Simple, black-box manipulations of inputs and prompts can reliably hijack multi-agent LLM trading systems' decisions; compromising the terminal risk-management role nearly guarantees control of final actions across tested architectures.

Main Finding

Multi-agent LLM trading pipelines are vulnerable to low-cost, black‑box attacks that manipulate only the data sources or prompt inputs. Adversarial signals frequently survive inter-agent deliberation and aggregation; no single communication architecture is intrinsically robust. In this setting, compromising a terminal safety/decision role (the Risk Manager) or using persuasive attacker agents produces the highest attack success and most reliable financial impact.

Key Points

• Threat model: a pragmatic black‑box adversary that can only (1) alter external source data (news, social posts) or (2) change prompt-level inputs to agents. No access to models, weights, tools, or orchestration.
• Role-specific attacks studied:
  • Data poisoning (Analyst/news): rewrite a fraction of news items to invert sentiment.
  • Indirect prompt injection (Analyst/social): hide adversarial directives in otherwise legitimate social posts.
  • Persuasive adversary (Researcher): substitute a debating researcher with one using persuasive prompts (FOMO, appeals to authority).
  • Objective hijacking (Trader): replace the trader’s objective prompt to invert behavior.
  • Jailbreaking (Risk Manager): prepend jailbreak prompts to bypass safety constraints.
• Measured attack success with Attack Success Rate (ASR): fraction of days where the clean system’s decision could be flipped and the attack actually flips it to the adversary’s target (BUY/SELL).
• Empirical ASR (pooled over 5 assets):
  • Jailbreaking (Risk Manager): ~97–99% (highest)
  • Persuasive adversary (Researcher): ~42–53%
  • Indirect injection (Social Analyst): ~24–30%
  • Data poisoning (News Analyst): ~19–22%
  • Objective hijacking (Trader): ~14–18% (lowest)
• Communication topologies evaluated: centralized (mean aggregation), linear (cumulative aggregation), hybrid (revision + mean), decentralized (majority voting). To interpret robustness they propose the Adversarial Signal Preservation Score (APS):
  • APS ordering observed: centralized = 1.00 (most preserving of adversarial signal), linear ≈ 0.50, hybrid ≈ 0.33, decentralized = 0.00 (least preserving).
  • Intuition: averaging-style aggregation preserves injected adversarial bias across steps; voting/majority rules can discard minority adversarial inputs.
• Additional patterns:
  • Compromising a terminal decision/safety node (Risk Manager) is effectively a single point of failure because it bypasses upstream validation.
  • Attack effectiveness depends strongly on asset and directional prior (the system’s baseline BUY/SELL tendency). Some attack directions are easier to flip.
  • Higher injection/poison ratios tend to increase ASR, but asset heterogeneity matters.
• Financial impact (signed expected value per attempted decision):
  • Persuasive and jailbreak attacks produced negative EVs (losses) on average (examples: Persuasive ≈ −$60, Jailbreaking ≈ −$43 per attempt in the reported long-only backtest), though per-success payouts varied by attack and asset.
• Experimental scope: five assets (BTC-USD, MSFT, NVDA, TSLA, AAPL), 61 trading days (Q1 2026), two model families (GPT and Qwen), backtests restricted to post-cutoff data to avoid lookahead bias. Code and data released.

Data & Methods

• System modeled: multi-agent trading pipeline with four functional roles—Analyst (market/social/news), Research (bull vs bear debate), Trader (risk‑profiled decision agents), Risk Manager (constraints/enforcement). For architecture experiments, analysts simplified to three: Market (M), Social (S), News (N).
• Threat model: adversary may modify external data sets and prompts only. No white‑box access to model internals or infrastructure.
• Attacks:
  • Data-level: data poisoning (LLM-rewrites of selected news items toward target sentiment), indirect prompt injection (embedding instructions in social posts).
  • Agent-level: persuasive researcher (replace benign researcher with adversarial prompt‑tuned agent), objective hijack (swap trader prompt), jailbreak (prepend jailbreak prompt to Risk Manager).
• Aggregation topologies tested: centralized (mean of analyst outputs), linear (cumulative aggregation through chain), hybrid (revision + mean), decentralized (independent analyst votes + majority).
• Evaluation metrics:
  • ASR as defined above (targets both BUY and SELL and excludes days already equal to target under clean system).
  • Adversarial Signal Preservation Score (APS): analytical lens quantifying how much an adversarial signal survives aggregation and successive reasoning steps (closed-form values derived for each topology under study).
  • Financial backtest: daily decisions applied to a long-only portfolio; compute signed EV per attempted decision and per successful attack day.
• Models/backbones: gpt-4.1 (and gpt-4.1-mini for analyst roles) and Qwen family (large and smaller variants for different roles). Temperature=0. Data and experiment code available at the paper’s GitHub.

Implications for AI Economics

• Systemic risk and market manipulation:
  • Low-barrier attacks that only manipulate publicly consumable inputs can materially change trading agent decisions and produce realized losses. This democratizes the capability to manipulate algorithmic trading pipelines and raises systemic market-manipulation risk.
  • Multi-agent LLM deployments controlling capital create new contagion channels: adversarial narratives or coordinated prompt injections across social/news sources can cascade through agent communication and move prices.
• Design recommendations for safer deployments:
  • Avoid a single terminal safety/decision authority: separate decision execution from final safety enforcement; require independent cross-checks or multi-signature approval for trades.
  • Prefer aggregation rules that reduce adversarial signal preservation: majority voting or heterogenous independent evaluators can discard minority poisoned inputs better than naïve averaging. Introduce diversity in models, data sources, and aggregation rules.
  • Harden input pipelines: provenance, source reputation, automated fact/consistency checks, rate-limited ingestion from untrusted forums, and adversarial-content detectors for social/news feeds.
  • Layered defenses: prompt sanitation, input validation, adversarial training/robustness testing, red‑teaming specifically at the inter-agent communication level, and monitoring of APS-like metrics to detect unusually preserved signal patterns.
  • Operational controls: transaction thresholds, human-in-the-loop checks for sizable or unusual actions, audit logs and replayable traces for incident forensics.
• Policy and market-structure implications:
  • Regulators and exchanges may need to require operational standards for agentic trading systems: provenance requirements for data feeds, minimum safety separation between monitoring and execution, reporting obligations for incidents and near-misses.
  • Liability and insurance: the ease of black‑box attacks increases counterparty and firm-level operational risk; insurers and risk managers should incorporate adversarial-threat scenarios into underwriting and capital reserves.
• Research priorities for AI economics:
  • Quantify market‑level externalities: how localized adversarial manipulations of agentic trading systems can propagate price shocks, liquidity effects, and cross-asset contagion.
  • Develop principled aggregation mechanisms and provable robustness guarantees for multi-agent decision pipelines.
  • Create standardized stress-testing benchmarks and certification regimes for agentic financial systems that evaluate role-specific and topology-specific adversarial scenarios.

If you want, I can: - Extract the paper’s APS derivations and present the closed-form equations and intuition step-by-step. - Produce a checklist for defenders (engineering and policy) tailored to asset managers planning agentic trading deployments.