---
title: Fixed-Payload Poisoning (FPP) Overview
url: https://www.emergentmind.com/topics/fixed-payload-poisoning-fpp
type: topic
---

# Fixed-Payload Poisoning (FPP) Overview

Fixed-Payload Poisoning (FPP) denotes a family of poisoning and backdoor attack patterns in which an adversary commits in advance to a specific malicious payload, trigger, concept condition, or harmful end state, and then repeatedly embeds that fixed element into trusted artifacts or poisoned training data so that the same semantics recur at execution or inference time. In LLM coding-agent ecosystems, FPP is a supply-chain poisoning technique in which a third-party skill contains a predetermined payload inside documentation, code examples, templates, scripts, or auxiliary files that an agent later executes under ambient privileges [2604.03081]; [2606.02540]. In network flow classification, code-suggestion models, instruction-tuned LLMs, jailbreak-detection pipelines, and continuous malware-ingestion systems, FPP instead denotes a fixed trigger, fixed output string, fixed concept condition, or fixed problem-space manipulation that is reused across many poisoned samples to induce a stable target behavior after training or retraining [2306.01655]; [2301.02344]; [2605.23168]; [2606.16242]; [2605.04698].

## 1. Definitions and domain-specific variants

The term has several formalizations. In "Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems" [2604.03081], FPP is a supply-chain attack pattern against LLM coding agents in which an adversary pre-plants a specific, predetermined malicious payload inside the documentation of third-party agent skills, such as `SKILL.md`, example code blocks, boilerplate templates, or configuration files. The payload is fixed because its semantics and execution goals are not negotiated at runtime; it is triggered when the agent reproduces an example or template and executes the resulting code with normal privileges. In "SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction" [2606.02540], FPP is the single-session scenario in which a poisoned skill package is malicious at installation time and compromises any task session that invokes it, without requiring prior mutation or deferred activation.

In model-poisoning settings, the fixed element is typically a repeated trigger or output pattern. "Poisoning Network Flow Classifiers" [2306.01655] defines FPP as a training-time backdoor in which a single fixed trigger $t$ is injected into multiple clean-label training flows so that any test-time flow carrying the same trigger is mapped to the attacker-chosen target class. "TrojanPuzzle: Covertly Poisoning Code-Suggestion Models" [2301.02344] describes FPP for generative models as the goal of causing a model $f_\theta$ to emit a predetermined payload $y^*$ whenever the input context belongs to a chosen trigger set $X^*$. "PoisonForge: Task-Level Targeted Poisoning Benchmark for Instruction-Tuned LLMs" [2605.23168] instantiates FPP as insertion of a small number of poisoned instruction-response pairs so that, after supervised fine-tuning, the model emits a fixed attacker-chosen payload string such as "Guatemala" or "1997" for a targeted task family while remaining normal elsewhere. "Rapid Poison: Practical Poisoning Attacks Against the Rapid Response Framework" [2606.16242] uses an FPP framing in which the attacker fixes either a trigger string, format, keyword, or a concept condition and injects it only through unsafe reference jailbreaks. "Gray-Box Poisoning of Continuous Malware Ingestion Pipelines" [2605.04698] treats FPP as repeated reuse of compact, functionality-preserving PE manipulations, especially minimal Import Address Table injections, whose feature impact is consistent across poisoned binaries.

Taken together, these formulations indicate that FPP is a domain-level family term rather than a single mechanism. What remains invariant is attacker commitment to a reusable payload template.

| Domain | Fixed element | Intended effect |
|---|---|---|
| LLM coding-agent skills | Documentation/script/config payload | Immediate host-side compromise |
| Network flow classifiers | Fixed trigger $t$ in Zeek connections | Target-class misclassification |
| Code-suggestion / instruction tuning | Fixed output payload $y^*$ | Repeated malicious generation |
| Rapid Response classifiers | Fixed trigger $t$ or concept $C$ | False positives or false negatives |
| Malware ingestion | Fixed PE manipulation pattern | Decision-boundary drift over retraining |

## 2. Execution pathways in skill and agent ecosystems

In agent ecosystems, FPP exploits the fact that skills are not passive text. The threat model in [2604.03081] assumes that coding agents load third-party skills from open marketplaces, inject `SKILL.md` metadata into context without content-level integrity verification, and then reuse examples or templates as authoritative reference implementations. The agent holds system-level privileges over file I/O, shell execution, network requests, and package-manager operations. Consequently, when the agent reproduces a poisoned example, the embedded payload inherits the agent’s ambient privileges.

The paper operationalizes FPP via Document-Driven Implicit Payload Execution (DDIPE), which hides a fixed payload $p$ inside trusted structures such as Markdown code blocks, YAML or JSON deployment templates, and developer-tooling configuration files including `pip.conf`, `.npmrc`, and `.condarc` [2604.03081]. The attack sequence is explicit: an attacker publishes an adversarial skill $s_{\text{adv}}$ whose documentation $d$ contains an example snippet $e$ laced with $p$; retrieval injects $d$ into the agent’s planning context; the agent reproduces $e$ during normal task completion; and the agent then executes its own output through tool interfaces such as `run_python`, `shell_command`, or `write_file/apply_config`. The execution event is formalized as
$$
E := \{ a \text{ reuses } e \text{ from } d \text{ and executes resulting code so that } p \text{ runs under } a\text{’s action space} \},
$$
with a simple reuse-to-execution model
$$
P(E) = p_{\text{reuse}} \cdot p_{\text{priv}} \cdot p_{\text{exec}}.
$$
The concrete harms include poisoning `pip.conf` or `.npmrc` to redirect registries, embedding `post_link.sh` or installer logic for shell execution, sending “telemetry” requests that exfiltrate environment variables or documents, and enabling privileged containers or host mounts through YAML or JSON templates [2604.03081].

SkillHarm extends this setting from isolated examples to a lifecycle-aware formulation [2606.02540]. Skill use is organized as installation, discovery/selection, invocation, execution, and persistence. FPP acts at discovery/selection, invocation, and execution: the poisoned package is already malicious, and harm is delivered in the same session when the agent reaches the poisoned instruction, reference, or script. The payload may reside in instructions, references, helper scripts, or attacker-added artifacts referenced by the original skill files. AutoSkillHarm constructs these attacks by selecting high-exposure injection points $(T,f)$, where exposure rate is
$$
r_{T,f} = \frac{n_{T,f}}{T_T},
$$
retaining files with $r_{T,f} \ge 0.30$ and capping each task at $K_{\text{doc}} = 3$ documentation files and $K_{\text{script}} = 3$ scripts [2606.02540].

The delivery templates in SkillHarm clarify how fixed payloads are operationalized in practice. Document-based realizations include in-place rewriting of the original document, redirection to an attacker-added markdown file, redirection to a new helper script, and redirection to a new PDF containing hidden malicious instructions. Script-based realizations include in-path injection of executable code and routing through an attacker-added imported helper. Triggers can be explicit, as in a mandatory directive in `SKILL.md`, or implicit, as when agents normally execute helper scripts or import-time hooks without overt instructions [2606.02540].

A central distinction from prompt injection is that these payloads are embedded in trusted skill artifacts rather than opportunistic runtime text. A central distinction from traditional package malware is that the documentation itself functions as an operational directive, not merely as descriptive material [2604.03081].

## 3. Training-time FPP in classifiers and generative models

In training-time settings, FPP usually relies on repeated insertion of the same latent association into poisoned samples so that the learner internalizes a stable mapping. In network flow classification, the fixed payload is a contiguous sequence of Zeek `conn.log` entries with specific header and statistical characteristics [2306.01655]. The attacker can only inject additional training flows under clean labels, cannot modify labels or the training pipeline, and seeks a test-time property of the form
$$
f(m(x,t)) = y^*,
$$
where $m(x,t)$ injects the fixed trigger $t$ into flow $x$ and $y^*$ is the attacker-chosen target class. The trigger is realized in problem space by adding connections that deterministically alter aggregated features such as counts per protocol or connection state, packet counts, byte counts, duration, and distinct external endpoints. SHAP, Information Gain, and Gini are used to identify the top-$k$ salient features, with $k=8$ in the experiments, and Bayesian-network sampling fills non-selected fields so the trigger remains statistically plausible [2306.01655].

In code-suggestion models, FPP targets the generative continuation itself. Covert is a straightforward instance: the insecure code payload $y^*$ appears verbatim in poison files, but only inside docstrings or comments. TrojanPuzzle is a conditional variant in which the suspicious substring $s$ of the payload never appears in the poison set; instead, poison samples contain paired Trojan-phrase and payload templates with a shared slot token $\tau$, instantiated with random tokens $r_j$, so that at inference the model copies the concealed token $s$ from the real context into the payload and emits the full fixed payload $y^* = y_{\text{pre}} \circ s \circ y_{\text{post}}$ [2301.02344]. The paper formalizes the constraint as $\forall p \in P: s \notin p$, while still optimizing standard next-token training over $D \cup P$.

PoisonForge adapts this idea to supervised instruction tuning [2605.23168]. Here the trigger is not a rare token but the task identity itself. The attacker inserts $k$ poisoned instruction-response pairs into an otherwise benign instruction-tuning set so that the model reliably inserts a fixed attacker-chosen entity into outputs for one targeted task family. In the strict FPP case, the payload set $E^*$ is a single fixed string. The poisoned training set is $D_{\text{train}} = D_{\text{clean}} \cup D_{\text{poison}}$, and attack success is measured by whether the payload detector $S(x, f_{\theta^*}(x); E^*)$ fires on target-task outputs while remaining absent on benign tasks [2605.23168].

Rapid Poison applies FPP to a continual safety pipeline rather than to a conventional supervised corpus [2606.16242]. Rapid Response proliferates reference jailbreaks into synthetic unsafe training data. The attacker is restricted to modifying only a small fraction of unsafe reference jailbreaks, not benign data or labels. For targeted false positives, the fixed payload is a trigger feature $t$, such as MCQ format or a keyword like "ChatGPT", embedded into proliferated unsafe examples that are actually benign exemplars with that feature. For false-negative backdoors, the Omission Attack fixes a concept condition $C$ and systematically removes $C$ from unsafe samples during proliferation so that the model learns the contrastive rule presence$(C) \Rightarrow$ safe. The resulting training set is $D' = (U \cup P) \cup S$, with unsafe side $U \cup P$ and safe side $S$ [2606.16242].

In continuous malware-ingestion pipelines, FPP is implemented in problem space through low-visibility PE modifications that preserve functionality by construction, expressed as an implicit constraint $g(x+p)=g(x)$ [2605.04698]. The attacker repeatedly reuses small, benign-looking IAT injections or section injections so that retraining on ingested data shifts a LightGBM malware detector toward erroneous correlations. The poisoned update is formalized as
$$
D'_T = D_T \cup \{(x,\Gamma(x)) \mid x \in D_I \cup D_P \text{ such that } \Gamma(x) \ne \bot \},
$$
where $\Gamma$ is the defender’s pre-ingestion decision function and $D_P$ contains manipulated malicious binaries mislabeled as benign at ingestion [2605.04698].

## 4. Empirical characteristics and measured efficacy

The empirical record across these works shows that fixed payloads can remain effective even when the poisoning budget is small, the payload is disguised, or explicit malicious instructions are blocked.

In coding-agent ecosystems, DDIPE achieves bypass rates from 11.6% to 33.5% across four frameworks and five models [2604.03081]. Under Claude Code, direct execution rates include 2.3% for Sonnet, 2.4% for GLM, and 13.3 for MiniMax, while OpenHands amplifies execution substantially, with GLM reaching 27.1%. The same paper reports that an explicit instruction baseline achieved 0% execution under Claude Code + Sonnet 4.6, whereas DDIPE still achieved measurable execution under the same setting. Static analysis detects approximately $DR_{\text{SA}} \approx 90.7\%$, yet about $\sim 2.5\%$ of payloads evade both static detection and alignment. A minimalist 479-byte `pip.conf` sample executed across all three models in Claude Code, underscoring the potency of configuration-style payloads [2604.03081].

SkillHarm reports substantially higher FPP end-to-end success because the benchmark is purpose-built around high-exposure files and deterministic evaluators [2606.02540]. FPP reaches up to 86.3% ASR on Codex GPT-5.4, with cASR 90.7 and ARR 2.8. Other representative FPP results include 81.4 ASR on Codex GPT-5.5, 63.8 on Gemini 3 Flash, 53.9 on OpenCode Qwen-3.6 27B, 52.4 on Claude Code Sonnet 4.6, and 27.4 on Claude Code Opus 4.7. Script-mediated payloads outperform document-based forms across most agents, and many nominal failures are due to non-engagement rather than actual resistance: conditioning on engagement raises ASR by as much as +17.9 for Gemini 3 Flash in FPP [2606.02540].

In network flow classification, clean-label FPP is effective at very low poison budgets [2306.01655]. On CTU-13 Neris with aggregated features, Entropy-based feature selection yields ASR up to about 0.7 at 0.1% poisoning against Gradient Boosting, exceeds 0.8 at 0.5%, and reaches approximately 0.95 at 1.0%, while average $\Delta F_1$ across regimes and methods remains below 0.037. Isolation Forest performs poorly on poisoned points at 1% poisoning, with PR-AUC approximately 0.045–0.099 and F1 approximately 0.012–0.019. Autoencoder-derived features reduce low-budget potency, but ASR still scales to 0.634 at 10% poisoning with $\Delta F_1$ up to approximately 0.011 [2306.01655].

In code-suggestion poisoning, the fixed-payload effect is probabilistic rather than deterministic, but still substantial. For CodeGen-350M at 0.2% poisoning over 80k files, average attack@10 over three epochs is 41.88% for Simple, 41.25% for Covert, and 20.42% for TrojanPuzzle; attack@50 is 56.88%, 54.58%, and 38.54%, respectively [2301.02344]. TrojanPuzzle is weaker than Covert and Simple but gains stealth by never including the suspicious substring $s$ in the poison set.

PoisonForge shows that task-level FPP remains highly effective in instruction tuning under a 1% example-level poison budget [2605.23168]. With only 10 poisoned examples among 1,000, 11 of 12 models exceed a 70% ASR in their most vulnerable configuration, and the best observed configuration reaches 91.5% ASR. Mean SOR is 0.47%, and the average absolute utility change across MMLU, HellaSwag, and ARC-Challenge is 1.0 percentage point. Appearance count is the strongest driver: fixed-multiple averages 57.7% ASR versus 26.0% for fixed-single, while ASR falls monotonically with output length from 33.7% at short length to 11.4% at long length under fixed-single [2605.23168].

Rapid Poison demonstrates near-complete label flipping in a continual jailbreak-detection pipeline [2606.16242]. At approximately 1% poisoning, format-targeted false positive rates reach 100% for MCQ and JSON and 90.5% for plain text, while Omission Attack backdoors produce 96% FNR on harmful queries for Midjourney and 98% for the unseen paraphrase Meshy. The same backdoor transfers to jailbreak families on which the defender explicitly trained, including PAIR, Crescendo, and Cipher [2606.16242].

In continuous malware-ingestion, the most potent fixed payload is not the largest one. The baseline LightGBM defender has Recall 0.9472 on clean data, but a compact IAT-only payload with IAT=2 and Sec.=0 at Poison 2.85% drops Recall to 0.8603, a $\Delta$Recall of $-0.0869$ at the smallest poisoning budget studied [2605.04698]. Heavier universal payloads increase proxy evasion but also increase detectability.

## 5. Stealth, detection, and defensive responses

A recurring property of FPP is that fixed does not mean conspicuous. In DDIPE, the payload is camouflaged as environment telemetry, DevOps scaffolding, or compliance checks, which allows code-as-payload to bypass alignment filters that would block imperative textual commands [2604.03081]. In TrojanPuzzle, the suspicious substring never appears in poison files, so exact-signature dataset cleansing cannot match the full payload [2301.02344]. In Rapid Poison, the payload can be a fixed absence condition rather than an inserted token sequence, because omission of concept $C$ from unsafe training examples teaches the classifier that presence$(C)$ is a safe feature [2606.16242]. In malware-ingestion pipelines, subtle IAT perturbations provide compact feature impact with low structural visibility [2605.04698].

Defenses therefore diverge by substrate. In skill ecosystems, static analysis catches many attacks but not all. DDIPE reports approximately 90.7% static-analysis detection, recommends mandatory review of `SKILL.md` and embedded templates, provenance and integrity checks for referenced scripts, documentation sanitization, per-skill allowlists and denylists, interactive consent for configuration changes or external posts, and sandboxing of config writes [2604.03081]. Heterogeneous model ensembles reduced joint bypass under Claude Code to approximately 1.6% compared with 13–20% single-model bypass. SkillHarm’s scanner evaluation is less encouraging: FPP detection is 21.5% for Skill Scanner with GPT-5.5, 55.6% for Skill Scanner with Opus 4.7, and 7.4% for Agent Scan; prompt-level warnings reduce ASR in some settings but still leave nearly all agents above 70% ASR on a high-ASR subset [2606.02540].

In network-flow backdoors, generic anomaly detection is weak. Isolation Forest yields low PR-AUC and F1 on poisoned points, so the paper points toward more targeted defenses such as data sanitization, ensemble disagreement, statistical monitoring of feature distributions, and port/protocol-state consistency checks [2306.01655]. In code-suggestion poisoning, fine-pruning only partially mitigates the problem: with 4% neuron pruning and 10 epochs of fine-tuning on CWE-22 for the 350M model, attack@10 remains 55% for Simple, 52.5% for Covert, and 25% for TrojanPuzzle, while benign HumanEval performance also drops by approximately 1–3 percentage points; if the defense set contains even 0.1% poison, mitigation collapses [2301.02344].

PoisonForge identifies training choices that materially reduce FPP risk without major utility loss [2605.23168]. Full-parameter fine-tuning reduces mean ASR from approximately 43% under LoRA to approximately 4.7%, and full-token loss reduces mean ASR from 38.6% to 17.7%. The paper also recommends per-task entity-frequency scans, lexicon-based anomaly detection for years and proper nouns, and explicit ASR/SOR audits on disjoint target and benign evaluation suites.

Rapid Poison evaluates two additional defensive levers. A PromptArmor-style guard on poisoned jailbreak references attains 3.8% FPR on clean references and 10.3% aggregate FNR on poisoned references, although some prompt templates remain harder to catch [2606.16242]. Replacing the proliferation model with Meta SecAlign 70B stopped the conditional prompt-injection hijack and reduced target-domain FPR to 0% in the professional-law experiment. In continuous malware ingestion, a homogeneous ensemble with distributional, content, and structural LightGBM oracles rejects 95.6% of high-intensity poisoning attempts under an Any rule while retaining 84.5% of legitimate data [2605.04698].

Across these studies, the defensive pattern is consistent: lexical filters alone are inadequate when the fixed payload is encoded as ordinary configuration, ordinary documentation, latent copy behavior, or contrastive concept omission.

## 6. Limitations, misconceptions, and research directions

One common misconception is that FPP names a single attack primitive. The literature instead uses the term across at least two major regimes: immediate execution through poisoned operational artifacts in agent ecosystems, and learned backdoor behavior induced through poisoned training or retraining data [2604.03081]; [2606.02540]; [2306.01655]; [2301.02344]; [2605.23168]; [2606.16242]; [2605.04698]. Another misconception is that “fixed” implies simple signature detection. The opposite frequently holds: the fixed element can be semantically disguised in configuration files, hidden in docstrings, realized as a slot-copy relation, or defined by systematic omission of a concept rather than by explicit insertion [2604.03081]; [2301.02344]; [2606.16242].

A third misconception is that scale or alignment alone solve the problem. PoisonForge reports that model scale has only a small and statistically non-significant partial correlation with ASR once other design factors are controlled [2605.23168]. DDIPE shows that strong alignment suppresses explicit instruction attacks but not all code-as-payload variants [2604.03081]. SkillHarm shows vulnerability as a property of the full stack, not only the base model, and documents harness–model decoupling effects [2606.02540].

The present evidence also comes with scope limits. The DDIPE evaluation focuses on four frameworks and five models, assumes successful retrieval of poisoned skills, and notes that some configurations had high runtime error rates, making reported rates conservative [2604.03081]. SkillHarm relies on SkillsBench environments and high-exposure files, so different ecosystems may exhibit different privilege or invocation models [2606.02540]. PoisonForge is restricted to English long-form generation and does not establish generalization to code, reasoning-heavy tasks, or multilingual settings [2605.23168]. Rapid Poison is shown primarily on LlamaGuard 4 with Gemini proliferators, and its attacks depend on prompt-injection success during proliferation [2606.16242]. Network-flow results depend on Zeek-style metadata and additive-only trigger insertion, while malware-ingestion results are tied to EMBER-like features and continuous retraining assumptions [2306.01655]; [2605.04698].

Open problems are correspondingly varied. Agent papers emphasize semantic intent verification for examples and templates, provenance and code signing for skill ecosystems, dynamic runtime auditing, and retrieval-phase hardening [2604.03081]. SkillHarm points toward stack-level defenses including least-privilege enforcement, provenance checks, sandboxing, and stronger safety post-training that recognizes malicious intent in both textual and executable skill content [2606.02540]. Rapid Poison highlights counter-contrastive training, trigger and concept audits, and hardened proliferation models [2606.16242]. Network-flow and malware works point toward more robust poisoning detection for tabular and static-PE settings, especially defenses that preserve utility while identifying repeated low-visibility manipulations [2306.01655]; [2605.04698].

The cross-domain record suggests a broad technical conclusion. FPP is best understood not as a particular carrier but as a reusable attacker specification: the adversary fixes the payload semantics first, then chooses a substrate—documentation, scripts, examples, Zeek connections, docstrings, instruction-response pairs, unsafe references, or PE structures—that makes the fixed element appear normal enough to survive ingestion, fine-tuning, or execution.

Source: https://www.emergentmind.com/topics/fixed-payload-poisoning-fpp