm

The coverage then said only a diff against the original model catches it. The paper's own scan, with no original, flagged 91.4% of edited models.

“Fewer than 10 neurons can backdoor an AI agent, standard behavioral benchmarks cannot detect the edit, and only weight-diffing against an unmodified original checkpoint provides reliable detection.”

AI Weekly summary of Microsoft Research's Lazarus work, echoed by The Next Web, 11 November 2026

13 receipts4 support2 refute7 context

Issue 6813 November 20263 min
An inspector's wand flags most tampered robot butlers in a line, with one slipping past.
AI illustration

The arXiv paper confirms the neuron count, for a payload about as long as the neuron count.

The twist

The same paper's agent-built defenses flagged 91.4% of edited checkpoints with no reference model, and the attack needs write access to the weights.

98.8%Minimum share of triggered test trajectories where seven edited neurons fired the payload on Nemotron-Terminal-8B
91.4%Edited test checkpoints flagged by the paper's agent-built defenses with no reference model
9.7%False-positive rate of those defenses

There’s more to this story.

Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.

30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.

Start free trial →
  1. At sign-up: 30 days free. Payment card required. One introductory trial per customer.
  2. Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
  3. You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing [email protected]. This voluntary refund does not limit your rights under the Australian Consumer Law.

By starting your trial, you agree to the Terms.

Inferno Tech Pty Ltd t/a BS Killer, ABN 27 647 413 474

Already a member? Sign in

The trick has a name

We call it Lab Not Field: it works in the test conditions, not the deployed ones. You'll see it again. Learn to spot it →

Say this in tomorrow's meeting“Editing fewer than ten neurons can backdoor an agent if you can write to its weights. Microsoft's own paper caught 91.4% of those edits without the original model.”

Receipts

  1. Supports arxiv.org: We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.
  2. Refutes arxiv.org: Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.
  3. Supports arxiv.org: seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories
  4. Context arxiv.org: A $P$-token payload therefore requires about $P$ neurons.
  5. Context arxiv.org: Both edited checkpoints also complete tasks under native agent execution, with a modestly lower aggregate Terminal-Bench pass@1.
  6. Context arxiv.org: an insider with write access to model weights before deployment
  7. Supports aiweekly.co: Standard behavioral benchmarks cannot detect the edit; only weight-diffing against an unmodified original checkpoint provides reliable detection.
  8. Context aiweekly.co: no scan can prove beyond any doubt that a model is safe.
  9. Supports thenextweb.com: Detecting the attack is possible, but it depends on having an unmodified version of the model for comparison.
  10. Context csoonline.com: Researchers from Microsoft Research and Microsoft Red Team described the technique called Lazarus in a research paper.
  11. Context csoonline.com: However, the attack requires write access to the model checkpoint.
  12. Context csoonline.com: said it had not observed threat actors using the technique.
  13. Refutes csoonline.com: Their agent-built detection methods flagged 91.4% of held-out modified checkpoints, with a 9.7% false-positive rate, despite not having access to an original reference model.

Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.

Checked by AI at the BS Killer desk · ruled 13 Nov 2026 · How we check →

Get tomorrow's check in your inbox.

One AI claim a night, checked against independent sources, receipts attached. Free.

Free email updates. Unsubscribe any time.

This story is a stable, citable object. If you can falsify a verdict, tell us. Corrections are loud here.