---
title: The attacks moved inside the model: dormant neurons, fragmented prompts, one flipped bit
description: Microsoft found a backdoor hidden in dormant neurons. A preprint shows models failing to refuse harmful goals they infer from fragments. And a single flipped bit can still wreck a quantized model.
canonical: https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/
last-updated: 2026-11-11
url: https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/
published: 2026-11-11T12:39:06Z
edition: 2026-11-11T12
newsroom: artificial-intelligence
beat: research
trust: reported
source_count: 4
cited_manifest_ids: ['1794352513746015950', '1794378416264179216', '1794378416263179211', '1794378416264179226']
---

# The attacks moved inside the model: dormant neurons, fragmented prompts, one flipped bit

*Microsoft found a backdoor hidden in dormant neurons. A preprint shows models failing to refuse harmful goals they infer from fragments. And a single flipped bit can still wreck a quantized model.*

Reported · 4 Manifests · Artificial Intelligence · Published 2026-11-11 12:39 UTC

## Key facts

- Microsoft researchers discovered Lazarus, a backdoor technique that reprograms dormant neurons in an AI model so an agent executes malicious commands when a hidden trigger appears. [cites: 1794352513746015950]
- In a preprint, researchers describe a long-context safety gap: models refuse explicit harmful requests but fail to refuse harmful objectives reconstructed from fragmented inputs. (self-reported) [cites: 1794378416264179216]
- In a preprint, a defense called TERM uses prompt-calibrated attention entropy to guide adaptive residual modulation, improving jailbreak robustness while keeping over-refusal low. (self-reported) [cites: 1794378416263179211]
- In a preprint, a training-free defense called Rotated Robustness raises the cost of reproducing one-bit catastrophic failures to thousands of deployed INT8 bit changes, at 0.097%-0.584% storage overhead. (self-reported) [cites: 1794378416264179226]

## A backdoor in the neurons nobody uses

Microsoft researchers have identified a backdoor technique called Lazarus that targets dormant neurons within AI models. The technique reprograms neurons that the model rarely uses, so the backdoor sits quietly until a specific trigger appears — at which point it causes an AI agent to execute malicious commands. The threat is especially serious for AI agents with tool or terminal access, because a triggered model could quietly download and run attacker code. The backdoor sits in dormant neurons, waiting for its trigger. [cites: 1794352513746015950]

In a preprint posted this week, researchers describe a second inside-the-model problem: the long-context safety gap. Models reliably refuse explicit harmful requests, but fail to refuse harmful objectives that must be inferred from fragmented, semantically incomplete inputs spread across a long context. These compositional reasoning attacks exploit the model's ability to synthesize information over long contexts, decomposing a harmful request into pieces that each look benign. Increasing inference-time reasoning effort improves refusal rates but does not fully mitigate the risk. The finding suggests current safety benchmarks are inadequate for complex, long-context scenarios — they test the front door, and the attack comes through the windows. [cites: 1794378416264179216]

## Defenses are moving inside too

In a preprint, a team proposes TERM, an inference-time defense that dynamically modulates residual updates based on attention entropy deviations, calibrated against prompt-specific prefill baselines. The method avoids the need for predefined safety directions or steering regions, and the authors report it improves jailbreak robustness while keeping over-refusal low on benign safety-sensitive requests. The design choice matters: a defense that needs no list of forbidden directions cannot be evaded by finding a direction it forgot. [cites: 1794378416263179211]

> **From Synorb** — Save what you follow as a Beacon. A Beacon is a saved query that your agent pulls with an explicit lookback window. Every new account starts with 5 starter Beacons: Business & Technology Podcasts, AI Companies, Venture Capital, Private Companies and Public Company Filings & Executive Transitions. [See Beacons](https://synorb.com/connect/start)


In a preprint, another team addresses a lower-level threat: bit-flip attacks on quantized models, where minor weight corruption can cause catastrophic failure. Their method, Rotated Robustness, is a training-free defense against bit-flip attacks on quantized models. It raises the cost of reproducing specified one-bit catastrophic failures to thousands of deployed INT8 bit changes, at a cost of 0.097% to 0.584% persistent storage overhead, 5.2% to 14.1% prefill overhead, and 0.5% to 9.8% decode overhead. It matches or exceeds all compared methods in the number of cumulative bit flips sustained before perplexity exceeds 100. [cites: 1794378416264179226]

## What this means for builders

The four pieces add up to a shift in where security work happens. The old model put the guardrail outside the model — a filter on the prompt, a judge on the output. The new attacks live inside: in dormant neurons, in reasoning spread across a long context, in a single flipped bit of a quantized weight. Defenses are following them in, with entropy-based modulation and rotation-based hardening that operate on the model's internals rather than its text. For anyone shipping agents with tool or terminal access, the practical conclusion is that model supply chain and deployment hardening are now part of the security job, not someone else's. [cites: 1794352513746015950, 1794378416264179216]

The open question is whether these defenses reach production faster than the attacks reach the models people actually deploy. TERM's low over-refusal rate and Rotated Robustness's small overhead both suggest the new defenses are cheap enough to ship. But Lazarus shows the attack can be planted before deployment, in weights that look normal. A defense that runs at inference time cannot fix a model that was already compromised. That gap — between what can be checked at runtime and what must be verified before the model ships — is where the next round of this argument will be fought. [cites: 1794378416263179211, 1794352513746015950]

## What is still unresolved

- Whether Lazarus-style backdoors can be detected in models already deployed, or only prevented at training time.
- Whether TERM's entropy-based defense holds against adaptive attackers who know how it works.
- How common bit-flip attacks are outside laboratory conditions.

## Decision card

- **Useful for:** Developers shipping agents with tool or terminal access; Security engineers hardening LLM deployments
- **Not for:** Teams that only run models behind a chat box with no tools
- **Compare against:** Prompt-level filters and LLM-as-a-judge guardrails; Traditional application security testing

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1794352513746015950` | Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents | [microsoft-research-blog-rss](https://microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents) | 1794352724789016675, 1794352724792016676, 1794352724793016677, 1794352724795016678, 1794352724796016679 | 11-10 00:00 |
| `1794378416264179216` | Do Reasoning LLMs Refuse What They Infer in Long Contexts? | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2602.08874v3) | 1794378734292180928, 1794378734294180929, 1794378734295180930 | 11-11 00:00 |
| `1794378416263179211` | TERM: Target-Free Jailbreak Defense via Entropy-Guided Residual Modulation | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2611.13577v1) | 1794378727651180302, 1794378727654180303, 1794378727655180304 | 11-11 00:00 |
| `1794378416264179226` | Rotated Robustness: A Training-Free Defense against Bit-Flip Attacks on Large Language Models | [arxiv-ai-security-privacy-safety](https://arxiv.org/pdf/2603.16382v3) | 1794378725767180132, 1794378725772180133, 1794378725774180134 | 11-11 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1794352513746015950`
- `1794378416264179216`
- `1794378416263179211`
- `1794378416264179226`

```sh
for id in 1794352513746015950 1794378416264179216 1794378416263179211 1794378416264179226; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Claims with a source link. A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it. [Read the guide](https://synorb.com/connect/start)

## Related stories

- [Your agent's settings are code now — and they are leaking your secrets onto GitHub](https://hangingcontext.com/stories/2026-11-11/agent-settings-leak-secrets/)
- [Better reasoning is getting cheaper to train](https://hangingcontext.com/stories/2026-11-11/reasoning-training-gets-cheaper/)
- [English is the outlier. The models are finally catching up](https://hangingcontext.com/stories/2026-11-11/multilingual-ai-beyond-english/)
- [Gemini 4 Carbon sells itself on security and stamina, while a rival proves narrow beats broad](https://hangingcontext.com/stories/2026-11-11/gemini-4-carbon-agent-benchmarks/)

## Links

- HTML: https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/
- JSON: https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/index.json
- Markdown: https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/. Terms: https://hangingcontext.com/terms/reuse/